Saudi Arabia - Deepfakes Guidelines

Overview

The Deepfakes Guidelines (Version 1.0) were published by the Saudi Data & Artificial Intelligence Authority (SDAIA) in September 2024 as a practical, ethics-informed policy instrument to address synthetic media risks in the Kingdom. The Guidelines are designed to inform developers, publishers, platforms, public-sector entities and the public about responsible creation, labelling, verification, and remediation of AI-generated audio, image and video content. They were launched during the Global AI Summit and opened to public consultation via a national e-participation platform; SDAIA framed the document as part of a continuing agenda that includes the AI Ethics Principles and related generative AI guidance. For the consultation and access to the published draft, see Deepfakes guidelines (eParticipation consultation) and SDAIA's repository Deepfakes Guidelines (PDF).

Definitions

The Guidelines define key terms used throughout the instrument, including "synthetic content" (media created or substantively altered by AI), "deepfake" (high-fidelity synthetic audio/visual content representing a real person), "non-consensual intimate imagery" (NCII), "provenance" (origin and transformation history of the content), and "labelling/watermarking" (visible or embedded markers indicating synthetic origin). Definitions emphasise intent and material impact — distinguishing minor edits and acceptable transformations (e.g., restoration, stylistic filters) from deceptive manipulations intended to mislead or harm. The document also uses established concepts from data protection ("personal data", "processing") aligning terms with the Kingdom's Personal Data Protection Law (PDPL).

Governance and Institutional Framework

The Guidelines set out a layered governance model for addressing deepfakes: (1) SDAIA as national coordinator for AI policy and convenor of multi-stakeholder consultation; (2) Sectoral regulators (e.g., Communications, Space & Technology Commission) to adopt sector-specific controls; and (3) Platform-level governance where content hosts implement detection, labelling and response workflows. SDAIA recommends internal governance for creators and vendors — AI ethics committees, documented risk assessments, incident response teams and data protection officers. The Guidelines reference collaboration channels with law enforcement for serious harms and propose public reporting and transparency mechanisms on takedown and remediation activities. See SDAIA's public consultation page and related announcements for institutional context: SDAIA eParticipation and news coverage summarising the launch at the Global AI Summit: Saudi Press Agency (SPA) summary coverage.

Key Focus Areas

The document organises guidance under several focus areas: (a) Consent & rights protection — requiring explicit and auditable consent when using an identifiable person's likeness or voice, and recommending standard consent forms and templates; (b) Transparency & disclosure — mandatory visible labels for published synthetic content and machine-readable provenance markers to allow automated detection and platform filtering; (c) Documentation & accountability — model cards, dataset documentation, training provenance and versioning records to enable audits; (d) Safety testing & evaluation — pre-deployment risk assessments, robustness testing against misuse and adversarial attacks, and ongoing red-team / external evaluation; (e) Privacy & data minimisation — alignment with PDPL for training data, retention limits and secure deletion; (f) High-risk use cases — special controls for political advertising, elections-related content, financial and health advice, and NCII; and (g) Public literacy — guidance for awareness campaigns and tools to help citizens identify manipulated media. SDAIA recommends watermarking and cryptographic provenance as preferred mitigation techniques and provides examples and templates for risk assessment and consent capture.

Implementation Framework

The Guidelines recommend a three-tiered implementation approach: (1) Baseline practices for all creators and platforms (labelling, basic documentation, notice-and-respond channels); (2) Enhanced controls for regulated sectors and medium/high-risk deployments (identity verification, provenance standards, faster takedown procedures); and (3) Technical integration for developers and vendors (SDKs for watermarking, metadata schemas and APIs for provenance exchange). SDAIA suggests pilot projects and regulatory sandboxes to test practical solutions and invites cross-sector pilots via the National Data Governance Platform. Entities are encouraged to adopt documented policies, staff training, and incident response exercises. For programmatic support and sandbox participation, see SDAIA's regulatory sandbox information: SDAIA National Data Governance Platform.

Monitoring and Evaluation

SDAIA's Guidelines propose a monitoring framework combining self-reporting from covered entities, platform transparency reports, third-party audits (e.g., conformity assessment bodies), and periodic public reviews. Key performance indicators include prevalence of labelled synthetic content, response times for takedown of non-consensual material, results of robustness tests, consumer-reported harms, and cross-border incident statistics. SDAIA recommends establishing a public registry of major synthetic-content platforms and periodic publication of aggregated metrics to track progress and inform potential conversion of guidance into binding rules. The Guidelines encourage international cooperation on detection capabilities and shared repositories for indicators of compromise.

Penalties, Liability, and Appeals

While the Guidelines themselves are non-binding guidance, they make clear that many prohibited behaviours (e.g., fraud, identity theft, distribution of NCII, defamation) remain subject to existing laws and may trigger civil or criminal liability. The document recommends that platform terms enforce takedown and repeat-offender sanctions and encourages contractual liability clauses for vendors. It also sets out remediation pathways for affected individuals: notice-and-takedown request templates, evidence preservation and escalation to regulators or law enforcement. SDAIA indicates that persistent or harmful non-compliance could inform future regulatory or enforcement action by sectoral authorities.

Relationship to Other Instruments

The Guidelines are positioned to complement existing national instruments: the Personal Data Protection Law (PDPL), SDAIA's AI Ethics Principles, Generative AI Guidelines (public and government versions), sectoral rules and the Kingdom's cybersecurity framework. They are intended to act as operational guidance that can be referenced by sectoral regulators when drafting binding rules or enforcement guidance. Internationally, the Guidelines reference UNESCO recommendations, OECD and other international workstreams to maximise compatibility with emerging global standards.

International Alignment

SDAIA frames the Guidelines within a policy objective of aligning Saudi practice with international norms on transparency, provenance, and labelling. The document cites global practice trends — EU labelling approaches, China's deep synthesis rules, and U.S. state-level NCII statutes — and encourages adoption of interoperable watermarking and provenance standards to facilitate cross-border detection and takedown cooperation. SDAIA's engagement in the Global AI Summit and OECD/UNESCO forums is presented as part of a strategic agenda for international alignment and standardisation.

Implementation Timeline

Sources and References