> For the complete documentation index, see [llms.txt](https://docs.solcis.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.solcis.ai/references/ai-regulatory-landscape/the-middle-east/ai-compliance-in-saudi-arabia.md).
# AI compliance in Saudi Arabia
AI compliance in Saudi Arabia: enforce your controls on what your AI systems do, with data and evidence held in-Kingdom, across PDPL and the requirements of SDAIA, NCA and SAMA.
*You bring your adopted compliance controls. Solcis Compliance Studio maps them to whichever Saudi obligations apply, and the Solcis Policy Engine enforces them on what your AI systems do, with data and evidence held in-Kingdom.*
AI compliance in Saudi Arabia means enforcing your adopted controls on what your AI systems do, with each control traceable to the clause it satisfies, independently verifiable evidence of every decision, and data and evidence held in-Kingdom. It supports Vision 2030's push for local AI infrastructure and your compliance with whichever Saudi obligations apply: PDPL and the requirements of SDAIA, NCA and SAMA. It is the jurisdiction-specific case of [runtime AI compliance](/references/concepts/runtime-ai-compliance.md).
## Key takeaways
* AI compliance in Saudi Arabia spans every regulated sector. PDPL applies regardless of industry, while NCA's ECC-2:2024 and SAMA's Cyber Security Framework add sector-specific layers for government, critical infrastructure and finance.
* Saudi Arabia has no AI-specific law. SDAIA's AI guidance is non-binding, but SDAIA also enforces PDPL, which makes it the clearest single reference point. NCA and SAMA carry equivalent weight for the entities they cover.
* Sovereignty here is a stated national strategy – DEEM, ALLaM, HUMAIN – not just a response to compliance pressure.
* Sovereignty answers where your data and infrastructure sit. AI compliance answers what your AI systems are allowed to do under PDPL and the requirements of SDAIA, NCA and SAMA. Both are required.
* Onshore infrastructure, from stc Cloud to HUMAIN to the hyperscaler regions, is where the evidence is hosted. The Solcis Policy Engine enforces your adopted controls, and Solcis Compliance Studio holds and reports the resulting evidence.
## What's shaping AI compliance in Saudi Arabia?
AI compliance in Saudi Arabia is shaped by state-led investment, strict data residency, a rapid data-centre build-out, and sector-specific cybersecurity controls.
[Vision 2030](https://www.vision2030.gov.sa/) sets the foundation for state-led AI adoption, while the [Saudi Data and Artificial Intelligence Authority (SDAIA)](https://sdaia.gov.sa/) unifies national AI strategy and data governance under one authority. [PIF-owned HUMAIN](https://www.pif.gov.sa/en/our-investments/our-portfolio/humain/) is building the entire AI stack – data centres, cloud infrastructure, models and applications – and [plans to deploy several hundred thousand NVIDIA GPUs over five years](https://nvidianews.nvidia.com/news/humain-and-nvidia-announce-strategic-partnership-to-build-ai-factories-of-the-future-in-saudi-arabia).
That regulatory reach extends to hosting itself. Cloud-first policy and data-residency rules together create a largely in-Kingdom hosting market. The government's [Cloud-First Policy](https://mcit.gov.sa/sites/default/files/cloud_policy_en.pdf) directs government IT procurement to consider cloud solutions first, and its data classification, together with NCA's cloud cybersecurity controls, requires classified government data to be hosted in-Kingdom. The [National Data Management Office (NDMO) data governance policies](https://sdaia.gov.sa/ndmo/Files/PoliciesEn.pdf) restrict sharing personal data outside the Kingdom without approval. [SDAIA's DEEM government cloud](https://sdaia.gov.sa/en/Services/Pages/Deem.aspx) already serves more than 200 government entities.
The same residency logic extends beyond government. Under the [Saudi Central Bank (SAMA) Cyber Security Framework](https://rulebook.sama.gov.sa/en/cyber-security-framework-2), cloud services should in principle be hosted in-Kingdom, and hosting outside the Kingdom requires explicit prior approval from SAMA. Personal data falls under the [Personal Data Protection Law (PDPL)](https://sdaia.gov.sa/en/SDAIA/about/Documents/PersonalDataProtectionLaw.pdf), and transfers outside the Kingdom are governed by its [Personal Data Transfer Regulations](https://www.spa.gov.sa/en/N2163905), amended in September 2024.
