--- title: "Saudi Arabia — Global AI Monitor" canonical: https://artificial-intelligence.gi/jurisdictions/saudi-arabia/ source_html: /jurisdictions/saudi-arabia/index.html description: "Saudi Arabia AI governance record: 6 instruments, 4 obligations and 31 evidenced claims across 12 modules. Research as of 12 Nov 2026." generated_at: 2026-11-12T17:20:02Z content_sha256: 84b8e6eafe372278376834691fc15b190e499190cbe600f5597386c4347b6e88 generator: "fe-fleet/md-twin@1.0" --- # Saudi Arabia AI Regulation & Governance 10 active modules 2 quiet Last updated 11 Nov 2026 · 12 modules · 6 instruments · 31 claims · 61 sources in the cumulative register Download report (PDF) Collapse all Framework status Draft Responsible Artificial Intelligence Policy (Draft, no legal force): Draft policy proposing four-tier risk framework, registration requirements, ethics labelling, audit duties and a regulatory sandbox for AI. Main regulator Regulator [Saudi Data & Artificial Intelligence Authority (SDAIA)](https://sdaia.gov.sa/en/default.aspx) Next milestone No upcoming dated milestone recorded Record status Live · Periodic active record · 61 sources (48 retrieved) · 1 under review · Not yet expert-reviewed ✦ AI-assembled from cited sources Evidence-gated · [How we verify](/methodology/#ai-content-disclosure) · Disclosure Not yet expert-reviewed · Not legal, compliance or investment advice. Facts are machine-assembled from cited public sources. Individual claims have not each been independently verified by a human reviewer. See [methodology](/methodology/). Source tiers: T1 enacted statute, regulation, or binding supervisory order · T2 official regulator guidance, consultation, or registry · T3 international standard-setter or peer-reviewed analysis · T4 practitioner commentary or secondary reporting. Confidence: high = corroborated by retrieved T1/T2 text · medium = single official source or secondary corroboration · low = preliminary or unverified. [Full definitions →](/methodology/#source-tiers) Research checked 12 Nov 2026 · Updated 11 Nov 2026 Record history Research as of 12 Nov 2026 · Record last changed 11 Nov 2026 · Published 11 Nov 2026 · Page built 12 Nov 2026 6 Instruments 6 Current instruments 0 Binding, in force +2 more binding, in-force date not recorded 4 Obligations 31 Claims 0 Upcoming milestones 61 Sources Jump to module (12) ### 01AI Framework LawActive▾# Draft Responsible Artificial Intelligence Policy (Draft, no legal force): Draft policy proposing four-tier risk framework, registration requirements, ethics labelling, audit duties and a regulatory sandbox for AI. 2 instruments (2 current) · 0 obligations · 7 claims · 0 milestones Saudi Arabia has no dedicated AI-specific statute in force, and no formal legislative process to enact a horizontal AI law has been announced. The Saudi Data and Artificial Intelligence Authority (SDAIA), established by royal decree on 30 August 2019 as the Kingdom's national authority for data and AI governance reporting to the Prime Minister, is the central body issuing AI governance instruments in the absence of such a statute. SDAIA's Principles and Controls of AI Ethics (the AI Ethics Principles), published in September 2023 as non-binding guidance, set ethical principles together with a four-tier risk classification for AI systems. Under that classification, systems assessed as unacceptable risk are barred from development or deployment, while systems assessed as high or limited risk are expected to comply with the Principles, though the framework itself remains non-binding and rests on voluntary adoption. Two further initiatives remain at the proposal stage and have not been adopted. SDAIA opened a public consultation in April 2026 on a draft Responsible Artificial Intelligence Policy that proposes registration, labelling, audit and sandbox mechanisms; it remains unadopted. Separately, the Communications, Space and Technology Commission consulted in April and May 2025 on a draft Global AI Hub Law, which establishes a cross-border data-hosting regime rather than a horizontal AI regulatory framework, and which also remains unenacted. Read full sub-brief · 216 words Instruments (2) - Draft Responsible Artificial Intelligence Policy Draft, no legal forceDraft policy proposing four-tier risk framework, registration requirements, ethics labelling, audit duties and a regulatory sandbox for AI.Authority: Saudi Data and Artificial Intelligence Authority · Verified 4 Nov 2026 - Principles and Controls of AI Ethics (AI Ethics Principles) Published 2023-09-01Non-binding national AI ethics framework establishing seven principles and a four-tier risk classification.Non-binding · Authority: Saudi Data and Artificial Intelligence Authority · Verified 4 Nov 2026 · [Official text](https://sdaia.gov.sa/en/SDAIA/about/Documents/ai-principles.pdf) Claims and evidence (7) - SDAIA was established by royal decree on 30 August 2019 as Saudi Arabia's national authority for data and AI governance, reporting to the Prime Minister.Confidence: Probable (capped: best source is T3) · As of 30 Aug 2019 · EvidencedEvidence and sources[Saudipedia](https://saudipedia.com/en/saudi-data-and-artificial-intelligence-authority-sdaia) T3 · Retrieved · retrieved 4 Nov 2026 · Section 6.3.3It was established by a Royal Decree on August 30, 2019, and it is directly linked to the Prime Minister. - Saudi Arabia has no dedicated AI-specific statute in force and has not announced a formal legislative process to enact one.