[co-author: Faisal Imam]
The draft law proposes a data embassy ecosystem and comprehensive framework in Saudi Arabia, promoting its position as a global AI hub.
On April 14, 2025, Saudi Arabia’s Communications, Space and Technology Commission (CST) issued a consultation draft of a “Global AI Hub Law.” This draft law marks Saudi Arabia as the first G20 nation to publish a draft of a comprehensive legal framework that embraces the concept of a data embassy and provides a roadmap for investment in and development of data embassies.
This blog post sets out the key aims and provisions under the draft law, which is open for consultation until May 14, 2025.
Background: Data Embassies
Data embassies offer a relatively recent solution to a digital society problem: How can a nation-state maintain data sovereignty and apply its laws to certain categories of data when such data needs to be hosted in a foreign state? In simple terms, a data embassy is a data center in one country that is subject to the laws of another country and not to the local laws where the data center is hosted.
Estonia piloted the concept in 2017 with a bilateral agreement with Luxembourg to host critical government data there. Monaco signed a similar agreement with Luxembourg in 2021. In these instances, bilateral agreements were necessary because the Vienna Convention on Diplomatic Relations 1961 was not considered sufficient to cover the establishment of a data embassy in a stand-alone data center, as opposed to a physical diplomatic mission in a foreign state.1
While other nation-states have explored the idea, Saudi Arabia aims to provide a full legal framework that promotes the establishment of sovereign data centers and categorizes the variations of AI hubs.
Saudi Arabia’s Draft Law
According to the consultation portal, the draft law aims to:
- enhance Saudi Arabia’s position as a global AI hub and pioneer in advanced technologies by fostering an attractive environment for foreign governments and private sector entities to develop and adopt such technologies for peaceful purposes and uses;
- maximize the benefit of Saudi Arabia’s strategic geographical location connecting three continents to offer technology solutions for global business and consumers, enhancing access to technology and bridging the digital divide sustainably; and
- facilitate the establishment of sovereign data centers that strengthen bilateral relationships with foreign states, hyperscalers, and other digital service providers by offering continuity of service, data sovereignty beyond borders, enhanced security, and future-proofed digital infrastructure.
The draft law defines three categories of “AI Hub,” which can be an entire data center or an isolated and clearly demarcated part of a data center:
- Private Hub: Operated by a “Guest Country” under a bilateral agreement with Saudi Arabia for the sole use of the Guest Country according to its laws and regulations
- Extended Hub: Operated by a third-party “Operator” under an agreement with the “Competent Authority” and an arrangement with a Guest Country according to the Guest Country’s laws and regulations
- Virtual Hub: Operated by a third-party “Service Provider” operating in Saudi Arabia and approved by the Competent Authority to offer a Virtual Hub for use by “Customers” of the Service Provider according to the laws and regulations of a “Designated Foreign State”
The Guest Countries are responsible for ensuring that relevant hubs operate in compliance with international law, adhere to technology-use restrictions, and cooperate with Saudi Arabia’s authorities to support digital infrastructure. Customer content within a Virtual Hub is subject to the jurisdiction of the competent courts of Designated Foreign Countries, but Saudi Arabia’s courts can provide necessary assistance.
Under the draft law, the Competent Authority will be authorized to enter into discussions with prospective Guest Countries, Operators, and Service Providers regarding the entry into relevant bilateral agreements to support the establishment of private hubs. The draft law does not specify the Competent Authority, which will be determined by the Council of Ministers and may be the CST or the Saudi Data and AI Authority (SDAIA).
Each category of AI Hub is subject to separate rules in the draft law, and further elaboration may be provided in future implementing regulations. The CST has clearly considered the need for distinct rules for foreign government data centers (Private Hubs) requiring digital diplomatic immunity, foreign company data centers (Extended Hubs), and data center providers in the Kingdom wishing to comply with foreign government laws while hosting data in Saudi Arabia (Virtual Data Centers).
Next Steps
The draft law is a consultation document, and the consultation exercise is open until May 14, 2025. We expect that future iterations of the draft law or implementation regulations or guidelines from the Competent Authority will clarify the distinctions between each type of hub and the process for setting them up. As a first step in establishing a data embassy ecosystem in Saudi Arabia, the draft law is both welcome and groundbreaking.
