Skip to main content

    AI by country · Middle East

    AI in Saudi Arabia: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Saudi Arabia know before starting with AI?

    Saudi Arabia has no dedicated AI law as of 29 October 2026. The Personal Data Protection Law (PDPL) and its Implementing Regulation apply to AI that uses personal data, and the Saudi Data and AI Authority (SDAIA) is both the data regulator and the national AI body. A company should check impact assessments, transfers abroad and breach reporting, and watch SDAIA's draft amendments that are open for comment until 5 November 2026.

    At a glance

    Saudi Arabia at a glance

    Key facts about Saudi Arabia
    Data protection lawPersonal Data Protection Law (Royal Decree M/19 of 1443H, amended in 2023), in force since September 2023
    RegulatorSaudi Data and Artificial Intelligence Authority (SDAIA)
    AI policyNational Strategy for Data and AI, plus SDAIA's AI Ethics Principles, Generative AI Guidelines and Deepfakes Guidelines. No dedicated AI law as of 29 October 2026
    Time zoneAST, UTC+3 (India is 2.5 hours ahead)
    CurrencySAR (Saudi riyal)
    Business languageArabic, with English widely used in business

    Why now

    Why Saudi Arabia is worth watching

    Each point links to the document it comes from.

    • The National Strategy for Data and AI aims for 20,000 or more data and AI specialists, about SAR 75 billion of investment in data and AI, and more than 300 startups.[3]

    • The strategy names education, government, health care and energy among its priority sectors.[3]

    • SDAIA publishes Generative AI Guidelines in two versions, one for government staff and one for the public, along with Deepfakes Guidelines and an AI Adoption Framework.[2]

    • SDAIA runs an AI service provider accreditation service and an AI ethics self-assessment tool on its data governance portal.[4]

    • SDAIA opened consultation on draft amendments to the PDPL Implementing Regulation from 6 October to 5 November 2026, including new impact assessment triggers for automated decisions.[5]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Personal Data Protection Law (Royal Decree M/19, amended by Royal Decree M/148)

    In force2021A controller must run an impact assessment of processing for any product or service, as set out in the Regulations (Article 22). Breaches must be reported to SDAIA, and to the person where harm is likely (Article 20). Transfers abroad are allowed only for listed purposes and under conditions in the Regulations (Article 29). Fines reach SAR 5 million, doubled for repeat violations (Article 36), and disclosing sensitive data to cause harm can bring up to two years in prison or a SAR 3 million fine (Article 35).[1]

    PDPL Implementing Regulation and Regulation on Personal Data Transfer outside the Kingdom

    In force2023These set the working detail of the PDPL. Law-firm summaries say the Implementing Regulation requires notice to SDAIA within 72 hours of a breach that is likely to cause harm. SDAIA also publishes standard contractual clauses, binding common rules guidance and a transfer risk assessment guideline.[4]

    Draft amendments to the PDPL Implementing Regulation

    Draft2026A law-firm summary says the draft would require a 72-hour breach notice to SDAIA whether or not harm is likely, an impact assessment where processing uses emerging technologies or makes automated decisions that affect people, and storage of personal data inside the Kingdom while still allowing lawful transfers. Comments close on 5 November 2026; the final text is not known as of 29 October 2026.[5]

    Where AI fits first

    Where AI fits first

    Health care

    Arabic and English clinical note drafting and appointment triage, with clinicians making decisions.

    Article 23 of the PDPL requires extra controls for health data, including limits on who can access it, set out in the Regulations.[1]

    Banking and finance

    Document checks for account opening, fraud alerts and customer service in Arabic.

    The PDPL says its Regulations are prepared with bodies including the Saudi Central Bank, so check the bank regulator's rules too.[1]

    Government and public services

    Assistants that answer service questions, with staff approving outputs.

    SDAIA has a separate Generative AI guideline for government employees, and a data sharing policy for government data.[2]

    Education

    Arabic tutoring support and marking assistance that a teacher reviews.

    Education is a priority sector in the National Strategy for Data and AI.[3]

    Your first steps

    Your first steps

    1. Run a PDPL impact assessment for each AI product or service that uses personal data, and keep it on file.
    2. Map every place personal data leaves Saudi Arabia, and record the legal purpose and safeguard, such as SDAIA's standard contractual clauses.
    3. Prepare a breach process that can notify SDAIA within 72 hours.
    4. Check whether you must appoint a personal data protection officer under SDAIA's rules.
    5. Read SDAIA's Generative AI Guidelines and AI Ethics Principles, and note how your system meets them.
    6. Read the draft Implementing Regulation amendments, especially data storage in the Kingdom, and comment before 5 November 2026.
    7. Use SDAIA's AI ethics assessment tool as a first self-check.

