Qatar, Bahrain, Oman And Kuwait: What Has And Has Not Been Published

Two Gulf states have moved on post-quantum cryptography in writing. Saudi Arabia’s central bank has set dated duties for its financial institutions, and the UAE has a national encryption policy with a post-quantum section. The other four members of the Gulf Cooperation Council, Qatar, Bahrain, Oman and Kuwait, are harder to read from the outside.

This article reports what research for this group could and could not confirm, as of October 2026. The short answer is that no post-quantum or quantum-readiness instrument was found from any of the four states, their national cyber security agencies or their central banks. That is a statement about search coverage, not proof that nothing exists. Several official sites did not load or refused automated access, so this piece is written as a record of what is known and a list of what to watch, rather than a summary of rules.

AI is covered in its own section below. No binding AI law was found in any of the four states, though Qatar’s central bank, Bahrain and Oman have issued AI rules for parts of their economies.

What Was Searched

Research covered the national cyber security bodies and central banks of each state: Qatar’s National Cyber Security Agency (NCSA) and the Qatar Central Bank; Bahrain’s National Cyber Security Centre and the Central Bank of Bahrain; Oman’s Central Bank and its national cyber security function; and Kuwait’s Central Bank and National Cyber Security Center. The aim was to find any instrument that names post-quantum cryptography, quantum risk or a cryptographic inventory, and any general cyber rule with cryptography controls.

For Qatar, the NCSA’s website lists a National Information Assurance certification under its national compliance framework.¹ The site’s pages did not render for automated retrieval, so the content of the NIA material, including any cryptography domain, and the question of who must comply could not be checked against the primary text. The Qatar Central Bank’s general cyber and technology risk rules were not reviewed for this article; its AI guideline is covered below.

For Bahrain, the Central Bank of Bahrain Rulebook could not be retrieved during research, and its rules were not reviewed for this article.² For Oman and Kuwait, no central bank or national cyber agency framework text could be located as a primary document during research. The specific wording of any framework has to be read before anyone relies on it.

What Still Applies

A firm in Doha, Manama, Muscat or Kuwait City is not outside cryptography rules simply because its national regulator has not published post-quantum text. Three kinds of obligation reach across borders.

Payment card rules. PCI DSS is a contractual standard that applies wherever card data is stored, processed or transmitted. Since 31 March 2025, requirement 12.3.3 has required a current list of the cipher suites and protocols in use, an active watch on whether each stays safe and a written plan for reacting to foreseeable cryptographic weaknesses, all revisited at least every 12 months.³ Status: Binding (contractual). Cryptography Compliance covers it in depth.

Group and cross-border rules. A Gulf banking group with a Saudi subsidiary falls under SAMA’s quantum circular for that subsidiary, which requires cryptographic asset classification procedures by the end of 2026 and a quantum risk assessment by the end of March 2027.⁴ Status: Binding for SAMA-supervised institutions. A firm that operates UAE critical information infrastructure falls under the UAE National Encryption Policy, whose post-quantum section asks for a public-key cryptography inventory and a transition plan.⁵ Status: Binding for UAE federal and emirate government entities and non-government CII operators. See the Saudi Arabia and UAE articles.

Parent and partner expectations. Groups headquartered in the EU, UK or US bring their home regulators’ expectations with them, and international partners may ask about cryptographic inventories in due diligence. The overview of post-quantum and cyber regulation in 2026 shows which of those expectations are binding and which are guidance.

AI Rules In The Four States

As of October 2026, no binding AI law was found in Qatar, Bahrain, Oman or Kuwait. What exists is narrower: a central bank guideline in Qatar, government policies in Bahrain and Oman, and national strategies.

Qatar. The central bank’s guideline is the most detailed of these instruments. It covers a licensed firm that builds AI, buys it or outsources work that depends on it. Firms must keep a register of their AI systems and send it to the bank every year, obtain the bank’s approval before launching an AI system they provide or signing a high-risk AI purchase or outsourcing deal, give every system a human oversight protocol, and defend models against prompt injection and query attacks. Customers must be told when they deal with AI and can ask a qualified person to review a negative AI decision.⁶ The bank calls it a guideline, but most of it is written as duties. Separately, the transport and communications ministry adopted a blueprint from the Qatar Computing Research Institute as the national AI strategy in October 2019,⁷ the NCSA released guidelines on secure AI use in February 2024,⁸ and the Ministry of Communications and Information Technology (MCIT) described two AI ethics guidance documents in May 2025.⁹ The NCSA and MCIT texts were not retrieved for this article.

Bahrain. The Information and eGovernment Authority’s AI policy was approved by a ministerial committee on 20 May 2025, and government entities have had to comply since that date. They must adopt AI in cooperation with the authority and follow its standards, should audit their AI use regularly, and remain responsible for any harm, which is attributed to people rather than the machine.¹⁰ The policy does not cover private companies. A UNESCO readiness assessment dated November 2025 describes a standalone AI law, with licensing and penalties, still under parliamentary review.¹¹ The assessment is not a rule, and no enacted AI law was found as of October 2026.

Oman. The transport, communications and IT ministry published its AI policy, in Arabic, in April 2025. It covers government units and regulated private institutions that build or use AI, which must comply in full and assess their systems regularly for accuracy, bias and harmful content. Developers must assess ethical, social and environmental impact before release and mark generated content. The ministry monitors government units and reports to the Council of Ministers, while sector regulators monitor the firms they supervise.¹²

Kuwait. No AI law, AI policy or published government AI strategy was found. The one strategy document reviewed is a May 2024 Microsoft whitepaper, prepared in cooperation with the Central Agency for Information Technology, which proposes a national AI strategy framework. It is a vendor’s proposal, not government policy.¹³

None of the AI documents whose full texts were reviewed mentions quantum computing. On cryptography, Oman’s policy asks for classified data used in AI to be protected with measures such as encryption, multi-factor authentication and anonymisation,¹² and the Qatar Central Bank guideline applies the bank’s sector information security regulation to every AI deployment.⁶

What To Watch

The one regional example of a dated instrument so far, SAMA’s August 2026 circular, focuses on inventory, risk assessment and governance. If the four states act, a first step of that kind seems more plausible than a full migration mandate. That is an inference from a single example, not a forecast from any official source.

There is one early signal from Qatar. At its fifth National Cyber Governance and Assurance Affairs Conference, reported by the Qatar News Agency on 5 October 2026, the NCSA set out initiatives that include planning for the post-quantum era.¹⁴ Status: Announcement. No instrument or published text has followed so far.

Practical signals worth tracking are updates to the four central banks’ cyber or technology risk rules, new versions of Qatar’s national information assurance material, and any regional statements through GCC bodies. A firm that has already built a cryptographic inventory with classification by sensitivity and migration priority will be well placed whichever form these take. Which Regulators Require A Cryptographic Inventory? explains the fields that the existing regimes ask for.

For AI, watch Bahrain’s draft law. AI Regulation At A Glance compares these states with other regions.