The CBUAE AI Guidance Note and Generative AI: What to Test, Clause by Clause
Look. Everybody in UAE banking is talking about the CBUAE AI guidance note. Very few have read it line by line. I did. Every word. And there is ONE thing it does not say.
Does the CBUAE guidance note require LLM red teaming? Not by name. The words "red teaming" appear nowhere in it. I checked the live English rulebook page and the PDF on 21 Oct 2026. Zero hits. What the note does say is that AI "should be subject to stress testing and validation to ensure they operate reliably under a range of scenarios and do not produce unsafe or unintended outputs" (section 5(d)), and that independent third parties "should be engaged periodically to assess the development of and use of AI" (section 6(b)). For a generative AI system, LLM red teaming is one practical way to produce that evidence. The method is my choice. The clauses are the Central Bank's.
The note is the Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., issued on 11 February 2026. It covers generative AI directly. Its definition of GenAI ends with "including popular Large Language Models." So yes, your chatbot is in scope. Your RAG assistant too.
I'm Ercin Dedeoglu, an AI Architect. I wrote the LLM red teaming for banking method and the open-source go-live checklist. This page is the bridge between the note's words and the tests.
What does the CBUAE note actually ask for?
Here's the deal. It's a guidance note. It speaks in "should" and "expected." It says itself that it shall "supplement and not replace any laws, regulations or directives issued by the CBUAE or other competent authorities." So nobody should tell you it mandates a specific test method. It DOESN'T. Anybody who says otherwise hasn't read it.
But it is very clear about outcomes. Stress testing and validation. Testing of automatic updates before implementation. Periodic independent challenge. An inventory with a risk rating. And the ability to switch the thing off. Fast. With a human.
Those outcomes need evidence. Evidence needs tests. Tests need a plan BEFORE go-live, not after the first incident. Simple.
Which clauses map to which LLM tests?
Every quote below is copied from the live rulebook page. Section letters follow that page. The table shows what I would test and what I would keep on file. The right two columns are my test design, not the note's wording.
| Section | What the note says (verbatim) | LLM test activities | Evidence the bank keeps |
|---|---|---|---|
| 5(d) | "AI should be subject to stress testing and validation to ensure they operate reliably under a range of scenarios and do not produce unsafe or unintended outputs." | Structured adversarial testing across nine harm categories, single turn and multi turn, in every language served. Severity score on every finding. | Coverage matrix (category × language × turn mode), severity-scored findings, test-set version |
| 5(d) | "LFIs should incorporate privacy-by-design and security-by-design principles into AI systems and maintain safeguards to protect data from unauthorised access or misuse." | Tests for sensitive information disclosure, system prompt leakage, prompt injection through content the system reads, and retrieval-layer weaknesses | Findings per category, fix or compensating control per finding, named owner |
| 6(b) | "LFIs are expected to consistently monitor and review and, where appropriate, update or cease using AI and ML models, taking into account changes in data, market conditions and customer behaviors." | Scheduled re-runs of the same test set. Re-run when data, products or customer behaviour change. | Dated re-test results compared with the last run, update or cease decisions |
| 6(b) | "Independent third-party providers of AI, independent experts and third parties (willing to challenge and question the use of AI in an LFI) should be engaged periodically to assess the development of and use of AI including third-party AI providers." | An independent team outside the build team challenges the system and the test plan itself | Independent assessment scope, dates, findings and responses |
| 6(c) | "LFI should ensure that automatic updates their AI tools are tested before implementation." | Pin the model version. Treat a provider-side model update as a re-test trigger. Run the regression set before the new version reaches customers. | Model version log, pre-implementation regression results, go or no-go record |
| 6(d) | "Mechanisms should be in place to detect, report and remediate any performance issues, biases or unintended consequences that may arise from any AI tool or model before implementation and over time." | Production logging and alerting for the same harm categories tested before go-live. A finding lifecycle from detection to fix. | Monitoring configuration, alert history, remediation records |
| 6(f) | "LFIs should at all times retain the clear and immediate ability, with human intervention, to cease use of an AI model system, technology or application deployed or utilized." | Kill-switch drill, end to end, by a named human | Drill record with the time to disable |
