48 Hours to the CBUAE Deadline: What "Evidence" Means on Wednesday, and Why Regulators Are Now Naming Boards, Not Vendors

Week of 14 September 2026 | Compiled by Team Paringa

This edition is written for the two days before Wednesday 16 September, when the Central Bank of the UAE's regularisation window closes and AI governance moves from a policy question to a supervisory one. It covers what the deadline actually demands, what Dubai's virtual-asset regulator said about AI accountability, and why boards across the region are being told the governance gap is theirs to close.

What Happened This Week

🔴 Wednesday 16 September: the CBUAE window closes and AI governance becomes evidence, not intent

The Central Bank of the UAE published its Guidance Note on Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions on 11 February 2026. It applies to banks, insurers, exchange houses, finance companies and payment service providers, and sets five principles: governance and accountability, fairness and non-discrimination, transparency and explainability, effective human oversight, and data management and privacy. Boards and senior management are named as directly accountable for AI outcomes, and governance frameworks must be documented and proportionate to the institution's size and AI footprint.

The date that matters is 16 September 2026. Federal Decree-Law No. 6 of 2025, the new CBUAE Law, came into force on 16 September 2025 with a one-year regularisation period for in-scope entities. Compliance commentators have flagged administrative penalties under the new law running to AED 1 billion. The Guidance Note itself does not carry a stand-alone deadline, but the supervisory conversations that follow this week's checkpoint will draw on the same artefacts: an AI inventory, model documentation, bias-testing records, third-party audit rights over AI vendors, and a human-oversight map showing who can stop a model and when.

The practical test on Wednesday is not "do you have a policy". It is "can you produce, on request, the register of every AI and ML system touching a customer outcome, the risk classification for each, the named accountable executive, and the evidence that it was tested for fairness in the last 12 months". Institutions that spent the summer on generative-AI pilots without a discovery exercise will find the first question, "what AI do you actually run", the hardest one to answer.

Sources: CBUAE Rulebook, Fintech News UAE, Kiteworks

The deadline will not produce enforcement letters on Thursday morning. What it produces is a supervisory dialogue where the first request is an AI inventory, and most institutions cannot produce one in under six weeks because nobody owns it. That is the DISCOVER layer of Track A, and it is the cheapest, fastest piece of work a compliance head can commission this month. Map the inventory to ISO 42001 clauses as you build it and the same document serves the CBUAE, the DFSA and any future Federal Authority for AI and Data request. Paringa's Abu Dhabi healthcare deployment is the reference: discovery first, then tokenise the sensitive fields, then govern what remains.

🟡 Dubai's VARA: "having a vendor is not a get out of jail free card", and market-facing AI needs a kill switch

Speaking at Khaleej Times' FutureSec conference in Dubai, Sean McHugh, Senior Director of Market Assurance at the Virtual Assets Regulatory Authority (VARA), said licensed firms remain fully accountable for any system acting on their behalf, whether an outsourced vendor or an AI tool. His words: "When they help you make a lot of money, you want to take credit for that. If they lose money or blow something up, you can't point to them. The up and the down is on your balance sheet." VARA's licensed base has grown from 14 firms to 57 in just over two years, including institutional traders, hedge funds and algorithmic trading houses.

McHugh drew a line that other UAE regulators are likely to adopt. VARA distinguishes between AI that interacts directly with customers or markets, such as trading bots, and AI used for internal functions like compliance or finance. Market-facing AI must have a functioning kill switch so the firm can intervene when an algorithm misbehaves. He also noted the shift in incident patterns: on-chain hacks have declined as infrastructure matured, while incidents linked to web interfaces, insider threats and distributed remote workforces have risen.

The same conference heard panellists from Landmark Group, Schneider Electric and Sukoon Insurance warn that granting AI agents access to corporate systems and credentials without controls "could significantly increase an organisation's exposure", and that AI is compressing the window between vulnerability disclosure and exploitation.

