AI automation for insurance brokers and financial services in the Middle East: what the agent may do, and what a licensed person must sign

An AI agent can take quote requests, chase documents, send renewal reminders and report claim status for a Gulf insurer, broker or finance firm. A licensed person still owns advice, prices, claim decisions and complaints. In the UAE that line is now in writing, in Central Bank AI guidance issued on 11 February 2026. This page sets out those rules, the Saudi equivalents and what WhatsApp's own policy forbids. It is written by Learnmind.ai, a Dubai firm that builds WhatsApp and voice agents.

What an AI agent can and cannot do for a Gulf insurer, broker or finance firm

Most messages a broker receives are not requests for advice. They are "how much for third party", "what do you need from me" and "has my claim moved". An agent handles those well, around the clock, in Arabic or English.

Two of those lines come from WhatsApp rather than a regulator. Its Business Messaging Policy was last updated on 23 September 2026. It says: "Don't share or ask people to share full length individual payment card numbers, financial account numbers, personal ID card numbers, or other sensitive identifiers."

The same policy prohibits payday loans, paycheck advances, peer-to-peer lending, debt collection and bail bonds. The bans apply "irrespective of the global or local licenses" a business holds. A licensed finance company that wants an agent for collections needs another channel.

The UAE rules an AI agent works inside

The Central Bank of the UAE supervises banks, finance companies and insurers. Its online rulebook still carries the former Insurance Authority's resolutions, marked as in force. For an agent that talks to customers, eight documents matter. We read each one in the rulebook on 2 October 2026.

The Consumer Protection Regulation covers the activities listed in Article 65 of the 2018 central bank law. It protects consumers who are individuals or sole proprietorships. Insurers and brokers also have the conduct rules listed above. Firms in a financial free zone work under other rules: the DIFC, for example, has its own Data Protection Law, DIFC Law No. 5 of 2020.

Chatbots already sit inside the 2020 electronic insurance rules

The Electronic Insurance Regulations cover offers, premium quotes, sales, marketing, claims and complaints handled "through electronic and smart systems". Their definition of a company's "website" names "Autoreply, chatbot and smart personal assistant" and "Live chat channels". On our reading, a WhatsApp agent that offers cover or receives claims is an electronic insurance channel.

That brings obligations. Article 3 expects a board-approved plan before a company seeks approval for electronic insurance operations, and Article 14 requires prior written approval to advertise them. Article 6 bars selling investment-linked life products through any website.

Advice is a regulated act, not a feature

The Consumer Protection Regulation treats as specific advice any communication meant to influence a choice "to select, buy, sell, hold, subscribe to a particular financial product/service". Staff who deal with consumers must hold the qualifications "necessary to provide Advice" (5.1.2.5).

The Brokers' Regulation goes further. A recommendation must be "consistent with the Client's insurance demands and needs", with reasons, after comparing prices and cover from different insurers (Article 12-1). An agent that says "Policy B is your best option" is doing the regulated part. An agent that sends the adviser's comparison and books a call is not.

The Central Bank's February 2026 AI guidance, clause by clause

The Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning covers "licensed financial institutions, including insurance providers". It is written as "should" rather than "must", and it supplements existing law rather than replacing it. It is still the clearest statement of what the Central Bank expects from a customer-facing AI.

Clause 7(d) also says AI "should not be used to target consumers with unsuitable products or to engage in pressure-selling or misleading marketing". On our reading, that rules out scripted urgency such as "price rises tonight" unless the insurer has announced it.

Quote requests: motor, health and home cover

A quote request is where an agent saves the most time and where it is easiest to overstep. The agent collects facts and sets expectations. The price comes from the insurer, and the recommendation from a licensed adviser.

Motor: the tariff sets the band

UAE motor premiums sit inside bands set by Insurance Authority Decision No. 30 of 2016, still listed as in force. Insurers compete within the bands, over a 13-month insurance period. This is part of the third-party liability table for private vehicles.

