artificial-intelligence.giGlobal AI Monitor

Saudi Arabia AI Regulation & Governance

SA10 active modules2 quiet

Last updated · 12 modules · 6 instruments · 31 claims · 61 sources in the cumulative register

Framework status
Draft Responsible Artificial Intelligence Policy (Draft, no legal force): Draft policy proposing four-tier risk framework, registration requirements, ethics labelling, audit duties and a regulatory sandbox for AI.
Main regulator

RegulatorSaudi Data & Artificial Intelligence Authority (SDAIA)

Next milestone
No upcoming dated milestone recorded
Record status
Live · Periodic active record · 61 sources (48 retrieved) · 1 under review · Not yet expert-reviewed
AI-assembled from cited sources
Evidence-gated · How we verify ·
DisclosureNot yet expert-reviewed · Not legal, compliance or investment advice. Facts are machine-assembled from cited public sources. Individual claims have not each been independently verified by a human reviewer. See methodology.

Source tiers: T1 enacted statute, regulation, or binding supervisory order · T2 official regulator guidance, consultation, or registry · T3 international standard-setter or peer-reviewed analysis · T4 practitioner commentary or secondary reporting. Confidence: high = corroborated by retrieved T1/T2 text · medium = single official source or secondary corroboration · low = preliminary or unverified. Full definitions →

Research checked · Updated
Record history

Research as of · Record last changed · Published · Page built

Jump to module (12)

#

Draft Responsible Artificial Intelligence Policy (Draft, no legal force): Draft policy proposing four-tier risk framework, registration requirements, ethics labelling, audit duties and a regulatory sandbox for AI.

2 instruments (2 current) · 0 obligations · 7 claims · 0 milestones

Standing sub-brief · as of 12 Nov 2026 216 words · last cycle 12 Nov 2026 · AI research, not expert reviewed

Saudi Arabia has no dedicated AI-specific statute in force, and no formal legislative process to enact a horizontal AI law has been announced. The Saudi Data and Artificial Intelligence Authority (SDAIA), established by royal decree on 30 August 2019 as the Kingdom's national authority for data and AI governance reporting to the Prime Minister, is the central body issuing AI governance instruments in the absence of such a statute. SDAIA's Principles and Controls of AI Ethics (the AI Ethics Principles), published in September 2023 as non-binding guidance, set ethical principles together with a four-tier risk classification for AI systems. Under that classification, systems assessed as unacceptable risk are barred from development or deployment, while systems assessed as high or limited risk are expected to comply with the Principles, though the framework itself remains non-binding and rests on voluntary adoption.

Instruments (2)
  • Draft Responsible Artificial Intelligence Policy Draft, no legal force

    Draft policy proposing four-tier risk framework, registration requirements, ethics labelling, audit duties and a regulatory sandbox for AI.

    Authority: Saudi Data and Artificial Intelligence Authority · Verified
  • Principles and Controls of AI Ethics (AI Ethics Principles) Published 2023-09-01

    Non-binding national AI ethics framework establishing seven principles and a four-tier risk classification.

    Non-binding · Authority: Saudi Data and Artificial Intelligence Authority · Verified · Official text
Claims and evidence (7)

  • SDAIA was established by royal decree on 30 August 2019 as Saudi Arabia's national authority for data and AI governance, reporting to the Prime Minister.

    Confidence: Probable (capped: best source is T3) · As of 30 Aug 2019 · Evidenced
    Evidence and sources
    • Saudipedia T3 · Retrieved · retrieved 4 Nov 2026 · Section 6.3.3It was established by a Royal Decree on August 30, 2019, and it is directly linked to the Prime Minister.

  • Saudi Arabia has no dedicated AI-specific statute in force and has not announced a formal legislative process to enact one.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • CMS Law T3 · Retrieved · retrieved 4 Nov 2026Saudi Arabia does not currently have an AI‑specific law and has not announced any formal legislative process to enact one.

  • SDAIA published non-binding AI Ethics Principles in September 2023, setting ethics principles and a four-tier risk classification for AI.

    Confidence: Probable (capped: best source is T3) · As of 1 Sep 2023 · Evidenced
    Evidence and sources
    • Regulations.ai T3 · Retrieved · retrieved 4 Nov 2026The Principles and Controls of AI Ethics is currently in force as non-binding guidance, having been published by the Saudi Data & Artificial Intelligence Authority (SDAIA) in September 2023

  • SDAIA's AI Ethics Principles classify AI systems into four risk tiers, with unacceptable-risk systems barred from development or deployment and high/limited-risk systems required to comply.