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[CMS Law](https://cms.law/en/int/expert-guides/ai-regulation-scanner/kingdom-of-saudi-arabia) T3 · Retrieved · retrieved 4 Nov 2026Saudi Arabia does not currently have an AI‑specific law and has not announced any formal legislative process to enact one. - SDAIA published non-binding AI Ethics Principles in September 2023, setting ethics principles and a four-tier risk classification for AI.Confidence: Probable (capped: best source is T3) · As of 1 Sep 2023 · EvidencedEvidence and sources[Regulations.ai](https://regulations.ai/regulations/RAI-SA-NA-PCAESXX-2023) T3 · Retrieved · retrieved 4 Nov 2026The Principles and Controls of AI Ethics is currently in force as non-binding guidance, having been published by the Saudi Data & Artificial Intelligence Authority (SDAIA) in September 2023 - SDAIA's AI Ethics Principles classify AI systems into four risk tiers, with unacceptable-risk systems barred from development or deployment and high/limited-risk systems required to comply.Confidence: Probable (capped: best source is T3) · As of 1 Sep 2023 · EvidencedEvidence and sources[Ting Saudi](https://www.tingsaudi.com/blog/pre-deployment-review-sdaia-ai-ethics) T3 · Retrieved · retrieved 4 Nov 2026Systems of little or no risk are recommended rather than required to comply; limited-risk and high-risk systems must comply with the principles and additional applicable controls; unacceptable-risk systems cannot be developed or deployed. - SDAIA opened a public consultation in April 2026 on a draft Responsible AI Policy proposing registration, labelling, audit and sandbox mechanisms; it remains unadopted.Confidence: Probable (capped: best source is T3) · As of 3 May 2026 · EvidencedEvidence and sources[DTS Solution](https://www.dts-solution.com/sdaia-and-ai-governance-in-saudi-arabia-building-responsible-ai-at-national-scale/) T3 · Retrieved · retrieved 4 Nov 2026In April 2026, SDAIA opened a public consultation on its draft Responsible AI Policy, a document that signals a clear shift away from broad ethics statements toward structured, operational governance. - CST's draft Global AI Hub Law, consulted on in April-May 2025, establishes a cross-border data-hosting regime rather than an AI regulatory framework, and remains unenacted.Confidence: Probable (capped: best source is T3) · As of 14 May 2025 · EvidencedEvidence and sources[Clyde & Co](https://www.clydeco.com/en/insights/2025/05/ksa-release-draft-global-ai-hub-law) T3 · Retrieved · retrieved 4 Nov 2026On 14 April 2025, the Communications, Space and Technology Commission (CST) in the Kingdom of Saudi Arabia (KSA) issued a public consultation on the draft Global AI Hub Law. - Saudi Arabia has no dedicated horizontal AI statute; SDAIA has issued non-binding principles and guidelines instead.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Herbert Smith Freehills Kramer](https://www.hsfkramer.com/insights/reports/ai-tracker/saudi-arabia) T3 · Surfaced · retrieved 11 Nov 2026The ECC are the foundational cybersecurity controls that apply to government organisations in KSA – including ministries, authorities, establishments, and others (inside and outside the Kingdom) – as well as to private sector organisations that own, operate, or host critical national infrastructure. ### 02Prohibited PracticesActive▾# Principles and Controls of AI Ethics (AI Ethics Principles) (Published 2023-09-01): Non-binding national AI ethics framework establishing seven principles and a four-tier risk classification. 1 instrument (1 current) · 0 obligations · 1 claim · 0 milestones Saudi Arabia has no standalone prohibited-practices statute. The operative instrument is SDAIA's non-binding AI Ethics Principles, published in September 2023, which classify AI systems into four risk tiers. Under that classification, systems assessed as unacceptable risk are barred from development or deployment in the Kingdom, while systems assessed as high or limited risk are expected to comply with the Principles' requirements, though compliance rests on voluntary adoption rather than a statutory duty. Instruments (1) - Principles and Controls of AI Ethics (AI Ethics Principles) Published 2023-09-01Non-binding national AI ethics framework establishing seven principles and a four-tier risk classification.Non-binding · Authority: Saudi Data and Artificial Intelligence Authority · Verified 4 Nov 2026 · [Official text](https://sdaia.gov.sa/en/SDAIA/about/Documents/ai-principles.pdf) Claims and evidence (1) - SDAIA's AI Ethics Principles classify AI systems into four risk tiers, with unacceptable-risk systems barred from development or deployment and high/limited-risk systems required to comply.Confidence: Probable (capped: best source is T3) · As of 1 Sep 2023 · EvidencedEvidence and sources[Ting Saudi](https://www.tingsaudi.com/blog/pre-deployment-review-sdaia-ai-ethics) T3 · Retrieved · retrieved 4 Nov 2026Systems of little or no risk are recommended rather than required to comply; limited-risk and high-risk systems must comply with the principles and additional applicable controls; unacceptable-risk systems cannot be developed or deployed. ### 03High-Risk SystemsActive Derived: Probable▾# Draft Responsible Artificial Intelligence Policy (Draft, no legal force): Draft policy proposing four-tier risk framework, registration requirements, ethics labelling, audit duties and a regulatory sandbox for AI. 2 instruments (2 current) · 1 obligation · 5 claims · 0 milestones Binding obligations apply to AI/ML-based software medical devices in Saudi Arabia: manufacturers and developers must obtain Saudi Food and Drug Authority Medical Device Marketing Authorization before an AI/ML-based standalone software medical device may be placed on the Saudi market, under SFDA Guidance MDS-G010, a requirement distinct from SDAIA's non-binding AI governance guidance. The National Cybersecurity Authority's Essential