Saudi Arabia - Global AI Hub Law (RAI-SA-NA-DGAHPXX-2025)

Overview

The Communications, Space and Technology Commission (CST) published a consultation draft of a "Global AI Hub Law" on 14 April 2025 to create a legal and regulatory regime for establishing sovereign and foreign-aligned data centres in the Kingdom. The draft law introduces the concept of three hub models (Private, Extended and Virtual) to accommodate different combinations of state-to-state governance, corporate-hosted operations and multi-tenant arrangements. The policy goal is to attract inward investment in data centres, AI infrastructure and related services, while providing legal predictability for foreign governments and multinational technology providers. The consultation was launched via the national public consultation platform Istitlaa and ran from 14 April 2025 until 14 May 2025. Stakeholders were invited to comment on licensing, jurisdictional recognition, security controls, emergency access, and the draft's interaction with existing national instruments such as the PDPL overseen by SDAIA.

Definitions

The draft law sets out specialized definitions to delimit the new legal constructs: "Hub" or "Center" (a geographically-sited data/compute facility and associated services), "Private Hub" (a hub established under a bilateral agreement conferring sovereign legal governance for a guest country), "Extended Hub" (a centre providing privileged corporate hosting arrangements and contractual privileges), and "Virtual Hub" (software/virtual multi-tenant environments where content is governed by designated foreign states). Other key definitions include "Guest Country", "Designated Foreign State", "Operator", "Service Provider", "Customer Content", and "Sovereign Data Embassy". These definitional choices are central to how jurisdiction, lawful requests and enforcement reach will be determined, and the draft separates governance mechanisms and privileges according to the hub category to reduce ambiguity about applicable law and oversight pathways.

Governance and Institutional Framework

The CST is the lead regulator for hub authorisation, licensing and oversight, working alongside national authorities responsible for data protection, cyber security, national security and investment promotion. The draft contemplates cooperation agreements with the Saudi Data and AI Authority (SDAIA), the National Cybersecurity Authority (NCA) and other competent ministries to manage registration, national security vetting, resilience and incident response. CST's role includes evaluating applications, identifying eligible operators, managing approvals of guest countries and designated foreign states, and maintaining a public register of authorised hubs. The framework envisions formal bilateral agreements for Private Hubs (state-to-state instruments) and administrative designation procedures for Virtual Hubs. The draft indicates that implementing regulations and memoranda of understanding will set out detailed roles and cross-agency coordination mechanisms; industry analysts have noted that these secondary instruments will be decisive in how competing legal claims and emergency powers are operationalised.

Key Focus Areas

The law concentrates on: (1) jurisdictional clarity — specifying when a guest country's laws will govern hosted content and when Saudi law will apply; (2) licensing and registration — mandatory authorisation and operational eligibility checks for hub operators; (3) security and resilience — baseline physical and cyber security requirements aligned with national standards and auditability obligations; (4) data governance and privacy — interaction with the PDPL and transfer/processing safeguards for personal data; (5) law enforcement and emergency access — narrowly defined Saudi intervention powers for public-safety and national-security situations; (6) investor protections and incentives — measures to attract capital while preserving sovereignty; and (7) transparency and dispute-resolution — obligations to maintain records, co-operate in cross-border investigations and specify dispute mechanisms. Commentary stresses the novelty of permitting foreign legal regimes to govern data hosted on Saudi soil under strictly controlled conditions and the resulting need for robust contractual and technical isolation controls.

Implementation Framework

Operationalisation will require a multi-step approach: issuance of secondary implementing regulations, bilateral treaties and model contractual terms for guest countries, establishment of CST licensing processes and a central registry, technical standards for segregation and cryptographic controls, clear incident reporting pathways, and coordination protocols for law-enforcement and emergency interventions. The draft anticipates that operators will need to demonstrate capacity for legal separation of data, audit trails, tamper-evident logs and rapid cooperation with both Saudi and guest-country authorities where lawful. It also anticipates economic and regulatory incentives to encourage investment, coupled with obligations for compliance audits and third-party conformity assessments. Several international law firms and advisors have recommended that potential operators begin aligning corporate governance, data-mapping, contractual and incident-response plans to the draft's constructs now to influence the final text during consultation.

Monitoring and Evaluation

CST proposes periodic reviews, reporting requirements for authorised hubs, and powers to inspect and audit compliance. The draft suggests annual reporting to the competent authorities on operational metrics, security incidents and cross-border access requests. An independent or inter-agency review mechanism is envisioned to evaluate whether host arrangements continue to meet national security, public-order and privacy thresholds. The law also contemplates sunset or renewal conditions for authorisations and the capacity to impose corrective measures, including temporary suspension, where systemic risks are identified.

Penalties, Liability, and Appeals

The draft sets out administrative sanctions for non-compliance with licensing, recordkeeping, cybersecurity and cooperation obligations, including fines, suspension and revocation of approvals. It reserves criminal or administrative liability for obstruction of lawful investigations, falsification of records, or willful breaches that materially harm national security or public order. Operators and service providers will be contractually liable under agreements with guest countries and may face civil claims from affected parties under domestic law and PDPL-related rights. The draft also establishes appeal routes against CST decisions through administrative tribunals or competent courts as defined in implementing rules, while ensuring expedited procedures for national-security related actions.

Relationship to Other Instruments

The draft explicitly interacts with the Kingdom's Personal Data Protection Law (PDPL) and implementing regulations; it signals that PDPL requirements for transfers, safeguards and data subject rights remain applicable unless a lawful exception is established under a hub agreement or as provided by CST-approved instruments. The law also references national cybersecurity frameworks, investment laws and international treaties. The relationship between hub privileges and PDPL transfer restrictions will be managed through designated safeguards and authorised channels, and CST envisages coordination with SDAIA to ensure alignment with national data-governance objectives.

International Alignment

The draft positions the Kingdom's model alongside emerging global approaches to sovereign compute, data embassies and cross-border data governance. CST notes alignment with international treaty frameworks and sets out processes to recognise foreign legal regimes as "designated foreign states" or guest countries through formal criteria and bilateral instruments. International law firms and commentators have compared the model to e-embassies and sovereign compute initiatives in other jurisdictions and highlighted potential benefits for foreign states seeking legal continuity for national data, and for providers seeking legal certainty; at the same time they flagged the need for harmonised frameworks for mutual legal assistance, data subject protections and cross-border evidence-sharing to avoid conflicting orders.

Implementation Timeline

Sources and References