It depends on where you are licensed, but the core is the same everywhere in the UAE. Every employee near an AI agent needs literacy in depth, verdicts and provenance. Every person who releases an agent's held actions needs certified, checkable competence. Your regime, onshore, the DIFC or ADGM, then decides which supervisor and data law will examine that evidence.
Which regime are you in, and why does it matter?
The UAE runs several regulatory regimes side by side:
- Onshore financial firms are supervised by the Central Bank of the UAE, and personal data falls under the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).
- Firms in the Dubai International Financial Centre are supervised by the DFSA, and the DIFC Data Protection Law governs personal data there.
- Firms in Abu Dhabi Global Market are supervised by the FSRA.
A group with entities in more than one regime should train to the strictest expectation it faces, so that a reviewer moving between entities does not need two sets of habits. The UAE Personal Data Protection Law guide covers the federal data duties in detail. Firms serving EU customers may also need to consider GDPR and the EU AI Act.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What should UAE staff learn before an agent acts?
- Depth. An agent can draft a claim decision at depth 2 and still be unable to pay it. Depth 4, for money and hard-to-undo actions, is earned through certification on your own cases.
- Reading a verdict. Each action is allowed, held, refused or withheld, and the verdict names which bound decided: role scope, certificate, sources, your own limits or the platform guardrails.
- Provenance. A sealed record from the policy or payment system outranks a declared statement, and an external email cannot authorise a payment.
- Expiry. Agent certificates lapse after 90 days, and a run that clears no depth drops the agent to depth 1 the same day.
What may the agent do, and what stays with a person?
| Work | Agent | Person |
|---|---|---|
| Reading claim, order or account records | Depth 1 | Interpreting exceptions |
| Drafting replies in Arabic or English | Depth 2 | Sending them |
| Updating a delivery slot within limits | Depth 3 | Changes outside the limits |
| Paying a claim or issuing a refund | Prepares and holds at depth 4, if certified | Releasing it |
For an insurer, the operations manager brief for insurance in the UAE covers who owns the right-hand column. For a retailer, the e-commerce operations brief for the UAE does the same.
Why do portable credentials matter in the UAE?
Many UAE teams are international and move between employers and entities. A manager hiring an approver needs to know, quickly, whether that person's credential is real and current. A certificate that can be checked at source, by number or QR code, with lapsed or revoked status shown on the same page, answers that without a reference call.
The same check works inside a group. If approval rights depend on a current credential, a person moving from a DIFC entity to an onshore one carries their standing with them, and the receiving manager can confirm it before granting rights.
How do you evidence the training?
Keep a record per person: role, capabilities overseen, training, result, credential and expiry. Join it to the append-only record of agent verdicts, which names who released each held action. A supervisor can then trace any decision to a person and their competence on the day. The full approach is set out in AI literacy and certification for people who work with agents; the Germany guide shows it under a single EU regime.
Where the Academy fits
Pryme Intelligence Academy issues its certificates through VerifyDoc.ai, and a public register lists certified people by name, credential and expiry. For teams, seats are included with paid Pryme Intelligence plans, and an admin view shows each person's progress, results and expiry dates across entities.
Questions people ask
Does the Central Bank of the UAE require AI certification?
The expectations covered here do not set a specific AI credential. They expect accountable oversight of the systems firms rely on, which certified approvers help show.
Should DIFC and onshore teams be trained separately?
Train them on the same concepts and test them on their own cases. Add the data protection law that applies to each entity.
Can agents reply to customers in Arabic without review?
Within approved templates and bounds at depth 3, yes. Anything outside them should be drafted at depth 2 for a person to approve.