Cybersecurity Controls bind government bodies and operators or hosts of critical national infrastructure, and may extend to AI systems that are classified as, or that support, critical national infrastructure. The National Cybersecurity Authority has also progressed draft AI Cybersecurity Guidelines (AICG-1:2026) through a public consultation that closed on 5 August 2026; no final, binding version of those guidelines had been published as at late October 2026. Separately, SDAIA's draft Responsible AI Policy, opened for consultation in April 2026, proposes registration, labelling, audit and sandbox mechanisms that would bear on high-risk system oversight; it remains a proposal and has not been adopted. Instruments (2) - Draft Responsible Artificial Intelligence Policy Draft, no legal forceDraft policy proposing four-tier risk framework, registration requirements, ethics labelling, audit duties and a regulatory sandbox for AI.Authority: Saudi Data and Artificial Intelligence Authority · Verified 4 Nov 2026 - SFDA Guidance on Artificial Intelligence (AI) and Machine Learning (ML) Technologies Based Medical Devices Valid from 2022-01-01Binding · [Official text](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC11250741/) Obligations - MDS-G010Manufacturers/developers of AI/ML-based software as a medical device must obtain SFDA Medical Device Marketing Authorization before placing the device on the Saudi market.Authorisation · Applies to: Product manufacturer · Principles and Controls of AI Ethics (AI Ethics Principles) Claims and evidence (5) - AI/ML-based software medical devices require SFDA Marketing Authorization before sale in Saudi Arabia, a binding requirement distinct from SDAIA's non-binding guidance.Confidence: Probable · EvidencedEvidence and sources[NCBI/PMC (academic journal article)](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC11250741/) T2 · Retrieved · retrieved 4 Nov 2026The SFDA has pioneered binding requirements designed for manufacturers to obtain Medical Device Marketing Authorization. - NCA's Essential Cybersecurity Controls bind government bodies and CNI operators/hosts, and may apply to AI systems classified as or supporting critical national infrastructure.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Herbert Smith Freehills Kramer](https://www.hsfkramer.com/insights/reports/ai-tracker/saudi-arabia) T3 · Surfaced · retrieved 11 Nov 2026The ECC are the foundational cybersecurity controls that apply to government organisations in KSA – including ministries, authorities, establishments, and others (inside and outside the Kingdom) – as well as to private sector organisations that own, operate, or host critical national infrastructure. - NCA closed a consultation on draft AI Cybersecurity Guidelines on 5 August 2026; no final, binding version has been published as at late October 2026.Confidence: Probable · As of 5 Aug 2026 · EvidencedEvidence and sources[National Cybersecurity Authority (NCA)](https://nca.gov.sa/en/public-consultations/ai-cybersecurity-guidelines) T1 · Retrieved · retrieved 4 Nov 2026“AI Cybersecurity Guidelines”. Closed [verbatim excerpt recorded in source register SRC-SA-008] - SDAIA opened a public consultation in April 2026 on a draft Responsible AI Policy proposing registration, labelling, audit and sandbox mechanisms; it remains unadopted.Confidence: Probable (capped: best source is T3) · As of 3 May 2026 · EvidencedEvidence and sources[DTS Solution](https://www.dts-solution.com/sdaia-and-ai-governance-in-saudi-arabia-building-responsible-ai-at-national-scale/) T3 · Retrieved · retrieved 4 Nov 2026In April 2026, SDAIA opened a public consultation on its draft Responsible AI Policy, a document that signals a clear shift away from broad ethics statements toward structured, operational governance. - Derived: Probable SFDA requires SFDA Medical Device Marketing Authorization before an AI/ML-based standalone software medical device may be placed on the Saudi market (MDS-G010).Confidence: Probable · EvidencedEvidence and sources[NCBI/PMC (academic journal article)](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC11250741/) T2 · Retrieved · retrieved 4 Nov 2026The SFDA has pioneered binding requirements designed for manufacturers to obtain Medical Device Marketing Authorization. - [Al Tamimi & Company](https://www.tamimi.com/law-update-articles/new-guidance-for-ai-and-big-data-medical-devices-in-saudi-arabia/) T3 · Surfaced · retrieved 4 Nov 2026An equivalence comparison of machine-learning-based medical devices will be conducted to compare the intended use, model used for machine learning, and characteristics of training data in the two products. ### 04General-Purpose AIQuiet▾# Nothing recorded for this module in the research of 2026-11-12. 0 instruments · 0 obligations · 0 claims Nothing recorded for this module in the research of 2026-11-12. ### 05Transparency & Synthetic ContentActive▾# Deepfakes Guidelines: Mitigating Risks While Fostering Innovation (Valid from 2025-05-01). 