AI governance in Saudi Arabia: the PDPL and SDAIA's principles in one programme

Saudi Arabia does not have a standalone AI law. Two instruments do most of the work. The Personal Data Protection Law is binding, fully enforceable since September 2024, and its Implementing Regulation names automated decisions directly. SDAIA’s AI Ethics Principles apply to every organisation designing, developing, deploying or using AI in the Kingdom, with risk levels, controls and roles.

They ask for different things, but they rest on the same records. A Saudi organisation that builds one register and one assessment process can cover both without doing the work twice. This guide sets out the order.

Start with a register that answers both

Every later step depends on knowing what AI you run. For each system and agent, record the owner, the purpose, the model and vendor behind it, the personal data it uses and where that data goes, and who is affected by its outputs. Add three fields that the Saudi rules make important.

• Does it decide anything about people on its own? The PDPL treats decisions made solely by automated processing differently from decisions a person makes with AI support.
• Is it a new technology for you? Article 25 of the Implementing Regulation lists processing based on newly adopted technologies as an impact assessment trigger.
• Which SDAIA risk level is it? Little or no risk, limited, high or unacceptable.

Our guide to building an AI system register covers the full field set and how to find the AI nobody registered. Shadow AI matters here. A team using a public generative AI tool on customer data is processing personal data, whether or not anyone wrote it down.

Classify each system once

SDAIA’s four levels give every system a single label that drives the rest of the work.

• Little or no risk. Spam filters and similar tools. No restrictions, though following the principles is recommended.
• Limited risk. Subject to the seven principles.
• High risk. Systems that pose high risks to basic rights need pre- and post-conformity assessments and must meet the relevant statutory requirements.
• Unacceptable risk. Social profiling, exploitation of children and likely distortion of behaviour are not allowed. If a system falls here, stop it.

Most systems that make consequential decisions about people with their personal data, such as credit scoring, hiring screens or fraud flags, will sit at high risk under SDAIA’s scheme and will also trigger the PDPL’s impact assessment duty. That overlap is the point. Assess them once, properly.

Settle the PDPL questions for automated decisions

For every system that decides on its own using personal data, three PDPL questions need a clear answer on file.

Consent. Where consent is the basis for processing, Article 11(2)(c) of the Implementing Regulation says it must be explicit when decisions are made solely by automated processing. Check that the consent you collect is specific to the purpose, separate for each purpose, and documented so it can be verified later.

Notice. Article 4(5) requires a controller that makes automated decisions based on personal data to tell people whether decisions will be made solely by automated processing, along with how it protects their data. Check the privacy policy and the notice at the point of collection, and keep them in step with the register. When a new automated system goes live, the notice should change with it.

Impact assessment. Article 25 requires a written, documented assessment that covers the purpose and legal basis, the nature, scope and context of the processing, necessity and proportionality, and the likely material and moral impact on people, with the measures taken to reduce the risks. An AI impact assessment built for ISO/IEC 42001 or the NIST AI RMF covers most of this, provided it speaks to the rights of the people whose data is used.

Where a decision is made by a person with AI support, rather than solely by the system, record what the person actually does. A reviewer who approves every output without looking is not much different from no reviewer at all.

Build oversight and accountability in

SDAIA’s principles expect human oversight across the whole lifecycle, and say that decisions that are irreversible or hard to reverse should trigger human oversight. Decide, for each high-risk system, who can intervene, at what point, and with what authority. Our guide to human oversight of AI sets out how to choose between a person in the loop and a person on the loop.

The principles also name four roles. The head of the entity or chief data officer owns the AI ethics practice and approves an annual AI ethics report. A compliance officer oversees the AI ethics plan and makes sure third-party systems meet the principles through contract terms. A Responsible AI Officer runs the plan day to day. An AI system assessor reviews systems and publishes assessment reports. A smaller organisation can combine roles, but each should have a named person.

Cover your vendors

Most AI in a Saudi organisation comes from vendors. Under the PDPL you remain the controller for decisions a vendor’s model makes on your behalf, and SDAIA expects third-party systems to be covered through contract terms. Ask each vendor what data it processes, where it processes it, how it changes its models and how you will hear about incidents. Our guide to vendor AI risk management lists the questions. Article 29 of the Law sets conditions on transferring personal data outside the Kingdom, so record where each vendor holds your data.

Watch the 2026 amendments

SDAIA published draft amendments to the Implementing Regulation on 6 October 2026, with consultation open until 5 November 2026. Commentary on the draft reports that solely automated decisions affecting people’s rights or interests would become an explicit impact assessment trigger, along with the use of emerging technologies. It also reports a proposed duty to store personal data in the Kingdom and a 72-hour breach notice to SDAIA without the current harm test. If adopted, the changes take effect 60 days after publication in the Official Gazette.

SDAIA also launched a National AI Risk Management Framework in July 2026, as a common method for identifying, assessing, treating and monitoring AI risk. An organisation that already runs the register, classification and assessments above is well placed for whatever these bring.

This guide is Aicura’s reading of the Saudi rules. It is not legal advice. Read the primary sources on SDAIA’s site and take advice on how they apply to you.