For comprehensive cover, the second table sets the maximum rate at 5% of the vehicle's value for a saloon and 7% for a four-wheel drive. An insurer may cut the minimum premium for a claim-free record: 10% for one year, 15% for two and 20% for three. It may also take 50% off the minimum for listed groups, including medical workers and people over 60. Where several reasons for a reduction exist, only the highest applies.

Insurers must also give a past customer a free certificate of their insurance experience. That is the document to ask about when a customer claims a no-claims history.

Health: medical details stay out of the chat

WhatsApp's policy says not to "send or request any health related information, if applicable regulations prohibit distribution of such information" to systems without heightened safeguards. Gulf data laws make that real. Oman's Personal Data Protection Law, Article 5, bars processing health data "except after obtaining a permit". Bahrain's law, Article 5, bans processing health data without consent unless a listed exception applies.

So the agent collects only non-medical facts, such as who needs cover and the emirate. Any medical declaration goes on the insurer's own form.

Home cover, and insurance sold with a mortgage

For home cover the agent asks: owner or tenant, which emirate, buildings or contents. Mortgage advisers and banks have extra rules under the Consumer Protection Standards.

When insurance is offered with a credit product, the consumer must be told in writing they can accept or reject it (2.1.3.13). Consent to the insurance is taken separately from the loan application (2.1.3.14). Where cover is mandatory, the consumer chooses from at least three approved providers, and the lender says if one belongs to its group (2.1.3.15). An agent can state all of this in its first reply.

Documents by photo: what WhatsApp and the regulators allow

Collecting an Emirates ID, a driving licence and a vehicle registration card by photo looks like the obvious job for an agent. It is also the job most likely to break a rule.

An Emirates ID carries a personal ID number, so asking for a photo of it means asking for that number. WhatsApp's policy says not to. It does not mention upload links. On our reading, a link to the firm's own secure portal keeps the number out of WhatsApp entirely. The policy has its own section on suspended and terminated accounts; we cover how numbers get restricted in WhatsApp Business account ban triggers.

Saudi Arabia adds a legal limit. Article 28 of its Personal Data Protection Law bars copying "official documents where Data Subjects are identifiable". The exceptions are a legal requirement or a request from a competent public authority. A photo of an ID card is a copy.

The UAE rules point the same way. The Electronic Insurance Regulations, Article 16, require identity and documents to be verified before a policy is sold or issued electronically. Those records are kept for at least 10 years.

The 2010 Code of Conduct, Article 6, says information "may not be incorporated in the application form by any employees of the insurance company". The 2020 regulation, Article 12, asks for a "step by step" approach to declarations. On our reading, an agent explains each question and never answers it for the customer.

1. Send the checklistWhich documents, for which product, in the customer's language.
2. Send a secure upload linkThe firm's own portal, tied to the customer's case reference.
3. Confirm receipt, not contents"We have your three documents", never a number read back.
4. Name what is missingEach document by name, with the reason the insurer needs it.
5. Hand over for verificationA person or the firm's own system checks identity, as Article 16 requires.
6. If an ID arrives in the chat anywayDo not repeat the number. Point to the upload link and follow the firm's deletion policy.

Photo reading still earns its place. A photo of car damage can open a claim notification, and the current insurer's renewal notice shows the expiry date. A voice note about an accident can be summarised for the claims handler; see how an AI understands the voice notes customers send.

Renewals: the notice clocks and what the reminders cost

Renewals are the most predictable conversation in insurance, and the rules give them fixed clocks.

Article 20 asks for at least two means of communication the customer prefers, such as email or SMS. On our reading, WhatsApp can be one of them if the customer chose it. Each reminder should carry the Code of Conduct's alert to disclose material changes, such as a new driver.

A reminder that also pitches a new product reads as marketing, so keep it about the policy. Our WhatsApp Business API pricing guide for the UAE explains the categories.

