SDAIA AI Ethics Principles

What it is

The AI Ethics Principles are published by the Saudi Data and AI Authority, SDAIA, the national reference body for data and AI. SDAIA first published them in 2023 after public consultation, and the edition on its site is dated May 2025. They sit alongside SDAIA’s other AI guidance, including the Generative AI Guidelines for government and for the public, the Deepfakes Guidelines and the AI Adoption Framework.

The document has three parts that matter to an organisation. A risk classification. Seven principles, each with controls set against the four stages of the AI lifecycle. And a set of roles for SDAIA and for the entities that adopt the principles, with a checklist in the appendices for measuring progress.

Who it applies to

The scope is broad. The principles apply to all AI stakeholders designing, developing, deploying, implementing, using or being affected by AI systems in the Kingdom. That includes public entities, private entities, non-profits, researchers and civil society. An entity that is required to follow the document is called an adopting entity.

SDAIA reviews and updates the principles and monitors adoption, directly or through sector regulators. Entities can register with SDAIA voluntarily. Registered entities can submit reports, have their progress measured against the checklist and receive motivational badges.

What it requires

Risk levels. Every AI system falls into one of four levels.

• Little or no risk. No restrictions, though following the principles is recommended.
• Limited risk. Subject to the AI ethics principles.
• High risk. Systems that pose high risks to basic rights must undergo pre- and post-conformity assessments and meet the relevant statutory requirements as well as the principles.
• Unacceptable risk. Systems that pose an unacceptable risk to people’s safety, livelihood and rights, such as social profiling, exploitation of children or likely distortion of behaviour, are not allowed.

Seven principles. Fairness. Privacy and security. Humanity. Social and environmental benefits. Reliability and safety. Transparency and explainability. Accountability and responsibility. Each has controls for planning and design, preparing input data, building and validating, and deploying and monitoring. Transparency, for example, asks that decisions be traceable and that people affected be given an understandable explanation of the rationale. Accountability asks that human oversight be demonstrated across the whole lifecycle, and that the people who design, develop and run a system be identifiable.

Roles. Adopting entities are expected to designate four roles. The head of the entity or chief data officer approves the AI ethics plan and the annual AI ethics report. A chief compliance officer or compliance officer oversees the plan, monitors AI ethics measures for in-house and third-party systems, and makes sure third-party systems meet the principles through contract terms. A Responsible AI Officer develops the plan and runs awareness. An AI system assessor reviews systems and publishes assessment reports covering development, deployment and third-party procurement.

In practice this becomes a register of AI systems with an owner and a risk level for each, risk and impact assessments for the higher levels, human oversight decisions recorded per system, and an annual report that shows the plan being followed.

Key dates

• 2023. SDAIA publishes the AI Ethics Principles after public consultation.
• May 2025. Current edition of the principles, published with the Generative AI Guidelines, the Deepfakes Guidelines and the AI Adoption Framework.
• July 2026. SDAIA launches its National AI Risk Management Framework, as a methodology for public and private entities to identify, assess, treat and monitor AI risks.

How it relates to other frameworks

The seven principles track the OECD AI Principles and other national sets, such as the UAE AI Charter. The four risk levels follow the same broad shape as the EU AI Act, from unrestricted to prohibited, though the Saudi levels come with guidance rather than a statute behind them.

For AI that processes personal data, the binding rules come from the Personal Data Protection Law, which requires explicit consent and an impact assessment for decisions based on automated processing. An AI management system built on ISO/IEC 42001 or the NIST AI RMF supplies much of the structure the principles ask for, from risk assessment to documented oversight.

A note on this page

This is Aicura’s reading of the AI Ethics Principles in the English edition SDAIA publishes. It is not legal advice and it is not the document itself. Read the primary source on SDAIA’s site, and take advice on how Saudi expectations apply to your organisation.