SDAIA's AI Ethics Principles explained

Saudi Arabia does not yet have a standalone AI law. Instead, SDAIA, the authority for both data and AI, governs AI through guidance: the AI Ethics Principles, the AI Adoption Framework, and the Generative AI and Deepfakes Guidelines. Most of it is voluntary. The binding floor comes from the PDPL, the Data Classification Policy, the NCA standards and the Anti-Cyber Crime Law, and the Generative AI Guidelines for Government are mandatory for government data.

Seven principles, four tiers

• The principles: fairness; privacy and security; humanity, grounded in Saudi cultural values; social and environmental benefits; reliability and safety; transparency and explainability; and accountability and responsibility.
• The risk tiers: little or no risk (ethics recommended), limited (apply the principles), high (pre- and post-conformity assessment plus statutory requirements), and unacceptable (prohibited, such as social scoring, child exploitation and mass surveillance).
• The tiers map closely to the EU AI Act, and the principles line up with the NIST AI RMF trustworthiness characteristics and the ISO 42001 management system.

If you already run ISO 42001

Then SDAIA is largely an overlay. The seven principles map to ISO 42001 Annex A controls and clauses, the lifecycle maps to the plan-do-check-act cycle, and the risk tiers map to the EU AI Act. What is genuinely Saudi-specific is the humanity and cultural-values principle, the data-classification limits on generative AI, and the deepfake provenance and consent expectations. Build those on top and you are most of the way there.

SDAIA is soft law with a hard floor. The ethics are voluntary; the PDPL, classification and cyber-crime rules underneath are not.