Contact usGet started

Frameworks · Saudi Arabia

AI governance frameworks and AI law in Saudi Arabia

Saudi Arabia governs AI through its Personal Data Protection Law, which treats automated decisions as higher-risk processing, and through national guidance from SDAIA, the Saudi Data and AI Authority. SDAIA's AI Ethics Principles set seven principles and four risk levels, supported by guidance on generative AI, deepfakes, AI adoption and AI risk management.

Who regulates AI here

  • Saudi Data and AI Authority (SDAIA)The competent authority for the Personal Data Protection Law and the national reference body for data and AI, which publishes the AI Ethics Principles and SDAIA's AI guidance.
  • Saudi Central Bank (SAMA)Supervises banks, insurers and finance companies, and sets the risk and cybersecurity expectations that reach the AI they run.
  • Capital Market AuthorityRegulates the Saudi capital market and the firms it licenses, whose use of AI falls under its supervision.
  • National Cybersecurity AuthoritySets the national cybersecurity controls that government bodies and critical infrastructure operators apply to their systems, AI included.
  • Communications, Space and Technology CommissionRegulates the communications, space and technology sector, and ran the 2025 consultation on the draft Global AI Hub Law.

Saudi Arabia

Saudi Arabia governs AI through its Personal Data Protection Law, which requires explicit consent and impact assessments for automated decisions, and national AI guidance from SDAIA, including its AI Ethics Principles.

LawSaudi PDPLSaudi Personal Data Protection Law and automated decisionsHow Saudi Arabia's PDPL and its Implementing Regulation apply to AI. Explicit consent for automated decisions, notice, impact assessments and the 2026 draft.In force since 14 September 2023 and fully enforceable since September 2024. Draft amendments to the Implementing Regulation under consultation until 5 November 2026.Regulator guidanceSDAIA AI Ethics PrinciplesSaudi Arabia's AI Ethics Principles from SDAIA. The seven principles, the four risk levels, the roles each entity designates and how to put them into practice.Published by SDAIA. Current edition dated May 2025. Registration is optional.

All Saudi Arabia frameworks

International

Standards and frameworks that apply across borders. Most organisations use one of these as the backbone of their AI governance, whatever their jurisdiction.

StandardISO/IEC 42001ISO/IEC 42001:2023 AI management systemsISO/IEC 42001 is the certifiable international standard for an AI management system. What it requires, how Annex A works and how to get ready to certify.Published December 2023, current editionIn Aicura from ProStandardISO/IEC 42005ISO/IEC 42005:2025 AI system impact assessmentISO/IEC 42005 is international guidance on assessing how an AI system affects people and society, when to assess, what to record and how it links to 42001.Published May 2025, current editionVoluntary frameworkNIST AI RMFNIST AI Risk Management Framework (AI RMF 1.0)The NIST AI RMF is a voluntary framework for managing AI risk through four functions, Govern, Map, Measure and Manage. What it asks and who uses it worldwide.Version 1.0 current, revision under wayIn Aicura from ProVoluntary frameworkNIST Generative AI ProfileNIST AI RMF Generative AI Profile (NIST AI 600-1)NIST AI 600-1 applies the AI Risk Management Framework to generative AI. Its 12 risks, the suggested actions behind them and who uses the profile and why.Final, published July 2024StandardISO/IEC 23894ISO/IEC 23894:2023 Guidance on AI risk managementISO/IEC 23894 adapts the ISO 31000 risk process to AI. What the guidance covers, its AI risk sources and lifecycle mapping, and how it fits with ISO 42001.Published February 2023, current editionStandardISO/IEC 38507ISO/IEC 38507:2022 Governance implications of the use of AI by organizationsISO/IEC 38507 is guidance for boards on governing an organisation's use of AI. What it asks of directors, how it links to ISO/IEC 38500 and who uses it.Published April 2022, current editionVoluntary frameworkOECD AI PrinciplesOECD Recommendation of the Council on Artificial Intelligence (OECD AI Principles)The OECD AI Principles are the intergovernmental standard for trustworthy AI, adopted 2019 and revised 2024. The five principles and how to apply them.Adopted May 2019, revised May 2024Voluntary frameworkHUDERIAHUDERIA: Risk and impact assessment of AI systems for human rights, democracy and the rule of lawHUDERIA is the Council of Europe's method for assessing AI risks to human rights, democracy and the rule of law. Its four elements, scoring and who uses it.Methodology and Model adopted, non-bindingLawCouncil of Europe AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)The Council of Europe AI Convention is the first binding international treaty on AI. Who has signed and ratified, what it asks of parties and when it applies.Open for signature, not yet in forceVoluntary frameworkG7 Hiroshima Code of ConductHiroshima Process International Code of Conduct for Organizations Developing Advanced AI SystemsThe G7 Hiroshima Code of Conduct sets 11 voluntary actions for advanced AI developers, with OECD HAIP reporting. What it asks and who reports under HAIP 2.0.Voluntary, reporting framework v2.0 liveVoluntary frameworkUNESCO AI Ethics RecommendationUNESCO Recommendation on the Ethics of Artificial IntelligenceUNESCO's Recommendation on the Ethics of AI is the global standard its member states adopted in 2021. Its values, principles and Ethical Impact Assessment.Adopted November 2021

All International frameworks

Aicura in Saudi Arabia

Frameworks elsewhere

Guides

Questions

Does Saudi Arabia have an AI law?

Not a standalone one. Binding rules for AI come mainly from the Personal Data Protection Law, whose Implementing Regulation requires explicit consent, notice and an impact assessment for decisions based on automated processing. SDAIA's AI Ethics Principles and other AI guidance set national expectations alongside it.

Who regulates AI in Saudi Arabia?

The Saudi Data and AI Authority, SDAIA, is the national reference body for data and AI and the competent authority for the Personal Data Protection Law. Sector regulators such as the Saudi Central Bank and the Capital Market Authority supervise the firms they license.

Is the Saudi PDPL being amended?

SDAIA published draft amendments to the PDPL Implementing Regulation on 6 October 2026 for consultation until 5 November 2026. Commentary on the draft reports wider impact assessment triggers, including solely automated decisions, and a duty to store personal data in the Kingdom. If adopted, they take effect 60 days after publication in the Official Gazette.

Does the PDPL apply to foreign companies?

Yes. It applies to processing of personal data about individuals residing in Saudi Arabia by any party outside the Kingdom, as well as to processing in the Kingdom.

Start with the AI you run.

Every framework begins with knowing which AI systems and agents you have. The AI register is free to start.

Sign upContact us