Staff paste Emirates IDs, IBANs and customer records into public AI tools, often on personal accounts. The CBUAE now asks how AI is governed. SentraGuard finds it, governs it and proves it, from your UAE data centre.
Find your shadow AI on the day you deploy. Reach full shadow AI governance in one week.
ISO 27001 CERTIFIED
Sensitive data does not leave through files any more. It leaves in a prompt, a paste and an agent's tool call, usually on a personal account. Usage control decides what happens at that moment.
67% of employees reach AI from non-corporate accounts on corporate devices. No log, no attribution, no answer for the auditor. Verizon DBIR 2026
Shadow AI is now the third most common non-malicious insider action in DLP data, with detections up 4x in a year. Source code is the top data type uploaded. Verizon DBIR 2026
Coding agents and MCP servers call tools and write to data. A tool list cannot govern a tool call.
The CBUAE guidance note on AI and ML (February 2026) covers generative AI, data privacy and third-party AI. DIFC Regulation 10 asks for a register of AI use cases and human review. Shadow AI is the part of that register nobody has written. CBUAE 2026 · DIFC Reg 10
The session blind spot
Federal, emirate and free zone rules overlap. Here is what applies to AI use at work, and the evidence SentraGuard produces for each.
The note covers consumer protection, generative AI, data privacy under the PDPL and the Information Assurance Regulation, and third-party or outsourced AI. The new Central Bank Law, Decree-Law 6 of 2025, set a compliance deadline of 16 September 2026 and fines up to AED 1 billion.
DIFC Regulation 10 covers personal data processed by autonomous and semi-autonomous systems. It asks for notice, a register of system use cases and processing activities, human review and an Autonomous Systems Officer for high-risk processing. ADGM expects breach reports within 72 hours, with fines up to USD 28 million.
The PDPL, Decree-Law 45 of 2021, has been in force since 2 January 2022. Its executive regulations are still pending, and organisations get six months to comply once they are issued. Under Federal Law 2 of 2019, health data must by default stay in the UAE.
A new federal authority now brings the Emirates Data Office, the UAE AI Office and TDRA's digital government sector under one body. The UAE Charter for the Development and Use of AI (2024) sets 12 principles, including privacy, human oversight and accountability.
Checked 24 September 2026. Regulations change; confirm current text with your counsel.
The browser plugin sees web apps and extensions. The IDE extension sees Cursor, VS Code and Copilot. The SDK and API gateway see your own apps. The endpoint agent runs on Windows, macOS and Linux and sees desktop AI apps, CLI agents, local models and MCP servers. Everything lands in one console.
Every surface reports to the same API-first backend, so one policy applies everywhere and every event lands in the same log.
A bank can run the whole pilot on the first rung and see every session, account and data class with no user impact. Each rung above adds control for one app, one group or one data class at a time.
Mark each app sanctioned, tolerated or unsanctioned. New apps inherit their category's decision until you change it. Then set the action by user group and by the data class detected in the prompt.
| Application | Retail ops | Engineering | Contractors |
|---|---|---|---|
| ChatGPT Enterprisesanctioned · SSO | Allow | Allow | Redact |
| ChatGPT personalunsanctioned | Coach | Coach | Block |
| Claude Codetolerated · engineering | Block | Redact | Block |
| DeepSeek webunsanctioned · trains by default | Block | Block | Block |
| M365 Copilotsanctioned | Allow | Allow | Coach |
A banner in the session, not a ticket the next day. The user sees why, what to do instead, and what is logged. Most usage moves to the approved tool without a block.
Illustrative rules. Your policy sets the real ones, per app, per group and per data class.
Every decision is logged with user, app, data class and action, and streamed to your SIEM.
Unsanctioned app on a personal account. The user sees the approved assistant and can continue; the session is logged.
Detection runs on the session, on every surface, with the same data classes. Redact keeps the workflow moving. Block stops the ones that must not leave.
Inventory, attribution, policy log, exceptions, a regulator clause map and a signed export. Produced from the same events the SIEM receives, so the auditor and the SOC read one truth.
