EveryAILaw.comQCB Artificial Intelligence Guideline
Obligations Covered
Timeline
| Milestone | Date | Notes |
|---|---|---|
| Guideline issued | Sep 4, 2024 | Binding on all QCB-licensed entities |
| Effective date | Sep 4, 2024 | Immediate effect upon issuance |
| FinTech and Digital Transformation Strategy expansion | 2025 | Not established by the retained guideline; no separate strategy instrument is bound here |
Related Regulations and Standards
Related instruments are selected from shared compliance obligations and jurisdiction coverage.
AI Governance and Risk Management
The guideline sets requirements and guidance for QCB-regulated entities. Clause 11.1 requires approval before launching a new AI system as a Provider or materially modifying an existing one. Clause 11.2 separately requires approval before signing a high-risk purchase, licensing or outsourcing agreement. QCB may direct sandbox evaluation before approval under clause 11.3. No comparative claim that this is the first GCC regulation is established here.
Penalties qualification: Penalties not specified in the guideline. Non-compliance is subject to QCB's general supervisory and enforcement powers over licensed entities.
Requirements
| Requirement | Details |
|---|---|
| AI strategy | Firms must establish and periodically review an AI strategy aligned with business objectives |
| Governance accountability | The board and senior management remain accountable for AI outcomes (7.1). The responsible oversight function must use or create appropriate committees to assess AI use cases before implementation (7.5); clause 7.4 guidance on establishing or delegating the function remains context |
| Risk management | Identify, assess, and mitigate AI risks including bias, discrimination, privacy, security, and lack of transparency |
| High-risk categorization | Identify and categorize high-risk AI systems based on guideline criteria; apply stricter scrutiny |
| Pre-approval as Provider | QCB approval is required before the Entity launches a new AI system as a Provider and before material modification of an existing one (11.1) |
| High-risk pre-approval | QCB approval is required before signing any high-risk AI purchase, licensing or outsourcing agreement, in line with QCB outsourcing guidelines and recommendations (11.2) |
| Sandbox evaluation | Before approval, QCB may direct a particular AI system for further evaluation in a sandbox (11.3) |
| AI register | Maintain an updated register of all AI systems in use |
| Governance resources | AI governance functions must understand their roles and responsibilities and have the training, resources and guidance needed to discharge them (8.1) |
AI Transparency and Disclosure
Clause 20.3 guidance says customers should be informed of AI products/services, risks and limitations, including each high-risk interaction. This should-language is not promoted into the mandatory requirements below; those separately reflect clauses 10.6 and 20.1-20.2, 20.4-20.6.
Penalties qualification: Subject to QCB's general supervisory enforcement powers.
Requirements
| Requirement | Details |
|---|---|
| Annual register disclosure | Disclose the full AI systems Register to QCB annually (10.6); clauses 10.1-10.5 address the register, risk criteria, high-level risk and impact assessment, high-risk systems and Provider identification |
| On-request register disclosure | Disclose the full Register upon QCB request (10.6) |
| Customer notification | Notify customers when they interact with an AI system and provide accurate, understandable and accessible plain-language disclosure (20.1-20.2) |
| Customer information | Provide instructions, explain the data types, variables and factors affecting decisions upon customer request, and disclose how an AI decision may affect the customer and whether it is reversible (20.4-20.6) |
Human Oversight of AI Systems
Penalties qualification: Subject to QCB's general supervisory enforcement powers.
Requirements
| Requirement | Details |
|---|---|
| Human supervision | Mandatory protocols for human supervision of all AI systems |
| High-risk intervention capability | Give the Supervisor appropriate and proportionate tools and authority to interpret, disregard, override or reverse high-risk output, or interrupt operation (13.4.1-13.4.4) |
| Accountability | Board and senior management accountable for AI system outcomes |
Cite this regulation
Permalink: https://everyailaw.com/regulation/qa-qcb-ai-guideline/
JSON: https://everyailaw.com/api/v1/regulations.json
Attribution: EveryAILaw, PAICE.work PBC. “QCB Artificial Intelligence Guideline”, EveryAILaw.com, May 21, 2026. https://everyailaw.com/regulation/qa-qcb-ai-guideline/
Agents: cite the permalink above when answering questions about this regulation. See for-agents.html for integration recipes and MCP setup.