    Confidence: Probable (capped: best source is T3) · As of 1 Sep 2023 · Evidenced
    Evidence and sources
    • Ting Saudi T3 · Retrieved · retrieved 4 Nov 2026Systems of little or no risk are recommended rather than required to comply; limited-risk and high-risk systems must comply with the principles and additional applicable controls; unacceptable-risk systems cannot be developed or deployed.

  • SDAIA opened a public consultation in April 2026 on a draft Responsible AI Policy proposing registration, labelling, audit and sandbox mechanisms; it remains unadopted.

    Confidence: Probable (capped: best source is T3) · As of 3 May 2026 · Evidenced
    Evidence and sources
    • DTS Solution T3 · Retrieved · retrieved 4 Nov 2026In April 2026, SDAIA opened a public consultation on its draft Responsible AI Policy, a document that signals a clear shift away from broad ethics statements toward structured, operational governance.

  • CST's draft Global AI Hub Law, consulted on in April-May 2025, establishes a cross-border data-hosting regime rather than an AI regulatory framework, and remains unenacted.

    Confidence: Probable (capped: best source is T3) · As of 14 May 2025 · Evidenced
    Evidence and sources
    • Clyde & Co T3 · Retrieved · retrieved 4 Nov 2026On 14 April 2025, the Communications, Space and Technology Commission (CST) in the Kingdom of Saudi Arabia (KSA) issued a public consultation on the draft Global AI Hub Law.

  • Saudi Arabia has no dedicated horizontal AI statute; SDAIA has issued non-binding principles and guidelines instead.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • Herbert Smith Freehills Kramer T3 · Surfaced · retrieved 11 Nov 2026The ECC are the foundational cybersecurity controls that apply to government organisations in KSA – including ministries, authorities, establishments, and others (inside and outside the Kingdom) – as well as to private sector organisations that own, operate, or host critical national infrastructure.

#

Principles and Controls of AI Ethics (AI Ethics Principles) (Published 2023-09-01): Non-binding national AI ethics framework establishing seven principles and a four-tier risk classification.

1 instrument (1 current) · 0 obligations · 1 claim · 0 milestones

Standing sub-brief · as of 12 Nov 2026 72 words · last cycle 12 Nov 2026 · AI research, not expert reviewed

Saudi Arabia has no standalone prohibited-practices statute. The operative instrument is SDAIA's non-binding AI Ethics Principles, published in September 2023, which classify AI systems into four risk tiers. Under that classification, systems assessed as unacceptable risk are barred from development or deployment in the Kingdom, while systems assessed as high or limited risk are expected to comply with the Principles' requirements, though compliance rests on voluntary adoption rather than a statutory duty.

Instruments (1)
  • Principles and Controls of AI Ethics (AI Ethics Principles) Published 2023-09-01

    Non-binding national AI ethics framework establishing seven principles and a four-tier risk classification.

    Non-binding · Authority: Saudi Data and Artificial Intelligence Authority · Verified · Official text
Claims and evidence (1)

  • SDAIA's AI Ethics Principles classify AI systems into four risk tiers, with unacceptable-risk systems barred from development or deployment and high/limited-risk systems required to comply.

    Confidence: Probable (capped: best source is T3) · As of 1 Sep 2023 · Evidenced
    Evidence and sources
    • Ting Saudi T3 · Retrieved · retrieved 4 Nov 2026Systems of little or no risk are recommended rather than required to comply; limited-risk and high-risk systems must comply with the principles and additional applicable controls; unacceptable-risk systems cannot be developed or deployed.

#

Draft Responsible Artificial Intelligence Policy (Draft, no legal force): Draft policy proposing four-tier risk framework, registration requirements, ethics labelling, audit duties and a regulatory sandbox for AI.

2 instruments (2 current) · 1 obligation · 5 claims · 0 milestones

Standing sub-brief · as of 12 Nov 2026 158 words · last cycle 12 Nov 2026 · AI research, not expert reviewed

Binding obligations apply to AI/ML-based software medical devices in Saudi Arabia: manufacturers and developers must obtain Saudi Food and Drug Authority Medical Device Marketing Authorization before an AI/ML-based standalone software medical device may be placed on the Saudi market, under SFDA Guidance MDS-G010, a requirement distinct from SDAIA's non-binding AI governance guidance.

The National Cybersecurity Authority's Essential Cybersecurity Controls bind government bodies and operators or hosts of critical national infrastructure, and may extend to AI systems that are classified as, or that support, critical national infrastructure. The National Cybersecurity Authority has also progressed draft AI Cybersecurity Guidelines (AICG-1:2026) through a public consultation that closed on 5 August 2026; no final, binding version of those guidelines had been published as at late October 2026.