This onshore demand is matched by one of the world's busiest data-centre build-outs. [stc's center3 and HUMAIN](https://spa.gov.sa/en/N2471061) plan a joint venture targeting up to 1GW of AI data-centre capacity, starting with up to 250MW. Meanwhile, SDAIA has broken ground on the [Tier IV, 480MW Hexagon government data centre](https://www.arabnews.com/node/2628030/saudi-arabia) in Riyadh, its foundation stone [laid on 1 January 2026](https://www.spa.gov.sa/en/N2480096).
Physical capacity is only half of it. Software running inside it, including AI systems that take actions, already has to meet strict security rules that Saudi regulators set well before any AI-specific guidance existed. For instance, [NCA's Essential Cybersecurity Controls (ECC-2:2024)](https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf) bind government agencies and operators of critical national infrastructure, including a duty to retain cybersecurity event logs for at least 12 months (Control 2-12-3-5), and [SAMA's Cyber Security Framework](https://rulebook.sama.gov.sa/en/cyber-security-framework-2) binds the financial sector. Neither was written with AI systems in mind, yet an autonomous AI system touching core systems still has to meet these privileged-access and logging controls.
## Which regulations and regulators bear on AI systems in Saudi Arabia?
The table outlines each instrument's requirements and its operational impact on AI systems that take actions.
| Regulation / regulator | What it requires | Relevance to AI systems |
| ------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Personal Data Protection Law (PDPL)** (all sectors) | Issued in 2021 and [amended in 2023](https://sdaia.gov.sa/en/SDAIA/about/Documents/PersonalDataProtectionLaw.pdf), in force since September 2023 with compliance required from September 2024. It requires privacy notices on how personal data is used. Its Implementing Regulations require explicit consent for decisions based solely on automated processing, and a Data Protection Impact Assessment (DPIA) where specified triggers apply, including automated decision-making and emerging technologies. [SDAIA](https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter) is the competent authority. | An AI system that processes personal data is subject to PDPL's notice duties like any other processing. Decisions made solely by automated means need explicit consent and may trigger a DPIA. |
| **SDAIA AI guidance** (AI Ethics Principles, Generative AI Guidelines for Government, AI Adoption Framework) | SDAIA's [AI Ethics Principles](https://dgp.sdaia.gov.sa/wps/wcm/connect/4c56ed1c-1b82-447d-ac29-638f5f99c12e/ai-principles-EN.pdf?MOD=AJPERES) (first issued 2023, updated 2025) set non-binding fairness, accountability and transparency expectations. Its [Generative AI Guidelines for Government](https://sdaia.gov.sa/en/SDAIA/about/Files/GenAIGuidelinesForGovernmentENCompressed.pdf) (first issued January 2024) add non-binding human-oversight and risk-management expectations for government generative-AI use. The [AI Adoption Framework](https://www.spa.gov.sa/en/N2217019) (September 2024) sets non-binding maturity levels for adopting AI. | Non-binding, but the clearest Saudi-specific reference point for how an AI system's actions should be governed and evidenced. |
| **NCA Essential Cybersecurity Controls (ECC-2:2024)** (government and critical national infrastructure) | [108 controls](https://cdn.nca.gov.sa/api/files/public/upload/86e09090-44e4-481f-bc28-355673607654_ECC--2024-EN.pdf) across four domains – governance, defence, resilience, and third-party and cloud security – binding on government agencies and their affiliated entities, and on private-sector organisations that own, operate or host critical national infrastructure. NCA's Cloud Cybersecurity Controls add requirements for cloud providers and tenants. | An AI system operating inside a covered entity's systems sits inside the same governance and third-party controls as any other deployment. |
| **SAMA Cyber Security Framework (CSF)** (financial sector) | Issued in May 2017, the CSF applies to banks, finance companies, credit bureaus, financial market infrastructure and payment service providers. It sets a mandatory minimum Level 3 maturity across governance, controls, third-party risk and incident response, and requires regulated organisations to [notify SAMA immediately](https://rulebook.sama.gov.sa/en/3315-cyber-security-incident-management-0) on identifying a medium or high classified security incident. | A financial institution's AI system is covered by the same third-party-risk and notification requirements as any other SAMA-regulated system. |
*The core instruments of Saudi Arabia's AI compliance landscape: PDPL and the requirements of SDAIA, NCA and SAMA.*
Saudi Arabia has no AI-specific law. The draft [Global AI Hub Law](https://istitlaa.ncc.gov.sa/en/Transportation/citc/globalailaw/Pages/default.aspx), published for consultation in April 2025, deals with data embassies and sovereign data hosting rather than the conduct of AI systems, and had not been enacted at the time of review.
