On 16 September, the one-year clock built into the New CBUAE Law ran out. Federal Decree-Law No. 6 of 2025, which replaced the UAE's 2018 Central Bank Law and 2023 Insurance Decree-Law with a single consolidated regime, gave in-scope entities exactly one year under Article 184 to regularise their status. Entities that haven't face administrative fines of up to AED 1 billion and, for unlicensed financial activity, criminal liability under Article 170 (Hadef & Partners).
Most of the compliance attention on this deadline has gone to banks and insurers, who knew exactly what they were: entities already holding a CBUAE licence, working through a checklist. The more interesting exposure sits with the firms who never thought they needed one.
The perimeter got wider, not just stricter
The New CBUAE Law didn't only tighten obligations on existing licence holders. Article 62 extends the licensing perimeter itself, bringing in "technology providers, APIs, and decentralised platforms that enable Licensed Financial Activities" (White & Case). That is deliberately broad drafting, and it was clearly aimed at exactly the category of firm the AI and embedded-finance boom has produced in volume over the past two years: the orchestration layer, not the bank itself.
A company that built an AI-driven credit-scoring API a licensed lender calls into. An agentic reconciliation or payments-orchestration platform sold as infrastructure to three different UAE banks. A "compliance copilot" that doesn't hold funds or issue credit but sits in the decision path of a Licensed Financial Activity. None of these firms would have described themselves as a bank, an insurer, or a payment institution. Article 62's language doesn't ask what you call yourself. It asks whether what you built enables a licensed activity.
Where this meets the AI governance conversation already under way
We covered the CBUAE's AI/ML Guidance Note in July (see The UAE's central bank just wrote the Gulf's AI governance template), and one of its requirements was that licensed institutions extend AI governance obligations to third-party and vendor risk, explicitly past the API boundary. At the time, that read as a burden falling on banks: assess your vendors, document the ownership, don't let accountability stop at the integration point.
The 16 September deadline is the other half of that picture. If Article 62 catches you, the obligation isn't just that your bank client has to assess you as a third-party AI risk. You may be the regulated entity, with your own licensing, capital, and governance obligations under the same law: independent of whatever due diligence your client is doing on you. A vendor that spent the past year treating the AI/ML guidance note as "our customer's compliance problem" may have missed that the New CBUAE Law was asking a different, more direct question about their own status.
Why this is easy to miss
Three reasons firms in this position haven't necessarily noticed:
- The self-assessment most technology firms run is "are we a fintech," not "does Article 62 apply to us." Those are different questions with different answers. A firm can reasonably conclude it isn't a fintech in the branding sense while still enabling a Licensed Financial Activity in the statutory sense.
- The deadline sat inside a banking-law reform that most AI and software vendors' legal counsel weren't tracking, because it arrived through Central Bank channels rather than a technology or data protection regulator.
- Article 184 gives CBUAE discretion to extend the regularisation period, which has likely encouraged some firms to assume the deadline is soft. Discretion exercised for entities that engaged proactively is a different thing from discretion extended to entities that didn't notice the law applied to them at all.
What to do now, deadline or not
- Get a specific Article 62 assessment, not a general fintech self-check. If your product sits in the decision or execution path of a UAE bank, insurer, or payment provider's Licensed Financial Activity, that's the question to answer, and it needs a lawyer who has read the article, not a founder's best guess.
- If you're in scope and unregularised, engage CBUAE now rather than wait to be found. The discretion to extend under Article 184 is far more likely to be exercised for firms that come forward than for firms identified through supervision.
- If you're the bank or insurer buying AI-enabled infrastructure from a third party, ask the question directly. A vendor operating unlicensed inside your supply chain, after this deadline, is now your regulatory exposure too, not just an AI governance gap under the guidance note, but a licensing gap under the law itself.
The bottom line
The AI governance conversation in the UAE has largely been framed as "how do we govern the AI we use." The New CBUAE Law's licensing perimeter asks a different question of a specific group of firms: are you regulated for the AI you sell. The deadline for answering that quietly passed last week, and the firms most likely to have missed it are the ones who were confident it didn't apply to them.