Introduction
Artificial intelligence is becoming a common feature of business operations across a wide range of sectors. Organisations are using AI to improve efficiency, automate routine tasks and support decision-making. At the same time, regulators globally are seeking to balance innovation with concerns relating to governance, accountability, consumer protection and the responsible use of data.
While jurisdictions such as the European Union are developing dedicated AI legislation, the UAE has so far adopted a more principles-based and innovation-focused approach, reflecting its ambition to position itself as a global leader in AI. This commitment is evident not only in the UAE's regulatory frameworks, but also in the way public authorities and financial services regulators themselves are increasingly using AI within their own operations. Earlier this month, the UAE Capital Market Authority (“CMA”) confirmed that AI is already being used across supervisory and investigative functions, including predictive tools to support market oversight, and announced a broader AI and digital transformation programme expected to be unveiled in December 2026. Similarly, the Ministry of Economy and Tourism has proposed using AI and advanced analytics within a new National Competition Platform to support competition enforcement and streamline regulatory processes. Together, these developments demonstrate a broader governmental focus on leveraging AI to enhance regulatory efficiency, oversight and decision-making, while reinforcing the UAE's position as a leading international financial centre.
This article provides an overview of the UAE’s current approach to AI, a focus on AI in the financial services industry in particular and how the UAE compares to other jurisdictions such as the UK.
The UAE’s Approach to AI Regulation
National Strategy and Governance
The UAE has positioned itself as a regional leader in AI through a policy-driven approach focused on innovation, government adoption and digital transformation. The UAE has not yet introduced a comprehensive AI law. Instead, organisations must navigate a framework of existing legislation and regulatory principles relating to data protection, cybersecurity, consumer protection, governance and sector-specific regulation.
The UAE’s approach is driven by national policy rather than legislation, including the UAE National Strategy for Artificial Intelligence 2031 and the UAE Charter for the Development and Use of Artificial Intelligence (2024), supplemented by the AI Ethics Principles and Guidelines (December 2022), which emphasise fairness, transparency, accountability and human oversight. The UAE has appointed Chief Executive Officers for AI across ministries and federal entities, created the UAE Council for Artificial Intelligence and, in April 2025, established the Regulatory Intelligence Office, which uses AI tools to integrate federal and local laws, judicial rulings and public services and to identify potential legislative updates. In June 2026, the UAE approved the establishment of the Artificial Intelligence and Data Authority, a new federal body reporting directly to the Cabinet. The Authority consolidates the functions of the Office of Artificial Intelligence, Digital Economy and Remote Work Applications, the UAE Data Office, and the Digital Government Sector of the Telecommunications and Digital Government Regulatory Authority, bringing responsibility for national AI strategy, data governance and digital government initiatives under a single institutional framework. This development reflects the UAE's increasingly centralised and coordinated approach to AI governance, with a continued emphasis on policy-driven oversight, institutional coordination and the integration of AI across government functions. Consistent with wider developments across the Middle East, regulators have generally favoured addressing AI-related risks through existing legal frameworks and governance initiatives rather than technology-specific legislation.
Data Protection
Data protection is one of the most significant compliance issues for AI in the UAE. Within onshore UAE, the principal framework is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”), which took effect on 2 January 2022 and governs the processing, storage and transfer of personal data, including through profiling and automated processing. Although the PDPL is in force, organisations will have six months to comply with its requirements once the Implementing Regulations are published. As of the date of this article, those Implementing Regulations have not yet been issued.
Despite the absence of the Implementing Regulations, the PDPL provides a useful indication of how AI-related processing is likely to be regulated in the UAE. Similar to the EU GDPR, the law expressly recognises profiling and automated processing and grants data subjects the right to obtain information regarding decisions based on automated processing, including profiling. It also provides data subjects with the right to object to decisions resulting from automated processing, particularly where those decisions have legal effects or otherwise adversely affect them and requires controllers to incorporate human review of automated decisions upon request. In addition, organisations must carry out a data protection impact assessment before undertaking processing involving technologies that pose a high risk to individuals’ privacy and confidentiality. This requirement expressly applies where processing involves a systematic and comprehensive assessment of individuals through automated processing or profiling that has legal or significant effects on the data subject.
