> For the complete documentation index, see [llms.txt](https://docs.solcis.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.solcis.ai/references/ai-regulatory-landscape/the-middle-east/ai-compliance-in-qatar.md).
# AI compliance in Qatar
AI compliance in Qatar: enforce your controls on what your AI systems do, with data and evidence held in-country, across PDPPL, NCSA, QFC and QCB requirements.
*You bring your adopted compliance controls. Solcis Compliance Studio maps them to whichever Qatari regime applies, and the Solcis Policy Engine enforces them on what your AI systems do, with data and evidence held in-country.*
AI compliance in Qatar means enforcing your adopted controls on what your AI systems do, with each control traceable to the clause it satisfies, independently verifiable evidence of every decision, and data and evidence held in-country. It aligns with Qatar's push for local AI infrastructure and supports your compliance with whichever Qatari obligations apply: PDPPL, NCSA guidance, the QFC regime, or QCB requirements for licensed financial institutions. It is the jurisdiction-specific case of [runtime AI compliance](/references/concepts/runtime-ai-compliance.md).
## Key takeaways
* Which regime applies depends on where your entity is registered and your sector. PDPPL sets the mainland baseline, the QFC runs its own GDPR-aligned regime, and the QCB sets mandatory AI rules for licensed financial institutions.
* Qatar has no AI law. The QCB AI Guideline is the one mandatory AI-specific instrument, and it requires QCB approval before launching any AI system and before deploying any fully autonomous one.
* PDPPL does not restrict cross-border data flows – Article 15 prohibits controllers from doing so in most cases. In-country requirements come from sector rules, notably QCB's Cloud Computing Regulation.
* Sovereignty is a stated national strategy – Qatar National Vision 2030, the Digital Agenda 2030, Fanar and Qai – not just a response to compliance pressure.
* Sovereignty answers where your data and infrastructure sit. AI compliance answers what your AI systems are allowed to do under whichever Qatari regime applies. Both are required.
* Onshore infrastructure, from MEEZA to Ooredoo to the hyperscaler regions, is where the evidence is hosted. The Solcis Policy Engine enforces your adopted controls, and Solcis Compliance Studio holds and reports the resulting evidence.
## What's shaping AI compliance in Qatar?
AI compliance in Qatar is shaped by a state-led sovereign AI ecosystem, a small number of regulators with broad mandates, and mandatory AI rules in the financial sector.
[Qatar National Vision 2030](https://www.gco.gov.qa/en/state-of-qatar/qatar-national-vision-2030/our-story/) set a knowledge-based economy as a national goal. Qatar's National AI Strategy followed in October 2019, built on a blueprint from the Qatar Computing Research Institute (QCRI), and a national AI Committee was established at the Ministry of Communications and Information Technology (MCIT) in 2021. The [Qatar Digital Agenda 2030](https://www.qna.org.qa/en/News-Area/News/2024-02/27/0088-ministry-of-communications-and-information-technology-launches-digital-agenda-2030), launched in February 2024, names technology and AI capability as core to delivering the vision.
That ambition is backed by infrastructure and models, not just policy. [Fanar](https://www.fanar.qa/en), a sovereign Arabic AI platform developed and operated by QCRI at Hamad Bin Khalifa University with MCIT, was [inaugurated on 10 December 2024](https://www.qna.org.qa/en/News-Area/News/2024-12/10/0033-prime-minister-and-minister-of-foreign-affairs-inaugurates-arabic-ai-large-language-model-fanar). [Fanar 2.0](https://arxiv.org/abs/2603.16397), a 27-billion-parameter model built on Google's open-weight Gemma 3 base, followed in December 2025, adding FanarGuard, a bilingual moderation filter, and an agentic tool-calling framework for multi-step workflows. QCRI has said [Fanar 3.0](https://thepeninsulaqatar.com/article/10/12/2025/fanar-20-a-major-leap-in-arabic-ai-technology) is targeted for December 2026.
