UAE AI Regulation Tracker for Financial Services: What Rules Apply?

UAE AI regulation for financial services now spans several instruments: the CBUAE issued AI and ML guidance for licensed financial institutions in February 2026, while the UAE PDPL, DIFC and ADGM data-protection regimes govern automated decisions. Together they set expectations on governance, explainability and human oversight for banks and lenders.

Key facts

• CBUAE AI/ML guidance: issued February 2026 for licensed financial institutions, covering governance, explainability, human oversight and third-party AI risk (CBUAE Rulebook).
• UAE PDPL: Federal Decree-Law 45/2021 governs personal-data processing, including automated processing (u.ae).
• DIFC autonomous decisions: DIFC Data Protection Law No. 5 of 2020, Article 10, addresses autonomous and AI-assisted decision-making.
• ADGM data protection: ADGM Data Protection Regulations 2021 apply within the ADGM free zone.
• Consumer conduct: the CBUAE Consumer Protection Regulation requires fair treatment and disclosure duties that extend to AI-driven customer interactions.

The UAE's financial sector is unusually layered, which is why "AI regulation" here is never one rulebook. A bank headquartered onshore in Dubai or Abu Dhabi answers to the CBUAE and the federal UAE PDPL; a firm licensed in the DIFC answers to the DFSA and the DIFC Data Protection Law; a firm in the ADGM answers to the FSRA and the ADGM Data Protection Regulations. Add a workforce that is majority expatriate, salary-transfer lending tied to the Wage Protection System (WPS), bilingual Arabic and English customer bases, and a parallel Islamic-finance track, and any AI system that scores credit, screens documents or talks to customers has to satisfy several overlapping regimes at once.

What is the CBUAE AI and ML guidance for financial institutions?

In February 2026 the Central Bank of the UAE issued guidance on the use of artificial intelligence and machine learning by licensed financial institutions. The guidance is principle-based rather than a rigid checklist, and it centres on four themes that recur across UAE AI regulation: governance and accountability, explainability of model outputs, meaningful human oversight of automated decisions, and management of third-party and outsourced AI risk.

For a lender, that translates into practical expectations. A model that influences whether a customer is approved for finance should have a documented owner, a clear audit trail, and an explanation a human reviewer can understand and, where needed, override. Where the AI capability is bought from a vendor, the institution remains accountable — the CBUAE Outsourcing Regulation and the AI guidance both push responsibility back onto the licensed firm, not the supplier.

How does the UAE PDPL apply to AI in financial services?

The UAE Personal Data Protection Law — Federal Decree-Law 45/2021 — is the federal baseline for processing personal data, and most AI in banking processes personal data by definition. It introduces principles familiar from global privacy law: lawful basis, purpose limitation, data minimisation, and data-subject rights. For AI specifically, the relevant pressure points are automated processing and profiling: if a model is making or heavily informing a decision about a person, the institution needs a lawful basis for that processing and a way to honour the individual's rights over their data.

The PDPL sits alongside, not instead of, CBUAE conduct rules. A credit-scoring model that uses AECB credit report data, salary-certificate information or bank-statement inputs is simultaneously a data-protection question (PDPL) and a consumer-conduct question (CBUAE Consumer Protection Regulation). Both have to be satisfied.

How do DIFC and ADGM regulate AI decisions differently?

The two financial free zones run their own common-law-based data-protection regimes, which is why a firm's licensing location changes its obligations.

The DIFC regime is notable because Article 10 of the DIFC Data Protection Law directly addresses decisions produced by autonomous or AI systems, giving individuals protections around decisions taken without meaningful human involvement. The ADGM Data Protection Regulations 2021 follow a broadly GDPR-aligned model within that free zone. A firm operating both onshore and in a free zone therefore has to map each AI use case to the regime that actually applies to the entity running it.

What does this mean for AI-driven collections and customer contact?

Customer-facing AI — outbound reminders, voice agents, chatbots — sits squarely inside the CBUAE Consumer Protection Regulation. The conduct rules emphasise fair treatment, clear disclosure and the absence of coercive collection pressure. An AI voice or messaging agent that contacts a customer about an overdue instalment must operate within those conduct limits just as a human agent would: no harassment, honest identification, and respect for the customer's rights.

Explainability matters here too. If an automated system decides which customers to contact, in what language, and with what message, the institution should be able to reconstruct why — both for its own governance and to answer any regulatory query.

How AI helps

The practical challenge is not choosing between AI and compliance — it is deploying AI that is compliant by design. The YuVerse Suite is built for exactly the governance expectations the CBUAE guidance sets out: audit trails on automated decisions, human-in-the-loop review points, explainable model outputs, and configurable conduct guardrails on customer-facing agents. For a UAE bank, that means credit assessment, document processing and customer contact can run on AI while keeping the documentation, oversight and explainability that regulators now expect. The concrete outcome is a materially shorter path from "we want to use AI" to "we can evidence how it is governed" — without the compliance team discovering the model after it has already gone live.

Frequently asked questions

Is there a single AI law in the UAE for banks? No. UAE AI regulation for financial services is layered: the CBUAE AI/ML guidance sits over the federal PDPL, with the DIFC and ADGM running their own data-protection regimes for firms licensed in those free zones.

When did the CBUAE issue its AI guidance? The CBUAE issued guidance on the use of AI and ML by licensed financial institutions in February 2026, covering governance, explainability, human oversight and third-party AI risk.

Does the UAE PDPL restrict automated decision-making? The PDPL (Federal Decree-Law 45/2021) governs personal-data processing including automated processing and profiling, so AI decisions about individuals must have a lawful basis and respect data-subject rights.

How is the DIFC different from onshore UAE for AI? Firms in the DIFC follow the DIFC Data Protection Law No. 5 of 2020, whose Article 10 specifically addresses autonomous and AI-assisted decision-making — a distinct regime from the federal PDPL that applies onshore.

Who is accountable if a third-party AI vendor causes a problem? The licensed institution remains accountable. Both the CBUAE AI guidance and the Outsourcing Regulation place responsibility for outsourced or vendor-supplied AI on the regulated firm.

Do consumer-protection rules apply to AI chatbots and voice agents? Yes. The CBUAE Consumer Protection Regulation applies to customer interactions regardless of channel, so AI-driven contact must meet the same fair-treatment and disclosure standards as human agents.

This is a general explainer, not legal advice. For a full view of AI and compliance for UAE financial services, visit the YuVerse UAE hub.

References

• Central Bank of the UAE — CBUAE Rulebook: https://rulebook.centralbank.ae/
• Central Bank of the UAE — Consumer Protection Regulation: https://rulebook.centralbank.ae/en/rulebook/consumer-protection-regulation
• UAE Government — UAE PDPL (Federal Decree-Law 45/2021), u.ae: https://u.ae/
• DIFC — Data Protection Law No. 5 of 2020: https://www.difc.com/
• ADGM — Data Protection Regulations 2021: https://www.adgm.com/