Separately, SDAIA's draft Responsible AI Policy, opened for consultation in April 2026, proposes registration, labelling, audit and sandbox mechanisms that would bear on high-risk system oversight; it remains a proposal and has not been adopted.

Instruments (2)
  • Draft Responsible Artificial Intelligence Policy Draft, no legal force

    Draft policy proposing four-tier risk framework, registration requirements, ethics labelling, audit duties and a regulatory sandbox for AI.

    Authority: Saudi Data and Artificial Intelligence Authority · Verified
  • SFDA Guidance on Artificial Intelligence (AI) and Machine Learning (ML) Technologies Based Medical Devices Valid from 2022-01-01
    Binding · Official text

Obligations

  • MDS-G010

    Manufacturers/developers of AI/ML-based software as a medical device must obtain SFDA Medical Device Marketing Authorization before placing the device on the Saudi market.

    Authorisation · Applies to: Product manufacturer · Principles and Controls of AI Ethics (AI Ethics Principles)
Claims and evidence (5)

  • AI/ML-based software medical devices require SFDA Marketing Authorization before sale in Saudi Arabia, a binding requirement distinct from SDAIA's non-binding guidance.

    Confidence: Probable · Evidenced
    Evidence and sources
    • NCBI/PMC (academic journal article) T2 · Retrieved · retrieved 4 Nov 2026The SFDA has pioneered binding requirements designed for manufacturers to obtain Medical Device Marketing Authorization.

  • NCA's Essential Cybersecurity Controls bind government bodies and CNI operators/hosts, and may apply to AI systems classified as or supporting critical national infrastructure.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • Herbert Smith Freehills Kramer T3 · Surfaced · retrieved 11 Nov 2026The ECC are the foundational cybersecurity controls that apply to government organisations in KSA – including ministries, authorities, establishments, and others (inside and outside the Kingdom) – as well as to private sector organisations that own, operate, or host critical national infrastructure.

  • NCA closed a consultation on draft AI Cybersecurity Guidelines on 5 August 2026; no final, binding version has been published as at late October 2026.

    Confidence: Probable · As of 5 Aug 2026 · Evidenced
    Evidence and sources

  • SDAIA opened a public consultation in April 2026 on a draft Responsible AI Policy proposing registration, labelling, audit and sandbox mechanisms; it remains unadopted.

    Confidence: Probable (capped: best source is T3) · As of 3 May 2026 · Evidenced
    Evidence and sources
    • DTS Solution T3 · Retrieved · retrieved 4 Nov 2026In April 2026, SDAIA opened a public consultation on its draft Responsible AI Policy, a document that signals a clear shift away from broad ethics statements toward structured, operational governance.

  • Derived: Probable SFDA requires SFDA Medical Device Marketing Authorization before an AI/ML-based standalone software medical device may be placed on the Saudi market (MDS-G010).

    Confidence: Probable · Evidenced
    Evidence and sources
    • NCBI/PMC (academic journal article) T2 · Retrieved · retrieved 4 Nov 2026The SFDA has pioneered binding requirements designed for manufacturers to obtain Medical Device Marketing Authorization.
    • Al Tamimi & Company T3 · Surfaced · retrieved 4 Nov 2026An equivalence comparison of machine-learning-based medical devices will be conducted to compare the intended use, model used for machine learning, and characteristics of training data in the two products.

#

Nothing recorded for this module in the research of 2026-11-12.

0 instruments · 0 obligations · 0 claims

#

Deepfakes Guidelines: Mitigating Risks While Fostering Innovation (Valid from 2025-05-01).

2 instruments (2 current) · 2 obligations · 6 claims · 0 milestones

Standing sub-brief · as of 12 Nov 2026 190 words · last cycle 12 Nov 2026 · AI research, not expert reviewed

SDAIA has issued two instruments addressing generative AI and synthetic content, both operating as non-binding regulatory expectations and supervisory guidance rather than statutory obligations. The Generative AI Guidelines (for Developers and Users), effective from 11 January 2024, direct developers and users of generative AI to build in human-oversight triggers, test for bias, and disclose AI use to users and the public. A companion instrument, the Generative AI Guidelines for Government, in force from January 2024, requires government entities specifically to adhere to the AI Ethics Principles across the generative-AI tool lifecycle and to refrain from using generative AI in critical decision-making.

