The CBUAE AI Guidance for Financial Institutions, Explained

The CBUAE AI guidance, issued in February 2026, sets supervisory expectations for how licensed financial institutions in the UAE adopt AI and machine learning. It covers board-level governance, model explainability, human oversight and third-party AI risk — reinforcing, rather than replacing, existing CBUAE rules such as the Consumer Protection Regulation.

Key facts

• What it is: CBUAE guidance on the use of AI and ML by licensed financial institutions, published February 2026. Source: CBUAE Rulebook.
• Core themes: governance, explainability, human oversight and third-party AI risk.
• Legal status: supervisory guidance that sits alongside binding regulations, including the Consumer Protection Regulation (Circular 8/2020) and the UAE PDPL (Federal Decree-Law 45/2021).
• Who it touches: banks, finance companies, exchange houses, insurers and other CBUAE-licensed entities using AI in the UAE.
• Related standard: ISO/IEC 42001, the international AI management-system standard many institutions map their controls to.

Few markets feel the pull of AI in banking as sharply as the UAE. An expatriate-majority customer base, salary-transfer lending anchored to the Wage Protection System (WPS), a fast-growing digital-bank cohort — Wio, Liv., Zand — and a parallel Islamic-finance track all push institutions towards automation for onboarding, credit and collections. At the same time, the UAE runs two regulatory perimeters: the onshore CBUAE regime and the financial free zones of DIFC (DFSA) and ADGM (FSRA). The CBUAE AI guidance speaks to the onshore world, and it lands at a moment when Emirates ID verification, AECB credit checks and Arabic-English service are all being reshaped by models.

What is the CBUAE AI guidance for financial institutions?

It is a set of supervisory expectations, published by the Central Bank of the UAE in February 2026, describing how licensed financial institutions should govern the design, deployment and monitoring of AI and machine-learning systems. Rather than banning or approving specific tools, the guidance tells institutions how to demonstrate that their AI is well-governed, explainable, overseen by people and controlled when it depends on third parties.

Crucially, it is guidance, not a standalone law. It works with the CBUAE's existing rulebook and the UAE's federal statutes. So an AI-driven credit decision must still respect the Debt Burden Ratio (DBR) rules, consumer-protection conduct duties and personal-data obligations — the model does not get an exemption because it is "AI".

Who does the CBUAE AI guidance apply to?

The guidance is aimed at entities the CBUAE licenses and supervises: banks such as Emirates NBD, FAB, ADCB, Mashreq and RAKBANK; Islamic banks including Dubai Islamic Bank, Emirates Islamic and ADIB; finance companies; exchange houses; and insurers overseen under the CBUAE's remit. Digital banks and fintech partners operating onshore fall in scope where they are CBUAE-licensed.

Institutions inside DIFC or ADGM answer to their own regulators and data-protection laws — for example, DIFC Data Protection Law Article 10 governs decisions based solely on automated processing. Many groups operate across both perimeters, so a single AI system may need to satisfy CBUAE expectations onshore and free-zone rules simultaneously.

What are the core pillars of the guidance?

The guidance groups its expectations around a handful of themes. The table below summarises them in plain terms and shows where each connects to existing UAE obligations.

The through-line is that AI must be traceable. If a customer is declined for a personal loan, the institution should be able to reconstruct why — which features drove the outcome, who was accountable and whether the result was fair.

How does it interact with existing UAE rules?

This is where the guidance becomes concrete. Consider an AI affordability engine used for retail lending in the UAE. It still has to enforce the DBR cap, under which monthly debt repayments are limited to 50% of a borrower's gross monthly income. An AI model cannot lend past that ceiling simply because it "scored" the applicant well.

Similarly, if the model uses AECB data — where credit scores range from 300 to 900 — the guidance's explainability expectation means the institution should be able to show how bureau signals influenced the decision, not treat the score as an unexplained black box. And because the Consumer Protection Regulation prohibits unfair treatment and coercive practices, an AI-driven collections strategy must stay within those conduct limits, whatever the model recommends.

