By 
Qatar's AI governance picture in 2026 is more developed than the common "still emerging" framing suggests. While there is no horizontal AI Act equivalent to the EU AI Act, the country has moved significantly in 2024 and 2025 from policy intention to operational instruments. The Qatar Central Bank's AI Guideline took effect in September 2024 with mandatory obligations for licensed financial institutions. The National Cyber Security Agency published Guidelines for the Secure Adoption and Use of AI in 2024. MCIT released the Principles and Guidelines for Ethical Development and Deployment of AI in 2025. The Qatar Financial Markets Authority issued draft AI regulations in May 2025. For businesses operating in Qatar, the practical compliance question is no longer "is there anything to comply with" but rather "which combination of these instruments applies to this deployment."
Vision 2030 and the strategic context
Qatar's AI strategy sits inside the broader Qatar National Vision 2030 framework and its operational successors. The Third National Development Strategy 2024-2030 (NDS-3) identifies AI as a priority sector for economic diversification. The National Digital Agenda 2030, announced by MCIT in support of NDS-3, is the operational roadmap for digital and AI transformation across the public and private sectors.
Within this context, Qatar's National AI Strategy was launched by MCIT in 2019 and has been refreshed through subsequent policy work. The strategy is structured around six interconnected pillars covering education and human capital, data and infrastructure, AI for impact in priority sectors, ethics and policy, business and industry, and AI for societal benefit. The strategy itself is policy guidance, not enforceable law. Its operational expression runs through the Artificial Intelligence Committee, MCIT, and the sector-specific regulators that issue binding rules.
Key institutions
Artificial Intelligence Committee (Cabinet Decision No. 10 of 2021)
The Artificial Intelligence Committee was established under Cabinet Decision No. 10 of 2021, with Mr. Hassan Jassim Al Sayed appointed as chairman. The Committee coordinates AI initiatives across government entities, oversees implementation of Qatar's AI Strategy, supports emerging AI companies and research, and represents Qatar in international AI fora. It is the central inter-ministerial coordination body for AI governance.
Ministry of Communications and Information Technology (MCIT)
MCIT is the lead policy ministry for AI. It oversees the National Digital Agenda 2030, supports the AI Committee, runs the GovAI Program for public sector AI adoption, and issued the 2025 Principles and Guidelines for Ethical Development and Deployment of AI. The minister of MCIT (currently H.E. Mohammed bin Ali Al Mannai) signs major partnerships including the February 2025 strategic agreement with Scale AI.
National Cyber Security Agency (NCSA)
The NCSA is responsible for cybersecurity policy and oversight in Qatar. The agency's National Cyber Governance and Assurance Affairs (NCGAA) administers and enforces the PDPPL. NCSA also published the Guidelines for the Secure Adoption and Use of AI in 2024, which provide technical cybersecurity guidance for AI systems including secure development lifecycle, vulnerability testing, incident response, and data residency or encryption requirements.
Qatar Central Bank (QCB)
QCB regulates banking, insurance, and fintech. Its AI Guidelines for licensed financial institutions entered into force in September 2024 and impose mandatory obligations including AI strategy and governance structures, risk assessments, human oversight, classification of high-risk AI systems, and reporting of high-risk systems to the regulator.
Qatar Financial Markets Authority (QFMA)
QFMA regulates capital markets. In May 2025, QFMA announced draft AI regulations aligned with its Strategic Plan 2023-2027, addressing transparency, accountability, data protection, and the use of regulatory technology (RegTech) and supervisory technology (SupTech) in capital markets.
Qatar Computing Research Institute (QCRI)
QCRI, part of Hamad Bin Khalifa University (HBKU), is Qatar's flagship AI research institution. While not a regulator, QCRI shapes national AI policy through research collaboration with government and industry. HBKU has also become a venue for AI ethics dialogue, including its work on the national AI ethics charter discussions.
Qatar Financial Centre (QFC)
The QFC free zone operates its own legal framework, including its own data protection rules. The PDPPL specifically excludes the QFC, meaning AI deployments in QFC are subject to QFC Authority rules rather than the federal PDPPL.
The Personal Data Privacy Protection Law (PDPPL, Law No. 13 of 2016)
The PDPPL is Qatar's primary data protection law and the first comprehensive data protection law in the Gulf Cooperation Council region. It came into full effect in 2017 and is enforced by the NCGAA under NCSA, with policy oversight from MCIT.
Scope
The PDPPL applies to personal data processed electronically, collected for electronic processing, or processed through a combination of electronic and traditional methods. It excludes:
- Personal data processed by individuals within a private or family scope
- Personal data processed for official statistical purposes under Law No. 2 of 2011
- The Qatar Financial Centre, which has its own data protection regime
Core obligations
- Lawful basis: consent is the default; processing is permitted on other bases including legal obligation, contractual necessity, vital interests, and other narrow grounds.