SDAIA's Deepfakes Guidelines: Mitigating Risks While Fostering Innovation, effective from 1 May 2025, set out a parallel set of non-binding expectations for deepfake content. The guidelines call on content creators to apply tamper-resistant watermarks to deepfake content and disclose its synthetic nature, to secure consent from an identifiable individual before creating synthetic media depicting them, and to allow that individual to request removal of their likeness or personal data from deepfake content. They further call for human-in-the-loop oversight and prohibit the use of deepfakes for fraud, impersonation or defamation.

Instruments (2)
  • Deepfakes Guidelines: Mitigating Risks While Fostering Innovation Valid from 2025-05-01
    Regulatory expectation · Official text
  • Generative AI Guidelines (for Developers and Users) Valid from 2024-01-11
    Regulatory expectation · Official text

Obligations

  • Section 4 (Scope/Principles)

    Government entities must adhere to the AI Ethics Principles across the generative-AI tool lifecycle and must refrain from using generative AI in critical decision-making.

    Transparency disclosure · Applies to: Other · Principles and Controls of AI Ethics (AI Ethics Principles)
  • Section 6.3.3 (content creators)

    Deepfake content creators must apply tamper-resistant watermarks to all deepfake content, disclosing its synthetic nature.

    Marking or watermarking · Applies to: Other · Deepfakes Guidelines: Mitigating Risks While Fostering Innovation
Claims and evidence (6)

  • SDAIA's January 2024 Generative AI Guidelines require government entities to follow the AI Ethics Principles and bar critical-decision use of generative AI.

    Confidence: Confirmed · As of 1 Jan 2024 · Evidenced
    Evidence and sources

  • SDAIA's Generative AI Guidelines (11 January 2024) direct developers and users of generative AI to build in human-oversight triggers, test for bias, and disclose AI use to users and the public.

    Confidence: Probable (capped: best source is T3) · As of 11 Jan 2024 · Evidenced
    Evidence and sources
    • Digital Policy Alert T3 · Retrieved · retrieved 4 Nov 2026The Guidelines set out considerations and practical steps, such as building in pre-defined triggers for human oversight, conducting testing against bias, and clearly communicate the use of AI to users and to the public.

  • SDAIA's Deepfakes Guidelines (effective 1 May 2025) require content creators to apply tamper-resistant watermarks to deepfake content and disclose its synthetic nature.

    Confidence: Probable (Capped from Confirmed: best source is T3) · As of 1 May 2025 · Evidenced
    Evidence and sources
    • Saudipedia T3 · Retrieved · retrieved 4 Nov 2026 · Section 6.3.3It was established by a Royal Decree on August 30, 2019, and it is directly linked to the Prime Minister.

  • SDAIA's Deepfakes Guidelines require creators to obtain explicit consent from individuals whose likeness, image or voice is used before creating deepfake content.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • BABL AI T3 · Surfaced · retrieved 4 Nov 2026Creators must obtain explicit permission before using someone's image, likeness, or voice in deepfake content.
    • Saudipedia T3 · Retrieved · retrieved 4 Nov 2026 · Section 6.3.3It was established by a Royal Decree on August 30, 2019, and it is directly linked to the Prime Minister.

  • SDAIA's Deepfakes Guidelines require consent before creating synthetic media of an identifiable person and a right to request removal of likeness or personal data.

    Confidence: Probable · Evidenced
    Evidence and sources

  • SDAIA's Deepfakes Guidelines require human-in-the-loop oversight, tamper-resistant watermarking of synthetic content, and prohibit deepfake use for fraud, impersonation or defamation.

    Confidence: Probable · Evidenced
    Evidence and sources

#

Nothing recorded for this module in the research of 2026-11-12.

0 instruments · 0 obligations · 0 claims

#

Implementing Regulation of the Personal Data Protection Law (Valid from 2023-09-14).

1 instrument (1 current) · 1 obligation · 12 claims · 0 milestones

Standing sub-brief · as of 12 Nov 2026 284 words · last cycle 12 Nov 2026 · AI research, not expert reviewed

Saudi Arabia's binding framework for automated processing sits in the Implementing Regulation of the Personal Data Protection Law, in force from 14 September 2023. Article 25(1)(c) requires a data-protection impact assessment where processing involves new technologies or automated decision-making; Article 4(5)(c) requires controllers using large-scale or repeated automated decision-making to disclose that fact to data subjects; and Article 11(2) requires explicit consent where relied on as the basis for a solely-automated decision. The PDPL and its Implementing Regulation do not, however, create a right to object to a solely-automated decision or to request human review of it.

