Saudi Arabia
Central data and AI authority governing through ethics principles, guidance and a national risk framework, backed by a binding data-protection law
Regulatory posture
Saudi Arabia governs AI through one powerful authority, SDAIA, rather than a statute. Its instruments — the AI Ethics Principles (2023), generative AI guidelines (2024) and the National AI Risk Management Framework (2026) — are advisory, but the binding Personal Data Protection Law gives SDAIA real enforcement reach over data-driven AI.
Tracked
- In force2
- Signals2
Set last reviewed 16 October 2026
Next review 13 November 2026
Tracked instruments
- Saudi AI Risk FrameworkAn advisory national reference for government and private entities to identify, assess, treat and monitor AI risks, using a four-stage lifecycle, a likelihood-impact matr…Standards & AssuranceGovernance & Procurement
- Saudi PDPLSaudi Arabia's comprehensive data-protection law, administered by SDAIA, governing collection, processing and cross-border transfer of personal data — including data used…Data & Privacy
Signals
SDAIA reopens consultation on PDPL implementing-regulation changes
A revised draft adds in-Kingdom data localisation, wider breach-notification triggers and expanded registration duties. Comments close 5 November 2026.
ContextSaudi Arabia launches national AI risk management framework
SDAIA launched an advisory framework giving government and private entities a single method to identify, assess, treat and monitor AI risks.
Context