Sources: Khaleej Times, Khaleej Times

Read VARA's customer-facing versus internal split alongside the CBUAE's five principles and you have the classification scheme every UAE institution now needs: which AI systems touch a customer or a market, and can a named human stop each one. That is the agentic-AI question in practical form. The kill-switch requirement maps directly to the AUTHENTICATE and GOVERN layers of Track A, and to ISO 42001's operational-control clauses. Vendor contracts signed in 2024 and 2025 rarely include audit rights over the model; that clause needs renegotiating before a regulator asks for it.

🟡 Boards are being told the AI governance gap is theirs: only 15% discuss AI at every meeting

A report published on 7 September by Dubai-based executive search firm EA Mena argues that Middle East boards must own AI strategy or risk both competitive loss and governance failure. Citing the 2026 IESE Survey on Boards of Directors, it found that 55% of board members believe AI is not yet generating significant business value, only 15% of boards discuss AI at every meeting, and 38% rate their board's involvement in defining AI strategy as low.

The regional adoption numbers make the gap sharper. IBM's 2026 CEO research found that 89% of Middle East CEOs say their organisations are embedding AI across multiple workflows, yet only 25% of employees use AI regularly as part of their jobs. EA Mena chief executive Alister Wellesley put it plainly: "AI adoption has to start in the boardroom, but it cannot stay there."

Sources: Khaleej Times

The CBUAE Guidance Note names the board as accountable. VARA names the licensee, not the vendor. A board that discusses AI at fewer than one meeting in six has no documentary trail to show a supervisor. The fix is not a strategy offsite; it is a standing agenda item backed by a one-page AI risk register, refreshed quarterly, with the inventory, classification and accountable owner for each system. That register is the output of Track A's DISCOVER and GOVERN layers and is the artefact ISO 42001 auditors ask for first.

What CIOs, CDOs and Compliance Heads Are Dealing With

The shift this week is from principle to proof. Every UAE and KSA regulator with an AI position, the CBUAE, VARA, the DFSA, SDAIA under the PDPL, now frames accountability in the same way: the institution owns the outcome regardless of who built the model or where it runs. Compliance teams that treated the February Guidance Note as a policy-drafting exercise are discovering that the supervisory ask is an inventory, a classification and a named human for each system, and that none of those exist because AI adoption happened in business units, not through a governance gate.

Underneath sits a data problem. Most of the AI systems in scope consume customer PII, and the CBUAE's fifth principle, data management and privacy, cannot be evidenced if the training and inference data has not been mapped and minimised. Institutions that tokenise sensitive fields before models see them shrink the governance surface materially: fewer systems handle raw PII, fewer fairness tests need customer identifiers, and the privacy evidence for the CBUAE, the UAE PDPL and the Saudi PDPL is the same document.

Three Things Worth Watching Next Week

1. 16 September CBUAE checkpoint - Watch for supervisory information requests to licensed financial institutions in the weeks that follow, and for the first public statements from the CBUAE on how it will assess AI governance frameworks against the five principles.

2. SDAIA Global AI Summit, Riyadh, 15 to 17 September - The fourth GAIN summit, under the Crown Prince's patronage, is the venue where SDAIA has historically launched governance initiatives and international agreements; expect PDPL enforcement signals and agentic-AI guidance.

3. GISEC Global, Dubai, 16 to 18 September - The UAE Cyber Security Council has said further details of the national cyber roadmap will be unveiled "in the coming weeks"; the post-quantum migration figure (10 to 15% of critical infrastructure already moved) and AI-agent controls are the items with direct governance consequences.

Questions? hello@paringa.ai

Paringa helps UAE and KSA institutions turn AI governance obligations into a working control stack: discover what AI runs, protect the data it consumes, govern the outcomes, and evidence all of it against ISO 42001 and the CBUAE Guidance Note. Delivered with Databorn as local partner, proven in Abu Dhabi healthcare. | 14 September 2026 | © Paringa Ltd