The UAE's AI Governance Grace Period Ends: CBUAE Deadlines Land as Riyadh Hosts the World on AI Ethics

Week of 21 September 2026 | Compiled by Team Paringa

Weekly intelligence for heads of AI, chief data officers, and compliance and risk leads in UAE and Saudi financial services, healthcare and government. This week: the Central Bank of the UAE's transition period expires and its resilience regulation goes live, Riyadh convenes 194 countries on AI ethics, and the security profession tells boards that AI agents are now a governance problem.

What Happened This Week

🔴 CBUAE deadlines land: reconciliation window closes and the Operational Risk and Resilience Regulation takes effect

Two Central Bank of the UAE deadlines converged this week. Federal Decree-Law No. 6 of 2025, the new Central Bank Law that came into force on 16 September 2025, gave licensed financial institutions one year under Article 184 to reconcile their positions. Hadef & Partners put that deadline at 15 September 2026 and noted that no general extension had been announced. Separately, Regulation No. C 1/2026 on Operational Risk Management and Operational Resilience came into effect on 14 September 2026, repealing the 2018 circular it replaces.

The new regulation applies to all licensed financial institutions with legal personality, not only banks. It requires an independent operational risk function under the Chief Risk Officer, mapping of critical operations and their interdependencies, third-party risk management, periodic stress tests including external penetration testing reported to the board, and business continuity exercises run under severe but plausible scenarios. Incident reporting is now tight: notification to the Central Bank within four hours of an event that threatens critical operations, a written report within 24 hours, and 72-hour notification of any high-severity incident. Data governance and public disclosure are listed explicitly as new layers over the 2018 regime, and the Central Bank names artificial intelligence systems and data analytics among the dependencies that create operational risk.

Enforcement is not theoretical. Gulf News reports that sanctions under the regulation can include removal or restriction of senior management and board members, temporary management of the institution, financial penalties and bans from the UAE financial sector. Under the primary law, fines for unlicensed activity range from AED 50,000 to AED 500 million, and Article 181 exposes responsible managers personally where negligence is established.

This sits on top of the February 2026 CBUAE Guidance Note on Consumer Protection and Responsible Adoption of AI and ML, which set five principles (governance and accountability, fairness, transparency and explainability, human oversight, data management and privacy) and expects documented AI governance frameworks proportionate to the institution's size and complexity. Hadef & Partners flag the AI guidance as part of the same "increasingly technology-focused" regulatory agenda under the new law.

Sources: Gulf News, Hadef & Partners, CBUAE Rulebook

For any UAE licensed financial institution running AI in credit, fraud, AML or customer service, the question the regulator can now ask is simple: show me the inventory of AI systems your critical operations depend on, who owns each one, how it was tested, and how fast you would know if it failed. Most institutions we speak to cannot answer that from a single document. The C 1/2026 dependency map and the AI Guidance Note governance framework are the same artefact viewed from two angles, so build them once. A short discovery exercise that lists every model and agent touching a critical operation, scores it against the five CBUAE principles and the ISO 42001 control set, and produces the four-hour incident playbook is the fastest route from exposed to defensible. Start with the systems a board member would be embarrassed not to know about.

🟡 Riyadh hosts UNESCO's Global Forum on the Ethics of AI: 194 countries, and a shift from principles to implementation

The fourth UNESCO Global Forum on the Ethics of Artificial Intelligence ran in Riyadh from 14 to 17 September, organised by the Saudi Data and AI Authority with UNESCO and the International Center for AI Research and Ethics (ICAIRE). Saudi Arabia is the first Arab country to host it, in a year the Kingdom has designated the Year of Artificial Intelligence. SPA reported participation from 194 countries; the forum programme listed more than 100 speakers across 30 sessions and a closed ministerial session of roughly 60 ministers and delegation heads.

UNESCO Deputy Director General Asa Regner told the opening press conference that UNESCO has now partnered with 78 countries on national AI strategies aligned to its Recommendation on the Ethics of AI, and that 58 countries have completed the AI Readiness Assessment Methodology, a diagnostic of legal, social, economic, educational and technical readiness to develop, deploy and govern AI. SDAIA President Dr Abdullah bin Sharaf Alghamdi framed the forum as a showcase of the Kingdom's institutional work on ethics regulation. The stated aim of this edition was to translate ethical principles into practical governance and implementation.

Worth noting for planning purposes: SDAIA's flagship Global AI Summit (GAIN), originally slotted for 15 to 17 September 2026, has been moved to 7 to 9 September 2027 following a request from international partners for further programme consultation. The UNESCO forum was therefore the Kingdom's main AI governance stage this month.