- Data subject rights: access, correction, deletion, withdrawal of consent, objection to processing.
- Special-nature data: heightened protection for data revealing ethnic origin, children, health, physical or psychological condition, religious beliefs, marital status, criminal records. Processing such data requires permission from the Competent Department.
- Personal data management system: controllers must implement technical, administrative, and financial measures appropriate to the data they handle.
- DPIA expectation: implied through Articles 11 and 13. The PDPPL Guidelines (issued January 2021) recommend DPIAs for processing that could harm data subjects' privacy. Failure to conduct a DPIA can attract fines up to QAR 1 million.
- Breach notification: required where a breach may "cause serious damage" to personal data or privacy. The PDPPL Guidelines specify a 72-hour notification window from the breach being detected.
- Cross-border transfers: restricted unless the receiving country provides adequate protection or appropriate safeguards apply.
Penalties
Penalties under the PDPPL range from QAR 1 million to QAR 5 million (approximately USD 275,000 to USD 1.38 million) per violation:
- Up to QAR 5 million for failure to put in place appropriate technical and organisational measures commensurate with the data.
- Up to QAR 1 million for failure to notify a breach to the NCGAA or affected individuals.
- Up to QAR 1 million for failure to conduct a required DPIA.
- Repeat offences can attract doubled penalties.
The PDPPL also contemplates criminal liability for responsible natural persons in connection with certain offences, with penalties pursued through Qatar's administrative and criminal channels.
Sector-specific AI instruments
QCB AI Guideline (in force September 2024)
The Qatar Central Bank's AI Guideline applies to all QCB-licensed financial institutions including banks, insurance companies, and fintechs. Mandatory obligations include:
- An institutional AI strategy and governance structure
- AI risk assessments aligned with the firm's broader risk management framework
- Human oversight of AI-driven decisions
- A defined classification methodology for "high-risk" AI systems
- Reporting of high-risk AI systems to QCB
- Documentation, testing, and monitoring requirements
The Guideline sits alongside QCB's existing rules on outsourcing, model risk management, and consumer protection.
NCSA Guidelines for Secure Adoption and Use of AI (2024)
NCSA's 2024 guidelines focus on the cybersecurity dimensions of AI systems. They cover:
- Secure development lifecycle protocols
- Vulnerability and adversarial testing
- Incident response mechanisms specific to AI
- Data residency and encryption safeguards
- Supply-chain security for AI components
The guidelines complement the PDPPL's security requirements and the QCB AI Guideline's risk management expectations.
MCIT Principles and Guidelines for Ethical Development and Deployment of AI (2025)
MCIT's 2025 ethical framework categorises AI systems based on potential impact and recommends graduated controls. For higher-impact systems, it recommends:
- Data Protection Impact Assessments (DPIAs)
- Discrimination Impact Assessments (DIAs)
- Documentation and human oversight requirements
- Alignment with PDPPL obligations and OECD/UNESCO international standards
The framework is non-binding but authoritative. Government procurement and inter-ministerial coordination increasingly reference it as a baseline.
QFMA draft AI regulations (May 2025)
QFMA's draft regulations for AI in capital markets, aligned with its Strategic Plan 2023-2027, address transparency, accountability, data protection, and the use of RegTech and SupTech for market supervision. As of April 2026, the regulations remain in draft form pending finalisation. Capital market participants should monitor QFMA announcements for the final text.
The GovAI Program and major initiatives
MCIT launched the GovAI Program as a national initiative to accelerate AI adoption across government entities. The program supports use case development, partner enablement, and impact assessment for public sector AI deployments aligned with the Digital Agenda 2030.
In February 2025, MCIT signed a five-year strategic partnership with Scale AI to develop more than 50 AI-driven government use cases by 2029. Qatar has also launched a joint UK-Qatar AI research commission (December 2024) led by Queen Mary University of London and Hamad Bin Khalifa University.
On the technology side, Fanar is a national initiative to develop large-scale Arabic language models, which is likely to attract specific rules around linguistic bias and cultural data sovereignty as the project matures.
Other relevant statutes
- Law No. 14 of 2014 on Combating Cybercrimes: addresses unauthorised access, misuse of digital information, identity theft, and online fraud. Applicable to AI systems used in or against digital infrastructure.
- Decree-Law No. 16 of 2010 on Electronic Commerce and Transactions: provides legal recognition for electronic contracts, digital signatures, and online transactions, relevant to AI-driven platforms in e-commerce.
- Law No. 11 of 2004 (Penal Code): applies to AI-related offences such as deepfakes that are otherwise within criminal scope.
