Saudi Arabia
Saudi Arabia runs one of the most centralized AI governance structures anywhere through the Saudi Data and Artificial Intelligence Authority, but has not enacted an AI statute. SDAIA's AI Ethics Principles, first issued in September 2023 and updated in a 2025 edition, classify systems into four risk levels and prohibit practices such as social scoring, the PDPL is actively enforced for data, and two drafts are pending: AI cybersecurity guidelines whose consultation closed in August 2026, and a draft Global AI Hub Law on sovereign data hosting.
Key points
- SDAIA's AI Ethics Principles (September 2023, updated in 2025) apply a four-level risk classification across the AI lifecycle, including prohibitions like social scoring.
- The principles are formally non-binding but function as the de facto benchmark in supervisory reviews and audits.
- The PDPL and its implementing regulations are enforced; SDAIA has activated complaints committees and issued guidance.
- The National Cybersecurity Authority's draft AI Cybersecurity Guidelines, covering governance, defense, resilience, and third-party risk for AI including generative and agentic systems, went through a public consultation from July 5 to August 5, 2026; no final version has been published.
- The Communications, Space and Technology Commission published a draft Global AI Hub Law on sovereign data hosting for consultation from April 14 to May 14, 2025; no final law has been issued.
- SDAIA's National AI Risk Management Framework, launched on July 14, 2026, gives public and private entities a common method for identifying, assessing, treating, and monitoring AI risks; it is non-binding guidance.
Laws and instruments
SDAIA AI Ethics Principles
National ethics framework graded by a four-level risk classification, applied across design, development, deployment, and use. Non-binding in form, benchmark in practice.
SDAIA National AI Risk Management Framework
A national methodology for identifying, assessing, treating, and monitoring AI risks, for public and private entities. It sets out a phased risk cycle, a likelihood-times-impact scoring matrix, seven risk categories, and seven ethical principles that tie back to the AI Ethics Principles. Non-binding, like the principles, and presented to regulators and practitioners at a Riyadh forum in September 2026.
Personal Data Protection Law (applied to AI)
The binding data layer for AI systems in the Kingdom, with SDAIA enforcement underway since September 2024 and transfer rules, including standard contractual clauses, issued in 2024.
Timeline
- September 2023SDAIA AI Ethics Principles issued.
- 2024 to 2025PDPL enforcement operationalized.
- 2025SDAIA publishes an updated 2025 edition of the AI Ethics Principles.
- April 14, 2025The Communications, Space and Technology Commission opens consultation on a draft Global AI Hub Law, to May 14.
- July 5, 2026The NCA opens consultation on draft AI Cybersecurity Guidelines, closing August 5, 2026.
- July 14, 2026SDAIA launches the National AI Risk Management Framework.
Who it applies to
No binding AI-specific statute. Companies operating in the Kingdom should treat SDAIA's risk-graded principles as the audit benchmark and comply with the PDPL for any personal data.
Penalties
PDPL sanctions for data violations; supervisory and procurement consequences for departing from SDAIA expectations. No AI-specific fine schedule yet.
Common questions
Does Saudi Arabia have a comprehensive AI law?
What are the penalties for AI violations in Saudi Arabia?
Who does AI regulation in Saudi Arabia apply to?
Artificial Intelligence Regulations, "AI Regulation in Saudi Arabia," reviewed October 26, 2026, https://artificialintelligenceregulations.com/jurisdictions/saudi-arabia.html.
Entries state the position as of the review date and link to the primary text for verification.