| 3(c) | "AI deployed should be subject to periodic testing, i.e. once a year or each time a model is upgraded, materially changed or a new one is introduced, to identify and remediate undue/unintended embedded biases or discriminatory outcomes." | Bias and fairness evaluation of LLM answers across customer groups, at least yearly and on every upgrade or material change | Bias test report per run, remediation notes |
| 4(b) | "Understandable plain language and accurate disclosures should be made in both Arabic and English, with telephone support available in all major languages of the UAE." | Run the test set in Arabic and English. Check that the assistant discloses it is AI, accurately, in both. | Bilingual results, disclosure checks per language |
| 7(d) | "AI should not be used to target consumers with unsuitable products or to engage in pressure-selling or misleading marketing." | Conduct and suitability tests: does the assistant push an unsuitable product or pressure the customer? | Conduct-category findings and fixes |
| 2(f) | "Such inventory should contain all material metadata, to include as a minimum model name, purpose, risk rating." | Register every LLM system before testing. The risk rating sets the test depth. | Inventory entry linked to the latest evidence pack |
| 9(c) | "Institutions should maintain an inventory of AI models, including those developed or hosted by third parties, and aim to ensure that third-party models adhere to the same standards of fairness, explainability and robustness as in-house models." | Run the same test set against hosted third-party models as against in-house ones | One inventory, one test standard, results per model |
| 9(b) | "...which should include annual cybersecurity reviews by independent and suitably qualified third parties and pre-deployment tests and checks to ensure appropriateness..." | Pre-deployment testing of any third-party LLM before it reaches customers | Pre-deployment test results, annual independent cybersecurity review |
Folks, read the 6(c) row twice. A provider can change the model under your product while your code stays the same. Same app. Different brain. If nobody re-tested it, nobody can say it passed. That's the Silent Swap, and it's the gap I see discussed least.
Why is the AI model inventory the first test artifact?
Because you can't test what you haven't listed. Obvious. Ignored ALL the time.
The note asks for the inventory twice. Section 2(f) says an inventory of all AI models, systems or technologies "should be maintained" and that it "should contain all material metadata, to include as a minimum model name, purpose, risk rating." Section 9(c) says the inventory includes models "developed or hosted by third parties."
So for an AI model inventory under the CBUAE note, I'd add three fields of my own to the minimum: model version, the date of the last test run, and a link to the evidence pack. Name, purpose and risk rating come from the note. The three extra fields are my suggestion. When the version changes and the test date doesn't, the inventory itself shows the gap. No meeting needed.
Section 8(d) adds that institutions "should create processes to rate the risk of each AI system/application/technology they deploy or use." Use that rating. A customer-facing generative AI assistant that can touch account data gets the deep test. An internal summariser with no customer data gets a lighter one. Proportionate. Documented. Defensible.
What does stress testing mean for a generative AI system?
Frankly, "stress testing" in a bank usually means capital. Here it means behaviour. Section 5(d) wants AI to "operate reliably under a range of scenarios." For an LLM, a range of scenarios is NOT one prompt per topic.
This is how I'd build it, using the nine harm categories (seven mapped to the OWASP LLM Top 10 2025) from my method:
- Financial-crime facilitation and conduct and suitability breaches. Finance-specific. No OWASP code. The second one lines up with section 7(d).
- Sensitive information disclosure (LLM02), system prompt leakage (LLM07), prompt injection through content the system reads (LLM01) and retrieval-layer weaknesses (LLM08). These line up with the security-by-design sentence in section 5(d).
- Excessive agency (LLM06), misinformation (LLM09) and unbounded consumption (LLM10). Once an agent can act, a bad answer becomes a bad action.
Then multiply. Every category, every language served, single turn and multi turn. Arabic and English give you 9 × 2 × 2 = 36 cells. Fill all 36 or the coverage gate stays red. The categories are public. The test prompts stay in access-controlled storage. Always. Defensive only.
A test plan that runs English, single turn, and calls it validated? That's Validation Theater. WEAK!
How does independent challenge work under section 6(b)?
The note names who: "Independent third-party providers of AI, independent experts and third parties (willing to challenge and question the use of AI in an LFI)." And when: "periodically." It doesn't set a frequency in 6(b). Don't invent one and pin it on the Central Bank.