In the Dubai International Financial Centre (“DIFC”), the DIFC Data Protection Law No. 5 of 2020 is supplemented by Regulation 10 of the DIFC Data Protection Regulations (“Regulation 10”), which took effect on 1 September 2023. Regulation 10 is particularly noteworthy as it is one of the first binding regulatory frameworks in the Middle East specifically addressing the use of autonomous and semi-autonomous systems, including AI. Regulation 10 regulates the processing of personal data through autonomous and semi-autonomous systems, addressing the roles of deployers and operators, transparency, safeguards, high-risk processing, accountability and certification, and applies to all DIFC entities, not only financial institutions. As part of its AI governance framework, the DIFC Commissioner of Data Protection has introduced the Regulation 10 Accreditation and Certification Framework, creating a certification regime for certain autonomous and semi-autonomous systems that engage in high-risk processing and helping align AI deployment with data protection and governance requirements. Following this, in June 2026 the DIFC consulted on further amendments to its Data Protection Regulations, including a proposed Regulation 11; these remain proposals at the time of writing. These developments may indicate increasing regulatory focus on compliance with Regulation 10 and AI governance requirements within the DIFC.
The Abu Dhabi Global Market (“ADGM”) has not introduced AI-specific regulations equivalent to Regulation 10. However, the ADGM Data Protection Regulations 2021 contains a number of provisions that are relevant to organisations implementing AI systems, including safeguards relating to automated decision-making and profiling, data protection impact assessments and privacy-by-design requirements. These may be particularly relevant where AI systems process substantial volumes of personal data or support decisions affecting individuals.
Sector focus: Financial Services
Unlike the EU, which has adopted a comprehensive legislative framework through the EU AI Act (2024/1689), alongside a wider body of digital regulation, the UAE has taken a more principles-based approach to regulating AI within financial services. Rather than introducing a standalone AI regulations or specific rulebooks, the UAE's financial services regulators have largely sought to address AI related risks through existing requirements on governance, risk management, consumer protection, outsourcing, cybersecurity and operational resilience, supplemented by targeted regulatory guidance.
Financial institutions are increasingly deploying AI across customer onboarding, fraud detection, anti-money laundering screening, credit assessments, investment solutions and customer service. While these applications offer significant opportunities for efficiency and innovation, they also raise questions about how established regulatory principles should apply to increasingly complex and autonomous technologies.
We set out below the regulatory developments for financial services firms adopting AI.
2021 Joint Guidelines for Financial Institutions Adopting Enabling Technologies
The Guidelines for Financial Institutions Adopting Enabling Technologies (the “Enabling Technologies Guidelines”) were issued jointly in 2021 by the Central Bank of the UAE (“CBUAE”), the Securities and Commodities Authority (now the CMA), the Dubai Financial Services Authority (“DFSA”) and the ADGM Financial Services Regulatory Authority (“FSRA”). They apply, on a proportionate basis, to all institutions licensed by those authorities that use or intend to use enabling technologies, including big data analytics and AI. For AI, they call for:
- a documented governance framework covering every stage of the model lifecycle, including an enterprise-wide record of AI applications;
- continuing board and senior management accountability for AI outcomes, including decisions made on the institution’s behalf;
- reliable, transparent and explainable models, with independent pre-deployment validation, periodic review and the ability to suspend models promptly;
- audit logs, traceability, versioning and archived training data, retained for at least five years (or as otherwise prescribed by applicable laws and regulations); and
- plain-language disclosure to customers and a mechanism for customers to request review of AI decisions.
Although the Enabling Technology Guidelines are not legally binding and do not themselves create new regulatory obligations, they are an important benchmark for licensed financial institutions for assessing the adequacy of their AI governance arrangements.
The coordinated approach taken by all of the UAE financial services regulators is significant as despite the multiple regulatory jurisdictions, the Enabling Technology Guidelines establish common regulatory guidelines for financial institutions operating within the UAE and addressing AI risks.
2026 CBUAE Guidance Note on AI and Machine Learning
The CBUAE’s Guidance Note on Consumer Protection and the Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions (the “Guidance Note”), issued on 11 February 2026, applies to CBUAE-licensed financial institutions, including insurance providers (“LFIs”). It focuses on consumer-facing risks and builds on the Enabling Technologies Guidelines with more detailed expectations, each of which maps across to a familiar regulatory principle:
- Governance, accountability and human oversight: boards and senior management are accountable for AI systems and outcomes, should receive regular reporting, and LFIs “should not employ AI models that they have no control over”. Oversight should be calibrated across human-in-the-loop, human-on-the-loop and (for low-risk, non-material processes only) human-out-of-the-loop models, and LFIs should at all times retain the immediate ability to cease using an AI system. This raises a practical question about whether boards have the AI literacy to challenge models they may not technically understand.
- Fairness: AI should be tested for bias annually and each time a model is upgraded, materially changed or introduced, and AI-supported decisions should be consistent with the duty to act honestly, fairly and in the best interests of consumers.