Compute is scaling too. Ooredoo launched a [sovereign AI cloud on NVIDIA GPUs](https://www.ooredoo.com/en/media/news_view/ooredoo-deploys-nvidia-accelerated-computing-in-qatar-ushers-in-the-countrys-next-wave-of-innovation/) in July 2025 and has announced an [Oracle Alloy](https://www.oracle.com/ae/news/announcement/ooredoo-oracle-collaborating-to-provide-ai-and-cloud-computing-services-2026-02-16/) sovereign cloud. In December 2025 the Qatar Investment Authority launched [Qai](https://www.gco.gov.qa/en/media-centre/top-news/qatar-launches-qai-to-power-its-global-ai-ambitions/), a national AI company focused on compute and infrastructure, and [Brookfield and Qai announced a US$20 billion AI infrastructure partnership](https://www.qia.qa/en/Newsroom/Pages/Brookfield-and-Qai-Form-$20-Billion-Strategic-Investment-Partnership-for-AI-Infrastructure.aspx) that includes a compute centre in Qatar.
Regulatory responsibility is concentrated in a few bodies with broad mandates. The [National Cyber Security Agency](https://ncsa.gov.qa/en) (NCSA) owns national cyber security and also administers PDPPL through its [personal data privacy protection function](https://ncsa.gov.qa/en/pages/personal-data-privacy-protection-department), part of its National Cyber Governance and Assurance Affairs division. The law was originally administered by the Ministry of Transport and Communications. In February 2024 the NCSA published voluntary [Guidelines for Secure Adoption and Usage of AI](https://assurance.ncsa.gov.qa/sites/default/files/publications/policy/2024/CSSP_Guidelines_for_Secure_Usage_and_Adoption_of_Artificial_intelligence-Eng-v1.0_2.pdf), covering governance, risk, security controls, testing and oversight across the AI lifecycle.
Financial services adds a mandatory layer. The [Qatar Central Bank's AI Guideline](https://www.qcb.gov.qa/Services/Financial%20Technology/QCB_Artificial_Intelligence_Guideline.pdf), in force since 4 September 2024, requires licensed financial institutions to keep an AI register, run board-level AI governance, and obtain QCB approval at several points in an AI system's life. The Qatar Financial Centre (QFC) is a separate legal jurisdiction with its own GDPR-aligned Data Protection Regulations. An organisation with a mainland entity, a QFC entity and a QCB-licensed entity answers to three separate regimes at once, not one national law with sector rules on top.
## Which regulations and regulators bear on AI systems in Qatar?
Which regime applies depends on where your entity is registered and whether it is a QCB-licensed financial institution. The table sets out what each instrument requires and what it means for an AI system operating inside it.
| Regulation / instrument | What it requires | Relevance to AI systems |
| ---------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **PDPPL, Law No. 13 of 2016** (mainland Qatar, in force since January 2017) | Consent and processing safeguards, and individual rights to withdraw consent, object to processing that is unnecessary, excessive, discriminatory, unfair or illegal, and to erasure, correction and access. Article 15 prohibits controllers from restricting cross-border data flows except where processing would breach the law or seriously harm the individual. Administered by the NCSA, with fines of up to QAR 1 million or QAR 5 million depending on the article breached. | PDPPL has no specific right concerning automated decisions. An AI system processing personal data is subject to the same safeguards and objection rights as any other processing, and automated decision-making is a factor in assessing whether a breach causes serious harm. |
| **NCSA Guidelines for Secure Adoption and Usage of AI** (February 2024, voluntary) | Lifecycle-wide governance across people, process and technology, including human oversight, risk management, security controls and testing. No direct penalties. | The clearest Qatar-wide reference point for documenting that an AI system's actions meet an acceptable standard of care, published by the body that also administers PDPPL. |
| **QFC Data Protection Regulations 2021** (Version 3, amended December 2023; QFC-registered entities) | A separate, GDPR-aligned regime. Article 22 gives individuals a right not to be subject to solely automated decisions with legal or similarly significant effects, subject to exceptions, with human intervention available. Article 27 requires a DPIA for high-risk processing, including automated processing or profiling with legal or significant effects. Enforced by the QFC Data Protection Office, with fines of up to US$1.5 million per infringement. | An AI system making solely automated decisions with legal or significant effects needs a lawful exception and human intervention on request, which makes human-in-the-loop checkpoints the practical default. |