A practitioner's compliance plan
Step 1: Map jurisdiction and applicable instruments
For each AI deployment, identify whether it operates onshore Qatar (PDPPL applies) or in the QFC (QFC Authority rules apply). Then identify which sectoral regulators have authority: QCB for licensed financial institutions, QFMA for capital market participants, MCIT and NCSA for cross-cutting governance, and the Ministry of Public Health for healthcare AI.
Step 2: PDPPL compliance baseline
For all in-scope deployments, ensure PDPPL compliance: lawful basis (typically consent), purpose limitation, proportionality, security measures, breach response with 72-hour notification, DPIA where indicated, and special protections for data of special nature. Document the compliance approach in a personal data management system.
Step 3: Layer in sectoral obligations
For QCB-licensed entities, implement the AI Guideline obligations: AI strategy, governance, risk assessments, human oversight, high-risk classification, and regulator reporting. For QFMA-supervised entities, monitor the finalised AI regulations and prepare for transparency, accountability, and SupTech requirements. For healthcare AI, comply with Ministry of Public Health rules on patient data and clinical AI validation. For all sectors, address NCSA cybersecurity guidelines and align with MCIT's ethical framework.
Step 4: Build governance roles and documentation
Appoint clear roles for AI risk management, including someone equivalent to a DPO for personal data and a senior owner for AI risk in higher-risk deployments. Maintain documentation covering use case rationale, data flows, DPIA and DIA outputs (where MCIT's framework recommends), bias testing, model cards, and human-oversight design.
Step 5: Plan for the forthcoming AI law
Industry analyses anticipate a formal national AI law that may codify today's ethical principles, formalise impact assessments, and establish a centralised registry for high-risk AI systems. Aligning current programmes with international frameworks such as ISO/IEC 42001 and the NIST AI Risk Management Framework reduces transition cost when binding rules are introduced.
Compliance FAQ
Does Qatar have a dedicated AI law?
Not yet. As of April 2026, AI compliance in Qatar is anchored on the binding PDPPL plus a layered set of binding sectoral instruments (QCB AI Guideline, draft QFMA regulations) and authoritative non-binding guidance (NCSA cybersecurity guidelines, MCIT ethical principles). Industry analysts anticipate a formal national AI law in due course.
What are the maximum penalties under the PDPPL?
Up to QAR 5 million (approximately USD 1.38 million) per violation, with QAR 1 million ceilings for specific failures (DPIA, breach notification). Penalties can be doubled for repeat offences. Criminal liability can apply to responsible natural persons for certain offences.
Does the PDPPL apply to AI systems in the Qatar Financial Centre?
No. The PDPPL specifically excludes the QFC, which has its own data protection regime under the QFC Authority. AI deployments in the QFC must address QFC-specific requirements rather than the federal PDPPL.
What does QCB require from AI use in financial services?
QCB-licensed financial institutions must implement an institutional AI strategy and governance structure, conduct AI-specific risk assessments, maintain human oversight, classify high-risk AI systems against a defined methodology, and report high-risk systems to QCB. The Guideline took effect in September 2024.
How does Qatar's framework compare to GDPR?
The PDPPL is conceptually aligned with GDPR principles (lawfulness, purpose limitation, data minimisation, accuracy, security, individual rights) but has important differences: a narrower extraterritorial scope than GDPR, different enforcement architecture (NCGAA under NCSA), QFC excluded from federal coverage, and the 72-hour breach notification window comes from the PDPPL Guidelines rather than the law text itself. A GDPR programme is a useful starting point but cannot be relied on without a Qatar-specific gap analysis.
Are MCIT's 2025 ethical principles legally binding?
No. The MCIT Principles and Guidelines for Ethical Development and Deployment of AI are non-binding policy guidance. They shape regulator expectations, government procurement, and likely the contours of any forthcoming AI law, but they do not directly impose fines. Sector regulators (QCB, QFMA) can incorporate the principles into their binding rules, and have begun doing so.
The bottom line
Qatar's AI compliance picture is more developed than it is sometimes portrayed. The PDPPL is binding and enforceable. The QCB AI Guideline is in force for financial institutions. NCSA cybersecurity guidance and MCIT ethical principles shape what regulators expect of AI deployments even where they do not directly impose fines. QFMA's draft regulations, the GovAI Program, the Scale AI partnership, and the Fanar project all signal that the operational reality will continue to develop quickly. For businesses building or deploying AI for the Qatari market, the durable compliance posture is to map each deployment against the PDPPL, identify the sectoral regulator that applies, build governance aligned with NIST AI RMF or ISO/IEC 42001, and track regulator announcements as the system matures toward a likely future AI law.
Last updated: April 2026. This article is educational content and is not legal advice. Qatar's AI regulatory framework is evolving with binding sectoral instruments and likely future codification. Consult qualified counsel before making compliance decisions.