We use privacy-friendly, cookieless analytics to understand how this site is used and improve it - handled in line with Qatar's PDPL and the GDPR. No personal profiles, no ad tracking. Privacy Policy
Every Arcus audit maps your AI operations against each of these instruments - so you know precisely where you stand, citation by citation.
Tick what describes your business - see the Qatar laws your AI use most likely engages.
Based on your answers
4 of 11 Qatar laws likely apply
Indicative only - your audit confirms exactly which articles apply.
Applies to: All entities processing personal data in Qatar
Qatar's primary data protection statute. Requires a lawful basis and explicit safeguards before personal data is collected, processed or transferred, with heightened protection for data of a 'special nature' (health, beliefs, criminal records, location).
Where AI exposes you
Pasting customer names, contracts, CVs or records into a public AI tool processes personal data without a lawful basis or safeguards - the single most common violation we find.
Penalty
Up to QAR 5,000,000 - with related criminal exposure of up to 3 years.
Applies to: Anyone using IT systems in or from Qatar
Criminalises offences committed through information technology, including unlawful access, privacy violations, and the capture, production or publication of images and content that harms individuals.
Where AI exposes you
Generating or editing AI images of identifiable real people, deepfakes, or scraping personal content can fall squarely within this law.
Penalty
Imprisonment and fines - and deportation for expatriate offenders.
Applies to: Entities established in the Qatar Financial Centre
A GDPR-aligned regime for QFC firms: controller/processor duties, Data Processing Agreements, Data Protection Impact Assessments, cross-border transfer rules and breach notification.
Where AI exposes you
Sending data to an AI vendor without a Data Processing Agreement (Art. 12) leaves a QFC firm carrying the full liability for how that vendor handles it.
Penalty
Up to QAR 5,000,000.
Applies to: Organisations across critical and regulated sectors
Sets baseline cybersecurity controls, governance and incident-handling obligations, backed by the NCSA's authority to conduct inspections.
Where AI exposes you
Unsanctioned AI tools and browser extensions widen the attack surface and create undocumented data flows that fail framework controls - exposed during an unannounced inspection.
Penalty
Regulatory action, remediation orders, and inspection authority.
Applies to: Transmission of data and electronic communications
Governs telecommunications services and protects the confidentiality of communications and transmitted data.
Where AI exposes you
Routing communications or data to overseas AI services can engage confidentiality and lawful-transmission obligations.
Penalty
Fines and regulatory sanction.
Applies to: Employment relationships in Qatar
Regulates the employer-employee relationship, including the handling of employee information and workplace monitoring.
Where AI exposes you
AI used in recruitment, performance scoring or employee monitoring - and employee data fed into AI tools - must respect employee rights and data limits.
Penalty
Fines and labour-dispute liability.
Applies to: Online transactions and electronic dealings
Establishes the validity of electronic transactions and signatures and sets duties around online consumer data and disclosures.
Where AI exposes you
AI chatbots, automated quoting and online flows that collect or act on consumer data must meet electronic-transaction and disclosure rules.
Penalty
Fines and invalidation of non-compliant transactions.
Applies to: Copyright, related rights and protected works
Protects original works and the rights of creators, including reproduction, distribution and derivative use.
Where AI exposes you
AI-generated content raises ownership and infringement questions - both for outputs you publish and for third-party material used as inputs.
Penalty
Fines and civil liability for infringement.
Applies to: General criminal law
Includes provisions on privacy, defamation, and public morality that apply regardless of the medium used.
Where AI exposes you
AI-generated content that defames, breaches privacy or offends public morality carries criminal exposure.
Penalty
Imprisonment and fines depending on the offence.
Applies to: Banks, fintechs and financial-sector entities
Directives on the responsible use and governance of AI and models within regulated financial institutions.
Where AI exposes you
Financial entities deploying AI without documented model governance, oversight and risk controls fall short of QCB expectations.
Penalty
Supervisory action - up to licence suspension.
Applies to: Businesses dealing with consumers
Protects consumers against misleading practices and unfair dealing, and governs the use of their information.
Where AI exposes you
AI-driven pricing, recommendations or marketing that mislead consumers - or misuse their data - breach consumer-protection duties.
Penalty
Up to QAR 1,000,000.
This page is general information, not legal advice. Arcus provides strategic management advisory and framework-aligned risk mapping - not legal representation or certification. For binding legal opinions or regulatory representation, we refer you to QFC-admitted law firms.
Free - receive your personalised risk feedback in under 48 hours. The cost of finding out later: everything.
Not sure which you need?