The UAE has made AI a national priority with a dedicated minister, a published Charter and a Central Bank that has been explicit about what it expects from licensed institutions using machine learning. UAE banks are among the region’s most aggressive adopters, and the supervisory questions about explainability, bias, drift and third-party models are already routine. A bank that wants to deploy at speed needs a governance framework that answers them before being asked.
This guide covers what the AI Charter, CBUAE guidance and the data protection regimes expect, how Saudi Arabia’s approach compares, and the operating model, from inventory to committee to tooling, that lets a UAE bank deploy AI quickly and defensibly.
UAE: the AI Charter and CBUAE guidance
The UAE issued its Charter for the Development and Use of Artificial Intelligence in July 2024, setting twelve principles including human oversight, safety, algorithmic bias avoidance, privacy and transparency, under the Minister of State for AI and the national AI strategy. The Central Bank has issued guidance on the use of AI and machine learning by licensed institutions, framed through its consumer protection and model risk expectations: institutions must be able to explain automated decisions that affect customers, test and monitor models for bias and drift, keep humans accountable, and manage third-party AI as outsourcing. The federal Personal Data Protection Law and the free-zone data protection regimes in DIFC and ADGM govern the underlying data.
The UAE’s approach is faster-moving than Saudi Arabia’s and more explicit about generative AI; the obligations on a bank are nonetheless very similar in substance.
How Saudi Arabia compares: SDAIA principles, SAMA supervision
Saudi Arabia governs AI through two layers. The Saudi Data and AI Authority sets the national framework: the AI Ethics Principles, which cover fairness, privacy, transparency, accountability, safety and humanity, and later guidelines for generative AI adoption. These are principles-based and apply across sectors. SAMA then supervises banks through rules that already existed and now cover AI by application: the Cyber Security Framework, the Rules on Outsourcing (which govern any AI service bought from a vendor or run in a cloud), model risk management expectations under its IT governance and risk frameworks, and consumer protection principles that require fair, explainable treatment of customers. The Personal Data Protection Law, enforced by SDAIA, adds consent, purpose limitation and transfer restrictions on the data models are trained and run on.
There is no single SAMA AI rulebook as of late 2026, and banks should not wait for one. Supervisors already ask about model inventories, validation, explainability of credit and fraud decisions, data lineage and the controls around generative AI tools used by staff.
What both regulators actually ask for
Strip away the framing and the supervisory questions converge. A model inventory: every model in use, what it decides, who owns it, how material it is. Validation: independent testing before deployment and periodically after, proportionate to materiality. Explainability: the ability to state the reasons for a decision that affects a customer, in language the customer and the supervisor understand. Fairness testing: evidence that outcomes do not differ unjustifiably across nationality, gender, age or other protected characteristics. Data governance: lineage, consent, residency and retention for training and inference data. Human oversight: a defined role that can override, pause or withdraw a model. Third-party management: the same due diligence, contracts and exit arrangements for AI vendors and cloud model providers as for any material outsourcing. And incident handling: what happens when a model misbehaves, who is told and how customers are remediated.
Generative AI changes the inventory
Traditional model risk management assumed a small number of models built by the bank. Generative AI adds foundation models the bank did not build, used by hundreds of staff through tools the bank may not have approved, and increasingly embedded in vendor products. The governance response is to extend the inventory to cover generative AI uses, classify them by what data they touch and what decisions they influence, set an approved-tools policy with an in-boundary alternative so that staff do not reach for consumer tools, and apply the same validation and monitoring logic to the use case rather than to the model. Data residency rules mean most customer-data use cases must run inside the country, which simplifies the policy if the bank provides the platform.
An operating model that works
A cross-functional AI governance committee with risk, compliance, data, technology, legal and business representation, meeting on a cadence tied to the deployment pipeline rather than the calendar. A tiering scheme that puts customer-affecting decisions (credit, fraud blocks, pricing, collections) in the highest tier with full validation, and internal productivity uses in a lighter tier. Standard documentation templates: model cards, data sheets, validation reports and decision logs, produced as part of the build rather than afterwards. Tooling that automates the boring parts: inventory, drift monitoring, fairness metrics, audit logs and approval workflows. And a named executive owner, because both regulators want to know who is accountable.
Governance as an enabler
Banks that treat governance as a gate deploy slowly; banks that treat it as a platform deploy faster, because each new model inherits the inventory, the monitoring, the documentation templates and the approval path of the last one. The first credit model under a proper framework may take longer to approve; the fifth takes weeks. The same is true of regulator relationships: supervisors who have seen a bank’s governance work on one model ask fewer questions about the next.
How Eurisko helps
Eurisko builds AI systems for banks with the governance built in: model inventories, validation and fairness testing, explainability for customer-affecting decisions, drift monitoring and audit logging, deployed inside the bank’s data boundary. Our Kortex platform provides the tooling; our delivery teams have worked under SAMA and CBUAE supervision. If you are setting up or maturing an AI governance function, talk to our team.
