Using generative AI in Saudi government: the mandatory rules

Most of SDAIA's AI governance is guidance, but the Generative AI Guidelines for Government are framed as mandatory rules for handling government data. If you are a government entity, or a vendor acting for one, these are the lines you do not cross.

The hard rules

• Public data only: do not enter data classified Restricted or higher into a generative-AI tool. Generative AI is limited to data classified Public.
• No critical decisions: do not use generative AI to make decisions that affect individuals or the Kingdom's vital interests.
• Human review every result: a person reviews the output before it is used.
• NCA and classification: comply with the National Cybersecurity Authority standards and the Data Classification Policy, check the tool's privacy and disclosure terms, and anonymise and obtain consent before any personal data goes near a prompt.

Guardrails that make it workable

The practical answer is governance, not prohibition. Stand up a Data Management Office that approves tools after reviewing their privacy and data-sharing terms, publish a usage policy, keep a record of who used what, and label generated content. Because these obligations are anchored in the PDPL and the Data Classification Policy, the evidence you keep for them is the same evidence your privacy programme already produces.

For government generative AI the rule is simple: public data, human in the loop, never the critical call.