- Transparency and explainability: customers should be told when they interact with AI, particularly for “high-impact decisions” such as loan or insurance claim decisions, with disclosures in Arabic and English. LFIs should consider opt-out rights, and consumers should be able to request human review and challenge AI decisions.
- Data quality, privacy and security: LFIs should ensure the accuracy, quality and provenance of data used by AI systems, implement privacy- and security-by-design measures, and conduct appropriate testing of AI systems.
- Outsourcing and third-party risk: LFIs remain responsible for outsourced AI and should conduct due diligence, secure audit and information rights. They should maintain an inventory of AI models (including third-party models), risk-rate each AI system, test vendor updates before implementation and avoid over-reliance on a single provider. When deploying AI through third-party or cloud-based providers, LFIs should also consider applicable CBUAE outsourcing and data localisation requirements, including restrictions relating to the storage and transfer of certain customer data outside the UAE.
Ultimately, firms cannot outsource accountability for AI-driven outcomes to technology providers. Clear internal ownership, effective testing and monitoring, and mechanisms to explain and challenge AI-assisted decisions are important, particularly in onboarding, lending, fraud detection, and customer service.
The Guidance Note reflects a broader shift in regulatory focus from the technological risks associated with AI towards the outcomes it produces for consumers. The underlying regulatory principles are not new or novel, financial institutions have long been required to treat customers fairly, manage conflicts of interest and maintain appropriate oversight of their activities. However, AI introduces new challenges in demonstrating compliance with these obligations, particularly where decisions are made using complex models that may be difficult to explain or independently challenge.
DFSA June 2026 Supervisory Letter
On 4 June 2026, the DFSA issued a letter to the Senior Executive Officers of all Authorised Firms setting out its expectations on AI risk management in the DIFC. The letter signals that the DFSA expects firms to manage AI risks within their existing compliance frameworks rather than wait for AI-specific rules. For firms operating in the DIFC, this means that AI governance, model oversight, third-party risk management and accountability are likely to remain areas of regulatory focus. It also reinforces the practical importance of the Enabling Technologies Guidelines, which the DFSA has indicated it will continue to use as a supervisory reference point when engaging with firms.
Existing rules applicable to AI
These AI-specific measures sit alongside a range of existing regulatory requirements that, while not designed specifically for AI, nevertheless apply to its use. For banks, the CBUAE's Model Management Standards governs the use of models in areas such as credit scoring, pricing and financial crime detection; the Consumer Protection Regulation and Consumer Protection Standards, which are relevant where AI is used to communicate with customers or support eligibility, suitability or pricing decisions; and the Outsourcing Regulation for Banks and Outsourcing Standards for Banks, which apply where institutions rely on third-party models, technology vendors or cloud-hosted AI platforms. The Guidance Note on AI expressly recognises the continued application of these frameworks and states that AI policies should complement, rather than duplicate, existing regulatory obligations. The recent implementation of the CBUAE’s Operational Risk Management Regulation also requires LFIs to identify, assess, monitor and manage operational risks arising from technology, systems, external dependencies and business processes.
A similar approach is taken within the two financial freezones. In the DIFC, the DFSA's existing cyber-risk and operational-risk rules apply to risks arising from AI systems and the outsourcing requirements set out within the DFSA’s General Module. Where authorised firms rely on third-party AI providers, cloud-hosted AI services, foundation models or other external technology vendors authorised firms must put in place adequate governance arrangements, conduct risk assessments and ensure ongoing monitoring of these arrangements. In the context of utilising AI, authorised firms must assess the risks associated with AI vendors, ensure that outsourcing arrangements do not impair the firm's ability to comply with its regulatory obligations, maintain appropriate contractual protections and retain effective oversight of outsourced functions, notwithstanding their reliance on AI-enabled services.
Earlier this year, the DFSA also launched a consultation on enhancing its operational resilience requirements which, if implemented, requires firms to identify important business services, establish impact tolerances and maintain resilience against operational disruptions. Although not AI-specific, these proposals are particularly relevant where AI systems support customer-facing services, decision-making processes or other critical operations, as firms may need to demonstrate that disruptions, failures or inaccuracies associated with AI systems can be appropriately managed and remediated.
In the ADGM, the FSRA's Information Technology Risk Management Guidance and Cyber Risk Management Framework, which took effect on 31 January 2026, perform a comparable function. The FSRA's existing rulebooks also contain outsourcing, governance and risk-management requirements under the FSRA Issues Cyber Risk Management Framework, which may be engaged where authorised firms deploy AI systems or rely on third-party AI providers. These obligations are likely to be relevant in areas such as vendor due diligence, concentration risk, operational resilience, cybersecurity, business continuity and oversight of critical service providers.