| **QCB AI Guideline** (QCB-licensed financial institutions, in force since 4 September 2024) | Mandatory for licensed institutions. Requires an AI register disclosed to QCB, board and senior-management accountability, and QCB approval before launching or materially changing any AI system, before signing any high-risk AI purchase, licensing or outsourcing agreement, of test results for new high-risk systems, and for any fully autonomous system. Systems that decide consumer access to financial services must be treated as high-risk, and decisions made without human involvement must be open to human review. | Fully autonomous AI systems are gated by QCB approval, and high-risk decisions need a human-review path. A licensed institution must be able to show which systems are approved and how each decision was controlled. |
*Qatar's AI compliance landscape: PDPPL's mainland baseline, the NCSA's AI guidelines, the QFC's separate regime, and the QCB AI Guideline for financial institutions.*
Qatar has no AI law. MCIT has published non-binding ethical AI principles and guidelines and consulted on a [draft National AI Policy](https://prod16-assets.sprinklr.com/prod16-cdata/DAM/160136/9d77e677-a7f4-4659-a890-8e723c53e6dc-1081146622/MCIT_National_AI_Policy_Consul.pdf) in September 2025. In April 2026 the [Shura Council debated AI governance](https://qna.org.qa/en/news/news-details?id=qatar-shura-council-debates-ai-governance-and-refers-draft-legislation-to-committees\&date=27/04/2026) and referred the matter to committee.
## What data-residency rules apply?
PDPPL does not require data to stay in Qatar. In-country requirements come from sector and government rules instead:
* **Financial services.** QCB's [Cloud Computing Regulation](https://www.qcb.gov.qa/Documents/InformationSecurity/Cloud%20Computing%20Regulation.pdf) (April 2024) requires QCB approval for any cloud arrangement, and requires the primary storage and processing of personal, sensitive and financial data to be in Qatar unless QCB approves otherwise. QCB's data handling and protection rules add further residency requirements for sensitive data.
* **Government and critical sectors.** The NCSA's National Data Classification Policy sets classification levels for government and critical-sector data, and the controls that apply to each level shape where that data can be hosted.
## What's distinctive here?
Qatar's compliance landscape is distinctive on three counts.
**One agency for cyber security and data protection.** The NCSA administers PDPPL and sets national cyber security policy, and has published its own AI guidance on top. Most jurisdictions split those responsibilities across separate regulators.
**Mandatory AI approval in financial services.** The QCB AI Guideline requires regulatory approval before a licensed institution launches any AI system, contracts for a high-risk one, or deploys a fully autonomous one. That is further than most financial regulators have gone on AI governance.
**A separate jurisdiction inside the country.** The QFC runs its own GDPR-aligned regime under its own regulator. Being registered in Qatar does not mean being under one law.
## Why does sovereignty matter for AI systems in Qatar?
Digital sovereignty is a national policy in Qatar, set out through the Digital Agenda 2030, rather than a preference organisations adopt on their own. It shapes where an AI system's data and infrastructure sit, alongside the sector residency rules above.
Local ownership backs that policy at the infrastructure level. [Ooredoo](https://www.ooredoo.com/en/investors/share_information/ownership-structure/) is about 68% held by Qatari government-related entities, and [Vodafone Qatar](https://www.vodafone.qa/en/investor-relations/shareholder-structure/major-shareholders) is 56.81% Qatari-controlled.
Fanar applies the same logic to the model layer. It is developed, trained and operated at QCRI on an open-weight base model, keeping the model an AI system relies on for reasoning and tool-calling under local operational control.
However, hosting an AI system on Qatari-owned infrastructure only answers the residency question. It says nothing about whether the system's actions are compliant – that is a separate, ongoing check on each action the system takes, which a hosting location cannot settle on its own.
## Applying AI compliance in Qatar
Applying AI compliance in Qatar means applying the [properties of runtime AI compliance](/references/concepts/runtime-ai-compliance.md) to Qatar's regulatory inputs: PDPPL, the NCSA's AI guidelines, the QFC's Data Protection Regulations and the QCB AI Guideline.
