AI Regulation Tracker / Financial services and banking
Qatar Central Bank Puts Binding AI Duties on Every Licensed Financial Firm
The Qatar Central Bank issued its Artificial Intelligence Guideline on September 4, 2024. It binds QCB-licensed financial firms to keep an AI strategy, maintain a register of their AI systems, obtain QCB approval before launching AI, run risk and impact assessments, keep a human in the loop, tell customers when AI is in use, and report AI information to the regulator every year. It is widely read as the Gulf's first sector-specific rulebook that actually binds firms rather than merely advising them.
The Qatar Central Bank issued its Artificial Intelligence Guideline on September 4, 2024, under the umbrella of the country's Third Financial Sector Strategy and its FinTech Strategy. The date matters, so I will be plain about it: this is not breaking news. The guideline has been live for well over a year. It earns a place in the tracker because it is one of the few AI instruments in the region that moved past ethics slideware and put enforceable duties on regulated firms, and because a lot of finance teams outside Qatar still do not know it binds their Doha operations.
The instrument applies to QCB-licensed financial firms that use AI systems, and it carries obligations rather than aspirations. As the law firm Pinsent Masons summarized it, firms are obligated to "develop and maintain an updated register of information on all of their AI systems," and "a human oversight protocol is also mandatory for using any AI system." Those are duties, not suggestions.
What a licensed firm actually has to do
Strip out the ethics language, which is real but familiar, and the operating spine of the guideline comes down to seven things a QCB-licensed firm has to have in place.
- An AI strategy. Firms must hold a defined AI strategy that is reviewed periodically, with oversight functions attached to it. This is a governance document that a supervisor can ask to see.
- A register of AI systems. Firms must keep a current inventory of every AI system in use. You cannot govern what you have not written down, and the QCB expects the list to exist and stay updated.
- Pre-approval before launch. A firm must obtain official approval from the QCB before launching a new AI system. For high-risk systems, the approval requirement bites even earlier, before the firm signs the purchase or licensing agreement.
- Risk and impact assessments. Firms must run a risk management system to evaluate and handle AI-related risks and conduct impact assessments on their AI use.
- Human oversight. A human oversight protocol is mandatory for any AI system. A model cannot be the final decision-maker with no accountable person behind it.
- Customer notification. Firms are expected to notify customers when they are interacting with an AI system and to inform them about decision-making processes that involve AI.
- Annual disclosure to the regulator. Firms must provide the QCB with prescribed information about their AI systems, including risks and provider details, annually and on request.
The pre-approval gate is the sharp edge
Most AI governance frameworks tell you to document, assess, and monitor. That is useful, but it is all things you do on your own clock. The QCB guideline adds something with more teeth: a regulator sign-off before deployment. You do not simply run your own risk assessment and go live. You get the QCB's approval first, and for high-risk systems you get it before you even contract for the tool.
That single design choice changes procurement. A high-risk AI vendor decision in a Qatar-licensed firm is no longer just a commercial and risk exercise. It is a regulatory milestone with a gatekeeper who can say no. Vendor timelines, contract signing, and go-live dates all now sit downstream of a QCB approval that a firm cannot schedule around.
Binding, but read the label precisely
I want to be exact about status, because the word "guideline" invites people to wave it off. This is a guideline in name, and it is not an act of parliament. But it is issued by the central bank to the entities it licenses, and the QCB enforces it through the same supervisory and licensing machinery it uses for everything else it expects of licensed firms. For a regulated institution, a central bank expectation with a pre-approval requirement functions as a binding rule, because ignoring it is a supervisory problem, not a philosophical one. Commentators have described it as the first sector-specific AI rulebook in the Gulf that genuinely binds firms rather than merely guiding them, and that framing is fair as long as you keep it in its lane: it binds QCB-licensed financial entities, and it is a supervisory instrument, not a criminal statute.
Why a US finance professional should care
If your firm is purely domestic, this is context, not homework. If it is not, read closer. A US bank, asset manager, or insurer that operates a Qatar-licensed subsidiary or branch is inside the perimeter of this guideline for that entity. That subsidiary's AI use is subject to the QCB's pre-approval gate, its register requirement, its human oversight protocol, its customer notification expectation, and its annual disclosure duty.
The practical trap is a global AI model that assumes one internal approval path. A tool that a US parent green-lights centrally still cannot go live in the Qatar entity until the QCB approves it, and a high-risk tool cannot even be contracted for the Qatar entity until the QCB approves it. Finance and compliance leaders running cross-border AI deployments need to treat Doha as a jurisdiction with its own gate, add the QCB approval step into the deployment plan, and make sure the local register and annual disclosure actually get produced. This is the same pattern showing up across financial regulators worldwide: a named human stays accountable, the regulator wants an inventory, and AI cannot go live in the dark. Qatar simply put a pre-approval lock on the front of it.
Questions professionals are asking
Is the QCB AI Guideline actually binding, or just guidance?
It is binding on QCB-licensed financial firms. The Qatar Central Bank issued it to the entities it licenses and enforces it through its supervisory and licensing authority, including a requirement that firms obtain QCB approval before launching AI systems. It is a supervisory instrument rather than a statute or a court ruling, but for a regulated firm it functions as a rule, not optional advice.
When did it take effect?
The QCB issued the Artificial Intelligence Guideline on September 4, 2024. It has been in force since then and is treated as a live supervisory expectation now, which is why firms operating in Qatar should already be complying rather than planning to.
What does the pre-approval requirement cover?
Firms must obtain official QCB approval before launching a new AI system. For high-risk systems the requirement is stricter: the QCB's approval is needed before the firm signs the purchase or licensing agreement, so the regulator sits upstream of both the contract and the go-live.
Does this reach US banks or asset managers?
It reaches their Qatar-licensed entities. A US group with a QCB-licensed subsidiary or branch must run that entity's AI through the guideline: the AI strategy, the register of AI systems, the QCB pre-approval gate, human oversight, customer notification, and annual disclosure. Central internal approval by a US parent does not substitute for QCB approval.
What has to go in the register of AI systems?
Firms must develop and maintain an updated register of information on all of their AI systems, and provide the QCB with prescribed information about those systems, including associated risks and provider details, annually and on request. In practice, the register is the inventory the regulator draws on for its annual disclosure.
RELATED BRIEFINGS
Browse the full AI Regulation News tracker
Informational analysis for working professionals, not legal or compliance advice. Confirm how the QCB Artificial Intelligence Guideline applies to your licensed entity with qualified Qatar counsel and the Qatar Central Bank.