Two related clauses sit elsewhere. Section 8(c) says a bank developing AI internally "should consider the use of third-party independent reviews to check suitability, security and reliability." Section 9(b) asks for "annual cybersecurity reviews by independent and suitably qualified third parties" when a third-party AI provider is selected. Annual there. Periodic in 6(b). Different clauses, different words. Quote them exactly.
The practical point is simple. The team that built the assistant should not be the only team that tests it. Independent means independent. Not the same people with a new slide template.
What does a bank keep as evidence?
Here is what I'd keep for each generative AI system, per release:
- The inventory entry (name, purpose, risk rating, plus version and last test date).
- The scope record and test-set version.
- The coverage matrix and the severity-scored findings.
- The five gate results: critical findings, high findings, coverage, kill switch, monitoring.
- The kill-switch drill record with the time to disable.
- The independent assessment, when one ran.
- The sign-off, with names and dates.
The llm-redteam-banking-checklist turns most of this into a gate that fails a CI run when a gate is red, and writes a markdown evidence pack. It's free, Apache-2.0, and archived on Zenodo as DOI 10.5281/zenodo.23536860. The same scorer runs in the browser as the LLM Red Teaming for Banking Severity Scorer. No attack prompts. No model calls. And it does NOT certify compliance. It shows your evidence. That's all a tool should claim.
So where should a UAE bank start?
Start with the inventory. Then rate the risk. Then test the highest-rated generative AI system against section 5(d) and 6(c) first, because those two break silently. Then run the kill-switch drill under 6(f). Then bring in independent challenge under 6(b).
Pick that order. Inventory, rating, test, drill, challenge. Everything else builds on it. BTW, if your current AI register can't tell you which model version is live today, that's finding number one. Fix it first.
More on the method: LLM red teaming for banking in the UAE. More on the architecture side: AI architect page. All tools: projects.
Does the CBUAE AI guidance note mention generative AI?
Yes. Section 1 defines GenAI as "artificial intelligence models that can understand and generate human like text, audio and images by leveraging vast amounts of training data and deep learning techniques, including popular Large Language Models." The note's definition of AI also includes GenAI.
Does the CBUAE guidance note require LLM red teaming?
Not by name. The term does not appear in the note. Section 5(d) says AI "should be subject to stress testing and validation," and section 6(b) says independent third parties "should be engaged periodically to assess the development of and use of AI." LLM red teaming is one practical way to produce that evidence for a generative AI system.
When was the CBUAE AI guidance note issued?
The rulebook page shows "Issued on 11/2/2026," which is 11 February 2026. Its full title is Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E.
What must the AI model inventory contain under the CBUAE note?
Section 2(f) says the inventory "should contain all material metadata, to include as a minimum model name, purpose, risk rating." Section 9(c) says it should include models "developed or hosted by third parties." Model version and last test date are useful additions, but they are my suggestion, not the note's text.
How often does the note say AI should be tested?
For bias, section 3(c) says "once a year or each time a model is upgraded, materially changed or a new one is introduced." Section 6(c) says automatic updates should be "tested before implementation." Section 6(b) says independent parties should be engaged "periodically," without a fixed interval.
Does the note require a kill switch?
It uses different words. Section 6(f) says LFIs "should at all times retain the clear and immediate ability, with human intervention, to cease use of an AI model system, technology or application deployed or utilized." A tested kill switch with a recorded time to disable is how I'd evidence it.
Sources
- Central Bank of the UAE. Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E. Issued 11 Feb 2026. Rulebook page: https://rulebook.centralbank.ae/en/rulebook/guidance-note-consumer-protection-and-responsible-adoption-and-use-artificial-intelligence
- Same note, PDF: https://rulebook.centralbank.ae/sites/default/files/en_net_file_store/CBUAE_EN_6958_VER1.pdf
- OWASP Gen AI Security Project. Top 10 for LLM Applications (2025). https://genai.owasp.org/llm-top-10/
- Dedeoglu, E. llm-redteam-banking-checklist v0.1.0. GitHub: https://github.com/ErcinDedeoglu/llm-redteam-banking-checklist. Zenodo: https://doi.org/10.5281/zenodo.23536860
- Dedeoglu, E. LLM Red Teaming for Banking: A UAE Go-Live Checklist. Hugging Face, 18 Oct 2026. https://huggingface.co/blog/Ercin/llm-red-teaming-banking-uae