Contact usGet started

Frameworks · Qatar

AI laws, regulation and governance frameworks in Qatar

Qatar governs AI without an AI-specific law. The Personal Data Privacy Protection Law applies to AI that processes personal data, with NCSA guidelines setting expectations on impact assessments. The Qatar Central Bank's Artificial Intelligence Guideline sets the most detailed rules, for licensed financial institutions, and the Qatar Financial Centre runs its own data protection regime with a GDPR-style rule on automated decisions.

Who regulates AI here

  • National Cyber Security Agency (NCSA)Its National Cyber Governance and Assurance Affairs administers and enforces the Personal Data Privacy Protection Law and publishes guidelines for regulated entities, including on DPIAs and breach notification.
  • Qatar Central Bank (QCB)Licenses and supervises banks and other financial institutions, and sets the Artificial Intelligence Guideline that governs how they develop, buy and oversee AI.
  • QFC Data Protection OfficeSupervises the QFC Data Protection Regulations 2021 for firms in the Qatar Financial Centre, including the rules on automated decisions and impact assessments.

Qatar

Qatar governs AI through its data protection law, the PDPPL, and the Qatar Central Bank's AI Guideline for financial institutions, with a separate GDPR-style regime in the Qatar Financial Centre.

LawQatar PDPPLQatar Personal Data Privacy Protection Law (PDPPL) and AIHow Qatar's PDPPL, Law No. 13 of 2016, applies to AI. Consent, notice, privacy reviews, DPIAs for automated decisions, breach notification and penalties.In force. NCSA guidelines for regulated entities at version 2.0 since September 2022.Regulator guidanceQCB AI GuidelineQatar Central Bank Artificial Intelligence GuidelineThe Qatar Central Bank's AI Guideline for licensed entities. Board accountability, the AI register, QCB approval for high-risk AI and human oversight.In force since 4 September 2024 for all QCB-licensed entitiesLawQFC Article 22QFC Data Protection Regulations 2021 and automated decisionsArticle 22 of the QFC Data Protection Regulations 2021 limits solely automated decisions by Qatar Financial Centre firms. Exceptions, safeguards and DPIAs.In force. Version 3 of the Regulations in force since 6 December 2023.

All Qatar frameworks

International

Standards and frameworks that apply across borders. Most organisations use one of these as the backbone of their AI governance, whatever their jurisdiction.

StandardISO/IEC 42001ISO/IEC 42001:2023 AI management systemsISO/IEC 42001 is the certifiable international standard for an AI management system. What it requires, how Annex A works and how to get ready to certify.Published December 2023, current editionIn Aicura from ProStandardISO/IEC 42005ISO/IEC 42005:2025 AI system impact assessmentISO/IEC 42005 is international guidance on assessing how an AI system affects people and society, when to assess, what to record and how it links to 42001.Published May 2025, current editionVoluntary frameworkNIST AI RMFNIST AI Risk Management Framework (AI RMF 1.0)The NIST AI RMF is a voluntary framework for managing AI risk through four functions, Govern, Map, Measure and Manage. What it asks and who uses it worldwide.Version 1.0 current, revision under wayIn Aicura from ProVoluntary frameworkNIST Generative AI ProfileNIST AI RMF Generative AI Profile (NIST AI 600-1)NIST AI 600-1 applies the AI Risk Management Framework to generative AI. Its 12 risks, the suggested actions behind them and who uses the profile and why.Final, published July 2024StandardISO/IEC 23894ISO/IEC 23894:2023 Guidance on AI risk managementISO/IEC 23894 adapts the ISO 31000 risk process to AI. What the guidance covers, its AI risk sources and lifecycle mapping, and how it fits with ISO 42001.Published February 2023, current editionStandardISO/IEC 38507ISO/IEC 38507:2022 Governance implications of the use of AI by organizationsISO/IEC 38507 is guidance for boards on governing an organisation's use of AI. What it asks of directors, how it links to ISO/IEC 38500 and who uses it.Published April 2022, current editionVoluntary frameworkOECD AI PrinciplesOECD Recommendation of the Council on Artificial Intelligence (OECD AI Principles)The OECD AI Principles are the intergovernmental standard for trustworthy AI, adopted 2019 and revised 2024. The five principles and how to apply them.Adopted May 2019, revised May 2024Voluntary frameworkHUDERIAHUDERIA: Risk and impact assessment of AI systems for human rights, democracy and the rule of lawHUDERIA is the Council of Europe's method for assessing AI risks to human rights, democracy and the rule of law. Its four elements, scoring and who uses it.Methodology and Model adopted, non-bindingLawCouncil of Europe AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)The Council of Europe AI Convention is the first binding international treaty on AI. Who has signed and ratified, what it asks of parties and when it applies.Open for signature, not yet in forceVoluntary frameworkG7 Hiroshima Code of ConductHiroshima Process International Code of Conduct for Organizations Developing Advanced AI SystemsThe G7 Hiroshima Code of Conduct sets 11 voluntary actions for advanced AI developers, with OECD HAIP reporting. What it asks and who reports under HAIP 2.0.Voluntary, reporting framework v2.0 liveVoluntary frameworkUNESCO AI Ethics RecommendationUNESCO Recommendation on the Ethics of Artificial IntelligenceUNESCO's Recommendation on the Ethics of AI is the global standard its member states adopted in 2021. Its values, principles and Ethical Impact Assessment.Adopted November 2021

All International frameworks

Aicura in Qatar

Frameworks elsewhere

Guides

Questions

Does Qatar have an AI law?

No. Qatar has no AI-specific law. AI is governed through the Personal Data Privacy Protection Law, the Qatar Central Bank's Artificial Intelligence Guideline for licensed financial institutions, and the QFC Data Protection Regulations for firms in the Qatar Financial Centre.

Who regulates data protection in Qatar?

The National Cyber Governance and Assurance Affairs of the National Cyber Security Agency administers and enforces the Personal Data Privacy Protection Law under Amiri Decree No. 1 of 2021. Inside the Qatar Financial Centre, the QFC Data Protection Office supervises the QFC Data Protection Regulations.

What does the QCB AI Guideline require?

Board accountability for AI outcomes, an AI register disclosed to QCB every year, a risk classification that flags high-risk systems, QCB approval before new, materially changed or high-risk AI goes live, a human oversight protocol for every system, and customer disclosure with a route to human review.

Is there a right not to be subject to automated decisions in Qatar?

Inside the Qatar Financial Centre, yes. Article 22 of the QFC Data Protection Regulations 2021 gives that right, with exceptions for contracts, applicable laws and explicit written consent. The PDPPL has no equivalent article, though individuals can object to processing that is discriminatory or unfair, and QCB-licensed entities must offer a human review of negative automated decisions.

Start with the AI you run.

Every framework begins with knowing which AI systems and agents you have. The AI register is free to start.

Sign upContact us