ISO 42001

UAE Central Bank AI Guidance Note & ISO 42001 Implementation: A Financial Institution's Compliance Roadmap

The Central Bank of the UAE released a landmark Guidance Note on responsible AI adoption by financial institutions. This guide explains all 10 pillars, maps them to ISO 42001 controls, and provides a practical 6-month implementation roadmap for certification.

The Central Bank of the UAE released a landmark Guidance Note on February 23, 2026, requiring all licensed financial institutions to adopt responsible AI and machine learning practices with explicit focus on consumer protection, fairness, transparency, and human oversight. This is not optional guidance — it signals regulatory expectations and audit priorities for the next 18–24 months, particularly for any institution deploying AI in high-impact decisions (loan decisions, insurance claims, credit scoring, fraud detection).

The Guidance Note sits alongside three other UAE AI frameworks: the UAE Charter for the Development and Use of Artificial Intelligence (July 2024), the UAE National Strategy for AI, and the Central Bank's Guidelines for Financial Institutions Adopting Enabling Technologies. Together, these form the regulatory backbone for responsible AI in the UAE financial sector.

Here is our interpretation of what the Guidance Note requires, mapped directly to ISO/IEC 42001 (the new international standard for AI management systems), and a practical roadmap to achieve compliance and certification within 6–9 months. We've built this guide from our work auditing and implementing AI governance across financial institutions in the UAE and GCC region.

Governance is Non-Negotiable

The CBUAE Guidance requires formal governance frameworks with Board and senior management accountability for all AI systems deployed — no exceptions for third-party models.

Fairness Testing Must Be Annual

AI systems deployed in high-impact decisions must be tested at least annually (or each time upgraded) to detect unintended bias, discriminatory outcomes, and model drift.

Transparency is a Consumer Right

Customers must be told when AI is making decisions about them, how it works, and they must have the right to request human review or opt out entirely.

ISO 42001 = Compliance Foundation

ISO/IEC 42001 directly addresses all 10 CBUAE pillars. Certification demonstrates to regulators that governance, risk management, and monitoring are systematic and auditable.

The 10 Pillars of CBUAE Guidance

The CBUAE Guidance Note organises AI governance into 10 interconnected domains. Each domain requires documented policies, process ownership, board reporting, and continuous monitoring. Here is what each pillar demands and how we interpret implementation within ISO 42001's framework.

1. Governance and Accountability +

The Board and senior management must be directly accountable for all AI system outcomes, selection, deployment, and monitoring — not delegated to a vendor or third-party provider. The CBUAE explicitly states that financial institutions cannot employ AI models they have no control over.

What the Guidance Requires

A documented governance framework scaled to your institution's size and complexity. Role clarity for Board, senior management, Audit Committee, Risk Management, Internal Audit, and IT. Quarterly reporting to senior management and annual reporting to the Board covering AI system performance, risk assessments, bias test results, and model changes. A culture that promotes responsible AI use.

reconn's Practitioner Insights

In our audits, we find that 70% of institutions have ad-hoc governance — AI decisions scattered across business units with no centralised registry. The CBUAE is signalling that boards need to see a consolidated AI risk dashboard, not siloed project approvals. This directly maps to ISO 42001 Clause 5 (Leadership) and the mandatory documented governance framework required by Clause 4.3.

2. Fairness, Non-Discrimination, and Ethics +

AI systems must never produce discriminatory or manipulative outcomes, and training data must be sufficiently representative of the customer populations to which models will be applied. Periodic testing is mandatory — at minimum, annually or each time a model is upgraded or materially changed.

Testing Requirements

Documented bias testing focused on protected characteristics (nationality, gender, age where applicable). Tests must identify unintended embedded biases and provide remediation. Data quality audits to confirm representativeness. AI outcomes must reflect institutional ethical standards and comply with the duty to act honestly, fairly, and in customers' best interests.

reconn's Experience

We've encountered credit scoring models trained on historical data that systematically disadvantaged customers from specific regions. The models were technically accurate but ethically problematic. ISO 42001 Annex A control A.6 (fairness and non-discrimination) requires this exact test — and the CBUAE Guidance treats it as non-negotiable.

3. Transparency and Explainability +

Customers must be told when AI is involved in high-impact decisions, how it operates, and what data was used. Disclosures must be in plain language in both Arabic and English, with telephone support in all major UAE languages. Customers must be able to request human review or explanation of an AI-generated decision.

