Does Saudi Arabia have a binding AI law?

Not yet. The AI Ethics Principles, the AI Adoption Framework and the Generative AI and Deepfakes Guidelines are guidance. The binding obligations that reach AI come from the PDPL, the Data Classification Policy, the NCA standards and the Anti-Cyber Crime Law, plus the mandatory Generative AI Guidelines for Government.

How do the risk tiers work?

Four tiers: little or no risk (ethics recommended), limited (apply the principles), high (pre- and post-conformity assessment plus statutory requirements), and unacceptable (prohibited, such as social scoring, child exploitation and mass surveillance). They line up closely with the EU AI Act.

We already run ISO 42001. Do we start over?

No. SDAIA is largely an overlay. We crosswalk it to ISO 42001, the EU AI Act and NIST AI RMF, so your existing evidence carries across, and you add only the Saudi-specific pieces.

What are the rules for generative AI in government?

Government entities must use generative AI only with public-classified data, must not use it in critical decisions, and must have a human review every result, alongside the NCA standards and the Data Classification Policy. We provide the policy and the guardrails.

All frameworks

SDASDAIA AI Ethics Principles and guidelines (2023 to 2025)

SDAIA AI compliance

Saudi Arabia's responsible-AI framework, from the authority for data and AI.

SDAIA's AI governance brings together the AI Ethics Principles, the AI Adoption Framework and the Generative AI and Deepfakes Guidelines into one responsible-AI framework for the Kingdom. It is guidance rather than a standalone AI law, so most of it is voluntary, with the binding floor coming from the PDPL, the Data Classification Policy, the NCA standards and the Anti-Cyber Crime Law, and with the Generative AI Guidelines for Government mandatory for government data.

Start from the basics

The standard

SDAIA AI Governance (AI Ethics Principles, AI Adoption Framework, Generative AI and Deepfakes Guidelines)

Who needs it

Any organisation in Saudi Arabia that designs, develops, deploys or uses AI, public or private. Government entities and their vendors face the mandatory Generative AI rules; everyone handling personal data in AI systems meets the binding PDPL and classification obligations.

AI ethics principles, mapped

The basics

What is SDAIA AI?

The core is seven AI Ethics Principles (fairness; privacy and security; humanity, grounded in Saudi cultural values; social and environmental benefits; reliability and safety; transparency and explainability; accountability and responsibility), applied across a four-step AI system lifecycle, with four risk tiers that map closely to the EU AI Act: little or no risk, limited, high, and unacceptable (prohibited, such as social scoring and mass surveillance).

Around that sit the AI Adoption Framework (directions, enablers and outcomes, with KPI targets), the Generative AI Guidelines for the public and the stricter government regime (public data only, mandatory human review, no use in critical decisions), and the Deepfakes Guidelines (provenance, watermarking and consent for developers, creators, regulators and consumers).

Why it matters

What SDAIA AI does for your business

Saudi buyers expect it by name

SDAIA is the authority for both data and AI, and 2026 is the Kingdom's Year of AI. Public-sector and enterprise buyers increasingly ask for alignment to the SDAIA AI Ethics Principles specifically, not just ISO 42001.

The binding parts are real

Even though the ethics guidance is voluntary, the PDPL, the Data Classification Policy, the NCA standards and the Anti-Cyber Crime Law apply with real penalties, and the Generative AI Guidelines for Government are mandatory for government data.

It is mostly an overlay

If you already run ISO 42001, the EU AI Act or NIST AI RMF, SDAIA is largely a crosswalk plus a few Saudi-specific additions (the humanity and cultural-values principle, data-classification limits for generative AI, and deepfake provenance).

What it covers

Ethics principles and risk tiers

Seven principles across the AI lifecycle, and a four-tier risk model that prohibits social scoring and mass surveillance and requires conformity assessment for high-risk systems.

Governance and roles

An AI ethics plan, defined roles (Chief Data Officer, compliance officer, responsible-AI officer, AI system assessor), optional registration and the AI ethics checklist.

Generative AI

Responsible generative-AI use for the public, and the mandatory government regime: public data only, human review, no critical decisions, NCA and classification controls.

Deepfakes

Provenance (C2PA), watermarking and consent for developers and creators, oversight and a use-case inventory for regulators, and detection literacy for consumers.

The hard way

Done by hand, responsible AI means keeping an AI system inventory with risk tiers, running ethical-impact and privacy assessments, proving data-classification limits for generative AI, and tracking deepfake provenance and consent, all while mapping back to ISO 42001, the EU AI Act and NIST AI RMF so you are not documenting the same thing four times. A platform turns that into one register with reused evidence.

The easier way, with Compliance One

A pre-loaded SDAIA AI control library across 13 domains, with each control marked recommended, binding or reference so the voluntary ethics guidance is never presented as mandatory law.
An AI system inventory with four-tier risk classification, ethical-impact and privacy assessments, and the AI ethics checklist, reusing the platform's AI-governance tooling.
Cross-mapping to ISO 42001, the EU AI Act and NIST AI RMF, with the privacy-relevant AI controls also mapped to ISO 27701 and the KSA PDPL, so one evidence set counts across your whole AI estate.
The government generative-AI guardrails (public data only, human review, classification limits) and the deepfake consent and provenance records, with the Saudi cultural-values principle built in.

Do it once, reuse it everywhere. Evidence you collect for SDAIA AI is automatically mapped to every other framework whose controls it also satisfies — and since these standards overlap heavily, most of that work isn't repeated.

Common questions

Does Saudi Arabia have a binding AI law?: Not yet. The AI Ethics Principles, the AI Adoption Framework and the Generative AI and Deepfakes Guidelines are guidance. The binding obligations that reach AI come from the PDPL, the Data Classification Policy, the NCA standards and the Anti-Cyber Crime Law, plus the mandatory Generative AI Guidelines for Government.
How do the risk tiers work?: Four tiers: little or no risk (ethics recommended), limited (apply the principles), high (pre- and post-conformity assessment plus statutory requirements), and unacceptable (prohibited, such as social scoring, child exploitation and mass surveillance). They line up closely with the EU AI Act.
We already run ISO 42001. Do we start over?: No. SDAIA is largely an overlay. We crosswalk it to ISO 42001, the EU AI Act and NIST AI RMF, so your existing evidence carries across, and you add only the Saudi-specific pieces.
What are the rules for generative AI in government?: Government entities must use generative AI only with public-classified data, must not use it in critical decisions, and must have a human review every result, alongside the NCA standards and the Data Classification Policy. We provide the policy and the guardrails.

Ready to tackle SDAIA AI?

See exactly how Compliance One maps SDAIA AI to your environment in a 30-minute walkthrough — and how much of it we handle for you.