Outsourcing AI at a UAE bank: what the CBUAE regulation requires in the contract

The Central Bank of the UAE issued the Outsourcing Regulation for Banks as circular C 14/2021, in force since 15 July 2021, together with Outsourcing Standards that expand on it and that the Central Bank says it will enforce [1, 2]. The Arabic Rulebook lists it as نظام التعهيد للبنوك [3]. It applies to every bank operating in the UAE, on a solo and a group-wide basis, and agreements signed before it took effect had to comply by 31 December 2023 [1]. No AI contract a bank holds today sits outside it on age.

Outsourcing is defined as an agreement with another party, inside or outside the UAE and including a related party, “to perform on a continuing basis an activity which currently is, or could be, undertaken by the Bank itself” [1]. The words that matter for AI are “could be”. A vendor that extracts data from trade finance documents, screens names, answers customers in the app or drafts credit memos is doing work the bank could do with its own staff or its own systems. That is outsourcing, whether the vendor sells it as software, a platform or an API.

The harder case is a model called from the bank’s own application. A hosted model that processes the bank’s requests every day is, on my reading, performing an activity on a continuing basis that the bank could run itself, so I would treat it as outsourcing and put it on the register. The register has to hold non-material arrangements as well as material ones [1], so caution costs one row, while a missing row costs an audit finding. That is a reading of the text, and the Central Bank’s Regulatory Development Division is the reference for interpreting it [1].

Materiality decides how much follows. The bank’s Board-approved policy sets how it is assessed, and the Standards list what the assessment must consider, including the effect on the bank’s ability to manage its risks and meet its legal duties, and the nature of the data shared [1, 2]. An AI service that sees customer data or sits inside a credit, fraud or complaints process will usually come out material.

Before a bank outsources any material activity, it must obtain a prior notice of non-objection from the Central Bank, and the arrangement needs approval by the Board or a Board committee [1]. The Standards set the minimum the request carries: a brief explanation of the activity, summaries of the materiality assessment, the risk assessment and the due diligence, confirmation that internal audit and compliance agree, an overview of closely related outsourcing agreements, confirmation of compliance with the Regulation, and evidence of the Board’s approval [2]. The Central Bank either grants it or asks for more, and it encourages banks to raise material plans early so the process does not hold them up [2].

For an AI programme this is a timing problem more than a legal one. A pilot that runs on real customer data with an outside vendor is already an arrangement. I would put the non-objection on the project plan at the same moment as the vendor shortlist, because the due diligence summary it asks for is work the bank has to do anyway.

Article 8 also says what the Central Bank will not generally allow: outsourcing core banking activities and key management and control functions, including Senior Management oversight, risk management, compliance, internal audit, and the management of risk-taking functions such as credit, investment and treasury management [1]. That line shapes AI design. A vendor’s model can score, summarise and recommend for a credit officer. A vendor that makes the credit decision is performing a function the Central Bank does not generally let a bank hand over. I would build every AI system in those functions so that the decision, and the named person accountable for it, stay inside the bank, and the vendor supplies a tool rather than the function.

Article 5 of the Regulation and section 5 of the Standards set the contract’s content, and the CBUAE’s AI guidance note adds what it expects of contracts with AI providers [1, 2, 4]. The table reads each clause for an AI service: what the text requires, and what it means once the vendor runs a model. The deliverables themselves, evaluation included, belong in the statement of work under the agreement, and the guide to what an AI statement of work should name covers that layer.

Middle column: the Rulebook text, summarised [1, 2, 4]. Third column: my reading for an AI service, not legal advice; the drafting belongs with the bank’s counsel.

A bank buying an AI product rarely buys from one supplier. The product vendor calls a model provider, which runs on a cloud, which may use subprocessors of its own. Each of those that touches Confidential Data must meet the Regulation’s requirements, and none of them may be given access to Confidential Data without the bank’s specific authorisation [1]. Due diligence therefore has to cover the whole chain, and the vendor has to be able to show it link by link.

The Standards name a risk that AI makes very real. Concentration risk includes “reliance by different outsourcing providers on the same subcontractor” [2]. A bank with separate vendors for its chatbot, its document extraction and its complaints triage may find all three calling the same model provider in the same region. On the register that looks like three suppliers. In an outage, or when a provider withdraws a model, it behaves like one. The AI guidance note makes the same point from the other side when it asks institutions to consider a range of AI providers where feasible [4].

The register can show this if it is built to. The Regulation asks for the provider’s details, the dates, a description of the service, whether Confidential Data is involved and whether the arrangement is material, and the Standards ask that it show what type of data is shared and distinguish levels of risk [1, 2]. I would add the model provider and its region to every AI row, so the concentration shows up in a query rather than in an incident review.

Where the vendor’s model feeds a modelling decision the bank relies on, the Model Management Standards add their own rule: the bank must remain the owner of its models at all times, must fully understand what a third party contributes, and must transfer knowledge from that third party to its own staff within a given time frame [5]. How the AI guidance note carries those standards into day-to-day AI governance is set out in what the CBUAE’s AI guidance note expects of banks.