## What's distinctive here?
Saudi Arabia's AI and cloud rules differ from most jurisdictions in three ways:
* **A dedicated national AI authority is rare.** Most jurisdictions split AI rules across separate privacy and sector regulators. Saudi Arabia has a single authority, SDAIA, that acts as the primary data protection regulator, leads national AI strategy, sets ethical guidelines, and operates the DEEM government cloud.
* **SAMA's regime is unusually prescriptive.** Rather than leave the target maturity to each institution's own risk profile, the [SAMA Cyber Security Framework](https://rulebook.sama.gov.sa/en/cyber-security-framework-3) sets a six-level (0–5) maturity model. Every regulated institution must reach at least [Level 3](https://rulebook.sama.gov.sa/en/node/5888), and banks must reach Level 4 in four named subdomains. Compliance is assessed against the model, starting from each institution's self-assessment.
* **CST's provider registration turns on control of infrastructure, not ownership.** The Communications, Space and Technology Commission (CST) [registers cloud service providers](https://www.cst.gov.sa/en/business/services/Cloud-Computing-Registration) in classes A, B and C by the data classification they may handle, with Class C the highest. Any provider with direct or effective control of the data centre or critical cloud infrastructure must register, whoever owns the company. Class C adds stricter requirements, including Tier III facility certification and alignment with NCA's cloud controls. [Huawei Cloud](https://www.telecompaper.com/news/huawei-cloud-receives-class-c-licence-in-saudi-arabia--1486956), for example, holds Class C despite being foreign-owned. This classification decides which providers can host an AI system handling government-linked or classified data.
## Why does sovereignty matter for AI systems in Saudi Arabia?
Sovereignty dictates where an AI system executes, keeping critical national data within Saudi borders. In-Kingdom data and deployment sit at the centre of the Kingdom's AI strategy. SDAIA built the [DEEM government cloud](https://sdaia.gov.sa/en/Services/Pages/Deem.aspx) to consolidate public-sector workloads onshore, and separately developed the sovereign [ALLaM Arabic-language model](https://sdaia.gov.sa/en/MediaCenter/News/Pages/NewsDetails.aspx?NewsID=296) to keep Arabic AI capability operationally controlled inside Saudi borders.
However, sovereignty in the Kingdom is usually a partnership arrangement rather than a single vendor's guarantee. Local operators such as [center3](https://www.datacenterdynamics.com/en/news/saudis-center3-targets-1gw-of-data-center-capacity-by-2030/) supply the physical facilities, connectivity and, in some cases, encryption-key custody, while foreign providers [supply the underlying cloud software](https://www.oracle.com/middleeast/news/announcement/blog/stc-offer-sovereign-cloud-services-in-saudi-arabia-with-oracle-alloy-2024-04-23/). Sovereign cloud hosting in the Kingdom therefore denotes local operational and cryptographic control, not domestically built software.
That partnership matters directly for AI compliance. An autonomous AI system can cross infrastructure, access systems and transmit data. Local hosting keeps a workload within the Kingdom, but it does not by itself control the system's actions or prove it stayed within approved data and system boundaries. Runtime AI compliance adds that layer, governing and evidencing how an AI system accesses data, uses systems and acts within Saudi sovereignty requirements.
## Applying AI compliance in Saudi Arabia
Applying AI compliance in the Kingdom means applying the [properties of runtime AI compliance](/references/concepts/runtime-ai-compliance.md) to Saudi Arabia's regulatory inputs: PDPL, SDAIA's guidance, NCA's ECC-2:2024 and SAMA's Cyber Security Framework.
* **Preventive enforcement at the action boundary.** The Solcis Policy Engine evaluates the intended action against the applicable controls before it executes wherever possible, returning `Allow`, `Deny` or `Escalate` with a severity rating.
* **Control-to-clause traceability.** In Solcis Compliance Studio, each adopted control is tied back to the exact clause it satisfies. That might be a PDPL notice duty, an NCA governance control, or SDAIA's human-oversight guidance.