Select a jurisdiction. Each dot is an artifact SentraGuard produces for that framework.
| Framework | Inventory | Attribution | Policy log | Redaction proof | Clause map | Signed export |
|---|---|---|---|---|---|---|
| CBUAE guidance note on AI and ML (2026) | ||||||
| Central Bank Law, Decree-Law 6 of 2025 | ||||||
| CBUAE Consumer Protection Regulation and Standards | ||||||
| CBUAE Outsourcing Regulation for Banks (2021) | ||||||
| UAE Information Assurance Regulation and IA Standard v2 | ||||||
| UAE PDPL, Decree-Law 45 of 2021 | ||||||
| DIFC Data Protection Law 2020 and Regulation 10 | ||||||
| ADGM Data Protection Regulations 2021 | ||||||
| Dubai DESC Information Security Regulation | ||||||
| UAE Charter for the Development and Use of AI (2024) |
| Framework | Inventory | Attribution | Policy log | Redaction proof | Clause map | Signed export |
|---|---|---|---|---|---|---|
| ISO/IEC 42001 | ||||||
| NIST AI RMF |
| Framework | What it expects |
|---|---|
| CBUAE guidance note on AI and ML (2026) | Generative AI, data privacy, third-party and outsourced AI, consumer protection |
| Central Bank Law, Decree-Law 6 of 2025 | New law for licensed financial institutions; compliance by 16 Sep 2026; fines up to AED 1 billion |
| CBUAE Consumer Protection Regulation and Standards | Customer data protection for licensed financial institutions |
| CBUAE Outsourcing Regulation for Banks (2021) | Third-party and outsourcing controls |
| UAE Information Assurance Regulation and IA Standard v2 | Asset inventory, data classification, monitoring and logging |
| UAE PDPL, Decree-Law 45 of 2021 | Lawful processing and cross-border transfer; executive regulations pending |
| DIFC Data Protection Law 2020 and Regulation 10 | Register of AI use cases, human review, Autonomous Systems Officer |
| ADGM Data Protection Regulations 2021 | Breach report within 72 hours; fines up to USD 28 million |
| Dubai DESC Information Security Regulation | Information security for Dubai Government entities |
| UAE Charter for the Development and Use of AI (2024) | Twelve principles, including privacy, human oversight and accountability |
| ISO/IEC 42001 | AI management system: inventory, roles, controls and monitoring for AI in use |
| NIST AI RMF | Govern, Map, Measure, Manage |
Answers for Gulf banks, insurers and government entities.
Observe records the app, the account type, the data class and the decision. Prompt text is captured only where a policy requires it, and it stays inside your deployment.
Yes. The endpoint agent finds MCP servers, clients and CLI agents at runtime on Windows, macOS and Linux. The SDK and API gateway cover in-house agents. Tool calls get the same four actions as prompts.
Yes. Kubernetes or VMs with no outbound connection. The app dictionary and detection updates arrive as signed bundles.
Inspection is asynchronous and near real time. The measured p95 will be published after the first pilots, not before.
Not in the on-premise or air-gapped deployment. The backend runs in your UAE data centre on CPU only. Policy, logs and the Evidence Pack stay inside your perimeter. This matters where health data must by default stay in the UAE under Federal Law 2 of 2019, and where CBUAE customer data rules apply.
Per protected user per year, by tier: Browser, Workforce, Enterprise. Quotes are issued at the pilot readout. There is no public price list.
Find your shadow AI on the day you deploy. Reach full shadow AI governance in one week, for one business unit. Delivered by the SOAISEC GCC team with Forcespot, our value-added distributor in the region, and NitronEdge, our value-added solution seller.
The category, the four decisions, what UAE and Saudi regulators expect, and a 12-question vendor checklist.
Read the guideFilter by browser extension, endpoint agent, on premise and price. Compiled from public vendor sites.
Compare the platformsInventory, decisions, agents, exceptions, UAE and Saudi clause maps and a signed export. Printable.
Open the sampleBans push usage to personal accounts. A one-week path from ban to governed use.
Read the articleEight questions the auditor will ask, and the evidence that answers each one.
Read the articleShadow AI found on day 0, an unsanctioned tool moved to sanctioned use, Microsoft 365 Copilot governed, and all four actions live by day 7. Voiceover, captions and transcript.
Watch the video
