Artificial Intelligence - Saudi Arabia

SDAIA's 'Principles and Controls of AI Ethics,' first issued in 2023 with an updated 2025 version, set out seven core principles (fairness; privacy & security; humanity; social & environmental benefits; reliability & safety; transparency & explainability; accountability) and a risk-based classification model across the AI lifecycle. They are guidance, not enforceable law.

SDAIA published two non-binding Generative AI Guidelines — one for government employees and one for the public — covering responsible use, transparency, content authenticity/watermarking, human oversight, and risk management, aligned with the PDPL.

The Personal Data Protection Law and its Implementing Regulations came into force on 14 September 2023 (full compliance required from 14 September 2024). It is enforced by SDAIA and regulates AI-relevant matters including automated decision-making, requiring legal basis/consent and addressing cross-border transfers.

SDAIA (established 2019) is the national authority responsible for data and AI policy, strategy, ethics, and PDPL enforcement, consolidating AI governance rather than dispersing it across sectoral regulators.

Legal analyses confirm Saudi Arabia currently has no AI-specific binding law and no formally announced legislative process to enact one; governance relies on voluntary SDAIA instruments plus existing data-protection and cybersecurity rules.

SDAIA's AI Adoption Framework (2024) outlines maturity levels and enablers (data, technology, human capabilities, responsible use) to operationalize AI uptake under the National Strategy for Data & AI, reinforcing a guidance-led national approach.