AI regulation in Saudi Arabia (2026)

The Saudi Cabinet officially designated 2026 as the 'Year of Artificial Intelligence,' with SDAIA issuing a national coordination framework on 26 March to align government, private, and non-profit entities across six pillars: ambition, competencies, policies, investment, innovation, and ecosystem. The declaration coincides with Saudi Arabia ranking 14th in the 2025 Global AI Index and hosting the fourth GAIN Summit.

Crown Prince Mohammed bin Salman launched HUMAIN, a Public Investment Fund (PIF)-owned full-stack AI company covering data centres, cloud infrastructure, frontier models (including an Arabic-language LLM), and applications. Concurrent partnerships include a $10 billion agreement with AMD to deliver 500 MW of AI compute capacity over five years.

The Communications, Space and Technology Commission (CST) put out a draft Global AI Hub Law — the first among G20 nations — creating a legal framework for 'data embassies': sovereign data centres where foreign governments and companies host data and operate under their own home-country law within Saudi territory. Public consultation closed 14 May 2025.

SDAIA published a substantially upgraded ethics framework introducing a four-tier risk classification (unacceptable / high / limited / minimal), explicit prohibitions on unacceptable-risk AI systems, a voluntary compliance-badge scheme, and a mandatory Responsible AI Officer role — the first document in Saudi AI governance to categorically ban specific AI applications.

The one-year PDPL transition period expired on 14 September 2024, making the Personal Data Protection Law fully enforceable against all organisations — including foreign entities processing Saudi residents' data. Active supervisory mechanisms, fines up to SAR 5 million, and criminal liability for wilful breaches became operative from this date.

Launched at the third GAIN Summit in Riyadh, the Deepfakes Guidelines impose disclosure, watermarking, and provenance-tracking obligations on synthetic-media creators and platforms, while the AI Adoption Framework defines four AI-maturity levels (with enablers across data, technology, human capability, and responsible use) to guide phased AI implementation across organisations.

SDAIA issued two parallel sets of Generative AI Guidelines: one for government entities (covering risk classification, data-handling rules, human-oversight triggers, and bias testing) and one for the general public (covering fairness, privacy, and deepfake risks). These are the Kingdom's first dedicated regulatory instruments specifically addressing large language models and generative AI.

SDAIA issued the Kingdom's first formal national AI ethics framework, establishing seven core principles (fairness, privacy, transparency, accountability, reliability, humanity, and social/environmental benefit), a risk-tiering system, and governance requirements including an ethics committee and Responsible AI Officer. Non-binding in isolation, it is enforced indirectly through the PDPL and government-procurement conditions.

SDAIA unveiled the Kingdom's first integrated national AI strategy at the inaugural Global AI Summit in Riyadh, setting a three-phase roadmap: address national urgencies by 2025, build competitive advantage in AI-intensive sectors by 2030, and become a global AI exporter thereafter. The NSDAI underpins 66 of Vision 2030's 96 goals and remains the governing strategic document for all Saudi AI activity.

King Salman issued Royal Order No. A/471 creating the Saudi Data and Artificial Intelligence Authority (SDAIA), reporting directly to the Prime Minister, with two subsidiaries: the National Data Management Office (NDMO) for data regulation and the National Center for AI (NCAI) for research and adoption. This single decree established the institutional architecture that drives all subsequent Saudi AI policy and regulation.