2 instruments (2 current) · 2 obligations · 6 claims · 0 milestones SDAIA has issued two instruments addressing generative AI and synthetic content, both operating as non-binding regulatory expectations and supervisory guidance rather than statutory obligations. The Generative AI Guidelines (for Developers and Users), effective from 11 January 2024, direct developers and users of generative AI to build in human-oversight triggers, test for bias, and disclose AI use to users and the public. A companion instrument, the Generative AI Guidelines for Government, in force from January 2024, requires government entities specifically to adhere to the AI Ethics Principles across the generative-AI tool lifecycle and to refrain from using generative AI in critical decision-making. SDAIA's Deepfakes Guidelines: Mitigating Risks While Fostering Innovation, effective from 1 May 2025, set out a parallel set of non-binding expectations for deepfake content. The guidelines call on content creators to apply tamper-resistant watermarks to deepfake content and disclose its synthetic nature, to secure consent from an identifiable individual before creating synthetic media depicting them, and to allow that individual to request removal of their likeness or personal data from deepfake content. They further call for human-in-the-loop oversight and prohibit the use of deepfakes for fraud, impersonation or defamation. Instruments (2) - Deepfakes Guidelines: Mitigating Risks While Fostering Innovation Valid from 2025-05-01Regulatory expectation · [Official text](https://sdaia.gov.sa/en/SDAIA/about/Files/File0001.pdf) - Generative AI Guidelines (for Developers and Users) Valid from 2024-01-11Regulatory expectation · [Official text](https://digitalpolicyalert.org/event/17196-published-sdaia-generative-ai-guidelines) Obligations - Section 4 (Scope/Principles)Government entities must adhere to the AI Ethics Principles across the generative-AI tool lifecycle and must refrain from using generative AI in critical decision-making.Transparency disclosure · Applies to: Other · Principles and Controls of AI Ethics (AI Ethics Principles) - Section 6.3.3 (content creators)Deepfake content creators must apply tamper-resistant watermarks to all deepfake content, disclosing its synthetic nature.Marking or watermarking · Applies to: Other · Deepfakes Guidelines: Mitigating Risks While Fostering Innovation Claims and evidence (6) - SDAIA's January 2024 Generative AI Guidelines require government entities to follow the AI Ethics Principles and bar critical-decision use of generative AI.Confidence: Confirmed · As of 1 Jan 2024 · EvidencedEvidence and sources[Saudi Data and Artificial Intelligence Authority (SDAIA)](https://sdaia.gov.sa/en/SDAIA/about/Files/GenAIGuidelinesForGovernmentENCompressed.pdf) T1 · Retrieved · retrieved 4 Nov 2026Government entities are required to adhere to the AI Ethics Principles when engaging with generative artificial intelligence tools across all stages of the tools’ life cycle. - SDAIA's Generative AI Guidelines (11 January 2024) direct developers and users of generative AI to build in human-oversight triggers, test for bias, and disclose AI use to users and the public.Confidence: Probable (capped: best source is T3) · As of 11 Jan 2024 · EvidencedEvidence and sources[Digital Policy Alert](https://digitalpolicyalert.org/event/17196-published-sdaia-generative-ai-guidelines) T3 · Retrieved · retrieved 4 Nov 2026The Guidelines set out considerations and practical steps, such as building in pre-defined triggers for human oversight, conducting testing against bias, and clearly communicate the use of AI to users and to the public. - SDAIA's Deepfakes Guidelines (effective 1 May 2025) require content creators to apply tamper-resistant watermarks to deepfake content and disclose its synthetic nature.Confidence: Probable (Capped from Confirmed: best source is T3) · As of 1 May 2025 · EvidencedEvidence and sources[Saudipedia](https://saudipedia.com/en/saudi-data-and-artificial-intelligence-authority-sdaia) T3 · Retrieved · retrieved 4 Nov 2026 · Section 6.3.3It was established by a Royal Decree on August 30, 2019, and it is directly linked to the Prime Minister. - SDAIA's Deepfakes Guidelines require creators to obtain explicit consent from individuals whose likeness, image or voice is used before creating deepfake content.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[BABL AI](https://babl.ai/saudi-authority-issues-deepfake-guidelines-to-address-risks-and-promote-ethical-use/) T3 · Surfaced · retrieved 4 Nov 2026Creators must obtain explicit permission before using someone's image, likeness, or voice in deepfake content. - [Saudipedia](https://saudipedia.com/en/saudi-data-and-artificial-intelligence-authority-sdaia) T3 · Retrieved · retrieved 4 Nov 2026 · Section 6.3.3It was established by a Royal Decree on August 30, 2019, and it is directly linked to the Prime Minister. - SDAIA's Deepfakes Guidelines require consent before creating synthetic media of an identifiable person and a right to request removal of likeness or personal data.Confidence: Probable · EvidencedEvidence and sources[Saudi Data and Artificial Intelligence Authority (SDAIA)](https://sdaia.gov.sa/en/SDAIA/about/Files/File0001.pdf) T1 · Retrieved · retrieved 11 Nov 2026Allow individuals to request the removal of their likeness or personal data from deepfake - SDAIA's Deepfakes Guidelines require human-in-the-loop oversight, tamper-resistant watermarking of synthetic content, and prohibit deepfake use for fraud, impersonation or defamation.Confidence: Probable · EvidencedEvidence and sources[Arab News Japan](https://www.arabnews.jp/en/saudi-arabia/sdaia-issues-deepfakes-guidelines-to-regulate-responsible-ai-use-169797) T2 · Retrieved · retrieved 11 Nov 2026a comprehensive regulatory document published in May 2025 under document number SDAIA-P119 - [Saudi Data and Artificial Intelligence Authority (SDAIA)](https://sdaia.gov.sa/en/SDAIA/about/Files/File0001.pdf) T1 · Retrieved · retrieved 11 Nov 2026Allow individuals to request the removal of their likeness or personal data from deepfake ### 06AI & Intellectual PropertyQuiet▾# Nothing recorded for this module in the research of 2026-11-12. 0 instruments · 0 obligations · 0 claims Nothing recorded for this module in the research of 2026-11-12. ### 07Sectoral & Public-Sector AIActive▾# Implementing Regulation of the Personal Data Protection Law (Valid from 2023-09-14). 