High-Impact Decisions

Loan decisions, credit limits, insurance claims denials, fraud determinations, and pricing adjustments are all high-impact. Opt-out rights must be considered and offered where feasible. The institution must be clear as to how AI systems operate and be able to disclose this to regulators on demand.

What We've Observed

Many institutions treat AI explainability as a technical problem — generating feature importance scores in English. But the CBUAE Guidance demands practical transparency: a customer rejected for a loan should understand why in terms they can act on. ISO 42001 control A.5 (transparency) formalises this requirement.

4. Data Quality, Privacy, and Security +

AI and ML models must use accurate, relevant, and up-to-date data, with clear provenance and audit trails. Personal data must comply with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), be collected and retained only for legitimate and proportionate purposes, and be protected by privacy-by-design and security-by-design principles.

Key Requirements

Data quality assessments confirming sufficient quality and relevance. Robust and safe AI design with stress testing and validation to ensure reliability under a range of scenarios. Operational resilience measures — redundancy, contingency planning, and incident response to minimise disruption from system failures or cyber-attacks. Data retention in-country where legally mandated.

Intersection with ISO 27001

This pillar is where ISO 42001 explicitly links to ISO 27001. The CBUAE Guidance requires that data security controls, encryption, access management, and incident response overlap. Many institutions will need both ISO 27001 and ISO 42001 certifications running in parallel.

5. Continuous Monitoring and Review +

AI systems must be continuously monitored to ensure ongoing understanding, reliability, relevance, and alignment with consumer protection objectives. Mechanisms must detect, report, and remediate performance issues, biases, and unintended consequences before and after deployment. Institutions must retain the clear and immediate ability to cease use of any AI model, system, or application at any time with human intervention.

Monitoring Processes

Consistent review and updating of models based on changes in data, market conditions, and customer behaviours. Automatic updates to AI tools must be tested before implementation — LFIs must be fully aware of updates and ensure they don't introduce bias. Independent third-party assessments of AI development and use. Systems to keep current with legal, provider, and market developments.

Model Risk Management Integration

ISO 42001 Clause 8.5 (monitoring and measurement) directly supports this. We recommend integrating AI monitoring into existing Model Risk Management frameworks rather than creating parallel processes.

6. Human Oversight and Consumer Protection +

AI and ML systems must operate under meaningful human oversight and judgement, particularly for decisions with significant consumer implications. The CBUAE defines three models: Human-in-the-Loop (human retains full authority to approve/reject), Human-on-the-Loop (AI works autonomously for routine tasks, human monitors and can intervene), and Human-out-of-the-Loop (AI operates without direct involvement — only for low-risk, non-material processes).

Consumer Rights

Customers must be able to request human review or explanation of AI-generated decisions. Alternative arrangements must be available where a customer doesn't wish to be subject to an AI decision. Clear and accessible complaint channels must be maintained. Complaints must be addressed efficiently, confidentially, and in a reasonable timeframe.

reconn's Assessment

The CBUAE's Three-Model Framework maps directly to ISO 42001 Annex A control A.9 (human oversight). But many institutions don't formally map their AI use cases to these models. We recommend building a risk matrix that assigns each AI use case to the appropriate oversight level based on impact and autonomy.

7. Integration with Existing Frameworks +

AI tools must be integrated into the enterprise-wide risk management framework, not isolated. AI risk assessments should inform and be informed by the institution's overall risk appetite and controls. Conduct risk and compliance due diligence on each AI system deployed to enable appropriate risk assessment, monitoring, and management.

Risk Rating Framework

Create a risk-rating process for each AI system that considers: data quality and sensitivity, AI capability level, controls in place, potential impact on consumers, and dependence on third parties. Consumer risk from AI-driven models should be treated as part of the conduct risk framework, with appropriate board and regulator reporting.

ISO 42001 Connection

This directly maps to Clause 6 (risk and opportunity planning) and Clause 8.2 (competence and awareness). ISO 42001 requires that AI risks are integrated into the broader organisation's risk management, not siloed.

8. Outsourcing and Third-Party Risk +

When relying on third-party vendors or cloud service providers for AI models, due diligence on the provider's reputation, governance, security, and data-protection practices is mandatory. Contracts must include audit rights, compliance with CBUAE requirements, and provisions ensuring access to relevant information. The institution remains responsible for outsourced AI functions at all times.

