Takaful operators and insurers in the UAE need auditors who can test AI agents that adjudicate health claims, check motor claims and draft bilingual replies. Training covers reading verdicts, approvals and certificates in the record, and knowing which regulator and data law governs each entity. Audit judgement stays human. The Central Bank of the UAE, DFSA and FSRA frame it.
What sits in the audit plan of a UAE insurer?
Health insurance is a large and fast-moving line, because employers in several emirates must provide health cover for staff. Claims arrive electronically from clinics and hospitals in high volume, and auditors test whether adjudication follows policy benefits, whether pre-approvals were properly given, and whether provider pricing is controlled. Motor claims, group life and property lines add their own tests.
Many insurers also run takaful windows or operate as takaful companies, which adds Sharia governance: the separation of participants' funds from the operator's, and the treatment of surplus. Audit tests that agents handling contributions or claims respect that separation. And because the population is diverse, customer communication is in Arabic, English and often other languages, which affects how audit samples replies.
How do agents change the audit universe?
Each agent the business deploys is a new audit object with its own certified depth.
- Health claim adjudication (depth 3 within limits). The agent checks an electronic claim against the member's benefits and approves routine items under the insurer's limit. Anything above is held for a medical reviewer.
- Pre-approval drafting (depth 2). It drafts the approval or denial for a planned procedure. A medical officer decides.
- Motor claim document checks (depth 1). It reads police reports, estimates and photos and lists inconsistencies.
- Bilingual customer replies (depth 2). It drafts in Arabic and English. A person reviews both and sends.
Audit can use agents on its own testing, at depth 1 to run full-population tests from the append-only record, and at depth 2 to draft workpapers that an auditor signs.
What must auditors learn, and what stays with them?
The foundations come first: depth, the minimum chain of five bounds, the four verdicts and the record. Our guide on what internal auditors should learn before working with AI agents sets these out.
Then the depth 3 test, which is specific to high-volume health adjudication. When an agent approves routine claims itself, audit must test three things: that each approved claim was under the insurer's limit; that the agent's certificate was current on the day, since certificates lapse after 90 days; and that claims above the limit were held for a named reviewer and not split into smaller claims to pass under it. Our guide on how internal auditors review an AI agent's decisions explains how to design these tests from the record.
Takaful adds a further skill: knowing which fund an agent's action touched. An auditor should be able to see from the record whether a claim was paid from the participants' fund and whether that was correct.
Auditors who take operator-level training to understand review from the inside can record their decisions in a practicum log template for internal auditors.
What stays with the auditor: the plan, the opinion, finding ratings, and reporting to the audit committee and, where relevant, the Sharia supervisory board.
Which UAE rules shape oversight and literacy?
The regulator depends on where the insurer is. Onshore insurers are supervised by the Central Bank of the UAE, which expects sound governance, internal controls and an independent internal audit function. Insurers in the DIFC are supervised by the DFSA, and those in ADGM by the FSRA, each with its own rulebook. Auditors in a group with entities in more than one jurisdiction need to know which expectations apply to which agent.
Data protection follows the same split. The federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, applies onshore, while the DIFC Data Protection Law applies in the DIFC. Health data is treated with particular care, and federal rules on health information also restrict where some health records may be stored. Auditors should test where the agent processes data and what it can read.
Cross-border standards help: ISO/IEC 42001 for an AI management system, ISO/IEC 27001 for information security, and the NIST AI Risk Management Framework for structuring risk work.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
A 90-day training plan
Days 1 to 30. All auditors learn the vocabulary of governed agents. Pryme Intelligence Academy's free Foundations track covers it in about four hours. Audit managers map each agent to its entity, regulator and data law.
Days 31 to 60. A pilot audit of health claim adjudication tests every depth 3 approval in a period, certificate currency, and the handling of claims above the limit, including splitting.
Days 61 to 90. Extend testing to takaful fund separation where relevant, write the standing agent audit programme, and use the training plan template for internal auditors to record who has been trained and to what level.
Questions people ask
Does the same agent need different controls in DIFC and onshore?
The controls may look alike, but the regulator and data law differ, so evidence must meet both. Audit should test each entity against its own rulebook.
How do auditors detect claim splitting?
By testing the record for several claims from the same provider for the same member within a short period, each just under the limit. The agent's verdicts make that pattern easy to query.
Should the Sharia supervisory board see agent audit findings?
Where a finding touches fund separation or permissible treatment, yes. Our piece on why internal auditors are the real control explains audit's reporting role, and the guide to AI agent skills by role covers others.