1 instrument (1 current) · 1 obligation · 12 claims · 0 milestones Saudi Arabia's binding framework for automated processing sits in the Implementing Regulation of the Personal Data Protection Law, in force from 14 September 2023. Article 25(1)(c) requires a data-protection impact assessment where processing involves new technologies or automated decision-making; Article 4(5)(c) requires controllers using large-scale or repeated automated decision-making to disclose that fact to data subjects; and Article 11(2) requires explicit consent where relied on as the basis for a solely-automated decision. The PDPL and its Implementing Regulation do not, however, create a right to object to a solely-automated decision or to request human review of it. In the medical devices sector, AI/ML-based software medical devices require Saudi Food and Drug Authority Marketing Authorization before sale, a binding requirement distinct from SDAIA's non-binding guidance, implemented through dedicated SFDA guidance (MDS-G010 v1.0) issued on 29 November 2022. In the financial sector, Saudi Central Bank (SAMA) Circular No. 43045328 of 23 December 2021 binds SAMA-supervised entities to align their policies, including AI-driven data processing, with the PDPL and with SDAIA's data-governance rules, in the absence of a dedicated AI-specific SAMA regulation. SAMA's Regulatory Sandbox separately admits AI-based fintech innovations not covered by existing SAMA rules, with overseas innovators required to partner with a SAMA-licensed firm. A further reported SAMA expectation of explainability in AI-driven credit scoring and fraud detection rests on limited evidentiary support and should be treated as a tentative supervisory expectation rather than a confirmed rule. For the public sector specifically, SDAIA's Generative AI Guidelines for government entities, effective from 10 January 2024, set out principles for the use of generative AI with government data, including a bar on its use in critical decision-making, as a non-binding supervisory expectation rather than a statutory duty. Read full sub-brief · 284 words Instruments (1) - Implementing Regulation of the Personal Data Protection Law Valid from 2023-09-14Binding · [Official text](https://arelion.dev/guides/saudi-pdpl-ai/) Obligations - Section 4 (Scope/Principles)Government entities must adhere to the AI Ethics Principles across the generative-AI tool lifecycle and must refrain from using generative AI in critical decision-making.Transparency disclosure · Applies to: Other · Principles and Controls of AI Ethics (AI Ethics Principles) Claims and evidence (12) - SDAIA's January 2024 Generative AI Guidelines require government entities to follow the AI Ethics Principles and bar critical-decision use of generative AI.Confidence: Confirmed · As of 1 Jan 2024 · EvidencedEvidence and sources[Saudi Data and Artificial Intelligence Authority (SDAIA)](https://sdaia.gov.sa/en/SDAIA/about/Files/GenAIGuidelinesForGovernmentENCompressed.pdf) T1 · Retrieved · retrieved 4 Nov 2026Government entities are required to adhere to the AI Ethics Principles when engaging with generative artificial intelligence tools across all stages of the tools’ life cycle. - AI/ML-based software medical devices require SFDA Marketing Authorization before sale in Saudi Arabia, a binding requirement distinct from SDAIA's non-binding guidance.Confidence: Probable · EvidencedEvidence and sources[NCBI/PMC (academic journal article)](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC11250741/) T2 · Retrieved · retrieved 4 Nov 2026The SFDA has pioneered binding requirements designed for manufacturers to obtain Medical Device Marketing Authorization. - SAMA's Regulatory Sandbox admits AI-based fintech innovations not covered by existing SAMA rules, with overseas innovators required to partner with a SAMA-licensed firm.Confidence: Confirmed · EvidencedEvidence and sources[Saudi Central Bank (SAMA)](https://rulebook.sama.gov.sa/en/entiresection/1368) T1 · Retrieved · retrieved 4 Nov 2026The Regulatory Sandbox allows new business models/concepts to be launched into the market for testing in a live environment within predefined parameters, provided that they are not regulated or covered by existing rules.. - SDAIA's Generative AI Guidelines for government entities set out principles for use of generative AI with government data and in critical decision-making, effective 10 January 2024.Confidence: Probable (capped: best source is T3) · As of 10 Jan 2024 · EvidencedEvidence and sources[Digital Policy Alert](https://digitalpolicyalert.org/event/17277-published-sdaia-generative-artificial-intelligence-guidelines-for-optimal-adoption-in-government-entities) T3 · Retrieved · retrieved 4 Nov 2026The Guidelines outline the key principles regarding the use of generative AI in connection with government data and in critical decision-making processes. - Saudi Arabia's PDPL Implementing Regulation requires controllers using large-scale or repeated automated decision-making to disclose that fact to data subjects (Article 4(5)(c)).Confidence: Probable (capped: best source is T3) · As of 14 Sep 2023 · EvidencedEvidence and sources[Arelion](https://arelion.dev/guides/saudi-pdpl-ai/) T3 · Retrieved · retrieved 4 Nov 2026Controllers whose activities include new technologies or automated decisions, on a large scale or repeatedly, must tell people whether "decisions will be made based solely on automated Processing of Personal Data" (Article 4(5)(c)). - Explicit consent is required under Article 11(2) of the PDPL Implementing Regulation where relied on as the basis for a solely-automated