Summary
- Version 1.0, dated July 2025, owned by the Central Bank of Jordan. Applies whether a bank builds AI, buys it, or outsources AI-dependent work (Scope).
- Governance (s.1): an AI oversight committee or a named existing body; AI aligned to strategy and risk appetite; each bank must classify AI as low, medium or high risk and scale oversight; roll out AI step by step starting with non-critical uses; human in the loop for critical systems.
- Ethics and transparency (s.2): AI decisions held to at least the same ethical bar as human ones; explainable outputs for high-impact uses such as credit scoring and anti-fraud; clear notice at the point of interaction; opt-out or non-AI alternative without losing essential services; an AI System Owner for each system; periodic AI impact assessments.
- Data (s.4): limit personal data in training, anonymise or pseudonymise, encrypt, minimise and purge; log data, models, decisions, prompts and overrides in tamper-evident storage. Points to Jordan's Personal Data Protection Law No. 24 of 2023 (s.3.1).
- Security and testing (s.5): follow the Cybersecurity Framework for Jordan's Financial Sector; robustness and adversarial testing; penetration tests including hallucination and jailbreak tests for GenAI; fallback, kill switch and human on the loop for critical uses; drift monitoring.
- Incidents and vendors (s.6, s.7): central AI incident registry; notify FinCERT/CBJ promptly; AI in business continuity drills; vendor due diligence on bias, explainability and testing; avoid single-vendor concentration; ask vendors for an AI Bill of Materials (AIBOM); audit, incident cooperation and exit clauses in contracts.
- CBJ reviews the framework every two years (s.9).
Who it applies to
- CBJ-regulated banking institutions in Jordan.
- Vendors are covered indirectly through s.7 due diligence and contract terms.
Key dates
- Version 1.0 approved and dated July 2025 (day not stated)
- Launch reported publicly in early August 2025 (secondary press reports)
Full date record
| Date | Event |
|---|---|
| 2025-07 | Version 1.0 approved (month only in the document) |
| 2025-08 | Public launch reported in press (secondary) |
| 2027 | First biennial review due, if counted from July 2025 (inference from s.9) |
Penalties and enforcement
- No penalties in the framework. Enforcement relies on CBJ's general supervisory powers (Not stated in the source in detail).
- Banks must name representatives, at minimum a Chief AI Officer or equivalent, to coordinate with CBJ via FinCERT (s.9).
What it means for an Indian company
- Indian core banking, credit decisioning, chatbot or fraud AI vendors serving Jordanian banks should prepare an AIBOM for each product (models, datasets, third-party components) (SC-AI-014 Model documentation (model cards, system cards), SC-AI-007 Third-party and vendor AI due diligence).
- Expect contract clauses on liability, IP, bias mitigation, explainability, audit rights, incident cooperation and exit support; have test evidence ready (SC-AI-015 Pre-deployment testing and validation, SC-AI-017 Fairness and discrimination testing of outputs, SC-AI-018 Robustness and adversarial testing (red teaming)).
- Build tamper-evident logs of prompts, decisions and overrides (SC-AI-032 Logging and record keeping) and a kill switch with fallback (SC-AI-033 Business continuity and fallback for AI).
- Support customer-facing features: AI notices, opt-out paths, appeal channels (SC-AI-022 Disclose AI interaction to users, SC-AI-027 Right to contest and human review for individuals).
- Help the bank feed its AI incident registry and FinCERT reporting (SC-AI-031 AI incident management and regulator reporting).
- Check cross-border data transfer rules under Jordan's data protection law before training on client data in India (SC-AI-011 Lawful basis and consent for personal data used in AI).
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when CBJ AI Framework for Banks is done.
Glossary
- CBJ: Central Bank of Jordan.
- FinCERT: CBJ's financial sector computer emergency response team, the contact point for AI incidents.
- AIBOM: AI Bill of Materials, a list of the models, data and components inside an AI product.
- HITL / HOTL: human in the loop (approves decisions) / human on the loop (monitors and can step in).
- AI System Owner: the person accountable for one AI system across its life.
Key takeaways
- Supervisory AI framework for all Jordanian banks, Version 1.0 dated July 2025, reviewed every two years.
- Mandatory-style risk classification (low, medium, high), human oversight for critical uses, customer opt-outs and explanations.
- Strong vendor angle: AIBOM, audit rights, exit plans, concentration limits.
- AI incidents go to FinCERT/CBJ.
Official sources
- Artificial Intelligence Framework for Banking Sector in Jordan, Version 1.0, July 2025 (PDF), accessed 2026-10-19
- Launch announcement: Petra (Jordan News Agency) item ID 74235 was not available in English when checked on 2026-10-19; press reports of an early August 2025 launch are secondary.
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.