Claims status and complaints: the clocks an agent can keep

An agent never forgets day 15, and it answers "any news on my claim" at midnight from the system of record. It cannot decide anything, and the rules are explicit about who does.

The Standards add two rules an agent can follow from day one. Each complaint gets a unique service request number (8.1.1.4). Dissatisfaction voiced without a formal complaint is still logged with date, issue and outcome (8.1.2.2). "This is the third time I have asked" counts.

1. Identify the claim by referenceUse the claim or policy reference, never an ID number.
2. Read the status from the system of recordNot from memory of the last chat.
3. Say the stage, the gap and the next stepWhat is done, what is missing, and when the customer will hear next.
4. Log dissatisfaction as it happensDate, issue and outcome, as Standard 8.1.2.2 asks.
5. Hand over on any disputeA disagreement about cover, an amount or a rejection goes to a person with the full thread.

Outbound messages: the UAE treats AI senders as telemarketers

The Central Bank's Telemarketing Regulation, Circular 3/2026, took effect on 31 March 2026. It applies to banks, insurance companies and other institutions the Central Bank licenses, including when telemarketing is outsourced.

Telemarketing covers selling or promotion "through any communication channel", including "messages through digital platforms, websites, social media and other applications". A telemarketer may include "automated communication systems and artificial intelligence". So an AI sending a WhatsApp offer for home cover is telemarketing. A reply about a customer's own claim is not, on our reading, but a cross-sell added to it probably is.

1. Get board approval firstArticle 2.1 requires the board to approve telemarketing in writing.
2. Get consent that covers AIConsent records language, channels and preferred contact method, including "artificial intelligence-based agents" (7.2).
3. Check the Do Not Call RegistryListed numbers and anyone who opted out are off limits (9.2).
4. Name the firm properlyThe full registered name, with "Telemarketing" shown next to it (6.3 and 6.4).
5. Open with the required factsWho initiated, the purpose, and the rights to complain and to join the registry (13.1.1).
6. Log every messageDate, time, the AI system's name or identifier, the customer and the purpose, kept 5 years (10.2, 10.4).
7. Respect the capOnce a day and twice a week at most; follow-ups only if the customer asked (15.3, 15.4).
8. Stop at the first noStop requests take effect immediately (14.1).

Article 14.2 deserves a second read. Telemarketing must not go to anyone who rejected the product before "or who have not answered a Telemarketing attempt regarding the same Product and/or Service". An AI sequence that chases silence with a second offer breaks that rule.

Calls run only between 9am and 6pm UAE time (15.1). The Central Bank may ask to see telemarketing scripts (Article 5); for an AI agent, its approved answers are the script. WhatsApp's own opt-in rules sit on top; see WhatsApp marketing consent in the UAE.

Saudi Arabia: Insurance Authority rules and the Personal Data Protection Law

Saudi Arabia's Insurance Authority licenses the sector and publishes its rules, several first issued by the Saudi Central Bank. Two matter most for an agent.

The Insurtech Rules

The Insurtech Rules, listed by the Authority on 7 November 2023, bind licensed insurtech companies. They also show what Saudi supervisors expect from a digital insurance channel.

• Identity from a reliable source. Identity and documents are verified electronically "through using a reliable source" (Article 7).
• Data hosted in Saudi Arabia. Information exchanged with clients electronically "shall be hosted and stored in Saudi Arabia" (Article 8).
• SMS one-time passwords. Two-factor authentication is required, with SMS OTP as one of the forms (Article 9).
• Uploads on the platform. Clients can upload photos and files on the company's own platform (Article 9).
• Commission disclosed. The client is told the amount or percentage the company receives (Article 9).

Anyone planning one-time passwords on WhatsApp should note that SMS has to be one of the factors.

Motor cancellation refunds

The Comprehensive Motor Insurance Rules allow cancellation in three cases: another valid policy, cancelled vehicle registration, or a change of owner. The insurer refunds by IBAN within three business days of becoming aware. Article 10.3 sets the formula.

