Banks are evaluating AI for risk assessment, customer service, fraud detection and operational efficiency. Each use case needs more than a convincing demonstration. It needs a clear purpose, evidence of performance and controls suited to its consequences.
The DFSA’s 2025 survey, published on 12 November 2025, found that 52% of surveyed authorised firms used AI, up from 33% in 2024. It was generative AI adoption that nearly tripled, growing by 166%. The regulator also reported that 21% of firms lacked clear accountability or oversight mechanisms. These findings describe the surveyed DIFC firms, not every financial institution in the UAE.
The Unique Challenge of Financial Services
Financial services is not like other industries when it comes to AI governance. The stakes are higher, the regulatory scrutiny is more intense, and the consequences of failure are more immediate. A retailer that deploys a flawed recommendation engine may lose sales. A bank that deploys a flawed credit scoring model can damage livelihoods, attract regulatory sanctions, and erode institutional trust built over decades.
The challenge is compounded by the nature of financial data. It is sensitive, it is regulated, and it is interconnected in ways that create systemic risk. A model that performs well in isolation can produce unexpected outcomes when it interacts with other models, other data sources, other market conditions. The 2010 Flash Crash (triggered in part by algorithmic trading systems interacting in unforeseen ways) remains a cautionary tale about what happens when autonomous systems operate without adequate oversight.
In the UAE context, the challenge has an additional dimension. The country's financial sector serves as a bridge between Eastern and Western markets, which means that data flows across multiple jurisdictions with different regulatory requirements. A model trained on customer data from several jurisdictions needs a case-specific assessment of the laws that apply, including the federal PDPL, DIFC or ADGM rules, the GDPR and other relevant local requirements. This is not a legal technicality. It is an architectural requirement that must be designed into the system from the ground up.
Where the Real Risk Lives
When I talk to chief risk officers about AI, the conversation usually starts with the obvious risks: model accuracy, data quality, and cybersecurity. These are important, and most organisations are at least aware of them. But the risks that concern me most are the ones that are harder to see.
The first is explainability. Financial regulators increasingly require that institutions be able to explain how decisions are made. If a customer is denied credit, the institution must be able to articulate why. Some AI models, particularly deep learning models, are difficult to interpret. Their outputs may be accurate even when the reasoning behind a particular result is unclear. That leaves institutions balancing model performance against regulatory compliance. The answer is not to choose one over the other, but to resolve the tension in the design.
The second is concentration risk. As more institutions adopt similar AI tools from similar vendors, the financial system becomes more homogeneous. When everyone is using the same models to assess the same risks, the system becomes vulnerable to correlated failures. If the model is wrong, everyone is wrong at the same time. This is a systemic risk that individual institutions cannot manage alone; it requires industry-level coordination and regulatory oversight.
The third is the talent gap. The people who build AI models are not typically the people who understand financial regulation. The people who understand financial regulation are not typically the people who can evaluate model performance. This gap creates blind spots that neither team can see on its own. Bridging it requires deliberate investment in cross-functional capability, with people who understand both disciplines well enough to connect them.
A Framework for the Financial Sector
The financial institutions that are navigating this well share several characteristics. They have established AI governance committees that include representatives from risk, compliance, technology, and the business. They have implemented model risk management frameworks that treat AI models with the same rigour as traditional financial models. They evaluate explainability methods alongside model performance and the requirements that apply to each use case. They also build internal capability that connects data science with financial regulation.
None of this is easy. It requires investment, patience, and a willingness to move at a pace that may feel slower than the market demands. But deploying AI at speed without adequate governance is not actually faster. It only appears faster until something goes wrong; recovery is then slower and more expensive.
Careful adoption protects the trust on which financial services depend. Institutions need to show how a model is used, who can question its output and how customers are protected when it is wrong.