AI in Saudi Arabia: What Organisations Need to Know Before a Project

Last updated 2 October 2026

This page is for organisations deciding on a project that involves AI in Saudi Arabia, or already running one. It sorts the instruments by legal weight, shows where the PDPL and NCA controls apply and ends with seven questions to settle before kick-off.

Who sets the rules for AI in Saudi Arabia

Anyone following artificial intelligence Saudi Arabia policy will meet two authorities first. SDAIA was established in 2019 and is linked directly to the Prime Minister. It leads the national data and AI agenda, includes the National Center for Artificial Intelligence, the National Data Management Office (NDMO) and the National Information Center, implements the National Strategy for Data and AI, and acts as the competent authority for the PDPL. The NCA is the national authority for cybersecurity and issues the control frameworks most Saudi organisations are measured against. Sector regulators can add requirements of their own for AI in Saudi Arabia, so ask yours before you fix a design.

The instruments that shape AI in Saudi Arabia, and how much weight each carries

Two rows are drafts, and drafts change, so check the status of anything you rely on when planning AI in Saudi Arabia.

Does Saudi Arabia have an AI law?

Not in the sources we checked. Law-firm trackers updated in February 2026 describe no dedicated AI statute and no announced legislative process to create one. The draft Global AI Hub Law, put out for consultation in April 2025, concerns hosting foreign data in the Kingdom under “data embassy” arrangements and does not regulate AI systems. What exists for AI in Saudi Arabia is SDAIA’s soft-law layer, summarised above, sitting on top of binding general law, so the AI regulation Saudi Arabia has produced so far is mostly guidance.

Does an AI system need SDAIA approval?

No general approval or licence for deploying AI in Saudi Arabia turned up in the material we reviewed. The SDAIA AI Ethics Principles describe registration as optional and offer badges to entities that register. Government entities that use AI in Saudi Arabia face more, because SDAIA’s Generative AI Guidelines set expected practice for them, and some sectors have their own regulators. In June 2026 SDAIA said it had launched ten regulatory documents on the ethical and responsible use of AI, so check its current list rather than relying on any article, this one included.

When the PDPL applies to an AI project

The PDPL applies whenever personal data is processed. In an AI project that includes training data, documents fed to a model, prompts that contain names or ID numbers, and the logs a system keeps. It covers processing of data about individuals residing in the Kingdom even when the processor is outside it, so hosting a model abroad does not take AI in Saudi Arabia outside its reach. The law took effect on 14 September 2023 and its one-year grace period ended on 14 September 2024. The points that most often shape a design for AI in Saudi Arabia are these.

• Definition. Personal data is any data that can identify an individual directly or indirectly (Article 1(4)). Sensitive data includes health, genetic and biometric data, which matters for image and voice systems.
• Purpose and minimisation. The purpose must be defined and documented before collection, and no more data than the purpose needs may be collected. A plan to feed a model everything available will need justifying against this.
• Impact assessment. The Implementing Regulations set out the cases in which a data protection impact assessment is required. Several of them, such as sensitive data, linking datasets from different sources and the use of emerging technologies, are common in AI projects.
• Transfers abroad. A separate Regulation on Personal Data Transfer Outside the Kingdom applies. If a vendor’s model or API runs outside Saudi Arabia, check whether sending personal data to it counts as a transfer.
• Breaches. A breach that may cause harm must be notified to SDAIA within 72 hours of becoming aware of it.
• Penalties. HSF Kramer’s summary of the law lists a fine of up to SAR 5 million for most violations and, for disclosing sensitive data, up to two years’ imprisonment or a fine of up to SAR 3 million. These apply to AI in Saudi Arabia as to any other processing.

This is general information, not legal advice. Confirm how the PDPL applies to your project with a qualified adviser or SDAIA.

Which NCA cybersecurity controls AI projects fall under

In the NCA material we reviewed, no control set in force is written for AI specifically, so AI in Saudi Arabia is covered by the general controls, like any other system. The Essential Cybersecurity Controls (ECC-2:2024) apply to government entities and their affiliates and to private-sector entities that own, operate or host critical national infrastructure. The NCA strongly encourages every other entity to use them too. Subdomains an AI project will touch include cybersecurity in information and technology project management (1-6), identity and access management (2-2), data and information protection (2-7), third-party cybersecurity (4-1) and cloud computing and hosting cybersecurity (4-2).