The agent explains the method but never confirms the amount; only the insurer knows the real figures.

The Personal Data Protection Law

Saudi Arabia's Personal Data Protection Law, published in English by SDAIA, defines personal data to include "license numbers", "bank and credit card numbers" and photos. Three articles bear directly on a financial agent.

• Advertising needs prior consent. Article 25 bars advertising through a person's own means of communication without prior consent and a clear way to stop.
• Credit data needs explicit consent. Article 24 requires checks that the person explicitly consented to collection or disclosure.
• Transfers abroad are limited. Article 29 allows them for set purposes, with adequate protection and the minimum data needed.

The Authority also lists an Online Insurance Activities Regulation. Its PDF would not open for us, so it is not summarised here.

Country by country: UAE, Saudi Arabia, Qatar, Kuwait, Bahrain and Oman

The six markets differ in who supervises insurance, how data law treats automation and where WhatsApp data can be kept. Where we could not open a primary source, the cell says "check locally".

Bahrain's law is the most specific about automation. Article 14 requires prior notice to the authority of "any wholly or partially automated processing operation", unless a Data Protection Guardian is appointed. Article 15 requires prior written authorisation for some automatic processing, including biometric identity checks.

Where the conversation data is stored

Meta's Cloud API offers local storage, which keeps message content at rest in a chosen country. The supported codes include AE and BH; Saudi Arabia, Qatar, Kuwait and Oman are not listed. Even with it on, Meta may process message content in data centres abroad for up to 60 minutes while in use. Contact book numbers are stored in Meta data centres regardless.

Regulators set their own rules. A UAE broker stores personal data in the UAE, with a separate backup, for 10 years (Brokers' Regulation, 16-2). It must not outsource any activity outside the UAE (17-6). Saudi insurtech companies host client data in Saudi Arabia. On our reading, transcripts, voice notes and photos all fall inside those rules.

Questions to put to any AI vendor, including us

• Where is each piece stored? Messages, voice notes, photos, summaries and logs, by country.
• Can we stop it at once? The guidance expects the firm to be able to cease use immediately (clause 6(f)).
• How are changes tested? Automatic updates should be tested before implementation (clause 6(c)).
• What are our audit rights? The guidance expects audit, information and termination rights in the contract (clause 6(e)).
• Who reviews your security? Annual cybersecurity reviews by independent, qualified third parties (clause 9(b)).

We cover UAE data rules for WhatsApp in more depth in WhatsApp and UAE data protection.

Human sign-off: matching each job to an oversight model

Clause 7 of the Central Bank's guidance describes three models. Human-in-the-loop: the AI recommends and a person "retains full authority to approve or reject". Human-on-the-loop: the AI handles routine tasks while a person monitors and can step in. Human-out-of-the-loop: only for "low-risk, non-material processes".

The level of involvement should match the risk to the consumer. This is how we would map a broker's jobs; the mapping is ours, not the Central Bank's.

A handover works only if the adviser can act on it in one read. This is the note an agent should pass on.

When to hand over matters as much as what travels with the customer. We cover both in how to build an AI agent customers trust. Firms that want a person to approve each reply can use the Learnmind AI CRM. The AI drafts every reply; a person approves, edits or skips it.

How Learnmind builds this for brokers and finance firms

Learnmind.ai is based in Dubai and builds bespoke AI systems for customer conversations. We build WhatsApp AI agents, Instagram and Facebook comment and DM automation, an AI voice receptionist and an AI-first CRM. We are not a licensed insurer, broker or lender, so the rules on this page are for your compliance function to apply.

Meta's terms for the WhatsApp Business Platform have restricted general-purpose AI assistants since 15 January 2026. An agent that answers a firm's own customers about its own products is the business-specific kind the terms allow.

• It reads photos and voice notes. Identity documents still go through the secure upload route above.
• It can start cautiously. The Learnmind WhatsApp agent can launch in approval mode, with a person signing off every reply.
• It remembers and updates. Past conversations carry over, and a changed tariff or wording is updated the same day.

