Qatar Central Bank Artificial Intelligence Guideline

What it is

The Artificial Intelligence Guideline is the Qatar Central Bank’s rulebook for the use of AI by the entities it licenses. Its full title is the Artificial Intelligence Guideline (Regulating the use of Artificial Intelligence by QCB Licensed Entities). It was issued under QCB’s Third Financial Sector Strategy and FinTech Strategy and entered into force on 4 September 2024.

Although it is called a guideline, it describes itself as instructions and most of its requirements are written as things an entity “must” do. It sits alongside the QCB Law and other QCB instruments, and section 24 lists the rules entities must also comply with when they use AI, including Law No. (13) of 2016 on Personal Data Privacy Protection, QCB’s January 2018 Technology Risks Circular and its 2024 Cloud Computing Regulation.

Who it applies to

The Guideline covers the use of AI by any QCB-regulated entity. It applies whether the entity develops and implements AI itself, purchases AI systems, or outsources processes or functions that rely directly on AI.

It distinguishes between an entity acting as a provider of an AI system and one acting as a user. A user that makes a material change to an AI model and puts it into service under its own name or trademark is treated as a provider.

What it requires

Governance. Each entity must set an AI strategy consistent with its risk appetite and review it periodically. The board and senior management remain accountable for the outcomes and decisions of the entity’s AI systems, including systems that make decisions on its behalf. The board approves the level of AI exposure the entity will tolerate and assigns clear accountability. Senior management must include at least one person who can understand and manage technology risk. Entities should set up or designate a function to oversee AI, which must use committees to assess AI use cases before implementation.

Risk management and classification. Entities must assess the risk and criticality of the processes each AI system supports. A system without direct human oversight is likely to be judged higher risk than an AI-assisted one where a person makes the final call. Regardless of score, a system must be classed as high-risk where it can harm people through decisions on consumer access to financial services, internal decisions that materially affect employees, or the processing of sensitive personal information.

Register. Entities must keep an up-to-date register of all their AI systems and disclose the full register to QCB every year and on request. Each entry records whether the system is high-risk, whether the entity is user or provider, a functional category and the human oversight protocol. Bought or outsourced systems add the provider’s details, a third-party supplier assessment, the governing law of the arrangement and contract dates. High-risk systems also need a detailed life cycle description and the date and summary of the latest risk assessment or audit.

QCB approval. An entity must obtain QCB approval before launching a new AI system as a provider and before any material modification of one. It must also obtain approval before signing a purchase, licensing or outsourcing agreement for a high-risk AI system. For new high-risk systems, the full results of training, validation and testing go to QCB.

Outsourcing. Entities must carry out due diligence on AI service providers, get board approval to outsource any AI function, and put service agreements in place with audit, confidentiality, continuity and exit terms. The entity stays responsible as principal for its providers’ acts and omissions.

Human oversight. Every AI system must have a human oversight protocol, chosen from AI-assisted decision-making, human exception monitoring or fully autonomous AI. High-risk systems must be designed so that a trained supervisor can understand them, interpret their output, disregard or reverse it, and stop the system. Fully autonomous high-risk systems need QCB approval before launch, built-in guardrails the AI cannot override, and a supervisor able to shut them down.

Life cycle. Entities need separate training, validation and test data, data quality controls and, where relevant, independent validation of material models. Documentation should cover data sources, design choices, testing metrics, assumptions and limitations. Monitoring includes audit logs, version records and archived training data, and a serious incident must be reported to QCB immediately once a causal link to the AI system is established or reasonably likely.

Customers. Entities must tell customers when they are interacting with an AI system, disclose AI use in plain language, explain on request the data and factors behind an AI decision, and say how a decision may affect the customer and whether it is reversible. Customers must be able to query AI decisions and ask for a human review of decisions made with no human involvement, or resubmit corrected data. Entities should consider offering an opt-out, and if they do not, must provide another route for review.

Exemptions. Any exemption from a requirement must be requested from QCB, tied to a specific requirement, recorded in an exemptions register with an expiry date and owned by the entity.

Key dates

• 4 September 2024. The Artificial Intelligence Guideline enters into force for all QCB-licensed entities.

How it relates to other frameworks

The Guideline is one of the more prescriptive financial sector AI rulebooks. Where Singapore’s MAS guidelines on AI risk management set supervisory expectations, QCB adds a prior approval step for new and high-risk systems and an annual register filing. Its human oversight protocols and customer recourse rights echo the ideas behind GDPR Article 22.

Personal data used by AI in a QCB-licensed entity is also governed by the PDPPL, which the Guideline names. An AI management system built on ISO/IEC 42001 or the NIST AI RMF supplies much of the governance structure, risk method and documentation the Guideline expects, though neither covers QCB’s approval and filing steps.

A note on this page

This is Aicura’s reading of the QCB Artificial Intelligence Guideline. It is not legal or regulatory advice and it is not the Guideline itself. Read the primary source published by the Qatar Central Bank, and take advice on how it applies to your entity.