* **Preventive enforcement at the action boundary.** The Solcis Policy Engine evaluates the intended action against the applicable controls before it executes wherever possible, returning `Allow`, `Deny` or `Escalate` with a severity rating.
* **Control-to-clause traceability.** In Solcis Compliance Studio, each adopted control is tied back to the exact clause it satisfies. That might be a QCB approval or human-review requirement, a QFC automated-decision right, a PDPPL processing safeguard, or an NCSA lifecycle-governance recommendation.
* **Runtime enforcement, inline.** Where the Solcis Policy Engine enforces inline, the control fires at the moment the AI system tries to act, and the decision is reached before the action proceeds.
* **Tamper-evident and independently verifiable evidence.** Each decision is recorded cryptographically at the moment it is made, in the Solcis Compliance Studio evidence ledger. An auditor or a QCB inspector can verify that the record is complete and unaltered using standard tooling, without trusting the organisation or Solcis. Verification establishes what the record says and that it has not changed, not that the underlying decision was correct.
To see these in action, consider a QCB-licensed bank whose QCB-approved AI agent assesses personal loan applications. Because the system decides consumer access to financial services, the QCB Guideline requires it to be treated as high-risk, and decisions made without human involvement must be open to human review. The bank has adopted a control, tracing to both requirements, that the agent may recommend but not issue a decline without a credit officer's sign-off.
When the agent attempts to issue a decline on its own, the Solcis Policy Engine escalates rather than letting the action complete, and a credit officer reviews the application and confirms or overturns the recommendation. Solcis Compliance Studio then records a tamper-evident record of the escalation and the officer's decision – auditable evidence that the control was enforced and how the decision was reached.
That record is trustworthy because it is cryptographically verifiable, not because of where it is hosted. Where the evidence physically sits is a separate, residency-specific question, covered next.
## Where can AI compliance be deployed in-country?
Running Solcis Policy Engine decisions, and keeping their evidence in Solcis Compliance Studio, in-country means deploying on onshore infrastructure. Not every option is equally ready, or equally Qatari-owned, and onshore hosting does not rule out offshore ownership.
| Provider | Who they are / what makes them sovereign | Relevance for deploying AI compliance in-country |
| -------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [**MEEZA**](https://www.meeza.net/) | Founded in 2008 by Qatar Foundation and Ooredoo, and [listed on the Qatar Stock Exchange](https://thepeninsulaqatar.com/article/24/08/2023/meeza-lists-on-qatar-stock-exchange) in August 2023. Operates [five data centres (M-VAULTs), three of them Tier III certified](https://www.meeza.net/services/data-centre-services/); M-VAULT 5 hosts Microsoft's Qatar region. | An established national hosting option with a large public-sector and government footprint. |
| [**Ooredoo**](https://www.ooredoo.com/) | About [68% held by Qatari government-related entities](https://www.ooredoo.com/en/investors/share_information/ownership-structure/). Runs a [sovereign AI cloud on NVIDIA GPUs](https://www.ooredoo.com/en/media/news_view/ooredoo-deploys-nvidia-accelerated-computing-in-qatar-ushers-in-the-countrys-next-wave-of-innovation/), launched July 2025, and has [announced an Oracle Alloy sovereign cloud](https://www.ooredoo.qa/web/en/press-release/ooredoo-qatar-announces-strategic-partnership-with-oracle-to-deploy-oracle-alloy-sovereign-cloud-and-ai-platform/) to be operated from its Qatar data centres. | An AI system's compute and compliance evidence can run on Ooredoo's in-country GPU cloud today, with a dedicated Oracle environment to follow. |