Sources: Arab News, Saudi Press Agency

Saudi organisations should read this as a signal of where SDAIA's expectations are heading: away from published principles and toward readiness assessments with evidence. The UNESCO RAM is a national-level tool, but the same logic applies inside a bank, hospital group or ministry. If your AI governance file is a policy document and a committee, it will not survive a "show me" conversation with SDAIA or the National Cybersecurity Authority. Run an internal readiness assessment now, map it to ISO 42001 clauses so it is portable across regulators, and keep the evidence trail. The organisations that did this for PDPL are the ones finding AI governance manageable.

🟡 GISEC Dubai: sovereign AI needs a security pillar, and AI agents become a board governance issue

GISEC Global 2026 ran from 16 to 18 September at Dubai Exhibition Centre, Expo City, hosted by the UAE Cyber Security Council with more than 25,000 attendees, 750 exhibiting brands and participants from 182 countries. The new Cyber First Global Summit brought together ministers, central bank governors and national cyber authorities to examine how cybersecurity, economic stability and national security are converging.

Two threads matter for AI governance leaders. First, Ahmed Alhadidi, Chief Strategy Officer at Ansen, argued that as the UAE builds sovereign AI capacity, security must become a third pillar alongside infrastructure and models, because sovereignty means "knowing, with confidence, what the AI running on top of that infrastructure is actually doing". He described AI agents as creating a growing "blast radius" as they connect to email, customer systems, internal tools and payment platforms, and urged boards and policymakers to reassess AI governance as systems move from generating content to taking actions. Second, Day 2 sessions featured Cisco's Fady Younes calling for AI agents to be secured "with the same rigour applied to people and applications", with hands-on workshops on identity controls, runtime oversight and autonomous containment for enterprise agents.

Gulf News attendees repeatedly named data sovereignty as their reason for attending, and the UAE Cyber Security Council's Dr Mohamed Al Kuwaiti used the week to call for policies and governance around AI, noting that around 95 per cent of AI use is positive but "there is a genie that is out of the bottle, and we have to control it".

Sources: Gulf News, Zawya, Khaleej Times

The UAE's own government has committed to running half of its services on agentic AI by 2028, and the enterprise sector is following. Agents are the gap in most AI governance programmes we see: the model inventory exists, but nobody has listed which agents hold credentials, what they can execute, and who approves their actions. That is a DISCOVER and AUTHENTICATE problem before it is a PROTECT problem. Add agents to your AI register this quarter, assign each one a human owner and an identity with least privilege, and log its actions the way you log a privileged user. ISO 42001's impact assessment clauses cover this if you scope them properly.

What Heads of AI, CDOs and Compliance Leads Are Dealing With

The underlying shift this week is from guidance to enforceability. For eighteen months UAE financial institutions could treat the CBUAE AI Guidance Note as a direction of travel. With the reconciliation window closed and C 1/2026 in force, the same governance expectations now attach to a regulation with named sanctions, a four-hour clock and personal liability for senior managers. Compliance leads are being asked to produce, in one place, an inventory of AI and data dependencies for critical operations, evidence of testing, and a rehearsed incident process. Few have it.

In Saudi Arabia the pressure is softer but pointed in the same direction. SDAIA is hosting the world on AI ethics implementation and readiness assessment, and the Kingdom's Year of AI has raised expectations that public and regulated bodies will demonstrate governance maturity rather than assert it. Across both markets, the arrival of agentic AI in production is exposing that most governance frameworks were written for models that answer questions, not systems that take actions. The practical work for the next two quarters is inventory, ownership, testing and evidence, mapped once to ISO 42001 so it can be shown to whichever regulator asks.

Three Things Worth Watching Next Week

1. CBUAE supervisory follow-up on the reconciliation deadline - Watch for any Board announcement extending the Article 184 period, or for the first supervisory communications testing C 1/2026 readiness. Institutions should have their gap analysis and critical-operations map ready to show.

2. Outputs from the Riyadh UNESCO forum - Look for SDAIA or ICAIRE publications following the ministerial session, particularly anything on national readiness assessments or sector-level AI governance expectations for Saudi financial services and healthcare.

3. UAE PDPL Executive Regulations - Full compliance with the federal PDPL is required by 1 January 2027 after the transition year. Any publication or clarification of the executive regulations will change data-governance scoping for AI systems immediately.

Questions? hello@paringa.ai

Paringa's AI governance assessment maps your AI and data estate to ISO 42001 and the CBUAE's five principles across six layers (DISCOVER, AUTHENTICATE, PROTECT, GOVERN, OPTIMISE, DEPLOY) and delivers a regulator-ready evidence pack. In the UAE and Saudi Arabia it is delivered with our regional partner Databorn. | 21 September 2026 | © Paringa Ltd