The Data Cybersecurity Controls (DCC-1:2022, issued 18 September 2022) set minimum requirements for protecting data through its whole life cycle. The Cloud Cybersecurity Controls (CCC-2:2024) apply to cloud service providers and their tenants. Both are extensions of the ECC. In December 2025 the NCA also issued controls for private-sector entities without critical infrastructure.

Seven questions to settle before kick-off

Before an organisation commits to AI in Saudi Arabia, these questions turn the rules above into decisions.

1. What decision or task is the system taking on, and what happens when it is wrong? The answer sets the risk level, the human review you need and how much testing is enough. Many first projects turn out to be rule-based work better served by robotic process automation than by AI.
2. Which personal data will it see? List the categories, mark anything sensitive and decide whether an impact assessment is needed.
3. Where will data be stored and processed, including by any vendor? Include model APIs, logs and backups. Hosting is covered in more depth in our guide to data residency in Saudi Arabia.
4. Which NCA controls cover your entity? Ask your security team which of the ECC, DCC, CCC and private-sector controls apply, and who signs off the design.
5. Does a sector regulator or a government customer add requirements? Ask before design, not at go-live.
6. Who is accountable? Name an owner for the system’s output, a route for incidents and a way for people affected to ask for a human review. SDAIA’s Ethics Principles describe a Responsible AI Officer role that can serve as a model.
7. How will you test it on your own data, in Arabic and English, and what is the exit if it fails? A pilot with a defined end date and success measure is easier to govern than an open-ended trial.

For AI in Saudi Arabia, most of these questions are answered during an assessment stage before anything is built. WASNA Digital Solutions describes how it runs that stage, covering data quality, integration points, hosting and PDPL implications, on its digital transformation and AI solutions page.

Sources

• AI Ethics Principles, Version 1.0, September 2023. Saudi Data and AI Authority (SDAIA). dgp.sdaia.gov.sa. Accessed 2 October 2026.
• Guide to the Saudi Personal Data Protection Law (for controllers and processors). SDAIA. dgp.sdaia.gov.sa. Accessed 2 October 2026.
• Essential Cybersecurity Controls (ECC-2:2024). National Cybersecurity Authority (NCA). cdn.nca.gov.sa. Accessed 2 October 2026.
• Data Cybersecurity Controls (DCC-1:2022). NCA. nca.gov.sa. Accessed 2 October 2026.
• Cloud Cybersecurity Controls (CCC-2:2024). NCA. nca.gov.sa. Accessed 2 October 2026.
• NCA Launches Public Consultation on “AI Cybersecurity Guidelines”, 5 July 2026. NCA. nca.gov.sa. Accessed 2 October 2026.
• NCA Issues ‘Cybersecurity Controls for Private Sector Entities Without Critical Infrastructure’, 28 December 2025. Saudi Press Agency. spa.gov.sa. Accessed 2 October 2026.
• SDAIA Invites Public, Entities to Share Views on Responsible AI Policy Draft, 2 April 2026. Saudi Press Agency. spa.gov.sa. Accessed 2 October 2026.
• SDAIA Builds Regulatory Environment for Data, AI to Promote Responsible Use, 8 June 2026. Saudi Press Agency. spa.gov.sa. Accessed 2 October 2026.
• SDAIA Launches Regulatory Framework for Establishing AI Units in Saudi Public Institutions, 12 September 2024. Saudi Press Agency. spa.gov.sa. Accessed 2 October 2026.
• SDAIA Launches AI Framework to Promote Ethical, Responsible Use of Advanced Technologies in Saudi Arabia, 1 December 2024. Saudi Press Agency. spa.gov.sa. Accessed 2 October 2026.
• Saudi Data and Artificial Intelligence Authority (SDAIA). Saudipedia. saudipedia.com. Accessed 2 October 2026.
• Generative AI Guidelines for Government (SDAIA), January 2024. Regulations.AI. regulations.ai. Accessed 2 October 2026.
• National Data and AI Strategy. OECD.AI Policy Observatory. oecd.ai. Accessed 2 October 2026.
• AI Tracker: Kingdom of Saudi Arabia (updated 12 February 2026). Herbert Smith Freehills Kramer. hsfkramer.com. Accessed 2 October 2026.
• AI laws and regulations in Kingdom of Saudi Arabia (updated 17 February 2026). CMS Expert Guides. cms.law. Accessed 2 October 2026.
• Saudi Arabia’s Personal Data Protection Law: what you need to know, November 2023. Herbert Smith Freehills Kramer. hsfkramer.com. Accessed 2 October 2026.
• Implementing regulations in Saudi PDPL, 2023. Addleshaw Goddard. addleshawgoddard.com. Accessed 2 October 2026.