    AI services for Saudi Arabia

    AI consulting and development for teams in Saudi Arabia

    We work remotely with companies in Saudi Arabia, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Saudi Arabia is on UTC+3 and India on UTC+5:30, a 2.5 hour gap. Taking a 9:00 to 17:00 day in Saudi Arabia and 9:30 to 18:30 in India, the overlap is about 7 hours, from 09:00 to 16:00 Saudi time. The Saudi working week is Sunday to Thursday, so Monday to Thursday are shared working days.

    Questions

    Common questions about AI in Saudi Arabia

    Does Saudi Arabia have an AI law?

    Not a dedicated one as of 29 October 2026. AI that uses personal data falls under the PDPL. SDAIA's AI ethics, generative AI and deepfake documents are guidance. SDAIA links its AI Ethics Principles as a draft on its own page.

    Who regulates personal data and AI?

    SDAIA does both. It is the competent authority under the PDPL and leads the National Strategy for Data and AI.

    Can we send data to an AI service outside Saudi Arabia?

    Only for the purposes in Article 29 and under the transfer regulation, with safeguards such as SDAIA's standard contractual clauses. The 2026 draft amendments would add a storage-in-Kingdom rule, so check the final text.

    What are the penalties?

    Up to SAR 5 million per violation, doubled for repeat violations, under Article 36. Disclosing sensitive data to harm someone can bring up to two years in prison or a SAR 3 million fine under Article 35.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Saudi Data and Artificial Intelligence Authority (SDAIA), 2023-04-23. Personal Data Protection Law (English translation, amended version, Apr…(sdaia.gov.sa)
      Full title and what we used it for

      Personal Data Protection Law (English translation, amended version, April 2023). Primary. SDAIA's English text. Used for Articles 20, 22, 23, 29, 35, 36, 42 and 43. The Arabic text is the official version.

    2. [2] Saudi Data and Artificial Intelligence Authority (SDAIA), 2026-10-29. Regulations and Policies(sdaia.gov.sa)
      Full title and what we used it for

      Regulations and Policies. Primary, accessed on this date. Used for the list of the PDPL, Implementing Regulation, transfer regulation, Generative AI Guidelines, Deepfakes Guidelines, AI Adoption Framework and the AI ethics principles (linked as a draft).

    3. [3] Saudi Data and Artificial Intelligence Authority (SDAIA), 2026-10-29. National Strategy for Data and AI(sdaia.gov.sa)
      Full title and what we used it for

      National Strategy for Data and AI. Primary, accessed on this date. Used for the targets (20,000+ specialists, about SAR 75 billion, 300+ startups) and priority sectors.

    4. [4] SDAIA, National Data Governance Platform, 2026-10-29. Personal Data Protection knowledge center(dgp.sdaia.gov.sa)
      Full title and what we used it for

      Personal Data Protection knowledge center. Primary, accessed on this date. Used for the existence of the Implementing Regulation, transfer regulation, standard contractual clauses, DPO rules, the AI service provider accreditation service and the AI ethics assessment tool. The 72-hour breach rule comes from law-firm summaries (see s5).

    5. [5] Clyde & Co, 2026-10-08. The SDAIA publishes draft amendments to the Implementing Regulations of…(clydeco.com)
      Full title and what we used it for

      The SDAIA publishes draft amendments to the Implementing Regulations of the PDPL. Law-firm summary, used for interpretation only: consultation dates (6 October to 5 November 2026 on Istitlaa), the proposed changes, and the current 72-hour harm-based breach rule. We did not read the draft itself.

    6. [6] Latham & Watkins, 2023-12-01. Saudi Arabia's data protection law enters into force(lw.com)
      Full title and what we used it for

      Saudi Arabia's data protection law enters into force. Law-firm summary, used for interpretation only: entry into force in September 2023 with a one-year transition period to September 2024. Published in December 2023.

    This is general information, not legal advice. Saudi data rules are being amended in 2026, and some details here come from law-firm summaries rather than the regulation text. Check with a qualified Saudi lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Saudi Arabia?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score