The Environment
A regulatory timeline that compounds.
UAE financial services now operate under overlapping obligations, not a single deadline.
The CBUAE AI/ML Guidance Note was issued on 23 February 2026. The New CBUAE Law sets a regularisation deadline of 16 September 2026. UAE PDPL reaches full compliance from 1 January 2027.
These obligations do not run in sequence; they run in parallel. The Guidance Note's expectation is continuous supervisory dialogue rather than one-time compliance, and for institutions in the financial free zones the same evidentiary ground is examined by more than one supervisor. An institution that cannot demonstrate a documented, traceable method enters that dialogue from a position of weakness — and does so repeatedly, not once. This is the environment the practice's instruments are built for.
Crucially, accountability for these systems cannot be delegated. Under the Guidance Note an institution remains responsible for AI outcomes even where a model is built, operated or supplied by a third party — and it must be able to produce evidence that withstands independent examination, not merely internal assurance. The expectation is not that an institution has a framework, but that it can demonstrate one to an examiner, on the record.