More broadly, even in the absence of AI-specific rules, the general principles applicable to authorised firms in both the DIFC and ADGM are likely to shape how AI may be deployed in regulated financial services businesses.
In the context of AI, these principles in practice will require firms to understand how AI systems are used within the business, undertake appropriate testing and validation prior to deployment, monitor outputs on an ongoing basis, manage model and data risks, address bias and fairness concerns where relevant, maintain sufficient human oversight over material decisions, and ensure that customers are not exposed to unfair or misleading outcomes generated by automated systems.
The regulatory requirements discussed above are illustrative rather than exhaustive, and the application of other regulatory obligations will depend on the nature of the AI systems deployed and the activities undertaken by the relevant financial institution.
Taken together, these developments demonstrate that UAE financial regulators are currently governing AI primarily through existing regulatory frameworks on governance, risk management, operational resilience, outsourcing and consumer protection, rather than through dedicated AI legislation.
International Perspective
The UAE's financial services regulators approach to AI governance is broadly consistent with wider international regulatory trends. One of the most significant recent developments is the Financial Conduct Authority’s review of AI and the future of retail financial services, published on 6 July 2026. The Mills Review (the “Review”) argues that financial services are moving from human-led decision-making towards increasingly AI-enabled and delegated services, where AI systems play a greater role in initiating and executing decisions on behalf of both firms and consumers. Particular attention is given to "agentic AI" and AI agents capable of managing aspects of an individual's financial affairs within pre-defined parameters. We explored these themes in our earlier Law-Now update, linked here.
The Review highlights governance, market concentration, fraud, cybersecurity and consumer protection as key areas of concern, and calls for greater system-wide coordination as well as AI-enabled supervisory capabilities within the FCA itself. The Review also provides a useful illustration of how leading financial regulators are assessing both the opportunities and risks associated with increasingly autonomous AI.
Many of the themes identified in the Mills Review are already reflected in guidance issued by the CBUAE and DFSA, including expectations around accountability, governance, explainability, consumer protection and third-party risk management. The key difference lies in regulators’ own use of AI: while the Mills Review recommends that the FCA build AI-enabled supervisory capability, UAE authorities such as the CMA are already using AI, and incorporating AI into their regulatory functions. The CMA, for example, has publicly stated that it uses AI across supervision and investigations, while the Ministry of Economy and Tourism is procuring an AI-enabled competition platform. Consistent with the objectives of the UAE National Strategy for Artificial Intelligence 2031, these developments suggest that AI is increasingly being embedded not only in regulated businesses but also in public administration, market supervision and regulatory decision-making.
The UK's principles-based approach can also be contrasted with the increasing developments across the globe. In the European Union, the EU AI Act 2024 has introduced a comprehensive, risk-based legislative framework which sets out a governance framework on the development and use of AI systems, including specific obligations for high-risk AI systems and general-purpose AI models. For more detail, here is a link to our EU AI Act guide. By contrast, Hong Kong has not yet adopted a standalone AI law and instead regulates AI primarily through existing legal frameworks and sector-specific guidance, including guidance issued by the Hong Kong Monetary Authority and Securities and Futures Commission in relation to the use of AI in financial services. For further detail, please refer to our guide to AI laws and regulations in Hong Kong.
Looking Ahead: Future Developments
The UAE's approach to AI regulation reflects a broader preference for technology-neutral and principles-based regulation. This approach offers flexibility, allowing regulators to address AI-related risks through existing frameworks governing governance, consumer protection, outsourcing, operational resilience, cybersecurity and risk management, rather than introducing standalone AI legislation which may not perhaps be reflective of its use across different sectors.
However, as AI capabilities continue to evolve, an important question is whether existing regulatory frameworks will be able to keep pace.
This may become increasingly challenging where AI systems evolve more rapidly than regulatory guidance, particularly as institutions become more reliant on third-party foundation models, cloud-based AI services and increasingly autonomous forms of AI.
More fundamentally, traditional governance, outsourcing and risk-management frameworks are generally built on the assumption that financial institutions can understand, monitor and exercise meaningful oversight over activities conducted on their behalf. As AI systems become more capable, less transparent and more dependent on complex external technology ecosystems, those assumptions may become more difficult to sustain. Questions around accountability, effective human oversight and control over third-party AI systems are therefore likely to remain central themes for regulators in the years ahead.
For now, the UAE's regulatory framework remains focused on applying existing principles to new technologies. Whether this approach continues to be sufficient as AI develops, or whether more prescriptive requirements emerge over time, will be one of the key questions shaping the next phase of AI regulation in the UAE financial services sector.
Article co-authored by Olivia Siran, Trainee Solictor at CMS.