On data, the UAE PDPL (Federal Decree-Law 45/2021) already governs how personal information is processed. The AI guidance layers on expectations about data quality and bias monitoring specifically for models, so training and inference data receive the same scrutiny as any other regulated processing.

What does compliance look like in practice?

For most institutions in the UAE, meeting the guidance is less about new technology and more about disciplined documentation and control. In practice that tends to mean:

• An AI inventory: a living register of where models are used — onboarding, KYC, credit, fraud, collections, service — with an owner for each.
• Model documentation: purpose, data sources, limitations, validation results and known risks, kept current as models are retrained.
• Explainability records: the ability to produce a clear rationale for individual decisions, especially adverse ones such as declines.
• Human-in-the-loop checkpoints: defined points where a person reviews or can override the model on material outcomes.
• Vendor oversight: contracts, due diligence and monitoring for third-party AI, including foundation-model providers.
• Ongoing monitoring: tracking for drift, performance decay and bias after deployment, not just at launch.

Institutions that already align to ISO/IEC 42001 will find much of this familiar; the standard offers a management-system scaffold that maps cleanly onto the CBUAE's themes.

How AI helps

The irony of AI governance is that it is easiest to satisfy when your AI stack is itself transparent and auditable. This is where a governed platform matters: the YuVerse suite is built so that automated onboarding, credit assessment, calling and messaging generate the decision trails, human-review points and monitoring hooks the CBUAE guidance expects — rather than bolting explainability on afterwards. The practical outcome for a UAE institution is that adopting AI for growth and demonstrating responsible AI to a supervisor become the same body of work, not two competing projects.

FAQ

Is the CBUAE AI guidance legally binding? It is supervisory guidance rather than a standalone law, but it sits on top of binding CBUAE regulations and UAE federal statutes. In practice, institutions are expected to align with it, and its themes reinforce rules that are binding, such as consumer protection and data protection.

When did the CBUAE issue its AI guidance? The Central Bank of the UAE published the guidance in February 2026, addressing governance, explainability, human oversight and third-party AI risk for licensed financial institutions.

Does the guidance apply to DIFC and ADGM firms? The CBUAE guidance targets onshore licensed institutions. Firms in DIFC and ADGM answer to the DFSA and FSRA and to their own data-protection laws, including DIFC Data Protection Law Article 10 on automated decision-making. Cross-perimeter groups may need to satisfy both.

Can a bank use AI to make lending decisions in the UAE? Yes, provided the decision remains explainable, subject to human oversight and compliant with existing rules — including the DBR cap of 50% of gross monthly income and consumer-protection conduct duties.

What is explainability under the guidance? It is the ability to describe, in understandable terms, how an AI system reached a particular outcome — which factors mattered and why — so that customers and supervisors can scrutinise the decision.

How does the guidance relate to the UAE PDPL? The UAE PDPL (Federal Decree-Law 45/2021) governs personal-data processing generally. The AI guidance adds model-specific expectations around data quality, bias monitoring and privacy, so AI systems are held to the same data standards as other regulated activity.

Building or reviewing an AI programme for a licensed institution in the UAE? Explore how a governed, audit-ready stack fits the CBUAE's expectations at the YuVerse UAE hub.

This is a general explainer, not legal advice.

References

• Central Bank of the UAE — CBUAE Rulebook (AI/ML guidance and regulations): https://rulebook.centralbank.ae/
• CBUAE Rulebook — Consumer Protection Regulation: https://rulebook.centralbank.ae/en/rulebook/consumer-protection-regulation
• CBUAE Rulebook — Article (3) Important Ratios (DBR): https://rulebook.centralbank.ae/en/rulebook/article-3-important-ratios
• Al Etihad Credit Bureau (AECB): https://aecb.gov.ae/en
• The UAE Government Portal (PDPL, Federal Decree-Law 45/2021): https://u.ae/
• DIFC — Data Protection Law: https://www.difc.com/
• The National — "UAE Central Bank issues new guidelines on the use of AI in financial sector" (Feb 2026): https://www.thenationalnews.com/business/banking/2026/02/23/uae-central-bank-issues-new-guidelines-on-the-use-of-ai-in-financial-sector/