The build follows how a Learnmind agent goes live. Day 1 is a 15-minute call where we map services, pricing logic, common questions and brand voice. Days 2 to 5 build the persona, including the escalation rules that matter most for a financial firm. The agent is tested on real questions and goes live from about day 14. Raise data residency on that first call, and get the answer in writing.

For inbound calls, the AI voice receptionist has public prices. Starter is USD 299 a month, no setup fee, 500 minutes included and USD 0.25 a minute over. Professional is USD 815 to 1,360 a month with 2,000 minutes, booking, WhatsApp plus voice and custom CRM integrations.

Our closest example is not a finance firm, but the pattern fits a broker. Alcaz Media, a UAE performance marketing agency, runs a Learnmind WhatsApp assistant that answers leads within seconds, 24/7, qualifies them and books strategy sessions. The founder gets a summary with the full transcript. The case study is on our results page.

A free 14-day WhatsApp AI trial runs on your own number at learnmind.ai/try; Meta bills its own message fees directly. Tell your compliance function first: a trial is still an AI talking to your customers.

Frequently asked questions

Sources

• RegulatorCentral Bank of the UAE, Guidance Note on AI and machine learning, issued 11 February 2026
• RegulatorCentral Bank of the UAE, Telemarketing Regulation, C 3/2026, effective 31 March 2026
• RegulatorCentral Bank of the UAE, Consumer Protection Regulation, Circular 8/2020, effective 25 December 2020
• RegulatorCentral Bank of the UAE, Consumer Protection Standards, sections 2.1, 6.1 and 8.1
• RegulatorCentral Bank of the UAE, Insurance Brokers' Regulation, C 1/2024, effective 15 February 2025
• RegulatorInsurance Authority Resolution No. 18 of 2020, Electronic Insurance Regulations, effective 28 April 2020
• RegulatorInsurance Authority Resolution No. 3 of 2010, Code of Conduct and Ethics, amended 2019
• RegulatorInsurance Authority Decision No. 30 of 2016, Motor Vehicle Insurance Tariffs, effective 1 January 2017
• LawUAE Government portal, Data protection laws, Federal Decree-Law No. 45 of 2021
• RegulatorSaudi Insurance Authority, Insurtech Rules, listed 7 November 2023
• RegulatorSaudi Insurance Authority, Comprehensive Motor Insurance Rules, Articles 9 and 10
• LawSDAIA, Saudi Personal Data Protection Law, English text
• LawBahrain, Law No. 30 of 2018 on Personal Data Protection, Articles 5, 14 and 15
• LawDIFC Data Protection Law, DIFC Law No. 5 of 2020, in force 1 June 2020
• LawOman, Royal Decree 6/2022 issuing the Personal Data Protection Law, Article 5
• RegulatorCentral Bank of Bahrain, Insurance
• RegulatorFinancial Services Authority, Oman
• RegulatorInsurance Regulatory Unit, Kuwait
• ResearchOxford Business Group, Qatar: Streamlining insurance regulation, 19 March 2013
• PlatformWhatsApp Business Messaging Policy, last updated 23 September 2026
• PlatformMeta for Developers, Cloud API local storage
• PlatformMeta for Developers, Phone number registration, supported local storage countries
• PlatformMeta for Developers, WhatsApp pricing, October 2026 UAE rates, verified 27 September 2026
• PlatformMeta for Developers, AI providers on the WhatsApp Business Platform
• LearnmindThe Learnmind WhatsApp agent, approval mode and handover
• LearnmindHow a Learnmind agent goes live
• LearnmindThe Learnmind AI receptionist, public prices
• LearnmindLearnmind results, the Alcaz Media case study

Written by Edmund Gay, Learnmind.ai, Dubai. Rules, dates and figures come from the official texts above, read on 2 October 2026. The oversight mapping, flows and worked examples are our interpretation, not legal advice.