Artificial IntelligenceRegulations

Saudi Arabia

No comprehensive lawApproach: Centralized governance through SDAIA; principles and drafts, no AI act

Saudi Arabia runs one of the most centralized AI governance structures anywhere through the Saudi Data and Artificial Intelligence Authority, but has not enacted an AI statute. SDAIA's AI Ethics Principles from September 2023 classify systems into four risk levels and prohibit practices such as social scoring, the PDPL is actively enforced for data, and two significant drafts are moving: AI cybersecurity guidelines out for consultation until August 2026 and a proposed AI and data sovereignty law.

Key points

  • SDAIA's AI Ethics Principles (September 2023) apply a four-level risk classification across the AI lifecycle, including prohibitions like social scoring.
  • The principles are formally non-binding but function as the de facto benchmark in supervisory reviews and audits.
  • The PDPL and its implementing regulations are enforced; SDAIA has opened investigations.
  • The National Cybersecurity Authority's draft AI Cybersecurity Guidelines are in public consultation until early August 2026.
  • A proposed AI and Data Sovereignty law has been publicly signaled.

Laws and instruments

SDAIA AI Ethics Principles

SDAIA, September 2023
No comprehensive law

National ethics framework graded by a four-level risk classification, applied across design, development, deployment, and use. Non-binding in form, benchmark in practice.

Effective: Published September 2023
Primary source: Global AI regulation guide (2026) ↗

Personal Data Protection Law (applied to AI)

PDPL and implementing regulations
In force

The binding data layer for AI systems in the Kingdom, with SDAIA enforcement underway and cross-border transfer rules still being finalized.

Effective: Enforcement phase since 2024
Primary source: Middle East TMT developments 2025 to 2026 ↗

Timeline

  • September 2023
    SDAIA AI Ethics Principles issued.
  • 2024 to 2025
    PDPL enforcement operationalized.
  • Mid-2026
    NCA draft AI Cybersecurity Guidelines in consultation until early August 2026.

Who it applies to

No binding AI-specific statute. Companies operating in the Kingdom should treat SDAIA's risk-graded principles as the audit benchmark and comply with the PDPL for any personal data.

Penalties

PDPL sanctions for data violations; supervisory and procurement consequences for departing from SDAIA expectations. No AI-specific fine schedule yet.

Common questions

Does Saudi Arabia have a comprehensive AI law?
Saudi Arabia has no comprehensive AI statute. Saudi Arabia runs one of the most centralized AI governance structures anywhere through the Saudi Data and Artificial Intelligence Authority, but has not enacted an AI statute. SDAIA's AI Ethics Principles from September 2023 classify systems into four risk levels and prohibit practices such as social scoring, the PDPL is actively enforced for data, and two significant drafts are moving: AI cybersecurity guidelines out for consultation until August 2026 and a proposed AI and data sovereignty law.
What are the penalties for AI violations in Saudi Arabia?
PDPL sanctions for data violations; supervisory and procurement consequences for departing from SDAIA expectations. No AI-specific fine schedule yet.
Who does AI regulation in Saudi Arabia apply to?
No binding AI-specific statute. Companies operating in the Kingdom should treat SDAIA's risk-graded principles as the audit benchmark and comply with the PDPL for any personal data.
Related topics
Prohibited AI practicesHigh-risk systems
Cite this page

Artificial Intelligence Regulations, "AI Regulation in Saudi Arabia," reviewed July 16, 2026, https://artificialintelligenceregulations.com/jurisdictions/saudi-arabia.html.

Entries state the position as of the review date and link to the primary text for verification.