AI Consultant UAE: What a UAE Bank Should Ask an AI Consultant Before Signing

Three things. Your own three. Before any consultant says a word.

1. Your AI inventory. The note says an inventory of AI models should contain, as a minimum, "model name, purpose, risk rating" [1, 2(f)]. No inventory? Then the consultant writes it for you. And whoever writes the inventory frames the whole engagement. Their frame. Not yours.
2. Your residency stance. The note points to "rules on data being retained in the country" [1, 5(c)]. Decide where prompts, files, embeddings and logs may live BEFORE the pitch. I broke down the options in sovereign AI for banking in the UAE and in what in-country LLM inference still lets leave the region.
3. Your risk appetite. The note says AI risk assessments "should inform and be informed by the institution’s overall risk appetite and controls" [1, 8(a)]. Write it down. Hand it over. Watch who reads it.

Know these three and meeting one changes shape. You ask. They answer. The RIGHT order.

Here's the deal. These ten are about the consultant. The team. The proposal. The evidence. The contract. Not the system. For the system itself I already wrote the eight questions I ask before a bank LLM goes live. Different job. Use both.

Each one: why it matters, the evidence to ask for, and an illustrative red-flag answer. I wrote those answers myself. Illustrations, not quotes from anyone.

a. Who on your team has shipped an LLM system into a regulated bank, and what can I check?

Why it matters: The note says due diligence on a third-party AI provider "should be conducted on the provider’s reputation in the field of AI" [1, 9(a)]. Reputation means people. Named people.

Evidence to ask for: Names on the statement of work. Public work you can open yourself: code, papers, talks, write-ups. Not a logo wall.

Red-flag answer: An answer like this one: "Our team has worked with leading banks." Which team? Which people? Logos are not evidence. Logos are WALLPAPER.

b. Where will our data and the models run, during the engagement and after it?

Why it matters: Residency again, 5(c). Plus one of the sharpest lines in the note: "LFIs should not employ AI models that they have no control over." [1, 2(b)]

Evidence to ask for: A data-flow diagram per use case. Every hop. Prompts, files, embeddings, logs, telemetry, the dev sandbox.

Red-flag answer: An answer like "Everything stays in the UAE." Everything? Show the hop list. No hop list, no claim.

c. Is your recommendation model-agnostic, or tied to a vendor you resell?

Why it matters: The note says LFIs should consider a range of AI providers "to try to ensure there is no over reliance on one AI system or provider" [1, 9(d)].

Evidence to ask for: Written disclosure of every reseller deal, referral fee and partner arrangement. At least two model options, scored on your criteria, not theirs.

Red-flag answer: Every slide lands on the same model. Before discovery started. Funny.

d. How will you test the system before go-live, and what are the gates?

Why it matters: Section 5(d) says: "AI should be subject to stress testing and validation to ensure they operate reliably under a range of scenarios and do not produce unsafe or unintended outputs." [1, 5(d)] Section 9(b) says the documented choice of a third-party AI provider should include "pre-deployment tests and checks" [1, 9(b)]. The note does not say red teaming. A finance-specific test programme is one way to produce that evidence. My method is on LLM red teaming for banking in the UAE, and clause by clause on the CBUAE AI guidance note and generative AI testing.

Evidence to ask for: A written test plan inside the proposal itself. Harm categories. Gates. The name of whoever signs each gate.

Red-flag answer: An answer like "We test thoroughly." Thoroughly is not a plan. It is an adverb.

e. Do you test in Arabic and English, single turn and multi turn?

Why it matters: The note says disclosures "should be made in both Arabic and English" [1, 4(b)]. That line is about disclosures, not testing. But a customer who reads Arabic disclosures chats in Arabic too. And 5(d) talks about "a range of scenarios". Long conversations are scenarios.

Evidence to ask for: A coverage table. Every harm category, every language you serve, single turn and multi turn. The open go-live checklist fails its coverage gate on a single unticked cell [2].

Red-flag answer: An answer like "Our model handles Arabic." Handles it how? Tested by whom? An English-only test pack for an Arabic launch. No.

f. Who scores the findings, on what rubric, and can we re-run it ourselves?

Why it matters: Section 6(d) says "Mechanisms should be in place to detect, report and remediate any performance issues, biases or unintended consequences" [1, 6(d)]. You can't remediate what you can't re-score.

Evidence to ask for: The rubric in writing. Severity levels with definitions. A score your own team can reproduce without the consultant in the room. One public example: the free severity scorer runs the same evaluate() function that runs in the open checklist's pytest and CI [2] [3].

Red-flag answer: A proprietary score. A black box. An answer like "Trust us." A score you can't re-run is a SLOGAN.

g. What evidence pack will we own at the end of each release?

Why it matters: Section 9(b) says the choice and deployment of third-party AI "should be appropriate and documented" [1, 9(b)]. Section 6(e) says LFIs should consider "appropriate contractual rights with respect to audit and information rights from providers" [1, 6(e)].

Evidence to ask for: A contract line that says the bank owns the evidence pack. For a sense of what goes in one, the open checklist writes the verdict, the severity table, the five gates, the findings, the missing evidence and the scope [2].

Red-flag answer: The evidence lives in the consultant's portal. Contract ends. Evidence goes. Auditor asks. You hold nothing. Sad.

h. Who holds the switch-off, the bank or the consultant?

