Saudi Arabia AI Regulation Overview

Overview

Saudi Arabia's approach to artificial intelligence regulation is centered around the National Strategy for Data & Artificial Intelligence (NSDAI), launched in 2020 to support the Kingdom's Vision 2030 economic and social transformation goals. To lead this effort, the Saudi Data and Artificial Intelligence Authority (SDAIA) was established by Royal Order in 2019 as the central national authority. SDAIA is charged with executing the national strategy, operating core data infrastructure, coordinating data governance across government entities, and advancing responsible AI adoption across both public and private sectors.

The Kingdom's regulatory landscape is characterized by strategic policy drivers, structured soft-law guidance, and specialized sectoral oversight. Key regulatory milestones include the release of the Principles and Controls of AI Ethics in September 2023, the Generative AI Guidelines for Government in January 2024, the AI Adoption Framework in September 2024, and the draft Deepfakes Guidelines. Alongside SDAIA, digital infrastructure and sovereign cloud initiatives are regulated by the Communications, Space and Technology Commission (CST), which introduced a draft Global AI Hub Law in 2025.

Regulatory Approach

Saudi Arabia employs a centralized, strategy-led governance framework that balances soft-law guidance with risk-based operational controls. Rather than enacting a single omnibus penal AI law, the Kingdom relies on SDAIA to issue comprehensive principles and practical playbooks. These frameworks adopt a functional risk taxonomy, categorizing AI applications into unacceptable risk, high risk, limited risk, and little or no risk categories. Higher-risk deployments require detailed impact assessments, continuous performance logging, and mandatory human oversight.

This soft-law strategy operates in close coordination with binding statutory frameworks, particularly the Personal Data Protection Law (PDPL) and cloud computing regulations. The governance structure emphasizes organizational maturity, establishing internal AI offices, appointing designated compliance officers, and applying phased implementation controls. Government entities and commercial enterprises are guided by standardized templates, readiness checks, and regulatory sandboxes to foster innovation while ensuring safety and alignment with public order.

Key AI Legislation

• Royal Order Establishing SDAIA (2019): Founded the Saudi Data and Artificial Intelligence Authority as the central national body responsible for setting the national data and AI agenda, operating national infrastructure, and supervising data governance.
• National Strategy for Data & Artificial Intelligence (NSDAI) (2020): Sets a national roadmap under Vision 2030 organized across six core pillars (Ambition, Skills, Policy & Regulation, Investment, Research & Innovation, Ecosystem) to position Saudi Arabia as a global data and AI hub.
• Principles and Controls of AI Ethics (2023): Establishes seven core principles (fairness, privacy & security, humanity, social & environmental benefits, reliability & safety, transparency & explainability, accountability) alongside a four-tier risk classification model.
• Generative AI Guidelines for Government (2024): Sets risk-based operational rules, data classification standards, prompt governance, human-in-the-loop requirements, and vendor due-diligence controls for public sector generative AI usage.
• AI Adoption Framework (2024): Provides a practical lifecycle playbook, readiness assessment templates, maturity levels (Emerging to Advanced), and operational controls for public and private organisations.
• Deepfakes Guidelines (Draft 2024): Outlines requirements for synthetic media, including verifiable consent for likeness use, visible and machine-readable watermarking, dataset provenance documentation, and high-risk use-case restrictions.
• Cloud Computing Regulatory Framework (CCRF v3 / Service Provisioning Regulations): Regulates cloud service providers (CSPs), customer data classification (Saudi Government Data vs Non-Government Data), and localization restrictions under CST oversight.
• Draft Global AI Hub Law (Draft 2025): Proposed framework by CST creating Private, Extended, and Virtual hub models to host sovereign, foreign-aligned compute and data facilities under tailored legal and jurisdictional arrangements.

Governance & Enforcement Bodies

The Saudi Data and Artificial Intelligence Authority (SDAIA) is the primary national authority governing AI and data across the Kingdom. Directly linked to the Prime Minister, SDAIA exercises executive oversight and coordinates national efforts through specialised internal units: the National Data Management Office (NDMO), the National Centre for Artificial Intelligence (NCAI), and the National Information Center (NIC). SDAIA administers compliance with national AI ethics guidance, maintains the National Data Governance Platform, and serves as the supervisory authority for the Personal Data Protection Law (PDPL).