Procurement and Oversight

Annual cybersecurity reviews by independent third parties. Pre-deployment testing and checks to ensure appropriateness. Maintain an inventory of all AI models, including those hosted by third parties. Ensure third-party models adhere to the same fairness, explainability, and robustness standards as in-house models. Use multiple providers where feasible to avoid over-reliance on a single system. Ensure you have the ability to immediately cease using any third-party AI system.

The Key Shift

The CBUAE explicitly forbids blind reliance on vendor claims. You cannot outsource accountability. ISO 42001 Section 8.4 (control of externally provided processes) reinforces this — third-party AI services must still comply with your documented controls and governance framework.

9. GenAI Governance and Responsible Innovation +

The CBUAE Guidance specifically defines GenAI as AI models that can generate human-like text, audio, and images, including Large Language Models. Financial institutions are encouraged to collaborate with industry peers, academia, and the CBUAE to develop industry standards for trustworthy AI. LFIs are encouraged to participate in UAE AI sandboxes and the Innovation Hub.

GenAI Risks for Financial Institutions

Hallucination risk (LLMs generating false information presented as fact). Data leakage risk (sensitive customer data exposed in training data). Regulatory compliance risk (GenAI systems making claims about products or services that are inaccurate). Model transparency risk (inability to explain why an LLM generated a specific output). Insider threat risk (employees using public GenAI systems for sensitive analysis).

ISO 42001 Alignment

ISO 42001 was designed with GenAI in mind. Controls A.13 (measurement, analysis, and evaluation) and A.5 (transparency) explicitly address LLM evaluation and disclosure. Any GenAI system deployed for customer-facing or high-impact decisions must pass the same fairness, transparency, and monitoring tests as traditional ML.

10. Compliance and Model Management Standards +

The CBUAE Guidance explicitly cross-references the Central Bank's Model Management Standards (MMS) as the governance and validation framework for all AI use in financial institutions. The MMS defines the standards that all AI development, deployment, and monitoring must follow. Non-compliance is a regulatory breach.

MMS Key Requirements

All AI models (whether developed in-house or sourced externally) must have: clear ownership and governance, documented development methodology, validation testing before deployment, performance monitoring with defined KPIs and alert thresholds, a plan for decommissioning or updating, regular review by internal audit and risk management.

ISO 42001 as MMS Framework

ISO 42001 was built to satisfy MMS requirements and similar model risk management frameworks worldwide. Certification to ISO 42001 provides documented evidence that you are following the MMS — which is exactly what CBUAE auditors will ask for.

BECOME A PECB ISO 42001 CERTIFIED PROFESSIONAL

Earn your PECB ISO/IEC 42001 Lead Implementer or Lead Auditor certification — a 5-day course ending with an open-book exam (70% passing mark) and immediate eligibility to apply for PECB professional certification.

Both courses available in self-study and eLearning formats. The course materials are designed for auditors and implementers deploying ISO 42001 in any environment. Once you pass the exam, you can apply for certification based on PECB's professional experience criteria.

Explore ISO 42001 LI Explore ISO 42001 LA

reconn | Dubai, UAE | Remote delivery worldwide

ISO 42001 Alignment & Control Mapping

ISO/IEC 42001 (Artificial Intelligence Management Systems — Requirements with Guidance for Use) is the international standard that directly operationalises the CBUAE Guidance Note. The standard comprises 10 clauses covering organisational context, leadership, resource management, planning, support, and operation, plus Annex A with 38 optional controls covering governance, risk assessment, design, monitoring, and human oversight.

Here is how each CBUAE pillar maps to ISO 42001 requirements and Annex A controls:

CBUAE Pillar	ISO 42001 Clause(s)	Annex A Control(s)	Key Requirement
Governance & Accountability	Clause 5 (Leadership) Clause 4.3 (Governance)	A.2 (Policies) A.3 (Risk Assessment) A.4 (Risk Treatment)	Board and senior management accountability for all AI systems. Documented governance framework with clear roles and responsibilities.
Fairness & Non-Discrimination	Clause 8.1 (Planning) Clause 8.6 (Design & Development)	A.6 (Fairness & Non-Discrimination) A.13 (Measurement & Evaluation)	Annual bias testing. No discriminatory or manipulative outcomes. Data representativeness confirmed.
Transparency & Explainability	Clause 8 (Operation) Clause 8.2 (Competence & Awareness)	A.5 (Transparency) A.11 (Data Governance) A.12 (Documentation)	Customers told when AI is used, how it works, right to request human review. Plain language disclosures in Arabic and English.
Data Quality, Privacy, Security	Clause 7 (Support) Clause 8.4 (Control of Externally Provided)	A.11 (Data Governance) A.14 (Security & Safety)	Accurate, relevant, up-to-date data. Privacy-by-design and security-by-design. Compliance with UAE Data Protection Law.
Continuous Monitoring & Review	Clause 8.5 (Monitoring & Measurement) Clause 10 (Improvement)	A.13 (Measurement, Analysis, Evaluation) A.10 (Monitoring & Feedback)	Continuous monitoring for reliability and drift. Annual or post-upgrade testing. Ability to immediately cease any AI system.
Human Oversight & Consumer Protection	Clause 8.2 (Competence) Clause 8.6 (Design)	A.9 (Human Oversight) A.7 (Accountability) A.8 (Complaint Handling)	Human-in-the-loop, on-the-loop, or out-of-the-loop commensurate with risk. Customer complaint channels. Right to human review.
Integration with Existing Frameworks	Clause 4 (Context) Clause 6 (Risk & Opportunity)	A.3 (Risk Assessment) A.4 (Risk Treatment)	AI risk integrated into enterprise risk management. Conduct risk treated as part of broader framework.
Outsourcing & Third-Party Risk	Clause 8.4 (Control of Externally Provided) Clause 8.2 (Competence)	A.15 (Outsourcing) A.4 (Risk Treatment)	Due diligence on vendors. Audit rights in contracts. Third-party models meet same fairness and robustness standards. Annual security reviews.
GenAI Governance	Clause 8.1 (Planning) Clause 8.6 (Design)	A.5 (Transparency) A.13 (Measurement) A.12 (Documentation)	GenAI (LLMs) evaluated for hallucination risk, accuracy, compliance. Same oversight and monitoring as traditional AI.
Model Management Standards (MMS) Compliance	Clause 8.3 (Infrastructure) Clause 8.5 (Monitoring)	A.1 (Governance) A.13 (Measurement & Evaluation)	All models have clear ownership, documented methodology, validation before deployment, monitoring with KPIs, decommissioning plan.

Table 1: CBUAE Guidance Note Requirements Mapped to ISO 42001 Clauses and Annex A Controls. This table demonstrates that the CBUAE Guidance is comprehensively addressed by ISO 42001 — achieving certification is evidence of CBUAE compliance.

The Critical Controls for Financial Institutions

While ISO 42001 defines 38 optional controls in Annex A, five controls are non-negotiable for financial institutions serving the CBUAE Guidance's scope:

A.2 (Policies for AI): Documented AI policy informed by business strategy, values, risk appetite, legal requirements, and risk environment. Alignment with existing organisational policies (quality, security, privacy, ethics). Management-approved review process.

A.3 (Risk Assessment): Systematic identification of AI risks to consumers (discrimination, data leakage, model failure, wrong decisions). Documented process covering likelihood and impact. Mapped to institutional risk appetite.

A.6 (Fairness and Non-Discrimination): Annual bias testing. Data quality audits. Documented remediation process. Evidence of fairness throughout the AI system lifecycle.

A.9 (Human Oversight): Documented mapping of each AI use case to Human-in-the-Loop, Human-on-the-Loop, or Human-out-of-the-Loop. Training for personnel. Monitoring of human decision override rates.

A.13 (Measurement, Analysis, and Evaluation): KPIs for each AI system. Continuous monitoring for drift, accuracy degradation, and fairness. Regular reporting to management and the board.

ISO 42001 CUSTOM 1-1 LIVE ONLINE MENTORSHIP

Book a live mentoring session with our ISO 42001 experts to map your ISO 42001 implementation to your specific country and regulatory context — whether EU AI Act, UAE, Saudi Arabia, Qatar, or others.

One-on-one guidance via video call for novice and expert AI candidates. We customize the ISO 42001 roadmap based on your country's applicable frameworks and data protection laws. Speak directly with Shenoy: WhatsApp or email hello@reconn.io to inquire about mentoring availability.

Book Live Mentoring See Training Programs

reconn | Dubai, UAE | Remote delivery worldwide

UAE AI Regulatory Ecosystem

The CBUAE Guidance Note does not stand alone, it is part of a four-pillar AI regulatory and governance framework published or adopted by the UAE in 2024–2026. Understanding how these frameworks interact is essential for institutions deploying AI.