decision.Confidence: Probable (capped: best source is T3) · As of 14 Sep 2023 · EvidencedEvidence and sources[Arelion](https://arelion.dev/guides/saudi-pdpl-ai/) T3 · Retrieved · retrieved 4 Nov 2026Controllers whose activities include new technologies or automated decisions, on a large scale or repeatedly, must tell people whether "decisions will be made based solely on automated Processing of Personal Data" (Article 4(5)(c)). - Saudi PDPL Implementing Regulation Article 25(1)(c) requires a data-protection impact assessment for processing using new technologies or automated decision-making.Confidence: Probable (capped: best source is T3) · As of 14 Sep 2023 · EvidencedEvidence and sources[Arelion](https://arelion.dev/guides/saudi-pdpl-ai/) T3 · Retrieved · retrieved 4 Nov 2026Controllers whose activities include new technologies or automated decisions, on a large scale or repeatedly, must tell people whether "decisions will be made based solely on automated Processing of Personal Data" (Article 4(5)(c)). - Saudi Arabia's PDPL and Implementing Regulation do not create a right to object to a solely-automated decision or to request human review of it.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Arelion](https://arelion.dev/guides/saudi-pdpl-ai/) T3 · Retrieved · retrieved 4 Nov 2026Controllers whose activities include new technologies or automated decisions, on a large scale or repeatedly, must tell people whether "decisions will be made based solely on automated Processing of Personal Data" (Article 4(5)(c)). - [PrivacyEngine](https://www.privacyengine.io/blog/pdpl-gdpr-comparison/) T3 · Retrieved · retrieved 4 Nov 2026Unlike the GDPR, the PDPL does not provide for the right to object to processing of personal data. - SAMA expects explainability in AI-driven credit scoring and fraud detection used by its supervised entities, as part of its cybersecurity and data-governance frameworks.Confidence: Uncertain (capped: best source is T3) · EvidencedEvidence and sources[regulations.ai](https://regulations.ai/regulations/saudi-arabia-summary) T3 · Retrieved · retrieved 4 Nov 2026In the financial sector, the Saudi Central Bank (SAMA) has integrated AI considerations into its broader cybersecurity and data governance frameworks, emphasizing the need for explainability in automated credit scoring and fraud detection. - SAMA Circular No. 43045328 (23 December 2021) binds SAMA-supervised entities to align their policies, including AI-driven data processing, with the PDPL and SDAIA's data-governance rules.Confidence: Probable (capped: best source is T3) · As of 23 Dec 2021 · EvidencedEvidence and sources[Vision2030.ai](https://vision2030.ai/regulation/saudi-arabia-ai-regulation-sdaia/) T3 · Retrieved · retrieved 4 Nov 2026That converts SDAIA's data rules into supervised obligations enforceable by SAMA against a licensed entity — a harder constraint than the PDPL alone. - The SFDA issued dedicated guidance (MDS-G010 v1.0) on AI/ML-based medical devices on 29 November 2022.Confidence: Probable · As of 29 Nov 2022 · EvidencedEvidence and sources[Saudi Data and Artificial Intelligence Authority (SDAIA)](https://sdaia.gov.sa/en/SDAIA/about/Pages/RegulationsAndPolicies.aspx) T1 · Retrieved · retrieved 4 Nov 2026The regulatory arrangements of the Saudi Data & AI Authority were issued by Council of Ministers Resolution No. (292) dated 27/4/1441 AH, and were amended by Council of Ministers Resolution No. - SAMA Circular No. 43045328 (23 December 2021) binds SAMA-regulated financial entities to align data-governance policy with the PDPL, in the absence of a dedicated AI-specific SAMA regulation.Confidence: Probable · As of 23 Dec 2021 · EvidencedEvidence and sources[Saudi Central Bank (SAMA)](https://rulebook.sama.gov.sa/en/entiresection/9441) T1 · Retrieved · retrieved 11 Nov 202643045328 Personal Data Protection Law and data governance policies, regulations and rules 23/12/2021 ### 08Safety & Incident ReportingActive▾# AI/ML-based software medical devices require SFDA Marketing Authorization before sale in Saudi Arabia, a binding requirement distinct from SDAIA's non-binding guidance. 0 instruments (0 current) · 0 obligations · 2 claims · 0 milestones Two regimes bear on AI safety outside any dedicated AI safety statute. AI/ML-based software medical devices require Saudi Food and Drug Authority Medical Device Marketing Authorization before sale in Saudi Arabia, a binding requirement distinct from SDAIA's non-binding AI governance guidance. Separately, the National Cybersecurity Authority's Essential Cybersecurity Controls bind government bodies and operators or hosts of critical national infrastructure, and may apply to AI systems that are classified as, or that support, critical national infrastructure. Claims and evidence (2) - AI/ML-based software medical devices require SFDA Marketing Authorization before sale in Saudi Arabia, a binding requirement distinct from SDAIA's non-binding guidance.Confidence: Probable · EvidencedEvidence and sources[NCBI/PMC (academic journal article)](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC11250741/) T2 · Retrieved · retrieved 4 Nov 2026The SFDA has pioneered binding requirements designed for manufacturers to obtain Medical Device Marketing Authorization. - NCA's Essential Cybersecurity Controls bind government bodies and CNI operators/hosts, and may apply to AI systems classified as or supporting critical national infrastructure.