Question 1

What is Arcus?

Accepted Answer

Arcus LLC is a GCC AI governance and IT risk advisory firm, registered with the Qatar Financial Centre (QFC No. 04428). We audit how your business uses AI tools and identify the specific regulatory risks that apply to you - then show you exactly what to do about it.

Question 2

Is this legal advice?

Accepted Answer

No. Arcus provides strategic AI management advisory - not legal advice. For binding legal opinions or regulatory representation, we refer you to QFC-admitted law firms. Our service gives you the operational framework and risk map. Your lawyer gives you the legal opinion where needed.

Question 3

Which laws does Arcus cover?

Accepted Answer

Every audit covers all applicable laws for your jurisdiction.

For Qatar: PDPPL (Law 13/2016), Cybercrime Law (Law 14/2014), Law No.11/2025, QFC DPR 2021, NCSA Framework (Decree 20/2021), Labour Law (14/2004), E-Commerce Law (16/2010), IP Law (7/2021), Penal Code provisions, Consumer Protection Law (8/2008), and QCB AI Directives 2023 (financial sector only).

For companies operating in Saudi Arabia, UAE, Bahrain, Kuwait or Oman, the audit maps your AI operations against the applicable law in your jurisdiction - Saudi PDPL, UAE Federal PDPL, Bahrain PDPL, Kuwait Cybercrime Law, or Oman PDPL.

Question 4

What exactly do I receive?

Accepted Answer

Standard Audit (QAR 8,000): a PDF Risk Report + executive summary + 5 priority actions ranked by urgency + an Approved Tool List showing which tools are safe to use and under what conditions + 5 operational annexes ready to implement.

Advanced Audit (QAR 15,000): everything above + 16 operational documents including AI Usage Policy, DPA Checklist, Risk Register, Incident Response Plan, Employee Responsibility Agreement, DPIA Framework and more + a 6-month checkpoint programme.

Question 5

How long does it take?

Accepted Answer

Your free Risk Report - a personalised compliance assessment - is delivered within 48 hours. The Standard Audit is delivered in 3 business days. The Advanced Audit in 5 business days. You have urgent exposure. You deserve a fast answer.

Question 6

Is my information confidential?

Accepted Answer

Completely. Arcus signs a mutual confidentiality agreement before every engagement. No audit finding is ever disclosed to any third party, including regulators. Arcus is an advisory firm - we have no obligation to report to authorities and we never do.

Question 7

What happens if a regulator reviews our AI governance?

Accepted Answer

The point of the audit is to let you show - not just say - that your AI use is governed. You receive a documented risk map, an approved tool list and AI usage policies so that if a regulator reviews your governance, you can demonstrate a structured, good-faith approach instead of scrambling to assemble evidence.

If you are already under active investigation, that goes beyond advisory work and we will refer you to a QFC-admitted law firm immediately.

Question 8

Do I need to change all my AI tools?

Accepted Answer

Not necessarily. The audit identifies tools that can continue with governance measures in place, tools that require contract changes with vendors, and tools that create unacceptable risk. The goal is practical protection - not total operational disruption.

Question 9

What is the difference between Standard and Advanced?

Accepted Answer

Standard gives you the diagnosis - your risks identified, prioritised, and your top 5 actions with 5 operational documents. Advanced gives you the diagnosis plus the complete remediation toolkit: 16 documents ready to implement, with a 6-month checkpoint programme to ensure nothing has slipped.

Question 10

Is Arcus certified by a government authority?

Accepted Answer

Arcus is registered with the Qatar Financial Centre (QFC No. 04428) - a public, verifiable registration. We are a management advisory firm: we provide framework-aligned risk mapping, not legal representation or certification. For binding legal opinions, we refer you to QFC-admitted law firms.

Question 11

What is the price?

Accepted Answer

Standard Audit: QAR 8,000. Advanced Audit: QAR 15,000. Annual Governance Refresh: QAR 4,000 (existing clients only).

To put this in perspective: the maximum fine under PDPPL alone is QAR 5,000,000. The Standard Audit costs 0.16% of that maximum exposure. Not subject to VAT. No hidden fees.

Question 12

Do you serve companies outside Qatar?

Accepted Answer

Yes. Arcus serves businesses operating across the GCC - Qatar, Saudi Arabia, UAE, Bahrain, Kuwait and Oman - and cross-market clients operating under GDPR and the EU AI Act. Every audit maps your AI use against the laws that apply specifically to you.

Question 13

Why not just use a law firm?

Accepted Answer

A law firm reads the law and tells you what it says. Arcus builds the documented operational framework the law requires you to have in place - policies, registers, DPAs, incident procedures. These are different disciplines. Most of our Advanced clients engage legal counsel for DPA execution using the framework we deliver. You need both. We are the step before the lawyer needs to get involved.

Question 14

Why not use a SaaS compliance tool?

Accepted Answer

SaaS tools give you a checklist to fill in yourself. Arcus delivers completed, company-specific documents your team can implement from day one - mapped to your exact tools, your sector, and your applicable law. No platform to learn. No templates to adapt. No monthly subscription.

Question 15

What if we already use ChatGPT's privacy settings?

Accepted Answer

ChatGPT's privacy settings are a product feature, not a legal compliance mechanism. They do not constitute a Data Processing Agreement, do not establish lawful basis under PDPPL, and do not satisfy transfer authorisation requirements. Regulators do not accept “we turned off training” as a compliance position.

Question 16

We are a small company - will regulators actually target us?

Accepted Answer

Three of the four NDPO enforcement actions in Qatar between December 2024 and April 2025 were against SMEs - an ICT company, an e-commerce company, and a contracting firm. SDAIA issued 48 decisions in 2025 across sectors of all sizes. Regulators filter by complaint, breach notification and sector audit - not by company size.

Question 17

What happens after the audit is delivered?

Accepted Answer

The audit is the beginning, not the end. Standard engagements include monthly progress checkpoints for 3 months. Advanced engagements include a 6-month checkpoint programme. At each checkpoint we review progress, flag new tools or regulatory developments, and confirm your governance position is current.

Question 18

Can we do this ourselves without Arcus?

Accepted Answer

Yes - and the Risk Report tells you exactly how. If your team has the capacity to implement the findings, draft the policies, negotiate vendor DPAs, and maintain the registers going forward, you can act on the report independently. Most clients find that the time cost of doing this correctly - and the risk of getting it wrong - makes the audit the more efficient path.

Every question we get, answered honestly.

Most businesses using AI are not compliant. Most never know until it's too late.