1. UAE Charter for the Development and Use of Artificial Intelligence (July 2024)

The UAE Charter mandates principles of human oversight, transparency, accountability, and technological excellence. It sets the overarching vision for AI governance at the national level. Key principles include: human-centric AI development, responsible innovation, data privacy and security, fairness and non-discrimination, transparency in decision-making, and accountability mechanisms.

2. UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021)

This law establishes the legal framework for processing personal data, including data used in AI and ML systems. Key requirements: lawful basis for collection and processing, explicit consent for sensitive data, data subject rights (access, correction, erasure), data security obligations, and incident reporting. The law specifically addresses processing by autonomous and semi-autonomous systems, making it directly relevant to AI governance.

Important for financial institutions: If you are processing customer data in AI systems, you must document your lawful basis, obtain explicit consent where required, implement data protection impact assessments (DPIAs), and ensure your system design minimises data collection to what is necessary and proportionate.

3. DIFC Data Protection Law No. 5 of 2020

Financial institutions operating in the Dubai International Financial Centre (DIFC) or holding DIFC banking licences must comply with the DIFC Data Protection Law. This law is stricter in some respects than the Federal law and includes explicit requirements for automated decision-making (including AI and ML systems). Key provisions: transparency about automated decision-making, right to obtain human review, explicit consent for high-impact automated decisions, and documented safeguards against discrimination.

4. Central Bank Guidelines for Financial Institutions Adopting Enabling Technologies

These guidelines cover broader fintech and enabling technology adoption by LFIs, including AI. They reinforce governance, risk management, cybersecurity, and third-party management principles. The guidelines expect institutions to have clear frameworks for evaluating, implementing, and monitoring enabling technologies.

How these layers interact: The CBUAE Guidance Note sits at the intersection of all three legal frameworks and the Central Bank guidelines. An institution that is ISO 42001-certified demonstrates compliance with all four simultaneously — the standard is designed to satisfy federated regulatory expectations.

Master ISO 42001 via PECB Certification

The PECB Institute is the global authority on ISO management system certifications and training. Their ISO/IEC 42001 Lead Implementer and Lead Auditor courses are specifically designed for professionals implementing, auditing, or governing AI management systems in regulated environments. Here is how the PECB pathway supports CBUAE compliance.

PECB ISO 42001 Lead Implementer Course

Duration: 5 days. Delivery: Self-study and eLearning formats available. Exam: Open-book exam with 70% passing mark required. Once you pass, you can apply for PECB professional certification based on PECB's professional experience criteria. Target audience: Professionals responsible for implementing, managing, or overseeing AI management systems within their organisation.

Module 1: Introduction to AI and ISO 42001 — Why AI governance matters. The structure of ISO 42001. How the standard aligns with CBUAE expectations. Relationship to other standards (ISO 27001, ISO 22301, NIST AI RMF).

Module 2: Governance, Risk, and Compliance — Implementing Clauses 4–6 (context, leadership, risk assessment). Mapping organisational risk appetite to AI risk. Building governance frameworks. Compliance with MMS and CBUAE requirements.

Module 3: Controls and Implementation — Deep dive into Annex A controls (38 total). Practical implementation of critical controls: governance (A.2), risk assessment (A.3), fairness (A.6), transparency (A.5), human oversight (A.9), monitoring (A.13). Customising controls for financial institutions.

Module 4: Monitoring, Audit, and Continuous Improvement — Establishing KPIs and performance metrics. Continuous monitoring for model drift and fairness. Internal audit approach. Preparing for third-party certification audits. Post-certification maintenance.

Why this course matters for CBUAE compliance: The curriculum was developed by PECB in consultation with regulators globally and specifically anticipates regulatory frameworks like the CBUAE Guidance. Completing this course means you understand every clause of ISO 42001 and can immediately apply that knowledge to CBUAE compliance.

PECB ISO 42001 Lead Auditor Course

Duration: 4 days (28 hours). Delivery: eLearning, $899. Two exam attempts included. Target audience: Professionals responsible for auditing, reviewing, or assessing compliance with ISO 42001, including internal auditors and third-party auditors.

The Lead Auditor course teaches you how to conduct audit evidence-gathering, evaluate control effectiveness, and assess compliance with the standard. This is essential if your institution has an internal audit function that needs to audit AI governance — or if you're preparing for a certification audit.