| [**Vodafone Qatar**](https://www.vodafone.qa/en/business/services/cloud-and-hosting/coud-services) | Despite the international brand, [56.81% Qatari-controlled](https://www.vodafone.qa/en/investor-relations/shareholder-structure/major-shareholders) through Qatar Foundation-linked entities and the General Retirement and Social Insurance Authority. Offers colocation in partnership with MEEZA and, under a [five-year partnership with Microsoft](https://www.vodafone.qa/en/investor-relations/vodafone-qatar-signs-five-year-partnership-with-microsoft) signed in September 2024, Azure and Azure OpenAI-based cloud and AI services. | An AI system's infrastructure can sit on MEEZA-partnered colocation, or its cloud and AI workloads can run on Vodafone's Azure-based services. Ownership is worth checking directly rather than assumed from the brand name. |
| [**Gulf Data Hub**](https://www.gulfdatahub.ae/) | UAE-headquartered, not Qatari-owned, and backed by a [KKR investment](https://www.businesswire.com/news/home/20250117834785/en/KKR-and-Gulf-Data-Hub-Form-Strategic-Partnership-to-Scale-One-of-the-Middle-Easts-Largest-Independent-Data-Center-Platforms) announced in January 2025. A Doha facility is planned. | Not yet an option: the Doha facility is not live, and once it is, it will not be Qatari-owned. |
| **Hyperscaler regions** (Microsoft, Google Cloud) *Onshore hosting, offshore ownership* | None Qatari-owned. [Microsoft's Qatar Central region](https://news.microsoft.com/en-xm/2022/08/31/microsoft-opens-first-global-datacenter-region-in-qatar-bringing-new-opportunities-for-a-cloud-first-economy/) has been live since August 2022. [Google Cloud's Doha region](https://qfz.gov.qa/google-cloud-region-qfz-launch/), Google's first in the GCC, opened in May 2023 from the Qatar Free Zones. Oracle has no standalone Qatar region; its presence is through Ooredoo's Alloy deployment. AWS has no Qatar region. | These regions let you run the Solcis Policy Engine in-country, subject to any sector approvals such as QCB's for cloud arrangements. |
*Qatar's in-country AI hosting options: MEEZA, Ooredoo, Vodafone Qatar, Gulf Data Hub (planned, not Qatari-owned) and the hyperscaler regions.*
## Frequently asked questions
Does Qatar's PDPPL apply to AI systems?
Yes, whenever an AI system processes personal data on the mainland. PDPPL's consent and processing safeguards and its objection rights apply as they do to any processing. Unlike the QFC regime, PDPPL has no specific right concerning automated decisions.
Does PDPPL require data to stay in Qatar?
No. Article 15 prohibits controllers from restricting cross-border data flows except where processing would breach the law or seriously harm the individual. In-country requirements come from sector rules, notably the QCB Cloud Computing Regulation for financial institutions, and from government data-classification controls.
Is there an AI law in Qatar?
Not yet. The QCB AI Guideline is mandatory for licensed financial institutions, and the NCSA and MCIT have published non-binding AI guidance. MCIT consulted on a draft National AI Policy in September 2025, and the Shura Council referred AI governance to committee in April 2026.
What do the NCSA AI guidelines require?
Human oversight, risk management, security controls and testing across an AI system's lifecycle. They are voluntary, with no penalties, but they are the NCSA's own description of good AI governance. Because the NCSA also administers PDPPL, they are the most concrete Qatar-wide reference point for showing an AI system's controls meet an acceptable standard.
Can AI compliance run in-country in Qatar?
Yes, on MEEZA, Ooredoo's GPU cloud, Vodafone Qatar, or the live Microsoft and Google Cloud regions. Ooredoo's Oracle Alloy cloud has been announced, and Gulf Data Hub's Doha facility is planned.
Is QCB's AI Guideline relevant if we're not a bank?
It applies to QCB-licensed financial institutions. If you supply one, it is relevant indirectly: QCB approval is required before the institution signs a high-risk AI purchase, licensing or outsourcing agreement, and responsibility for AI governance stays with the institution even where a third party builds or runs the system.
***
This page is general information about how Solcis supports work against Qatari instruments. It is not legal or regulatory advice. Confirm your obligations with a qualified professional and the primary source. Last reviewed: 23 September 2026.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.solcis.ai/references/ai-regulatory-landscape/the-middle-east/ai-compliance-in-qatar.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.