Article 6 is the rule most AI architectures run into. The Master System of Record, defined as all the data, including Confidential Data, a bank needs to conduct its core activities, manage its risks and comply with the law, must be continuously maintained and stored within the UAE [1]. A branch of a foreign bank may, with Central Bank approval, instead keep a copy in the UAE updated at least daily [1].

Confidential Data is data about a customer who is or can be identified, from that data alone or together with other information the recipient holds or is likely to get [1]. It must not be shared outside the UAE without Central Bank approval and the customer’s prior written consent, and the customer must also acknowledge in writing that the data may be accessed under legal proceedings abroad [1]. A bank may not outsource to a provider in a jurisdiction that cannot safeguard Confidential Data to the standard that would apply in the UAE, a test that covers every jurisdiction relevant to the agreement, and it may not store data where bank secrecy or other laws would restrict the Central Bank’s access [1].

Read with an AI system in mind, a prompt carrying a customer’s name, account details or a scanned document is Confidential Data, and sending it to a model hosted outside the UAE shares it outside the UAE. That leaves three workable designs: run the model in a UAE region, remove anything that identifies the customer before a request leaves the country, or collect the approval and consents Article 6.3 asks for, which does not scale to a customer-facing service. The identification test is broad, so redaction of free text has to be tested rather than assumed. Whether a UAE cloud region actually runs the model you want is a separate question, and the guide to which Gulf cloud regions actually run AI models works through it.

Articles 6.7 and 6.8 add that a bank must consider how changes in economic, political, social, legal or regulatory conditions could affect a provider abroad, and the operational, legal and reputational risks of using one [1]. AI vendors change their terms, models and regions often, so that assessment needs repeating each time they do.

Outsourced activities stay fully inside the bank’s internal audit and compliance scope [1]. The Standards add that internal audit must be able to obtain all the information it needs, and to demand that audits performed by third parties are extended in scope where necessary [2]. A vendor’s independent assurance report that stops short of the model pipeline is exactly the case for that right.

A breach travels in two steps. The vendor tells the bank without undue delay [1]. The bank must then notify the Central Bank immediately when it becomes aware of a material breach of an outsourcing agreement, or of another development in an outsourced Material Business Activity that has, or is likely to have, a significant impact on its operations, reputation or financial condition [1]. A vendor clause that allows days of internal investigation before any notice leaves the bank unable to meet its own duty.

Exit is the part of an AI contract I would check hardest. The Central Bank can require a bank to end an arrangement that is no longer compliant or presents undue risk [1], and the Standards treat vendor lock-in as a risk to manage, asking for arrangements that let an outsourced activity move to another provider or back in-house without undue delay, with contingency plans to do it [2]. For an AI service, the exit pack is the bank’s data, the prompts and configuration, the evaluation set and its results, and any model trained on the bank’s data where the contract gives the bank rights to it. If those cannot be moved, the exit plan is a hope.

A bank offering Islamic financial services carries one more duty: its outsourcing must stay consistent with Shari’ah rules and principles, and the Standards warn that providers may be unfamiliar with them [1, 2]. An assistant that explains Islamic finance products to customers sits squarely in that risk, and its test set should include the questions the bank’s Shari’ah function would ask.

The bank’s due diligence has a fixed shape. The Standards list the provider’s financial capacity, experience, governance and internal control, security including cyber security, staffing and country risk [2], and the AI guidance note adds the provider’s reputation in AI, its governance, security and data-protection practices, and an annual cybersecurity review by an independent, suitably qualified third party [4]. A vendor that brings the answers saves the bank asking for them one at a time.

This is architecture before it is paperwork. The clauses are only true if the system behind them keeps Confidential Data in the UAE, logs every model call, pins model versions and can hand everything back at exit. That is the work we sell as production AI systems when we build the service, and as AI governance implementation when the controls have to go into systems a bank already runs. For a vendor selling to UAE banks, the same work produces the pack above from the system itself. We work in financial services, with clients across the UK, the US and the Gulf, and UAE clients can contract locally through our UAE entity. We have built Arabic-language AI, including bilingual Arabic and English search and Arabic document OCR.

We are an outsourcing provider in this picture too, and the same terms apply to us. Our engineers work under identities the client issues, nothing we deliver depends on a system only we can reach, and a fixed-scope statement of work keeps our access as narrow as the scope. We do not resell model licences, so the bank chooses its model provider on the evidence and holds that contract itself. Our closest published work in the region is the production estate of a government-accredited EdTech in the Middle East, whose database we replatformed into Google Cloud’s Doha region, me-central1, to meet Gulf data-residency requirements. It is education rather than banking, and I mention it for the method. A fixed-scope build can start within a day of the scope being signed, and if you already have a scoped job, we can resource it on contract from the collective of associates who work with us, held to the same standard. Whether a contract satisfies the Central Bank stays with your compliance function and counsel. The call is booked from the end of this page.