AI rules of the six GCC central banks, with the Sharia board

At a glance

Qatar, QCB

Artificial Intelligence Guideline (2024), in force since 4 September 2024

United Arab Emirates, CBUAE

Guidance note on AI and machine learning, issued 11 February 2026 and announced 23 February 2026; Model Management Standards, in force (version of November 2022)

Kuwait, CBK

No AI-specific instruction for banks; the Cyber and Operational Resilience Framework (first release, 3 December 2025) has a section on AI and ML security

Saudi Arabia, SAMA

No AI directive for banks in the rulebook; the Counter-Fraud Framework (in force, 11 October 2022) covers AI and ML in fraud systems

Bahrain, CBB

None issued in the CBB rulebook, as checked on 21 October 2026

Oman, CBO

None issued among the CBO’s circulars, as checked on 21 October 2026

Qatar: the QCB Artificial Intelligence Guideline

The guideline covers the use of AI by any QCB-regulated entity, whether it develops AI itself, buys AI systems or outsources processes (the guideline). Among its requirements:

• the board of directors and senior management remain accountable for the outcomes and decisions of the entity’s AI systems (7.1);
• the entity must develop and maintain an updated register of information on all its AI systems arrangements, and disclose the full register to the QCB every year and on request (10.1, 10.6);
• official QCB approval is needed before launching a new AI system as a provider, and before any material change to an existing one (11.1);
• every AI system must have a human oversight protocol (13.1), and customers can ask for clear explanations of the data and factors behind an AI decision (20.5);
• outsourcing any AI function needs the board’s approval, documented (12.5).

United Arab Emirates: the CBUAE guidance note and the MMS

The guidance note applies to licensed financial institutions, insurance providers included, and supplements the CBUAE’s laws and regulations. It says senior management and the board should be responsible and accountable for AI and ML systems and their outcomes, and that AI use should follow the principles of the Model Management Standards (the rulebook). It also expects:

• an inventory of all AI models, systems or technologies developed or deployed, with as a minimum model name, purpose and risk rating, including those developed or hosted by third parties (2(f), 9(c));
• meaningful human oversight, particularly for decisions with significant implications for consumers, and the ability at all times to stop using an AI system (7(a), 6(f));
• a process to rate the risk of each AI system (8(d)), and the ability to disclose how AI systems operate and make decisions (4(a)).

The Model Management Standards apply to all licensed banks, Islamic banks included, and list artificial intelligence among model types. Institutions must keep a comprehensive inventory of all their models in production, internal and third-party (4.4.1); in the MMS, “must” is mandatory and “should” strongly recommended.

Kuwait and Saudi Arabia: AI within wider frameworks

Kuwait’s Cyber and Operational Resilience Framework applies to all entities the CBK supervises. Its section 7.1.2 says regulated entities shall ensure AI and ML models are explainable and auditable, specifically where they are involved in high-impact decisions such as fraud detection or credit risk scoring, and 7.1.1.2 asks for CBK approval when adopting new and emerging technologies.

SAMA’s Counter-Fraud Framework says that where machine learning or artificial intelligence are used, the system should not be a black box and should be capable of being audited (3.8). It applies to the member organizations SAMA notifies.

The Sharia board, a second authority

In each of the six states, an Islamic institution’s Sharia supervisory board or committee has authority over whether its products and operations comply with Sharia:

• UAE: the internal Sharia supervision committee approves the institution’s business, products and contracts, and its fatwas are binding where consistent with the Higher Sharia Authority, whose resolutions bind the committees and the institutions (Federal Decree-Law No. 6 of 2025, Art. 75 and Art. 24).
• Saudi Arabia: “The board must rely on the committee for issuing Shariah decisions related to engaging in Islamic banking activities” (SAMA Shariah Governance Framework, Art. 10).
• Qatar: the Sharia Supervisory Board expresses a binding opinion on whether the institution’s operations, transactions and contracts comply with Sharia (QCB Law No. 13 of 2012, Art. 108).
• Bahrain: “The fatawa and rulings of the SSB are binding on the Bahraini Islamic bank licensee” (CBB rulebook, SG-2.3.1).
• Kuwait: resolutions of the Shariah Supervisory Board are binding and the bank’s management shall adhere to them (CBK instructions on Shariah supervisory governance, 2016; the Arabic text is the legal version).
• Oman: the CBO’s Islamic Banking Regulatory Framework of 2012 made the fatawa and rulings of the Sharia Supervisory Board binding on licensees (Art. 2.2.1.2); the CBO says Banking Law 2/2025, Articles 125 to 134, now governs Islamic banking and supersedes that framework.

How GovernanceOS™ helps

• Check a register, free, in your browser: goslint carries a pack for the QCB guideline’s Article 10 register (20 fields), one for the CBUAE note’s inventory minimum (4 fields) and one for the MMS model inventory (12 fields).
• Download a register template for the QCB, the CBUAE note or the MMS, with the columns goslint checks.
• The regulation rows cover all six states, including where a central bank has issued no AI directive, with a Sharia board recorded as a second authority over the same records, by design. Regulation rows
• Sharia review: three documents in the Defensible AI Library, technical validation and Sharia review run as two tracks and closed together.
• The GCC regulators endorsement on the AI governance certification, for practitioners.

Conformance with any framework is self-declared.