Market · State of Qatar
Qatar is the one Gulf state where the question every buyer should ask — who is actually allowed to sign this? — has a published answer. That makes scoping simpler and the sequencing stricter.
Under the National Information Security Compliance Framework, certification moves through scope preparation and documentation, audit planning with an accredited auditor, the compliance audit and controls assessment by that auditor, and finally the certification decision by the NCSA's governance and assurance division.
That sequence is worth internalising, because it determines who you engage and when. Readiness work is phase one. It cannot substitute for phase three, and no amount of it changes who signs.
The NCSA accredits service providers by category, and firms announce accreditation publicly because it gates the work. We hold none, and we will not bid as though we do. What we do is the readiness half — scope definition, control assessment, evidence and remediation planning — so that when the accredited auditor arrives, the audit is short. If you need the audit itself, we will tell you on the first call and name firms that hold the accreditation.
Reference numbers below are taken from the NCSA's own document library. Note that the NCSA and the central bank do not make every document publicly available, so this is a verified sample rather than a complete register.
Confirmed current as of July 2026. Binds government entities, critical information infrastructure operators across energy, water, telecoms, financial services, healthcare and transport, and service providers accessing information assets on behalf of mandated organisations.
The component documents that govern how an audit is conducted and how certification is granted. Together with the accreditation scheme, they make Qatar the most legible assurance regime in the Gulf — you can find out in advance exactly what will be done to you and by whom.
Three risk tiers — low, medium and high — determining the technical and administrative controls required. Mandatory for government entities and institutions, and in practice the first piece of work on any Qatari engagement, because nothing downstream can be scoped until the classification is settled.
The first data protection law in the Gulf, effective 2017. Unusually, it has no extraterritorial application and no adequacy or standard-clause mechanism — transfers are permitted unless they breach the law or cause serious damage. Sensitive data covering health, religion, criminal records and children requires prior written permission from MCIT, which is a lead time, not a formality. Enforcement is administrative and non-public.
The most prescriptive AI rule anywhere in the GCC, and binding. Prior QCB approval is required for new or materially modified high-risk AI systems — before deployment, and before signing purchase, licensing or outsourcing agreements. Licensed entities must maintain an AI register covering every system, its risk classification, provider, human-oversight protocol and contract dates; must separate training, validation and testing datasets with bias testing; and must report serious AI incidents.
Administered by the independent QFC Data Protection Office and broadly GDPR-aligned, which makes it a significant upgrade on the 2005 regime and a different proposition from the state-level law. Applies to QFC-licensed firms as controllers and processors; biometric data is treated as special category.
Most firms reading the QCB guideline plan for an approval before go-live. Read it again: approval is required before signing the purchase, licensing or outsourcing agreement. If you are a QCB-licensed entity selecting an AI vendor, the regulatory step sits inside your procurement timeline, not after it — and discovering that during contract negotiation is expensive. This is the single most commonly missed sequencing point in the Gulf.
We are not an NCSA-accredited auditor. These are the pieces that do not require one.
Readiness against the National Information Assurance Standard and your classification tier, ahead of an audit an accredited firm will sign.
The data protection obligations under Law 13/2016, carried as a named function rather than added to someone's existing job.
The QCB guideline read properly: approval bites at procurement, not at launch.
Tell us the entity, your classification tier if you have one, and whether you are inside the QFC. Twenty minutes usually settles who needs to do what.