In the medical devices sector, AI/ML-based software medical devices require Saudi Food and Drug Authority Marketing Authorization before sale, a binding requirement distinct from SDAIA's non-binding guidance, implemented through dedicated SFDA guidance (MDS-G010 v1.0) issued on 29 November 2022.

Instruments (1)
  • Implementing Regulation of the Personal Data Protection Law Valid from 2023-09-14
    Binding · Official text

Obligations

  • Section 4 (Scope/Principles)

    Government entities must adhere to the AI Ethics Principles across the generative-AI tool lifecycle and must refrain from using generative AI in critical decision-making.

    Transparency disclosure · Applies to: Other · Principles and Controls of AI Ethics (AI Ethics Principles)
Claims and evidence (12)

  • SDAIA's January 2024 Generative AI Guidelines require government entities to follow the AI Ethics Principles and bar critical-decision use of generative AI.

    Confidence: Confirmed · As of 1 Jan 2024 · Evidenced
    Evidence and sources

  • AI/ML-based software medical devices require SFDA Marketing Authorization before sale in Saudi Arabia, a binding requirement distinct from SDAIA's non-binding guidance.

    Confidence: Probable · Evidenced
    Evidence and sources
    • NCBI/PMC (academic journal article) T2 · Retrieved · retrieved 4 Nov 2026The SFDA has pioneered binding requirements designed for manufacturers to obtain Medical Device Marketing Authorization.

  • SAMA's Regulatory Sandbox admits AI-based fintech innovations not covered by existing SAMA rules, with overseas innovators required to partner with a SAMA-licensed firm.

    Confidence: Confirmed · Evidenced
    Evidence and sources
    • Saudi Central Bank (SAMA) T1 · Retrieved · retrieved 4 Nov 2026The Regulatory Sandbox allows new business models/concepts to be launched into the market for testing in a live environment within predefined parameters, provided that they are not regulated or covered by existing rules..

  • SDAIA's Generative AI Guidelines for government entities set out principles for use of generative AI with government data and in critical decision-making, effective 10 January 2024.

    Confidence: Probable (capped: best source is T3) · As of 10 Jan 2024 · Evidenced
    Evidence and sources
    • Digital Policy Alert T3 · Retrieved · retrieved 4 Nov 2026The Guidelines outline the key principles regarding the use of generative AI in connection with government data and in critical decision-making processes.

  • Saudi Arabia's PDPL Implementing Regulation requires controllers using large-scale or repeated automated decision-making to disclose that fact to data subjects (Article 4(5)(c)).

    Confidence: Probable (capped: best source is T3) · As of 14 Sep 2023 · Evidenced
    Evidence and sources
    • Arelion T3 · Retrieved · retrieved 4 Nov 2026Controllers whose activities include new technologies or automated decisions, on a large scale or repeatedly, must tell people whether "decisions will be made based solely on automated Processing of Personal Data" (Article 4(5)(c)).

  • Explicit consent is required under Article 11(2) of the PDPL Implementing Regulation where relied on as the basis for a solely-automated decision.

    Confidence: Probable (capped: best source is T3) · As of 14 Sep 2023 · Evidenced
    Evidence and sources
    • Arelion T3 · Retrieved · retrieved 4 Nov 2026Controllers whose activities include new technologies or automated decisions, on a large scale or repeatedly, must tell people whether "decisions will be made based solely on automated Processing of Personal Data" (Article 4(5)(c)).

  • Saudi PDPL Implementing Regulation Article 25(1)(c) requires a data-protection impact assessment for processing using new technologies or automated decision-making.

    Confidence: Probable (capped: best source is T3) · As of 14 Sep 2023 · Evidenced
    Evidence and sources
    • Arelion T3 · Retrieved · retrieved 4 Nov 2026Controllers whose activities include new technologies or automated decisions, on a large scale or repeatedly, must tell people whether "decisions will be made based solely on automated Processing of Personal Data" (Article 4(5)(c)).

  • Saudi Arabia's PDPL and Implementing Regulation do not create a right to object to a solely-automated decision or to request human review of it.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • Arelion T3 · Retrieved · retrieved 4 Nov 2026Controllers whose activities include new technologies or automated decisions, on a large scale or repeatedly, must tell people whether "decisions will be made based solely on automated Processing of Personal Data" (Article 4(5)(c)).
    • PrivacyEngine T3 · Retrieved · retrieved 4 Nov 2026Unlike the GDPR, the PDPL does not provide for the right to object to processing of personal data.

  • SAMA expects explainability in AI-driven credit scoring and fraud detection used by its supervised entities, as part of its cybersecurity and data-governance frameworks.

