What happens on September 16, 2026
The New CBUAE Law's one-year regularisation period expires on September 16, 2026. This is the date by which all in-scope entities must have completed their transition to compliance under the consolidated banking, insurance, and technology-enabler regime. Administrative fines reach up to AED 1 billion for non-compliant institutions.
This deadline sits alongside — not in place of — the CBUAE AI Guidance Note issued on February 11, 2026. The Guidance Note itself is technically non-binding but has been confirmed by legal analysis to form part of supervisory dialogue and regulatory assessments going forward. The practical effect: institutions that have not met the Guidance Note's AI governance expectations will surface those gaps in their September examination.
What the two frameworks require from the same evidence layer
The CBUAE Law's regularisation checklist and the Guidance Note's supervisory dialogue depend on the same underlying data. Which AI systems exist. What data they touch. Who authorised them. What the audit trail shows.
An institution that builds the evidence layer for one will largely have built it for the other. This is the most important operational insight for 2026 compliance planning: there is no efficiency in treating these as separate programmes.
Five actions to complete before August
First, complete your AI model inventory. Every AI system must be formally registered with ownership, risk tier, version history, and assessment status. This is the foundation — nothing else is possible without it.
Second, complete pre-deployment assessments for all High and Medium risk models. For models deployed before January 2026 without formal assessments, retrospective documentation is better than none. Produce the PDF artifacts and get sign-off now.
Third, verify your audit trail is searchable and tamper-evident. Test that you can produce all decisions about a specific customer in the last 90 days within two hours. If you cannot, that gap will surface in examination.
Fourth, run a supervisory dialogue dry-run in July or early August. Produce your AI governance evidence package against the Guidance Note expectations. The dry-run surfaces gaps before an actual supervisory engagement does.
Fifth, get the board engaged now. Boards that first see AI compliance materials in September examination prep are structurally behind. Quarterly board engagement on AI risk starting immediately is what supervisory examiners expect to see.
What the CBUAE Guidance Note specifically requires
The Guidance Note requires documented AI governance frameworks proportionate to firm size. Boards and senior management directly accountable for AI outcomes. A comprehensive inventory of every AI model aligned with the 2022 Model Management Standards. Annual bias testing — documented, auditable, defensible. Security-by-design and privacy-by-design embedded in every AI system. Immediate cessation capabilities for outsourced AI vendors.
None of these are aspirational expectations. They are the evidence set examiners will arrive expecting to see.