Saudi Arabia is yet to enact AI Regulations, relying on guidelines to establish practice standards and general principles.

Laws/Regulations directly regulating AI (the “AI Regulations”)

There are currently no AI Regulations that have the force of law in the Kingdom of Saudi Arabia (the "Kingdom"). That said, the Saudi Data and Artificial Intelligence Authority of Saudi Arabia (SDAIA) have issued draft AI Ethics Principles dated September 2023 (the "AI Principles").¹ The Council of Ministers' Resolution No. (292) mandates SDAIA to develop policies, governance mechanisms, standards, and controls related to data and artificial intelligence and monitor compliance therewith upon issuance. SDAIA has analyzed global practices and standards to develop these AI Principles which aim to:

• Support the Kingdom's efforts towards achieving its vision and national strategies related to adopting AI technology, encouraging research and innovation, and driving economic growth for prosperity and development

• Develop and establish AI ethics policies, guidelines, regulations, and frameworks

• Govern data and AI models to limit the negative implications of AI systems (economically, psychologically, socially, etc.) and potential threats (security, political, etc.)

• Help entities adopt standards and ethics when building and developing AI-based solutions to ensure responsible use thereof

• Protect the privacy of data subjects and their rights with respect to the collection and processing of their data²

Additionally, SDAIA has also issued two Generative AI Guidelines (the "Guidelines"), both dated January 1, 2024. The first version is directed toward government employees (the "Government Guidelines").³ The second version is for the public (the "Public Guidelines").⁴ Both versions provide guidelines regarding adoption and use of generative artificial intelligence (GenAI) systems, along with examples based on common scenarios. They also highlight the challenges and considerations associated with the use of GenAI, propose principles for responsible use, and present recommended practices. These Guidelines also do not have the force of law but serve as guidance.

Status of the AI Regulations

As noted above, the AI Principles remain in draft, and there are currently no specific laws or regulations in the Kingdom that directly regulate AI.

Other laws affecting AI

There are several other areas of law that affect the development or use of AI, including the Personal Data Protection Law⁵, intellectual property laws, and other laws that may affect the use of AI in specific sectors or contexts.

Definition of “AI”

SDAIA defines "AI" as: systems that employ methods that can gather data and use it to predict, suggest, or make decisions with varying degrees of autonomy and select the best course of action to accomplish particular objectives.⁶

Territorial scope

As noted above, there are currently no specific laws or regulations in the Kingdom that directly regulate AI. The AI Principles are currently in draft form and therefore do not have the force of law in the Kingdom. That said, when the draft AI Principles do get issued, they shall apply to all AI stakeholders designing, developing, deploying, implementing, using, or being affected by AI systems within the Kingdom, including but not limited to public entities, private entities, non-profit entities, researchers, public services, institutions, civil society organizations, individuals, workers, and consumers.⁷

The Guidelines apply to (i) the public, including developers and users of GenAI, in the Kingdom⁸; and (ii) promote the responsible and effective utilization of GenAI tools and services in government transactions.⁹ The Guidelines As noted above, there are currently no specific laws or regulations in the Kingdom that directly regulate AI. The AI Principles are currently in draft form and therefore do not have the force of law in the Kingdom. That said, when the draft AI Principles do get issued, they shall apply to all AI stakeholders designing, developing, deploying, implementing, using, or being affected by AI systems within the Kingdom, including but not limited to public entities, private entities, non-profit entities, researchers, public services, institutions, civil society organizations, individuals, workers, and consumers.

The Guidelines apply to (i) the public, including developers and users of GenAI, in the Kingdom ; and (ii) promote the responsible and effective utilization of GenAI tools and services in government transactions.⁹ The Guidelines emphasize the proper use and processing of government data in adherence to relevant laws and regulations in the Kingdom.

Sectoral scope

As noted above, there are currently no specific laws or regulations in the Kingdom that regulate AI. Accordingly, there is no specific sectoral scope at this stage.

Compliance roles

As noted above, there are currently no specific laws or regulations in the Kingdom that regulate AI. The AI Principles and the Guidelines do not have the force of law, so compliance is not mandatory. The AI Principles are still in draft form and the Guidelines specifically provide that they are for guidance purposes and are not obligatory.

That said, pursuant to the Royal Order establishing SDAIA, SDAIA does have the overarching power to monitor and create regulations regarding AI, which does include the right to monitor compliance of AI Regulations if issued in the future.

Core issues that the AI Regulations seek to address

Based on the draft AI Principles, the core issues are as follows:

• Fairness
• Privacy and security
• Humanity
• Social and environmental benefits
• Reliability and safety
• Transparency and explainability
• Accountability and responsibility¹⁰

Risk categorization

The Guidelines provide no category of risk, but provide the following categories of risk mitigation measures:¹¹

Deepfakes and Misrepresentation – This includes mitigation measures such as:

• Watermark implementation
• Know Your Customer (KYC) protocols for cloud server providers
• Output verification
• Enhanced digital literacy and online safety

Safety Threats – This includes mitigation measures such as:

• Content moderation and filtering systems
• Training dataset filtering
• Limiting open access/open source for scientific GenAI models

Misinformation and Hallucination – This includes mitigation measures such as:

• Content verification and citation
• Content labelling
• User vigilance and fact-checking
• Raising awareness

Classified Data Breaches – This includes mitigation measures such as:

• GenAI usage protocols
• Employee awareness and training
• User data control

Certification Fraud – This includes mitigation measures such as:

• Assessment enhancement
• Education and training
• Guidelines and policies
• Query proficiency

Intellectual Property Infringement and Protection – This includes mitigation measures such as:

• IP licensing and due diligence
• Creator permission and compensation

Variability of Outputs – This includes mitigation measures such as:

• Clear annotation for AI-generated code
• Regularly verifying and validating code
• Staying informed about updates
• Building expertise

Key compliance requirements

As noted above, there are currently no specific laws or regulations in the Kingdom that directly regulate AI. The relevant aspects of the AI Principles and the Guidelines are set out above.

Regulators

The key regulator is SDAIA. SDAIA is the competent authority in the Kingdom concerned with data and AI, including big data. SDAIA is also the national reference in all matters related to the organization, development, and handling of data and AI; in addition, it has the original competence in all matters related to operation, research, and innovation in the field of data and AI. SDAIA was established by Royal Order No. (A/471) and is headquartered in Riyadh. SDAIA is directly linked to the Prime Minister; its sub-entities are the National Data Management Office (NDMO), National Center for AI (NCAI), and National Information Center (NIC), all of which are organizationally linked.

Enforcement powers and penalties

As noted above, there are currently no specific laws or regulations in the Kingdom that directly regulate AI. As such, enforcement and penalties relating to the creation, dissemination and/or use of AI are governed by the Royal Order establishing SDAIA, which does grant SDAIA the overarching power to monitor and regulate AI in the Kingdom.

1 See here
2 See here, p.5
3 See here
4 See here
5 See here
6 See here
7 See here, p.9
8 See here, p.5
9 See here, p.5
10 See here
11 See here, section 5 "Generative AI Risks & Mitigations"

Jeffrey Shin (Trainee Solicitor, White & Case, London) contributed to this publication.

[View source.]