Qatar - AI Guidelines for Banks

Overview

The QCB Artificial Intelligence Guideline (issued 4 September 2024) sets mandatory expectations for QCB‑licensed entities that develop, procure, outsource, operate or provide AI systems. It adopts a risk‑based lifecycle approach requiring corporate governance, board and senior management accountability, dedicated AI governance functions, an AI Register and prior QCB approval for material changes and High‑Risk AI. The Guideline also prescribes human oversight protocols, data governance and TRiSM security programs, disclosure and customer recourse mechanisms, outsourcing controls, documentation and monitoring, and alignment with Qatar's data protection law. The primary text is published by QCB: Artificial Intelligence Guideline (QCB) and appears as Annex 160 to QCB Instructions to Banks 2024: QCB Instructions to Banks 2024 (Annex index). The Guideline aims to foster responsible innovation while protecting customers, financial stability and data privacy.

Definitions

The Guideline defines key terms used throughout, such as 'AI Model', 'AI System', 'High‑Risk AI', 'Human Oversight', 'Material AI Portfolio', 'Provider', 'User', 'Register', 'Training/Validation/Testing Data' and 'AI TRiSM'. 'High‑Risk AI' covers systems with potential to cause significant negative impact on operations, the financial system or individuals (e.g., affecting access to financial services, employee decisions, or processing sensitive personal information). Human Oversight protocols are classified into AI‑assisted decision‑making, human exception oversight and fully autonomous AI, with escalating controls for systems with less human control.

Governance and Institutional Framework

The Guideline places accountability with the Board of Directors (BOD) and senior management. Boards must approve AI risk appetite and exposures, assess governance structures, assign clear lines of accountability, and ensure resourcing. Senior management must include members knowledgeable in technology/AI risk and be responsible for assessment, monitoring and allocation of responsibilities across AI lifecycle activities. Entities are required to establish (or designate) a function to oversee AI, create committees for assessing AI use cases, and adopt an AI Governance Policy covering audits, documentation, role allocation, training, and controls. QCB oversight powers allow it to review policies and require sandbox evaluation. See the QCB original Guideline for the corporate governance clauses: QCB AI Guideline (Annex 160).

Key Focus Areas

The Guideline’s substantive obligations fall into several focus areas: 1) Risk management: risk assessments, criticality analysis, identification of 'High‑Risk' systems and integration into enterprise risk frameworks; 2) Register & approvals: maintaining a full AI Register and annual disclosure to QCB, and prior QCB approval for new or materially modified AI systems and for purchase/licensing/outsourcing of High‑Risk AI; 3) Human oversight: mandatory oversight protocols, supervisor training and tools, stop/kill switch requirements for fully autonomous systems, and defined human exception monitoring processes; 4) AI lifecycle and data governance: separate training/validation/testing datasets, quality checks, bias testing, independent validation where appropriate, archiving of original datasets and version control; 5) Outsourcing: due diligence, Board approval, contractual audit and exit clauses, confidentiality and continuity protections; 6) Security/TRiSM: model security, DLP, anomaly detection, defenses against prompt injection and query attacks, and alignment with sector security rules; 7) Transparency & customer protection: notification, plain language disclosures, instructions for use, ability to request review and corrective action, and opt‑out considerations; 8) Monitoring and documentation: ongoing monitoring systems, audit logs, versioning and robust documentation of design choices, metrics and validation results.

Implementation Framework

Entities must implement the Guideline proportionate to size, complexity and materiality of AI use. Required elements include a documented framework for High‑Risk AI (written policies, procedures and instructions covering design, verification, testing, development quality assurance and post‑launch reviews), a TRiSM program for security and trust, an AI Register capturing classification, provider details, human oversight protocol, contract dates and third‑party assessments, and Board‑approved outsourcing decisions. Entities acting as Providers must be able to supply QCB the full lifecycle and technical data for user entities. For High‑Risk systems, entities must submit training, validation and testing outcomes for QCB review and may be directed into a sandbox for further evaluation prior to approval.

Monitoring and Evaluation

Entities must maintain auditable records of AI system performance, establish monitoring systems that collect operational experience and outcomes (including provider reports), perform periodic risk assessments and reviews, and document the date of most recent audits and next planned audits. Monitoring must include automated and human controls to detect drift, bias and technical anomalies; entities must report serious incidents to QCB when a causal link (or reasonable likelihood) is established. Regular performance metrics, model‑version logs, and archived datasets must be retained to allow retrospective review.

Penalties, Liability, and Appeals

The Guideline itself references QCB’s supervisory and enforcement toolkit; non‑compliance may trigger QCB directions, audits, mandatory remediation, fines or other administrative measures under the QCB Law and Instructions. Entities remain principal for acts or omissions of outsourcing providers. Exemptions may be requested from QCB with documented business justification and an expiration date; QCB approval is required for exemptions. For customer disputes, the Guideline requires internal review mechanisms, two‑choice processes for customers affected by AI decisions (resubmit data or request human review), and standard complaint handling. Specific monetary penalties are governed by QCB sanctions frameworks and other applicable laws (including personal data protection penalties under Law No. 13 of 2016).

Relationship to Other Instruments

The Guideline sits within QCB’s Instructions to Banks and connects to multiple secondary instruments. It explicitly requires compliance with: QCB Sector‑Specific Security Regulation; Law No. 13 of 2016 on Personal Data Privacy Protection; QCB Technology Risks Circulars (e.g., January 2018); QCB Cloud Computing Regulation 2024 (where cloud AI is used); and other QCB regulations/guidelines. Entities must align AI policies with national data protection obligations and applicable sector rules. The Guideline supplements—not replaces—existing legal obligations such as the QCB Law, data protection law, cloud and cybersecurity regulations, and contractual/regulatory outsourcing rules.

International Alignment

The Guideline reflects international best practice and aligns conceptually with risk‑based AI frameworks (e.g., EU AI Act approach to high‑risk systems, UK & Hong Kong financial sector AI guidance, and NIST risk management principles). It emphasizes lifecycle governance, human oversight, bias mitigation, documentation and monitoring which are common features in leading international AI regulatory instruments. QCB’s approach to registers, pre‑approval for high‑risk deployments and sandboxing parallels measures seen in other prudential and financial sector regulator guidance globally. QCB also cross‑references privacy law obligations consistent with international data protection norms.

Implementation Timeline

Sources and References