LLM testing for CBUAE AI/ML compliance
The CBUAE AI/ML Guidance Note sets expectations for how UAE-licensed financial entities deploy AI. We run independent testing and a control-by-control gap analysis against it, so you can show the regulator evidence, not intentions.
What the CBUAE AI/ML Guidance Note requires
The Guidance Note covers how regulated entities govern and control AI and machine-learning systems: governance and accountability, risk management, model controls, human oversight, record-keeping, incident reporting, and the ability to stop or override a system.
We translate those expectations into concrete, testable controls for your specific deployment.
There is no AI deadline to wait for
The Guidance Note is supervisory guidance that has been operative since it was issued in 2026, not a dated, binding deadline with a countdown. The 16 September 2026 date some advisers attach to it belongs to a separate instrument, the licensing-regularisation period under Federal Decree-Law No. 6 of 2025, not to the AI/ML Note. The practical question is therefore not when a cut-off lands, but whether you can put evidence of alignment in front of a supervisor whenever they ask.
We sequence the remediation roadmap against your own supervisory and release timelines, so the work is ready before it is needed rather than pegged to a date that does not apply.
The control mapping and how we assess
We produce a full control-by-control mapping and assess your deployment against every control. That means reading your AI policy, model inventory, vendor contracts, decision logs, and incident records, and interviewing the people who actually run the systems day to day.
The output is a gap-analysis report scored against each control, so you know exactly where you stand.
Off-switch and cessation readiness
A specific expectation is being able to stop, override, and safely fall back from an AI system. We assess cessation readiness and can issue a sample off-switch readiness certificate mapped to the Guidance Note.
Adjacent frameworks
CBUAE is rarely the only regime that applies. Depending on where you operate, we also map to neighbouring UAE frameworks.
- DIFC data protection and AI expectations (Regulation 10)
- VARA, for virtual-asset activity
- UAE PDPL, for personal data
- Federal Decree-Law No. 6 of 2025, where it intersects with AI in UAE-licensed financial entities
What you receive
A signed, dated gap-analysis report, a sequenced remediation roadmap tied to your own supervisory and release timelines, and an annual reassessment, because both the framework and your deployment keep moving.
Who signs the report.
Lattice/AI is an independent AI evaluation firm, founded and led by Rahul Srivastava. For seventeen years he has made it his work to find how systems fail before the people who rely on them do, and he built Lattice/AI to bring that discipline to AI.
His research on AI safety is published and peer-reviewed, he contributes to Microsoft PyRIT, the open framework Microsoft built for adversarial AI testing, and his findings have carried enough weight for a major model vendor to ship a fix in response. What you are hiring is judgment proven in the open, with a name attached to it, not a logo.
Every engagement ends in a signed, dated report that shows what failed next to what passed. Here is the format we ship: a sample scorecard.
Questions buyers ask.
What does the CBUAE AI/ML Guidance Note require?
It sets expectations for how UAE-licensed financial entities govern and control AI: governance, risk management, model controls, human oversight, record-keeping, incident reporting, and the ability to stop a system. We map those to testable controls for your deployment.
Is there a CBUAE deadline for AI compliance?
Not in the way it is often described. The CBUAE AI/ML Guidance Note is supervisory guidance, operative since its 2026 issuance, not a dated binding deadline. The 16 September 2026 date some advisers cite is the licensing-regularisation period under the separate Federal Decree-Law No. 6 of 2025, not an AI-specific cut-off. In practice you need to be able to evidence alignment whenever a supervisor asks, which is what we help you prepare.
Who does it apply to?
UAE-licensed financial entities deploying AI or machine-learning systems. If you are regulated by the CBUAE and using AI in decisions, it is relevant to you.
What is an AI off-switch or cessation readiness certificate?
Evidence that an AI system can be stopped, overridden, and safely fallen back from, mapped to the CBUAE AI/ML Guidance Note. We assess this and can issue a sample certificate.
Do you cover DIFC and VARA as well as CBUAE?
Yes, where they apply. We map to DIFC, VARA, the UAE PDPL, and relevant federal law alongside the CBUAE Guidance Note so you are not auditing one regime at a time.
Tell us what’s under contract.
Three sentences is usually enough. Tell us what you are trying to ship, when it has to land, and the thing that scares you about it.