CBUAE AI/ML Guidance — what regulated firms must document

Pressure 1: Federal Decree-Law 6/2025 (Central Bank / Regulation of Financial Institutions & Insurance) is in force since 16 September 2025 with a 1-year regularization deadline of 16 September 2026 (Art. 184). Maximum administrative penalty for unlicensed or breaching activity is AED 1 billion. This is not an AI fine — it is the general ceiling.

Pressure 2: the CBUAE AI/ML Guidance Note issued 23 February 2026 is a supervisory expectation on transparency, fairness, explainability, accountability, and redress. Formally non-binding — but divergence from the Note will be challenged in any supervisory review.

1. Model + dataset inventory.

2. Documented lawful basis and consumer-disclosure stance.

3. Bias testing and outcome monitoring on consumer-facing decisions.

4. Override and redress workflow — the consumer can challenge an automated decision and reach a human.

5. Audit trail at the AI layer (prompts, retrieval sources, decisions) not just the application layer.

"There is a 1-billion-dirham AI fine landing in September" is a sales line that does not survive a sharp DIFC buyer. The convergence is the real story: a hard licensing deadline plus an active, supervisory-expectation AI Note land on the same day. After October 2026 the urgency wedge expires; the routine governance work continues.