CBUAE's AED 1 Billion Deadline Lands as Saudi Enforcement Hits 48 Cases

Week of 28 September 2026 | Compiled by Team Paringa

Gulf AI and data governance stopped being aspirational this month: the UAE's central bank closed its one-year compliance window and Saudi Arabia's data authority is now routinely fining violators.

What Happened This Week

🔴 CBUAE's Central Bank Law reconciliation deadline exposes AI governance gaps

The one-year transition period under Federal Decree-Law No. 6 of 2025 — the UAE's new Central Bank Law — closed in mid-September 2026, per Article 184's "reconciliation" requirement. Every licensed financial institution (LFI) operating in the UAE was required to bring its licensing, governance and technology arrangements into conformity with the new law by that date. Non-compliance carries administrative fines up to AED 1 billion (up from a AED 200 million ceiling under the previous law), unauthorised financial activity a minimum AED 1 million fine, and criminal exposure of up to AED 500 million plus imprisonment, with personal liability attaching to responsible management where negligence is established.

The deadline matters for AI governance specifically because it sits directly downstream of the CBUAE's February 2026 Guidance Note on Consumer Protection and Responsible Adoption of AI, issued by Governor Khaled Mohamed Balama. That note requires LFIs to maintain documented AI governance frameworks with board-level accountability, model inventories aligned to the 2022 Model Management Standards, annual bias testing, human oversight controls, and third-party audit rights over AI vendors. An April 2026 CBUAE FAQ clarified that Article 62 of the new law does not create new licensed activities but does confirm that decentralised, Web3-based or AI-mediated delivery channels don't escape existing regulation — while pure infrastructure and software vendors serving LFIs remain outside direct licensing scope, provided they don't present themselves as performing the regulated activity itself.

Three independent law-firm analyses (White & Case, Pinsent Masons, Hadef & Partners) converge on the same reading: this is not a blanket sunset on existing arrangements, but it does mean any LFI that hasn't documented its AI governance posture, model inventory and vendor oversight now sits in a materially higher enforcement-risk position than it did in August.

Sources: White & Case | Pinsent Masons | Hadef & Partners | The Asian Banker

This is the enforcement hook Gulf-facing compliance teams have been waiting for — and largely ignoring. Any client with an LFI licence, an embedded fintech product, or an AI-driven credit/fraud model in the UAE should be asked one question this week: can you show CBUAE a board-approved AI governance framework and a current model inventory today, not in Q1? The AED 1 billion ceiling is a headline number few institutions will actually hit, but the personal-liability provision for negligent management is the one that changes behaviour in the C-suite. Paringa's advisory line here is a 30-day gap assessment against the February AI Guidance Note, not a generic "PDPL readiness" pitch — that ship (mostly) sailed in 2025.

🟡 Saudi SDAIA enforcement wave reaches 48 decisions, foreign firms now in scope

Saudi Arabia's Data and Artificial Intelligence Authority (SDAIA) has issued 48 enforcement decisions against organisations violating the Personal Data Protection Law since it became enforceable in September 2023 — described by IAPP as "the first substantive wave of adjudications" and confirmed still active in a 23 September 2026 update. Common violations cited: unlawful data collection beyond stated purpose, insufficient technical/organisational security controls, and unconsented marketing communications, described as "widespread" in retail, telecoms and financial services specifically.

Maximum administrative fines reach SAR 5 million (~USD 1.33 million) per violation, doubling for repeat offences, alongside SDAIA's power to issue warnings and remediation orders. Organisations must notify SDAIA of breaches within 72 hours and respond to data subject access requests within 30 days. Separately, compliance commentary this month (via ComplianceHub.Wiki and confirmed in the enforcement pattern) notes PDPL's extraterritorial reach now actively catches foreign firms processing Saudi residents' data, not just domestic entities — a meaningful shift for any UK/EU consultancy or vendor servicing Saudi clients remotely.

Sources: IAPP | GISuser

No specific fined company has been named publicly in any of the 48 decisions we could locate — SDAIA is enforcing quietly, via aggregate disclosure, which is itself a signal worth relaying to clients: the absence of a naming-and-shaming pattern doesn't mean the absence of risk. For any client with Saudi data-processing exposure, the extraterritorial point is the one to lead with — "we're not in Saudi" is no longer a defensible compliance position if Saudi residents' data touches your systems.

What UAE/Saudi Compliance Leaders Are Dealing With

The structural story beneath both headlines is the same: Gulf AI and data regulators have shifted from publishing frameworks to actually enforcing them, on compressed timelines, with real financial consequences. The UAE consolidated its AI/data/digital-government functions into a single Cabinet-level Federal Authority for Artificial Intelligence and Data under Omar Sultan Al Olama in June 2026 — explicitly tasked with supporting "cybersecurity efforts and government information security management" alongside AI strategy, signalling that governance, data and security are now treated as one regulatory problem rather than three. Saudi Arabia's SDAIA is running the same playbook a year further along its enforcement curve.

For compliance leaders, this means AI governance can no longer be scoped as a standalone ISO 42001 certification exercise sitting apart from core data protection and financial-sector licensing work — CBUAE, SDAIA and the new UAE Federal Authority are all converging their expectations around the same core requirements: documented governance, human oversight, audit trails, and breach notification within tight windows.

Three Things Worth Watching Next Week

1. First public CBUAE enforcement action post-deadline — watch for the first institution named (or fined) for failing the mid-September reconciliation deadline; none has surfaced publicly yet.

2. UAE Federal AI and Data Authority's first substantive policy output — the authority consolidated in June 2026 but hasn't yet published its own AI governance rulebook distinct from CBUAE/DIFC frameworks.

3. Whether SDAIA names a fined entity — all 48 decisions to date are anonymised; a named case would materially change risk perception among foreign firms.

Could not verify: The exact reconciliation deadline date is given as both 15 and 16 September 2026 across otherwise-reliable law-firm sources — treated here as "mid-September" since the discrepancy doesn't affect substance. No publicly named company or specific fine amount could be found for either the CBUAE or SDAIA enforcement actions referenced above; both regulators appear to disclose only aggregate figures.

Questions? hello@paringa.ai

Paringa's Gulf-market practice tracks CBUAE, SDAIA and DIFC/ADGM AI governance requirements as they move from strategy to enforcement, so clients aren't caught flat-footed by deadlines that arrive with real fines attached. If your AI governance documentation predates February 2026, it predates the rules that now matter. | 28 September 2026 | © Paringa Ltd