The Communications, Space and Technology Commission (CST) serves as the primary regulator for telecommunications, digital infrastructure, and cloud service provisioning. CST manages registration and licensing regimes for cloud operators, establishes cybersecurity and data resilience standards, and oversees proposed cross-border initiatives such as the Global AI Hub regime, coordinating with national security agencies and SDAIA where sensitive data or infrastructure are concerned.

Penalties & Enforcement

The guidance frameworks issued by SDAIA—including the AI Ethics Principles, Generative AI Guidelines, and AI Adoption Framework—are structured as soft-law instruments and do not contain independent statutory fine schedules. SDAIA monitors compliance through self-assessments, maturity evaluations, mandatory reporting for government entities, and administrative audits across AI offices.

Enforceable legal sanctions and administrative penalties derive from underlying primary statutes. Violations involving personal data privacy during AI training or processing are enforced under the Personal Data Protection Law (PDPL) and its executive regulations. In cloud computing and telecommunications, CST enforces regulatory compliance through licensing conditions, registration suspensions, service revocations, and administrative remedies.

Data Protection Framework

Data protection in the Kingdom is governed by the Personal Data Protection Law (PDPL), enacted by Royal Decree in 2021 with executive regulations and guidance issued by SDAIA in September 2023. As the supervisory authority, SDAIA oversees controller registration, enforces lawful processing standards, and monitors compliance with data subject rights. The PDPL imposes strict rules regarding personal data collection, processing, and cross-border transfers.

Saudi Arabia's AI governance instruments are closely integrated with the PDPL framework. SDAIA's ethics and adoption guidance mandate data minimization, privacy impact assessments (DPIAs), and consent mechanisms whenever personal data is processed by AI models. Additionally, CST cloud regulations enforce strict data localization and transfer restrictions for Saudi Government Data, prohibiting unauthorized processing outside the Kingdom.

Sector-Specific Rules

Sector-specific AI implementation is guided by the National Strategy (NSDAI) and the AI Adoption Framework, which prioritize high-impact sectors including healthcare, financial services, energy, education, mobility, and government operations. Entities operating in these sectors are instructed to establish dedicated internal AI offices, adopt tailored risk management practices, and align model development with sectoral oversight requirements.

The provided regulatory corpus does not contain standalone legislation or specific rules dedicated exclusively to autonomous vehicles or employment AI algorithms, focusing instead on cross-sectoral risk assessments, ethics controls, and data protection rules applied across all deployers.

International Alignment

Saudi Arabia's AI governance frameworks explicitly incorporate international best practices and technical standards. SDAIA's Principles and Controls of AI Ethics and AI Adoption Framework align with trustworthy AI principles established by global bodies such as UNESCO and the OECD, as well as ISO/IEC technical standards for quality management and model validation.

The Kingdom actively engages in international cooperation through global events such as the Global AI Summit (GAIN) in Riyadh. Furthermore, CST's Draft Global AI Hub Law introduces novel legislative concepts designed to facilitate international alignment, allowing guest countries and foreign entities to host sovereign data within specialized hub models subject to defined jurisdictional and legal frameworks.

Future Developments

Future regulatory developments focus on formalizing and operationalizing draft legislation released for public consultation. A key priority is the enactment and implementation of CST's Draft Global AI Hub Law, which underwent public consultation on the Istitlaa platform in mid-2025 to refine licensing terms, sovereign data embassy structures, and emergency access provisions.

SDAIA is also expected to continue expanding sector-specific guidance, sandboxes, and verification tools under the AI Adoption Framework and Deepfakes Guidelines. These measures signal a ongoing transition toward structured conformity assessments, automated monitoring telemetry, and standardized registries for high-risk AI deployments.

Enforcement Bodies

Agency	Mandate	Key Powers	Website
Saudi Data and Artificial Intelligence Authority (SDAIA)	Central national authority for data and artificial intelligence strategy, policy, and governance; supervisory body for the Personal Data Protection Law (PDPL).	Issues AI ethics and operational guidance, maintains controller registers, operates national data platforms, conducts compliance audits, and coordinates AI strategy across government bodies.