    Confidence: Uncertain (capped: best source is T3) · Evidenced
    Evidence and sources
    • regulations.ai T3 · Retrieved · retrieved 4 Nov 2026In the financial sector, the Saudi Central Bank (SAMA) has integrated AI considerations into its broader cybersecurity and data governance frameworks, emphasizing the need for explainability in automated credit scoring and fraud detection.

  • SAMA Circular No. 43045328 (23 December 2021) binds SAMA-supervised entities to align their policies, including AI-driven data processing, with the PDPL and SDAIA's data-governance rules.

    Confidence: Probable (capped: best source is T3) · As of 23 Dec 2021 · Evidenced
    Evidence and sources
    • Vision2030.ai T3 · Retrieved · retrieved 4 Nov 2026That converts SDAIA's data rules into supervised obligations enforceable by SAMA against a licensed entity — a harder constraint than the PDPL alone.

  • The SFDA issued dedicated guidance (MDS-G010 v1.0) on AI/ML-based medical devices on 29 November 2022.

    Confidence: Probable · As of 29 Nov 2022 · Evidenced
    Evidence and sources
    • Saudi Data and Artificial Intelligence Authority (SDAIA) T1 · Retrieved · retrieved 4 Nov 2026The regulatory arrangements of the Saudi Data & AI Authority were issued by Council of Ministers Resolution No. (292) dated 27/4/1441 AH, and were amended by Council of Ministers Resolution No.

  • SAMA Circular No. 43045328 (23 December 2021) binds SAMA-regulated financial entities to align data-governance policy with the PDPL, in the absence of a dedicated AI-specific SAMA regulation.

    Confidence: Probable · As of 23 Dec 2021 · Evidenced
    Evidence and sources
    • Saudi Central Bank (SAMA) T1 · Retrieved · retrieved 11 Nov 202643045328 Personal Data Protection Law and data governance policies, regulations and rules 23/12/2021

#

AI/ML-based software medical devices require SFDA Marketing Authorization before sale in Saudi Arabia, a binding requirement distinct from SDAIA's non-binding guidance.

0 instruments (0 current) · 0 obligations · 2 claims · 0 milestones

Standing sub-brief · as of 12 Nov 2026 76 words · last cycle 12 Nov 2026 · AI research, not expert reviewed

Two regimes bear on AI safety outside any dedicated AI safety statute. AI/ML-based software medical devices require Saudi Food and Drug Authority Medical Device Marketing Authorization before sale in Saudi Arabia, a binding requirement distinct from SDAIA's non-binding AI governance guidance. Separately, the National Cybersecurity Authority's Essential Cybersecurity Controls bind government bodies and operators or hosts of critical national infrastructure, and may apply to AI systems that are classified as, or that support, critical national infrastructure.

Claims and evidence (2)

  • AI/ML-based software medical devices require SFDA Marketing Authorization before sale in Saudi Arabia, a binding requirement distinct from SDAIA's non-binding guidance.

    Confidence: Probable · Evidenced
    Evidence and sources
    • NCBI/PMC (academic journal article) T2 · Retrieved · retrieved 4 Nov 2026The SFDA has pioneered binding requirements designed for manufacturers to obtain Medical Device Marketing Authorization.

  • NCA's Essential Cybersecurity Controls bind government bodies and CNI operators/hosts, and may apply to AI systems classified as or supporting critical national infrastructure.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • Herbert Smith Freehills Kramer T3 · Surfaced · retrieved 11 Nov 2026The ECC are the foundational cybersecurity controls that apply to government organisations in KSA – including ministries, authorities, establishments, and others (inside and outside the Kingdom) – as well as to private sector organisations that own, operate, or host critical national infrastructure.

#

SFDA Guidance on Artificial Intelligence (AI) and Machine Learning (ML) Technologies Based Medical Devices (Valid from 2022-01-01).

1 instrument (1 current) · 1 obligation · 2 claims · 0 milestones

Standing sub-brief · as of 12 Nov 2026 78 words · last cycle 12 Nov 2026 · AI research, not expert reviewed

The binding conformity requirement currently in force is the Saudi Food and Drug Authority's Medical Device Marketing Authorization regime: AI/ML-based standalone software medical devices require SFDA Medical Device Marketing Authorization before being placed on the Saudi market, under SFDA Guidance MDS-G010. Beyond this sector-specific regime, the National Cybersecurity Authority closed a public consultation on draft AI Cybersecurity Guidelines (AICG-1:2026) on 5 August 2026; no final, binding version of those guidelines had been published as at late October 2026.

