Saudi Arabia — AI Law & Policy Updates

Saudi Arabia's Personal Data Protection Law (PDPL), enacted by Royal Decree M/19 of 2021 and amended in 2023, became fully enforceable on 14 September 2024, carrying fines up to SAR 5 million plus criminal liability for misuse of sensitive data. AI governance is led by the Saudi Data & Artificial Intelligence Authority (SDAIA) through non-binding AI Ethics Principles (2023) and Generative AI Guidelines (2024), aligned with the National Strategy for Data & AI and Vision 2030.

Personal Data Protection Law PDPL — Royal Decree M/19 of 2021, amended 2023 · SDAIA AI Ethics Principles 2023 · SDAIA Generative AI Guidelines 2024 · National Strategy for Data & AI NSDAI / Vision 2030 — Status: PDPL in force; AI governed by SDAIA principles Saudi Arabia governs AI through its data authority, SDAIA the Saudi Data & Artificial Intelligence Authority , rather than a dedicated AI Act. The binding instrument is the Personal Data Protection Law Royal Decree M/19 of 2021, amended 2023 , which became fully enforceable on 14 September 2024 and carries fines up to SAR 5 million plus criminal liability for misuse of sensitive data. On top of it, SDAIA has issued non-binding AI Ethics Principles 2023 and Generative AI Guidelines 2024 covering fairness, transparency, accountability and human oversight, all aligned with the National Strategy for Data & AI and Vision 2030's goal of becoming a top-tier AI economy. Companies deploying AI must comply with the PDPL and are expected to follow SDAIA's guidelines. Recent developments: