United Arab Emirates — federalAE

Guidance Note on Consumer Protection and the Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E.

Central Bank of the UAE · supervisory · in_force · v1 · official text

Consumer-protection expectations for licensed financial institutions using AI and ML: board and senior management accountability, an inventory of AI models including third-party models, fairness and non-discrimination, transparency and explainability, meaningful human oversight of consumer-affecting decisions, and third-party due diligence.

1. 2 Governance and Accountability — Licensed financial institutions should adopt a documented AI/ML governance framework proportionate to their operations, following the principles of the Model Management Standards. Senior management and the board are responsible and accountable for AI systems and outcomes, and institutions should not employ AI models they have no control over.
2. 7 Human Oversight and Consumer Protection — AI and ML systems should operate under meaningful human oversight proportionate to consumer risk, using human-in-the-loop, human-on-the-loop or — only for low-risk, non-material processes — human-out-of-the-loop models. Consumers must be able to request human review or explanation of AI-generated decisions and to challenge them.

Model Management Standards

Central Bank of the UAE · binding · in_force · v1 · official text

Minimum standards for banks employing models in decision-making: model governance, data management, development, implementation, usage, monitoring and independent validation.

Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data

United Arab Emirates · binding · in_force · v1 · official text

General personal-data law that reaches AI systems processing personal data. Article 18 gives the data subject a right to object to decisions resulting from automated processing including profiling, and requires the controller to include the human element in reviewing automated decisions on request.

1. Article (18) Right to Processing and Automated Processing — The data subject may object to decisions resulting from automated processing including profiling, particularly decisions with legal or adverse effect, subject to contract, statutory and prior-consent exceptions. The controller must include the human element in reviewing automated decisions on request.