Instruments (1)
  • SFDA Guidance on Artificial Intelligence (AI) and Machine Learning (ML) Technologies Based Medical Devices Valid from 2022-01-01
    Binding · Official text

Obligations

  • MDS-G010

    AI/ML-based standalone software medical devices require SFDA Medical Device Marketing Authorization before placement on market.

    Authorisation · Applies to: Product manufacturer · SFDA Guidance on Artificial Intelligence (AI) and Machine Learning (ML) Technologies Based Medical Devices
Claims and evidence (2)

  • NCA closed a consultation on draft AI Cybersecurity Guidelines on 5 August 2026; no final, binding version has been published as at late October 2026.

    Confidence: Probable · As of 5 Aug 2026 · Evidenced
    Evidence and sources

  • Derived: Probable SFDA requires SFDA Medical Device Marketing Authorization before an AI/ML-based standalone software medical device may be placed on the Saudi market (MDS-G010).

    Confidence: Probable · Evidenced
    Evidence and sources
    • NCBI/PMC (academic journal article) T2 · Retrieved · retrieved 4 Nov 2026The SFDA has pioneered binding requirements designed for manufacturers to obtain Medical Device Marketing Authorization.
    • Al Tamimi & Company T3 · Surfaced · retrieved 4 Nov 2026An equivalence comparison of machine-learning-based medical devices will be conducted to compare the intended use, model used for machine learning, and characteristics of training data in the two products.

#

SDAIA was established by royal decree on 30 August 2019 as Saudi Arabia's national authority for data and AI governance, reporting to the Prime Minister.

0 instruments (0 current) · 0 obligations · 4 claims · 0 milestones

Standing sub-brief · as of 12 Nov 2026 103 words · last cycle 12 Nov 2026 · AI research, not expert reviewed

The Saudi Data and Artificial Intelligence Authority was established by royal decree on 30 August 2019 as Saudi Arabia's national authority for data and AI governance, reporting to the Prime Minister. SDAIA's AI guidance frameworks carry no independent statutory penalty schedule, and there is no AI-specific fine tier in Saudi Arabia. Academic analysis has separately found that SFDA Guidance MDS-G010 contains binding components but leaves unclear how penalties for non-compliance will operate.

In the financial sector, SAMA Circular No. 43045328 of 23 December 2021 binds SAMA-supervised entities to align their policies, including AI-driven data processing, with the PDPL and with SDAIA's data-governance rules.

Cited evidence in this module rests solely on tier 3/4 commentary despite primary official sources existing for this jurisdiction.

Claims and evidence (4)

  • SDAIA was established by royal decree on 30 August 2019 as Saudi Arabia's national authority for data and AI governance, reporting to the Prime Minister.

    Confidence: Probable (capped: best source is T3) · As of 30 Aug 2019 · Evidenced
    Evidence and sources
    • Saudipedia T3 · Retrieved · retrieved 4 Nov 2026 · Section 6.3.3It was established by a Royal Decree on August 30, 2019, and it is directly linked to the Prime Minister.

  • SDAIA's AI guidance frameworks carry no independent statutory penalty schedule; there is no AI-specific fine tier in Saudi Arabia.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • regulations.ai T3 · Retrieved · retrieved 4 Nov 2026The guidance frameworks issued by SDAIA—including the AI Ethics Principles, Generative AI Guidelines, and AI Adoption Framework—are structured as soft-law instruments and do not contain independent statutory fine schedules.

  • SAMA Circular No. 43045328 (23 December 2021) binds SAMA-supervised entities to align their policies, including AI-driven data processing, with the PDPL and SDAIA's data-governance rules.

    Confidence: Probable (capped: best source is T3) · As of 23 Dec 2021 · Evidenced
    Evidence and sources
    • Vision2030.ai T3 · Retrieved · retrieved 4 Nov 2026That converts SDAIA's data rules into supervised obligations enforceable by SAMA against a licensed entity — a harder constraint than the PDPL alone.

  • Academic analysis finds MDS-G010 contains binding components but leaves unclear how penalties for non-compliance will operate.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • Asian Bioethics Review (Springer) / PubMed Central T3 · Retrieved · retrieved 11 Nov 2026 · Section 6.3.3This paper examines the Saudi Food and Drug Authority's (SFDA) Guidance on Artificial Intelligence (AI) and Machine Learning (ML) technologies based Medical Devices (the MDS-G010).

#

Draft Responsible Artificial Intelligence Policy (Draft, no legal force): Draft policy proposing four-tier risk framework, registration requirements, ethics labelling, audit duties and a regulatory sandbox for AI.

