On 11 February 2026, the Central Bank of the UAE issued a Guidance Note on the responsible adoption and use of artificial intelligence and machine learning by licensed financial institutions. It applies to every regulated lender in the country. For credit and risk teams, it arrives at an awkward moment. The pressure to automate underwriting has rarely been higher, and the regulator has just written down what those automated decisions have to be able to do:
- Explain how they reached an outcome
- Leave the final call on high-impact cases with a person
- Stay inside the institution's own risk governance
What looks like a brake on AI in lending is in reality a description of how AI in lending should have been built from the get-go. The tension between automation and oversight only exists when the AI sits outside a governed system. When it sits inside one, the guidance and the automation ask for the same thing.
This piece breaks down what the Guidance Note requires, where common AI credit setups fall short of it, and what an architecture that satisfies it looks like in practice.
What the CBUAE Guidance Note requires
The Guidance Note applies to all licensed financial institutions, including banks, finance companies, and insurers. It supplements the CBUAE's existing frameworks rather than replacing them, and is meant to be read alongside the UAE's National Strategy for Artificial Intelligence and the earlier Guidelines for Financial Institutions adopting Enabling Technologies.
Its scope is defined by impact. The note introduces the idea of a ‘high-impact decision’, which it defines as any determination made using AI that materially affects a customer's access to financial products or services. It gives a loan application as an example, and credit decisions sit squarely inside the definition.
From there, the note sets out principles covering governance, fairness, transparency, data, monitoring, and human oversight. Four of them carry most of the weight for a lending team.
- Human oversight: For high-impact decisions, the note expects a person to hold the decision. It names three oversight models. In human-in-the-loop, the AI produces a recommendation, and a human retains full authority to approve or reject it. In human-on-the-loop, the AI runs routine work on its own while a human monitors and can step in. Human-out-of-the-loop, where AI operates without direct human involvement, is restricted to low-risk, non-material processes.
- Explainability: Institutions have to be transparent about how their AI systems operate and make decisions, and be able to disclose that. For a credit team, this means being able to show which factor or rule drove a given approval or rejection.
- The consumer's right to review: Customers can request human review or an explanation of an AI-generated decision, and an alternative arrangement has to exist for anyone who does not want to be subject to one. Customers can also challenge a decision and correct inaccurate inputs that fed it.
- Governance and accountability: A lender needs a documented governance framework, a board and senior management accountable for AI outcomes, and an inventory of the AI models in use. The note is direct on two points that matter here: an institution should not run AI models it has no control over, and AI risk belongs inside enterprise-wide risk management rather than beside it.
Where common AI credit setups fall short
The requirements are clear. But, most AI decisioning systems will be hard-pressed to comply considering they were not built for these frameworks.
A standalone scoring model that returns a number has no straightforward way to show which rule drove the result, so it struggles against the explainability and disclosure requirement.
An autonomous system that reads the documents, writes the memo, and finalises a recommendation with no defined stopping point leaves no room for a human to hold the decision, which is exactly what the note asks for on high-impact calls.
AI that runs alongside the decision engine, bolted on for a single step, sits outside the institution's risk framework instead of inside it, and misses the integration the note expects.
A setup with no versioning and no record of each run has no clean answer when a customer exercises the right to request human review or challenge a decision, because there is nothing to retrieve and show.
None of these gaps is about model quality. They are about how the system is built. The Guidance Note rewards AI that was built inside a governed system from the start.
What compliant AI credit decisioning looks like
A system that satisfies the Guidance Note keeps a governed decision engine as its foundation, with the institution's policies and audit trail living within it. AI handles the assembly work a human analyst would otherwise do by hand: reading documents, extracting fields, reconciling numbers, researching an entity, drafting the memo.
Each of those steps produces a structured, inspectable output rather than an opaque verdict. The human keeps the decision on anything high impact. Every change to the logic is versioned and reviewable, and every run leaves a trace.
Described that way, compliance and sound engineering turn out to be the same design.
How Sentinel AI maps to the guidance
Sentinel AI is FinBox's agentic credit decisioning platform. It runs a low-code business rule engine that lenders use to design, test, and deploy credit policy live, and it now ships a library of configurable AI agents with an orchestration layer that chains them into end-to-end lending workflows. The rule engine stays underneath the agents, so the policies, the audit trail, and rollback are unchanged by adding AI on top.
That structure lines up with the Guidance Note requirement by requirement.
CBUAE requirement | How Sentinel AI is built for it |
Human oversight on high-impact decisions | The rule engine holds the decision while agents assemble context and recommend. The orchestration layer consolidates each agent's output into one outcome that can be routed for human review. Agent guardrails surface uncertainty as "Needs review" instead of passing it through silently. |
Transparency and explainability | Every agent run is recorded as a governed case that shows which agent and which rule drove each approval or rejection. Agents return structured output that can be inspected, rather than free-form prose. |
The consumer's right to review and challenge | Each case carries a full trace of its inputs, tool calls, and output — the record a lender needs to answer a review request or a challenge. |
Governance and accountability | Logic is versioned like production software, moving from Draft to In Review to Ready to Deploy, with maker-checker on every change, role-based access control, and one-click rollback. |
AI inside enterprise risk management | Agents sit on the governed rule engine rather than as a standalone tool, so AI-assisted steps run inside the same policy and control framework as the rest of the decision. |
Continuous monitoring and the ability to stop | Real-time dashboards track policy outcomes as they happen. Champion/Challenger and Canary test new logic against live traffic, and rollback lets a team stop a strategy under human control. |
Data handling and provenance | Structured inputs and per-case traces give each decision clear provenance, and decision data stays within the lender's environment. |
The human-oversight row is the closest match. The note's definition of human-in-the-loop, where AI recommends and a human retains authority to approve or reject, is the operating model Sentinel AI is built around. Agents do the assembly that consumes an analyst's day, and the decision stays with the governed engine and the person reviewing the case. The regulator has described, in its own words, the division of labour the platform already runs on.
Explainability is the second. The note asks a lender to disclose how a decision was made. Because every Sentinel agent returns structured output, and every run is stored as a case tied to the agent and rule that produced it, the answer to "why was this approved or rejected" is a record that already exists rather than something reconstructed after the fact.
Sentinel AI for the UAE
Sentinel AI is built to seamlessly work in new markets, new products, new systems and more. Its agent library is now being optimized for the UAE, which means adding agents that read Emirates ID and local KYC documents natively. Adding agents is what the platform is designed for, so this is the system doing what it already does. The document agents are UAE-specific. Everything they run on is already live in production.
The governance the CBUAE guidance calls for is a property of that platform, not of any one agent, so it carries into a new market without being rebuilt. A team defines a new agent's job, its rules, and its output in plain language, and the agent inherits the same governed rule engine, the same versioning, and the same case-level audit trail as everything already running. New agents, proven rails.
The data layer to build against is already forming. The UAE's Open Finance framework, established under Federal Decree-Law No. 6 of 2025, gives licensed providers consented access to customer financial data, with a planning deadline of 16 September 2026 for affected entities. A version of Sentinel AI localised to the UAE draws on those rails for the inputs its agents assemble.
On data and security, the platform keeps decision data within the institution's environment and holds ISO 27001 and SOC 2 posture. Aligning that footing with the UAE's own data protection and information assurance requirements is part of the localisation work rather than something inherited from another market.
The direction MENA is taking
The CBUAE note is unlikely to be the region's last word. Its emphasis on human oversight, explainability, and governance tracks the direction other GCC regulators are moving.
In Saudi Arabia, the central bank has moved open banking into a formal licensing regime and has been clear that sensitive tasks such as credit decisions still call for human judgment. The expectations converging across MENA are the same ones the UAE has now put in writing.
For a lender deciding how to bring AI into credit, that convergence is the useful signal. Building on decisioning that is governed, explainable, and human-supervised is how you meet the CBUAE guidance today, and it is how you stay ready for the frameworks the rest of the region is still drafting.
