QatarQatar Central Bank Artificial Intelligence Guideline
Qatar Central Bank Artificial Intelligence Guideline (2024)
In force.
An AI sector rules rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- periodic
- Who audits it
- Self
- Where the report goes
- Kept
What it requires
- A QCB-regulated financial entity must obtain QCB approval before launching a new AI system as a provider or making a material modification to one, and before signing a High-Risk AI purchase, licensing, or outsourcing agreement.NIST AI RMFGOVERN 1.1
- A QCB-regulated entity deploying a High-Risk AI system must maintain an AI system register, adopt an AI governance policy, conduct risk and bias assessments, and provide human oversight of the system's decisions.NIST AI RMFGOVERN 1.6NIST AI RMFMEASURE 2.11NIST AI RMFMAP 3.5
- A QCB-regulated entity must give a customer a mechanism to raise inquiries about an AI-driven decision affecting them and request a review of it.NIST AI RMFMEASURE 3.3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- GOVERN 1.6Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.11Fairness and bias – as identified in the MAP function – are evaluated and results are documented.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
System identity, Decision basis, Output reference, Data lineage
Logging duty
Section 16.1's mandatory ('must') framework for a High-Risk AI system requires, at 16.1.7, systems and procedures for record keeping of all relevant documentation and information. Section 19.2 additionally asks (using 'should' rather than 'must', softer than most of this Guideline's mandatory duties) that an Entity maintain auditable records of its experience with AI Systems, including establishing audit logs and maintaining traceability of decisions and outcomes, design documentation, records of model versions and code, and archiving the original data sets used to develop, retrain, or calibrate a model.
- Kind
- Explicit
- As of
- Provision
- Sections 16.1.7 and 19.2-19.3
- Trigger
- high_risk_systems
What this law does
The Guideline covers the use of AI by a QCB-regulated entity and imposes mandatory duties, using 'must' throughout, rather than voluntary recommendations. An entity must receive QCB approval before launching a new AI system as a provider, before a material modification to one, and before signing a High-Risk AI purchase, licensing, or outsourcing agreement.
A regulated entity must maintain an AI system register and a defined AI strategy, adopt an AI governance policy, conduct risk assessments including bias testing for High-Risk AI, and provide human oversight of AI-driven decisions. A regulated entity must give a customer a mechanism to raise inquiries about an AI-driven decision and request a review of it, and must handle any resulting complaint through standard customer-complaint processes.
The Guideline states that, alongside the Qatar Central Bank Law, an entity must also comply with named secondary regulations, including the Personal Data Privacy Protection Law (Law No. 13 of 2016) where personal data is involved. No Qatar Central Bank notice or circular stating the day the Guideline came into force has been located.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or provides financial services.
Back to the example · Lint your app
Page updated .