Start-up compliance series · 6 of 7

AI governance in Saudi Arabia: policy led, with force through the PDPL

Saudi Arabia's AI governance landscape combines SDAIA guidance with binding privacy, cybersecurity and sector requirements. Start-ups need to distinguish principles from enforceable duties while building evidence for both.

Last reviewed: 3 October 2026

Series
Start-up compliance series · 6 of 7
Lead body
SDAIA, with NCA and sector regulators
Guidance
AI Ethics Principles, Generative AI Guidelines, Deepfakes Guidelines and AI Adoption Framework
Binding foundations
Saudi PDPL, implementing regulations, cybersecurity controls and sector rules

How Saudi AI governance operates in practice

  • Saudi PDPL. The law governs personal data used for training, operation and evaluation, including transfers and individual rights, and addresses certain automated processing affecting individuals.
  • Generative AI guidance. SDAIA materials address data classification, privacy controls, human review, bias, hallucination and synthetic content risks for relevant audiences.
  • Deepfakes guidance. The framework addresses developers, creators and consumers, including recommendations on transparency, watermarking and consent.
  • Cybersecurity. Applicable National Cybersecurity Authority controls and sector requirements should be assessed for AI systems and their supporting infrastructure.

A developing legal landscape

A draft Global AI Hub Law was consulted on in 2025. Sources reviewed for the briefing described it as focusing on infrastructure, data sovereignty and data embassy concepts rather than a general law governing AI systems.

The draft law's current status should be confirmed through official Saudi sources before relying on any description of its effect.

Selling AI to Saudi government

Start-ups targeting public sector customers should expect government focused generative AI guidance to influence procurement. Data classification, access controls, human review and evidence of responsible deployment should be designed into the product and operating model early.

Five actions for Saudi AI deployment

  • Align policy to SDAIA principles. Translate the relevant AI Ethics Principles into owners, controls and review evidence.
  • Classify model data. Record the data used by each system and the points at which a person reviews or overrides outputs.
  • Address synthetic content. Consider labelling and retain appropriate consent records for a person's likeness or voice.
  • Apply the Saudi PDPL. Assess training data, operation, transfers and rights handling under the privacy framework.
  • Check sector requirements. Review the rules and expectations of regulators relevant to the target market, including financial, health and aviation sectors where applicable.

Sources and scope

Source briefing: CMS AI Regulation Scanner, Saudi Arabia; Bird & Bird AI Regulatory Horizon Tracker, Saudi Arabia.

This article provides general information for start-ups and does not constitute legal advice. Requirements should be checked against current official sources and assessed for the organisation's circumstances before reliance.