- The PDPL is the binding law that affects most AI use, because it covers personal data. It has been fully enforceable since 14 September 2024.
- SDAIA's AI Ethics Principles set seven principles for all AI systems.
- The Generative AI Guidelines for the Public are non-binding, but they list the risks to plan for.
- Do not paste customer data into an AI tool until you know where it is stored and why you may use it.
Is there an AI law in Saudi Arabia?
There is no single AI law that covers everything. Instead, a binding data law sits next to a set of guidelines. You need to know which is which.
Which rules are binding?
The Personal Data Protection Law (PDPL) is binding. It became enforceable on 14 September 2024 after a one-year grace period. The regulator is the Saudi Data and AI Authority (SDAIA). If your AI tool touches personal data, the PDPL applies.
Are the AI guidelines binding?
No. The Generative AI Guidelines for the Public are non-binding. They sit alongside binding laws such as the PDPL. They still show what regulators care about, so follow them.
What about the draft Global AI Hub Law?
It came from the Communications, Space and Technology Commission and went to public consultation in April and May 2025. At the time our source was written, it had not been enacted. Check for updates before you rely on it.
What are SDAIA's AI Ethics Principles?
They are SDAIA's baseline for anyone who builds or uses AI in the Kingdom. Version 2.0 dates from September 2023.
What are the seven principles?
- Fairness: reduce bias and discrimination.
- Reliability and safety: the system behaves as intended and avoids harm.
- Transparency and explainability: explain automated decisions and say when AI is used.
- Accountability and responsibility: people stay responsible for harm.
- Privacy and security: protect data and defend against attacks.
- Humanity: keep people at the centre of the design.
- Social and environmental benefits: support society and avoid damage.
Do they apply to every AI system?
Yes. They apply to all AI systems, not only generative AI. They use a risk-based approach, so higher-risk uses need more care.
Can you put customer data into an AI tool in Saudi Arabia?
Only if you can answer three questions: why, where and how long. If you cannot, wait.
What does the PDPL say about consent and purpose?
You need a legal basis to use personal data. Consent is one of them. You must also give a privacy notice that states the data you collect, the purpose and where the data is used.
What if the AI tool is hosted outside Saudi Arabia?
Transfers to countries without an SDAIA adequacy decision need safeguards. These can be standard contractual clauses, binding corporate rules or a certificate of accreditation. A risk assessment is also required. Ask the tool's provider where your data goes.
What is a simple rule for staff?
This is our advice. Do not paste names, phone numbers, IDs or contracts into a public AI tool. Remove the personal details first, or use a tool your company has approved.
What risks do the Generative AI guidelines warn about?
The guidelines for developers and users list real risks. They apply the Ethics Principles to everyday use.
What are the main risks?
- deepfakes
- safety threats
- misinformation and hallucination
- data breaches
- certification fraud
- intellectual property infringement
- output that varies from one run to the next
How do you lower the risk of wrong answers?
Our advice: have a person check every AI answer before it reaches a customer. Ask the tool for its sources and open them. Keep a note of who approved what.
How can a company start with AI step by step?
You do not need a big plan. A small, safe start teaches you more.
What is the SDAIA AI Adoption Framework?
It is a 2025 framework that describes maturity levels and the things an organisation needs in place to adopt AI. Use it as a checklist when you grow beyond one tool.
What is a simple starting plan?
- Pick one task that is slow and low risk, such as drafting internal notes.
- List the data it will touch. Leave out personal data at first.
- Choose a tool and find out where it stores data.
- Add a human check before anything goes out.
- Write down what you decided, so you can explain it later.