Since 11 February 2026 the CBUAE holds your board accountable for every AI system in the bank. Does your framework know about the model your collections team switched on last quarter?
Each one below is dated, named, and set by someone other than us. Read them against what you could show this week, not what you plan to build.
| Date | Regulator | Obligation | What you must show |
|---|---|---|---|
| In force | CBUAE | Fraud-liability transfer for entities retaining OTP-based authentication (since July 2025) | Migration off OTP; 24/7/365 fraud monitoring with device, location and behaviour analysis |
| 27 Nov 2025 | UAE Cyber Security Council | National Encryption Policy approved | Formally approved post-quantum transition plans; automated cryptographic inventory; crypto-agility |
| During 2026 | UAE | Mandatory submission of PQC migration plans | A migration plan resting on an inventory you can defend |
| 1 Jan 2026 | DIFC Commissioner of Data Protection | Regulation 10 in full enforcement | Documented pre-processing risk assessments, transparency notices, human-oversight design, and either certification or a named Autonomous Systems Officer |
| 11 Feb 2026 | CBUAE | Guidance Note on Consumer Protection and Responsible AI Adoption | Board and senior-management accountability for every AI system deployed; human oversight of high-impact decisions |
| Sep 2025 | UAE Central Bank | Decree-Law No. 6 (2025) extends oversight to fintech and crypto firms | Statutory fraud-prevention capability, prompt breach reporting; criminal liability attaches to management negligence |
| Jul 2025 | DIFC | Data Protection Amendment No. 1 | Private right of action including for distress; processors carry direct liability |
| From 2026 | KSA — NCA | NCNICC-1:2025 brings private-sector entities into mandatory scope | Governance, audit, third-party and cloud-provider controls |
| 2024 | KSA — SAMA | Cyber Security Framework and e-KYC framework | Biometric identity proofing for licensed digital banks and payment service providers |
| 2027 | SWIFT | SwiftNet 8.0 expected to be PQC-enabled | Participant migration inside a 15-month window |
| 2028 | CBUAE | PQC readiness expectation for banks | Migration executed on critical systems |
No instrument for this jurisdiction is listed on this page. Federal and cross-border obligations under Show all still apply.
The CBUAE guidance names board and senior management for every AI system deployed, with no exemption for third-party systems. Look at your last board pack: does it list the models running in the bank, or does it describe the governance framework that is supposed to cover them?
Since July 2025 the fraud liability for entities retaining OTP authentication sits with the entity. That is not a deadline to plan for. Count the months since, and that is how long the exposure has been on your balance sheet.
SwiftNet 8.0 is expected to be PQC-enabled in 2027, opening a fifteen-month migration window. Before any of that is plannable you need to know what cryptography you actually run. Does anyone in the bank hold that list today?
Fixed fee, fixed duration, delivered remotely. We publish the bands so you know before you call whether this is your size of problem.
| Assessment | Duration | Indicative fee | What you receive |
|---|---|---|---|
| Cryptographic discovery & inventory | 4–6 weeks | USD 40–90K | A risk-ranked inventory of your cryptographic estate and a migration-plan skeleton: where the keys are, what algorithms sit under the payment and messaging rails, and what must move before the SWIFT window opens |
| AI governance gap assessment | 6 weeks | USD 35–75K | A gap report against ISO/IEC 42001 and the CBUAE guidance, with a remediation roadmap your board committee can act on |
| DIFC AI readiness review | 3–4 weeks | USD 20–40K | Regulation 10 readiness: system inventory, risk-assessment documentation, transparency and human-oversight design, and the evidence pack behind them |
| Identity & fraud control review | 4 weeks | USD 25–50K | Control and documentation gap analysis across authentication and onboarding, mapped to the CBUAE circular and PAD-level expectations |
| Annual assurance retainer | 12 months | USD 60–150K | Recurring review and regulatory-change monitoring, so the evidence stays current between audits |
The board and senior management, under the CBUAE Guidance Note of 11 February 2026, with no exemption for third-party systems.
Migration-plan submission is mandatory during 2026, SwiftNet 8.0 is expected to be PQC-enabled in 2027, and the CBUAE has signalled a 2028 readiness expectation.
If your institution still relies on OTP-based authentication, yes — the liability has sat with the entity since July 2025.
The rule governing personal data processed through autonomous systems in the DIFC, in full enforcement since 1 January 2026.
Yes, and we recommend it — one business line assessed properly is worth more than an estate covered shallowly.
A fixed-scope assurance review of your AI estate — inventory, control mapping against the frameworks that apply to you, and a written evidence package your board and your regulator can read. Defined price, defined duration, no obligation beyond it.
The people who bring us in are usually the ones who saw it coming.