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Herbert Smith Freehills Kramer](https://www.hsfkramer.com/insights/reports/ai-tracker/saudi-arabia) T3 · Surfaced · retrieved 11 Nov 2026The ECC are the foundational cybersecurity controls that apply to government organisations in KSA – including ministries, authorities, establishments, and others (inside and outside the Kingdom) – as well as to private sector organisations that own, operate, or host critical national infrastructure. ### 09Standards & ConformityActive Derived: Probable▾# SFDA Guidance on Artificial Intelligence (AI) and Machine Learning (ML) Technologies Based Medical Devices (Valid from 2022-01-01). 1 instrument (1 current) · 1 obligation · 2 claims · 0 milestones The binding conformity requirement currently in force is the Saudi Food and Drug Authority's Medical Device Marketing Authorization regime: AI/ML-based standalone software medical devices require SFDA Medical Device Marketing Authorization before being placed on the Saudi market, under SFDA Guidance MDS-G010. Beyond this sector-specific regime, the National Cybersecurity Authority closed a public consultation on draft AI Cybersecurity Guidelines (AICG-1:2026) on 5 August 2026; no final, binding version of those guidelines had been published as at late October 2026. Instruments (1) - SFDA Guidance on Artificial Intelligence (AI) and Machine Learning (ML) Technologies Based Medical Devices Valid from 2022-01-01Binding · [Official text](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC11250741/) Obligations - MDS-G010AI/ML-based standalone software medical devices require SFDA Medical Device Marketing Authorization before placement on market.Authorisation · Applies to: Product manufacturer · SFDA Guidance on Artificial Intelligence (AI) and Machine Learning (ML) Technologies Based Medical Devices Claims and evidence (2) - NCA closed a consultation on draft AI Cybersecurity Guidelines on 5 August 2026; no final, binding version has been published as at late October 2026.Confidence: Probable · As of 5 Aug 2026 · EvidencedEvidence and sources[National Cybersecurity Authority (NCA)](https://nca.gov.sa/en/public-consultations/ai-cybersecurity-guidelines) T1 · Retrieved · retrieved 4 Nov 2026“AI Cybersecurity Guidelines”. Closed [verbatim excerpt recorded in source register SRC-SA-008] - Derived: Probable SFDA requires SFDA Medical Device Marketing Authorization before an AI/ML-based standalone software medical device may be placed on the Saudi market (MDS-G010).Confidence: Probable · EvidencedEvidence and sources[NCBI/PMC (academic journal article)](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC11250741/) T2 · Retrieved · retrieved 4 Nov 2026The SFDA has pioneered binding requirements designed for manufacturers to obtain Medical Device Marketing Authorization. - [Al Tamimi & Company](https://www.tamimi.com/law-update-articles/new-guidance-for-ai-and-big-data-medical-devices-in-saudi-arabia/) T3 · Surfaced · retrieved 4 Nov 2026An equivalence comparison of machine-learning-based medical devices will be conducted to compare the intended use, model used for machine learning, and characteristics of training data in the two products. ### 10Authorities & EnforcementActive▾# SDAIA was established by royal decree on 30 August 2019 as Saudi Arabia's national authority for data and AI governance, reporting to the Prime Minister. 0 instruments (0 current) · 0 obligations · 4 claims · 0 milestones The Saudi Data and Artificial Intelligence Authority was established by royal decree on 30 August 2019 as Saudi Arabia's national authority for data and AI governance, reporting to the Prime Minister. SDAIA's AI guidance frameworks carry no independent statutory penalty schedule, and there is no AI-specific fine tier in Saudi Arabia. Academic analysis has separately found that SFDA Guidance MDS-G010 contains binding components but leaves unclear how penalties for non-compliance will operate. In the financial sector, SAMA Circular No. 43045328 of 23 December 2021 binds SAMA-supervised entities to align their policies, including AI-driven data processing, with the PDPL and with SDAIA's data-governance rules. Cited evidence in this module rests solely on tier 3/4 commentary despite primary official sources existing for this jurisdiction. Claims and evidence (4) - SDAIA was established by royal decree on 30 August 2019 as Saudi Arabia's national authority for data and AI governance, reporting to the Prime Minister.Confidence: Probable (capped: best source is T3) · As of 30 Aug 2019 · EvidencedEvidence and sources[Saudipedia](https://saudipedia.com/en/saudi-data-and-artificial-intelligence-authority-sdaia) T3 · Retrieved · retrieved 4 Nov 2026 · Section 6.3.3It was established by a Royal Decree on August 30, 2019, and it is directly linked to the Prime Minister. - SDAIA's AI guidance frameworks carry no independent statutory penalty schedule; there is no AI-specific fine tier in Saudi Arabia.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[regulations.ai](https://regulations.ai/regulations/RAI-SA-NA-SUMMARY-2026) T3 · Retrieved · retrieved 4 Nov 2026The guidance frameworks issued by SDAIA—including the AI Ethics Principles, Generative AI Guidelines, and AI Adoption Framework—are structured as soft-law instruments and do not contain independent statutory fine schedules. - SAMA Circular No. 43045328 (23 December 2021) binds SAMA-supervised entities to align their policies, including AI-driven data processing, with the PDPL and SDAIA's data-governance rules.Confidence: Probable (capped: best source is T3) · As of 23 Dec 2021 · EvidencedEvidence and sources[Vision2030.ai](https://vision2030.ai/regulation/saudi-arabia-ai-regulation-sdaia/) T3 · Retrieved · retrieved 4 Nov 2026That converts SDAIA's data rules into supervised obligations enforceable by SAMA against a licensed entity — a harder constraint than the PDPL alone. - Academic analysis finds MDS-G010 contains binding components but leaves unclear how penalties for non-compliance will operate.