Why it matters: Section 6(f): "LFIs should at all times retain the clear and immediate ability, with human intervention, to cease use of an AI model system, technology or application deployed or utilized." [1, 6(f)] The bank. Not the consultant.

Evidence to ask for: A drill where the bank's own staff switch the system off with the bank's own accounts. Written down as an acceptance item.

Red-flag answer: An answer like "Just call us and we'll disable it." At 2 a.m.? On a public holiday? Then the switch is THEIRS.

i. Who is independent of the build when it gets assessed?

Why it matters: Section 6(b) says independent third parties "(willing to challenge and question the use of AI in an LFI)" "should be engaged periodically to assess the development of and use of AI" [1, 6(b)]. For in-house builds, 8(c) says the LFI should consider "third-party independent reviews to check suitability, security and reliability" [1, 8(c)].

Evidence to ask for: The assessor's name. Proof they did not design or build the system. A separate engagement letter.

Red-flag answer: The builder grades the builder. Same firm, same team, new slide title. I call that the Self-Graded Pack. Worthless as independence.

j. What are the acceptance criteria and exit points after discovery and after the pilot?

Why it matters: Section 6(e) lists "appropriate termination/cease provisions" among the things an LFI should consider for outsourced AI [1, 6(e)].

Evidence to ask for: Written acceptance criteria per phase. A clean exit after discovery. A clean exit after the pilot. Handover of code, prompts, configs and evidence at each exit.

Red-flag answer: A long commitment from day one. No phases. No exits. That is not a plan. That is a cage.

Four steps. Proposal. Evidence. Gate. Go or no-go. Evidence-First Buying on one page.

The proposal makes claims. Each claim needs an artefact. Each artefact goes through a gate the bank agreed in advance. The gate decides. Not the slide. Not the relationship. The GATE.

The open go-live checklist runs that pattern in code. Five gates: critical findings, high findings, coverage, kill switch and monitoring [2]. Its own words: "A red gate fails the process. You still get the markdown evidence pack." [2] Exit code 1. No debate.

Ask every consultant for their equivalent. A gate that can say no. If it can't say no, it isn't a gate. It's a formality.

Folks, five flags. Any one of them and you slow down.

• No named people. A team page with no names is a staffing plan, not a team.
• ROI numbers with no method. A number without a method is a guess in a nice font. Ask for the inputs. Ask for the baseline.
• Answers like "Fully compliant with the guidance note." The note calls itself "flexible principles" that "should not be taken to be static or fixed" [1]. It "shall supplement and not replace any laws, regulations or directives" [1]. Even my own open checklist says "It does NOT certify compliance." [2] A consultant who promises full compliance with a moving set of principles is selling CERTAINTY nobody can sell.
• No test plan. No plan, no 5(d) evidence. Zero.
• Lock-in to one model. See 9(d). One provider, no exit, no leverage. Ugly.

Frankly, this table is the part a CRO will print. Every row says "maps to". The clause words are EXACT. The note names none of these questions [1].

What does an AI consultant do for a UAE bank?

For a UAE bank, the job is turning AI ideas into a plan the bank can test, own and switch off. The useful kind arrives with a test plan, an evidence pack the bank keeps and a clause mapping to the CBUAE guidance note of 11 February 2026 [1].

AI consultant or AI architect: what's the difference?

I answered that in AI architect, AI engineer or AI consultant: what's the difference? on my AI architect page.

Does the CBUAE expect an independent AI assessment?

Not by that name. Section 6(b) of the guidance note says independent third parties "should be engaged periodically to assess the development of and use of AI" [1]. Section 8(c) adds "third-party independent reviews" for AI an LFI develops internally [1].

Is there a free checklist?

Yes. FREE. The LLM red-teaming banking checklist is free and Apache 2.0 licensed. It covers nine harm categories, mapped to the OWASP LLM Top 10 (2025) where a code exists (categories 1 and 2 carry none), and five go/no-go gates [2]. BTW, the same rules run in the free severity scorer on Hugging Face [2] [3].

The one who brings evidence. ONLY that one.

Named people. A hop list. A test plan with gates. A score you can re-run. An evidence pack you keep. A switch you hold. An assessor they don't control. An exit at every phase.

The slide-deck consultant tells you what AI could do. The evidence consultant shows you what it did, what it failed and how to switch it off. Pick the second. Every time.

One last thing. This page maps public text to regulator clauses. It is not legal advice.

Keep going:

• LLM red-teaming banking checklist on GitHub
• LLM red teaming severity scorer on Hugging Face
• LLM red teaming for banking in the UAE
• The CBUAE AI guidance note and generative AI testing
• The CBUAE AI guidance note on generative AI
• Sovereign AI for banking in the UAE
• In-country LLM inference for a UAE bank

1. Central Bank of the UAE, "Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E.", issued 11/2/2026. https://rulebook.centralbank.ae/en/rulebook/guidance-note-consumer-protection-and-responsible-adoption-and-use-artificial-intelligence (opened live 25 Oct 2026, 14:15 Dubai)
2. Ercin Dedeoglu, llm-redteam-banking-checklist, GitHub, Apache 2.0. https://github.com/ErcinDedeoglu/llm-redteam-banking-checklist (opened 25 Oct 2026, 14:16 Dubai)
3. Ercin Dedeoglu, LLM Red Teaming for Banking Severity Scorer, Hugging Face Space. https://huggingface.co/spaces/Ercin/llm-red-teaming-banking-severity-scorer (200 on 25 Oct 2026, 14:16 Dubai)