Model Risk Has a New Rulebook. Your Evidence Should Be Continuous.

The CBUAE's February 2026 AI and machine learning guidance is the most complete AI expectation set issued by a Gulf prudential supervisor. It applies across banks, finance companies, insurers, exchange houses and other licensed financial institutions, and it is explicit that responsibility sits with the board and senior management, not with the technology function and not with the vendor.

• Documented AI governance framework, proportionate to size and complexity
• AI risk integrated into enterprise-wide risk management rather than run beside it
• A comprehensive AI model inventory, aligned to the 2022 Model Management Standards and Guidance
• Annual bias testing on representative training data, with results retained
• Security- and privacy-by-design; stress testing, redundancy and incident response for AI systems
• Third-party arrangements with audit rights and the ability to cease use immediately
• Continuous monitoring and periodic review, with regular reporting to the board

Read against the 2022 MMS, which already required model identification, tiering, validation, ongoing monitoring and an annual model risk report, the practical effect is that AI systems must be brought inside a framework UAE banks have been running for four years, and monitored continuously. That is precisely what AxiSentinel is designed to produce.

An EU bank faces four instruments at once, and the EBA's November 2025 mapping letter confirmed they are meant to interlock rather than stack. That is only helpful to a bank that can evidence the mapping.

• AI Act Annex III 5(b), creditworthiness evaluation and credit scoring of natural persons is high-risk. Following the Digital Omnibus, in force 27 July 2026, Annex III obligations apply from 2 December 2027. Fraud detection is expressly carved out of the credit limb; anti-money-laundering use is not automatically high-risk but attracts the same governance in practice.
• Article 50 transparency, live since 2 August 2026. A customer interacting with a bank's chatbot must know it is an AI system, and synthetic content must be machine-readably marked.
• Article 4 AI literacy, in force since 2 February 2025 for every provider and deployer, including staff and contractors operating AI on the bank's behalf.
• DORA, ICT risk management, resilience testing, incident classification and reporting, and the register of information for ICT third-party arrangements. Where a model provider becomes a critical third-party provider, the CTPP oversight regime applies at EU level.
• CCD2, from 20 November 2026 in national law, Article 18(3) gives the consumer the right to human intervention, a meaningful explanation of the assessment and the automated processing used including the logic and risks involved, and the right to request a review of the decision. Article 22 SAFE lending and Article 35 forbearance duties sit alongside.
• GDPR Article 22, solely automated credit decisions with legal or similarly significant effect require a lawful basis, meaningful information about the logic, and a route to human review. The SCHUFA ruling put credit scoring squarely inside this.

The UK has no AI statute and does not need one. PRA SS1/23 sets five principles, model identification and inventory, governance, development and implementation, third-party validation, and model risk mitigants, and applies them to any model the bank relies on, including models it did not build. The FCA's Consumer Duty then tests whether the outcome was good, which no amount of documentation can substitute for.

• A complete inventory covering vendor and embedded AI, not only internally developed models
• Board-approved model risk appetite with clear ownership
• Third-party validation proportionate to model tier, including for third-party models
• Consumer Duty outcome monitoring on AI-influenced pricing, lending, arrears and collections
• Operational resilience for important business services that depend on AI
• Senior Managers and Certification Regime accountability mapped to AI decisions

On 17 April 2026 the Federal Reserve, OCC and FDIC replaced fifteen years of prescriptive model risk guidance with six principles, and made the whole thing expressly non-binding. For sophisticated banks this is an opportunity; for anyone with thin evidence it is exposure, because the burden of justifying the chosen approach has moved onto the bank.

• Materiality assessed across four drivers: inherent risk, exposure, purpose and use
• Model definition narrowed, simple arithmetic, spreadsheets and deterministic rule-based processes are excluded; "complex" added; statistical, economic or financial theory required
• Effective challenge redefined around accuracy, expertise and authority to drive change, not organizational separation
• Annual revalidation removed in favour of risk-based oversight, which the bank must now defend
• Generative and agentic AI expressly out of scope pending a request for information, but existing risk management principles still apply to them
• Fair lending (ECOA/Reg B), FCRA and adverse-action specificity are untouched and remain the sharpest litigation risk

Note on sources: some commentary circulating in early 2026 claimed a clarification extending the old SR 11-7 to all machine learning and agentic systems. That is inconsistent with the agencies' own published position, and we do not rely on it.

Asia Pacific is where the most operationally specific AI expectations for banks have emerged, largely because the supervisors wrote them after watching deployment rather than before.

• MAS, a Risk Materiality Assessment for every AI use case, weighing impact, complexity and reliance; an accurate inventory of all AI use; a cross-functional AI oversight forum where exposure is material; and lifecycle controls including ongoing monitoring and change management. Finalized on 7 October 2026, applying from 7 October 2027, with full lifecycle expectations from 7 October 2028.
• HKMA, the ART Framework (Accountability, Resilience, Trust) of 15 October 2026 superseding the 2019 principles, with generative AI in customer-facing applications governed under the Supervisory Policy Manual, with the GenA.I. Sandbox++ giving banks a supervised route to prove controls before scale.
• RBI, draft guidance of 24 June 2026 extends model risk management enterprise-wide, requires human oversight where models influence important decisions, and mandates the ability to override, suspend or deactivate a model.
• APRA, CPS 230 operational risk, critical operations and material service provider management from 1 July 2025; CPS 234 information security; CPG 235 data risk.
• Korea, the AI Framework Act from 22 January 2026, with high-impact impact assessments, human oversight, documentation, extraterritorial reach and a domestic representative requirement.
• Japan, FSA supervisory dialogue against the AI Guidelines for Business Ver. 1.2, principle-based and without prescriptive penalties.
• Malaysia, Indonesia, Thailand, Philippines, Vietnam, BNM, OJK, BOT, BSP and SBV governance, outsourcing, cloud and data expectations that increasingly name AI directly.

AML and sanctions is the one banking domain where AI is already ubiquitous, already examined, and already the subject of enforcement. Supervisors do not object to machine learning in screening and monitoring; they object to a bank that cannot explain a threshold, evidence a tuning decision, or show that model changes were governed.

• Model tuning and threshold changes documented, approved and reproducible
• Above- and below-the-line testing evidence retained across versions
• Sanctions screening fuzzy-matching logic explainable to an examiner
• Alert triage automation with demonstrably meaningful human review, not volume rubber-stamping
• Transaction monitoring coverage mapped to the institution's own risk assessment
• FATF, EU AMLR/AMLA, UAE AML federal decree, MAS 626/824, FinCEN and OFAC expectations reconciled in one control set