1 instrument (1 current) · 0 obligations · 2 claims · 0 milestones

Standing sub-brief · as of 12 Nov 2026 71 words · last cycle 12 Nov 2026 · AI research, not expert reviewed

SAMA's Regulatory Sandbox, a confirmed and operating mechanism, admits AI-based fintech innovations that are not covered by existing SAMA rules, with overseas innovators required to partner with a SAMA-licensed firm. Beyond this sector-specific sandbox, SDAIA opened a public consultation in April 2026 on a draft Responsible AI Policy proposing, among other mechanisms, a general sandbox alongside registration, labelling and audit requirements; that policy remains a proposal and has not been adopted.

Instruments (1)
  • Draft Responsible Artificial Intelligence Policy Draft, no legal force

    Draft policy proposing four-tier risk framework, registration requirements, ethics labelling, audit duties and a regulatory sandbox for AI.

    Authority: Saudi Data and Artificial Intelligence Authority · Verified
Claims and evidence (2)

  • SDAIA opened a public consultation in April 2026 on a draft Responsible AI Policy proposing registration, labelling, audit and sandbox mechanisms; it remains unadopted.

    Confidence: Probable (capped: best source is T3) · As of 3 May 2026 · Evidenced
    Evidence and sources
    • DTS Solution T3 · Retrieved · retrieved 4 Nov 2026In April 2026, SDAIA opened a public consultation on its draft Responsible AI Policy, a document that signals a clear shift away from broad ethics statements toward structured, operational governance.

  • SAMA's Regulatory Sandbox admits AI-based fintech innovations not covered by existing SAMA rules, with overseas innovators required to partner with a SAMA-licensed firm.

    Confidence: Confirmed · Evidenced
    Evidence and sources
    • Saudi Central Bank (SAMA) T1 · Retrieved · retrieved 4 Nov 2026The Regulatory Sandbox allows new business models/concepts to be launched into the market for testing in a live environment within predefined parameters, provided that they are not regulated or covered by existing rules..

#

HUMAIN agreed with Nvidia to deploy up to 600,000 AI chips over three years, with US export approval secured in November 2025.

0 instruments (0 current) · 0 obligations · 2 claims · 0 milestones

Standing sub-brief · as of 12 Nov 2026 75 words · last cycle 12 Nov 2026 · AI research, not expert reviewed

HUMAIN has agreed with Nvidia to deploy up to 600,000 AI chips over three years, with US export approval for the arrangement reported secured in November 2025. Separately, and with limited corroboration from a single lower-tier source, HUMAIN is reported to be raising a USD 2.5 billion fund via BSF Capital while preparing for a possible dual Saudi-New York listing by 2029; this should be treated as an unconfirmed report rather than a settled development.

Claims and evidence (2)

  • HUMAIN agreed with Nvidia to deploy up to 600,000 AI chips over three years, with US export approval secured in November 2025.

    Confidence: Probable · As of 20 Nov 2025 · Evidenced
    Evidence and sources
    • Malay Mail (Reuters) T2 · Retrieved · retrieved 4 Nov 2026the US Department of Commerce said it had approved the export of advanced Nvidia chips to Humain and G42

  • HUMAIN is reported to be raising a USD 2.5 billion fund via BSF Capital while preparing for a possible dual Saudi-New York listing by 2029.

    Confidence: Uncertain (capped: best source is T4) · Evidenced
    Evidence and sources
    • Startup Fortune T4 · Retrieved · retrieved 4 Nov 2026is raising a $2.5B fund via BSF Capital and building an IPO team for a Saudi-New York dual listing by 2029
No modules match.

Filters combine as OR inside a group and AND across groups.

Authorities

AuthorityType
Saudi Data and Artificial Intelligence AuthorityAi office

Enforcement actions

No enforcement actions recorded in this research.

Cases

No cases recorded in this research.

Consultations

ConsultationAuthorityStatusOpenedCloses
Draft Responsible Artificial Intelligence PolicySaudi Data and Artificial Intelligence AuthorityClosed
Draft AI Cybersecurity Guidelines (AICG-1:2026)Closed

What this record does not yet establish is set out on the transparency register; its dated events are on the regulatory calendar.

Think something on this page is wrong? Report an error.

Technical provenance (record schema, run ID & build metadata)
Schema version
artificial-intelligence-record-v2.12
Research run ID
aic-union-SA-2026-11-04
Page model
module-card-page-v1
Renderer
render_jid_aic_v13
Build date