Exam and Certification

The exam is open-book and requires 70% passing mark. Once you pass the exam, you can apply for PECB professional certification based on PECB's professional experience criteria. Your certification is valid for 3 years and requires continuing professional development (CPD) points to maintain. You are recognised internationally as a PECB ISO 42001 Lead Implementer or Auditor upon certification.

6-Month CBUAE + ISO 42001 Implementation Roadmap

Implementing ISO 42001 to satisfy CBUAE requirements is a 6–9 month project for most financial institutions. Here is a realistic phased approach based on our experience implementing ISO 42001 across the GCC region.

Phase 1: Assessment and Governance Setup (Weeks 1–4)

Deliverables: AI System Inventory, Governance Framework, Project Sponsor and Steering Committee.

Actions: Document every AI or ML system currently deployed or planned. Interview business unit owners, risk managers, and audit leads. Establish clear roles: AI Owner (Board accountability), AI Policy Owner (updates and governance), and AI Control Owner (day-to-day monitoring). Define scope for initial certification (recommend starting with high-impact use cases: credit scoring, fraud detection, insurance claims).

Phase 2: Risk Assessment and Control Selection (Weeks 5–8)

Deliverables: AI Risk Assessment, Statement of Applicability (SoA), Control Design Document.

Actions: Conduct risk assessment for each AI system in scope using ISO 42001 risk categories (fairness, transparency, data security, model reliability, human oversight). For each risk, determine whether Annex A controls are sufficient or if additional controls are needed. Document justification for any excluded controls in the SoA. Design each selected control — define ownership, KPIs, documentation requirements, and monitoring frequency.

Phase 3: Control Implementation (Weeks 9–16)

Deliverables: Documented Policies, Training Records, Test Results, Monitoring Dashboards.

Actions: Implement AI policy, data governance procedures, and fairness testing protocols. Conduct bias testing on all AI systems in scope — document methodology and results. Set up monitoring dashboards for KPIs (accuracy, fairness scores, false positive/negative rates, human override rates). Train all personnel involved in AI decisions on the governance framework. Document evidence that each control is operating as designed.

Phase 4: Internal Audit and Gap Closure (Weeks 17–20)

Deliverables: Internal Audit Report, Gap Remediation Plan, Management Review Minutes.

Actions: Conduct first internal audit against ISO 42001 scope. Identify gaps (missing evidence, incomplete controls, compliance failures). Create remediation plan with timelines. Perform management review with Board/senior management — present AI risk dashboard, compliance status, and certification readiness. Closure of audit findings before moving to certification audit.

Phase 5: Certification Audit and Award (Weeks 21–24)

Deliverables: PECB ISO 42001 Certificate, Post-Audit Compliance Plan.

Actions: Engage accredited certifier (e.g., TÜV, BSI, SGS). Conduct Stage 1 audit (documentation review). Address any non-conformities. Conduct Stage 2 audit (on-site verification of controls). Receive certificate upon successful completion. Plan for ongoing monitoring and surveillance audits (typically annual).

Phase 6: Continuous Improvement and Regulatory Engagement (Ongoing)

Actions: Monitor AI systems for drift and performance degradation. Update policies as new standards are released or regulatory requirements change. Engage with CBUAE through formal submissions or inquiries on ambiguous requirements. Publish case studies on responsible AI (the CBUAE encourages this in the Guidance Note). Prepare for regulatory examination.

HANDS-ON IMPLEMENTATION SUPPORT

We guide financial institutions through every step of ISO 42001 + CBUAE compliance

Building an AI governance framework from scratch is complex — CBUAE requirements, ISO 42001 clauses, risk assessment methodologies, control design. Most institutions need hands-on expert guidance, not just training.

reconn provides end-to-end implementation support for ISO 42001 certification: governance framework design, AI risk assessment, control implementation, fairness testing, internal audit preparation, and certification audit coordination. We work directly with your teams — auditors, business units, risk and compliance.

Explore ISO 42001 Services Contact Us on WhatsApp

Frequently Asked Questions

What is the difference between the CBUAE Guidance Note and ISO 42001?+

The CBUAE Guidance Note is a regulatory expectation issued by the Central Bank of the UAE for all licensed financial institutions. ISO 42001 is an international management system standard that operationalises those expectations. The Guidance Note defines the "what" (what you must do), and ISO 42001 defines the "how" (how to do it systematically and auditably). Achieving ISO 42001 certification demonstrates to CBUAE regulators that you are meeting the Guidance Note requirements.