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Asian Bioethics Review (Springer) / PubMed Central](https://pmc.ncbi.nlm.nih.gov/articles/PMC11250741/) T3 · Retrieved · retrieved 11 Nov 2026 · Section 6.3.3This paper examines the Saudi Food and Drug Authority's (SFDA) Guidance on Artificial Intelligence (AI) and Machine Learning (ML) technologies based Medical Devices (the MDS-G010). ### 11Sandboxes & Transitional ReliefActive▾# Draft Responsible Artificial Intelligence Policy (Draft, no legal force): Draft policy proposing four-tier risk framework, registration requirements, ethics labelling, audit duties and a regulatory sandbox for AI. 1 instrument (1 current) · 0 obligations · 2 claims · 0 milestones SAMA's Regulatory Sandbox, a confirmed and operating mechanism, admits AI-based fintech innovations that are not covered by existing SAMA rules, with overseas innovators required to partner with a SAMA-licensed firm. Beyond this sector-specific sandbox, SDAIA opened a public consultation in April 2026 on a draft Responsible AI Policy proposing, among other mechanisms, a general sandbox alongside registration, labelling and audit requirements; that policy remains a proposal and has not been adopted. Instruments (1) - Draft Responsible Artificial Intelligence Policy Draft, no legal forceDraft policy proposing four-tier risk framework, registration requirements, ethics labelling, audit duties and a regulatory sandbox for AI.Authority: Saudi Data and Artificial Intelligence Authority · Verified 4 Nov 2026 Claims and evidence (2) - SDAIA opened a public consultation in April 2026 on a draft Responsible AI Policy proposing registration, labelling, audit and sandbox mechanisms; it remains unadopted.Confidence: Probable (capped: best source is T3) · As of 3 May 2026 · EvidencedEvidence and sources[DTS Solution](https://www.dts-solution.com/sdaia-and-ai-governance-in-saudi-arabia-building-responsible-ai-at-national-scale/) T3 · Retrieved · retrieved 4 Nov 2026In April 2026, SDAIA opened a public consultation on its draft Responsible AI Policy, a document that signals a clear shift away from broad ethics statements toward structured, operational governance. - SAMA's Regulatory Sandbox admits AI-based fintech innovations not covered by existing SAMA rules, with overseas innovators required to partner with a SAMA-licensed firm.Confidence: Confirmed · EvidencedEvidence and sources[Saudi Central Bank (SAMA)](https://rulebook.sama.gov.sa/en/entiresection/1368) T1 · Retrieved · retrieved 4 Nov 2026The Regulatory Sandbox allows new business models/concepts to be launched into the market for testing in a live environment within predefined parameters, provided that they are not regulated or covered by existing rules.. ### 12Commercial ActivityActive▾# HUMAIN agreed with Nvidia to deploy up to 600,000 AI chips over three years, with US export approval secured in November 2025. 0 instruments (0 current) · 0 obligations · 2 claims · 0 milestones HUMAIN has agreed with Nvidia to deploy up to 600,000 AI chips over three years, with US export approval for the arrangement reported secured in November 2025. Separately, and with limited corroboration from a single lower-tier source, HUMAIN is reported to be raising a USD 2.5 billion fund via BSF Capital while preparing for a possible dual Saudi-New York listing by 2029; this should be treated as an unconfirmed report rather than a settled development. Claims and evidence (2) - HUMAIN agreed with Nvidia to deploy up to 600,000 AI chips over three years, with US export approval secured in November 2025.Confidence: Probable · As of 20 Nov 2025 · EvidencedEvidence and sources[Malay Mail (Reuters)](https://malaymail.com/news/money/2025/11/20/saudi-ai-firm-humain-seals-nvidia-deal-as-us-clears-high-end-chip-sales/199129) T2 · Retrieved · retrieved 4 Nov 2026the US Department of Commerce said it had approved the export of advanced Nvidia chips to Humain and G42 - HUMAIN is reported to be raising a USD 2.5 billion fund via BSF Capital while preparing for a possible dual Saudi-New York listing by 2029.Confidence: Uncertain (capped: best source is T4) · EvidencedEvidence and sources[Startup Fortune](https://startupfortune.com/saudis-humain-preps-ipo-and-25-billion-dollar-fund-to-build-ai-data-centers/) T4 · Retrieved · retrieved 4 Nov 2026is raising a $2.5B fund via BSF Capital and building an IPO team for a Saudi-New York dual listing by 2029 No modules match. Filters combine as OR inside a group and AND across groups. Reset all filters ## Authorities Authority Type [Saudi Data and Artificial Intelligence Authority](https://sdaia.gov.sa) Ai office ## Enforcement actions No enforcement actions recorded in this research. ## Cases No cases recorded in this research. ## Consultations Consultation Authority Status Opened Closes [Draft Responsible Artificial Intelligence Policy](https://www.deep-lex.com/ai-regulation-tracker/saudi-arabia) Saudi Data and Artificial Intelligence Authority Closed 1 Apr 2026 3 May 2026 [Draft AI Cybersecurity Guidelines (AICG-1:2026)](https://nca.gov.sa/en/public-consultations/ai-cybersecurity-guidelines) Closed 5 Jul 2026 5 Aug 2026 What this record does not yet establish is set out on the [transparency register](/gaps/#gap-sa); its dated events are on the [regulatory calendar](/calendar/?jid=SA). Think something on this page is wrong? [Report an error](/legal/#contact). Technical provenance (record schema, run ID & build metadata) Schema version artificial-intelligence-record-v2.12 Research run ID aic-union-SA-2026-11-04 Page model module-card-page-v1 Renderer render_jid_aic_v13 Build date 12 Nov 2026