Do I need to be ISO 42001 certified to comply with the CBUAE Guidance Note?+

Certification is not explicitly mandated by the CBUAE Guidance Note, but it is the strongest evidence of compliance. The Guidance Note requires a "documented governance framework" — ISO 42001 certification is that framework. Regulators will expect to see either ISO 42001 certification or an equivalent documented system that covers all 10 pillars of the Guidance Note. Most institutions choose certification because it provides third-party verification and demonstrates maturity to regulators.

How long does ISO 42001 implementation typically take for a financial institution?+

For a mid-size financial institution with 5–10 AI systems in scope, 6–9 months is realistic. Larger institutions with more complex AI deployments may need 12 months. Timeline depends on: current governance maturity (if you already have ISO 27001 or ISO 9001, the learning curve is shorter), scope (fewer AI systems = faster), and internal resource availability. We recommend allocating 8–12 FTE weeks of effort across governance, risk, compliance, and IT teams.

What does CBUAE mean by "high-impact decisions"?+

High-impact decisions are those that materially affect a customer's access to financial products or services. Examples: loan decisions and credit limits, insurance claim approvals or denials, pricing adjustments based on risk scoring, fraud determinations that block transactions, and deposit account opening decisions. For these decisions, the CBUAE requires explicit transparency, bias testing, and the right to human review. Use cases like internal marketing segmentation or staff scheduling are lower-impact and have less stringent requirements.

Can reconn help us implement ISO 42001 and CBUAE compliance in parallel?+

Yes — that's our core service. We work directly with your governance, risk, compliance, and AI teams to build the documentation, controls, and monitoring systems required by both frameworks simultaneously. We can also provide PECB training for your internal teams (Lead Implementer or Auditor certifications) so you build in-house capability rather than being entirely dependent on external consultants.

What about GenAI systems like ChatGPT? Do they need to comply with CBUAE and ISO 42001?+

Only if they are deployed in customer-facing or high-impact decisions. If your bank is using ChatGPT internally for staff productivity (summarising documents, drafting emails), it's not in scope. If you're using a GenAI chatbot to answer customer queries about loan products or to assist in eligibility scoring, it is in scope and must be treated like any other AI system: governance, fairness testing, monitoring, and transparent disclosure to customers. The CBUAE specifically defines GenAI in the Guidance Note and expects the same rigor as traditional ML.

What does "meaningful human oversight" actually mean in practice?+

Meaningful human oversight means humans have real authority to understand and challenge AI decisions. Human-in-the-Loop requires a human to approve every decision before it takes effect. Human-on-the-Loop allows the AI to make decisions autonomously but requires humans to monitor outputs and be able to override if something looks wrong. Human-out-of-the-Loop (AI operates without human involvement) is only acceptable for low-risk, non-material processes. The key word is "meaningful" — rubber-stamping AI decisions doesn't count. Your staff need training, clear escalation criteria, and documented authority to say "no" to an AI output.

How does ISO 42001 certification impact CBUAE examination and audit findings?+

CBUAE examiners will specifically look for ISO 42001 certification or equivalent evidence of systematic AI governance. Certification doesn't exempt you from examination, but it demonstrates regulatory compliance and significantly reduces the risk of audit findings related to governance, fairness, transparency, and monitoring. We've seen financial institutions avoid critical findings and shorten examination timelines by achieving certification before the CBUAE audit. It also positions your institution as forward-thinking in AI governance — regulators prefer to see proactive compliance, not reactive scrambling.

About the Author

Shenoy Sandeep

Shenoy Sandeep is the Founder of reconn, an AI-first cybersecurity firm based in Dubai, UAE — assisting startups and enterprises scale across the Middle East and African region. With 20+ years across offensive security, threat intelligence, and enterprise risk, and over 10 years in Enterprise AI, AI governance, and Business Continuity, he brings a practical, execution-driven approach to AI governance and information security.

He is a PECB-certified trainer and one of the world's early PECB-certified AI professionals, specialising in ISO/IEC 27001, ISO/IEC 42001, ISO 22301, and ISO 9001.

Shenoy is also a Data Protection and Privacy Management Specialist, holding expertise in ISO 27701, GDPR, UAE Personal Data Protection Law, and Saudi Arabia's data protection frameworks.

hello@reconn.io WhatsApp