* **Runtime enforcement, inline.** Where the Solcis Policy Engine enforces inline, the control fires at the moment the AI system tries to act, and the decision is reached before the action proceeds.
* **Tamper-evident and independently verifiable evidence.** Each decision is recorded cryptographically at the moment it is made, in the Solcis Compliance Studio evidence ledger. An auditor, or a SAMA or NCA inspector, can verify that the record is complete and unaltered using standard tooling, without trusting the organisation or Solcis. Verification establishes what the record says and that it has not changed, not that the underlying decision was correct.
To see these in action, consider a government entity's generative-AI agent that drafts a citizen-facing response, then attempts to publish it without review – a high-risk action. The entity has adopted a control, drawn from [SDAIA's Generative AI Guidelines for Government](https://sdaia.gov.sa/en/SDAIA/about/Files/GenAIGuidelinesForGovernmentENCompressed.pdf) on human oversight, that citizen-facing content needs human sign-off before release.
When the agent attempts to publish without approval, the Solcis Policy Engine escalates rather than letting the action complete, and a reviewer is brought in to approve or amend the draft. Solcis Compliance Studio then records a tamper-evident record of the escalation and the reviewer's decision – auditable evidence that the control was enforced and how the approval was resolved.
That record's trustworthiness comes from its cryptographic verifiability, not from where it is hosted. Where the evidence physically sits is a separate, residency-specific question, covered next.
## Where can AI compliance be deployed in-Kingdom?
Deploying compliant AI systems means hosting them on approved, local platforms that meet Saudi Arabia's data-residency standards. Onshore hosting and local ownership are not the same thing, and the table below marks where that distinction matters most.
| Provider | Who they are / what makes them sovereign | Relevance for deploying AI compliance in-border |
| ----------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [**stc Cloud**](https://cloud.stc.com.sa/) | Majority state-owned, with PIF holding a [62% controlling stake](https://www.pif.gov.sa/en/news-and-insights/press-releases/2024/pif-announces-sale-of-100-million-shares-in-stc/), the basis for its sovereign status despite some foreign underlying technology. Its stack spans [SCCC](https://sccc.sa/) (an Alibaba Cloud joint venture, live since June 2022) and a dedicated [Oracle Alloy](https://www.oracle.com/middleeast/news/announcement/blog/stc-offer-sovereign-cloud-services-in-saudi-arabia-with-oracle-alloy-2024-04-23/) environment run from center3 facilities since April 2024. stc.AI also offers a [sovereign AI cloud built with SambaNova](https://developingtelecoms.com/telecom-technology/telecom-cloud-virtualization/18013-saudi-llm-sovereign-cloud-platform-launched-by-stc-group.html) for open-weight models. | The broadest range of in-Kingdom deployment options, spanning conventional sovereign cloud, a dedicated Oracle estate and a sovereign AI cloud for open-weight models. |
| [**center3**](https://center3.com/) (stc's data-centre arm) | Shares stc's PIF-controlled ownership. Its sovereignty claim rests on physically owning facilities that other providers, including foreign hyperscalers, run on. It operates around 20 data centres, in operation or development, across Saudi Arabia and Bahrain, targets [1GW of capacity by 2030](https://www.datacenterdynamics.com/en/news/saudis-center3-targets-1gw-of-data-center-capacity-by-2030/), hosts [Huawei Cloud's Saudi region](https://www.datacenterdynamics.com/en/news/huawei-to-host-saudi-cloud-region-in-center3-data-center/) and stc's Oracle Alloy deployment, and lands subsea cable systems including 2Africa. | Not a deployment target for AI systems itself – it supplies the physical layer other in-Kingdom platforms depend on for their own onshore compliance evidence. |
| [**HUMAIN**](https://www.humain.com/) | Wholly PIF-owned, building the Kingdom's entire AI stack end to end – data centres, cloud platforms, models and applications. It plans to deploy several hundred thousand NVIDIA GPUs over five years, backed by partnerships including [NVIDIA, Microsoft, AMD, Qualcomm, AWS, Google Cloud and Groq](https://www.pif.gov.sa/en/our-investments/our-portfolio/humain/). | The clearest state-backed option for the highest-assurance sovereign AI workloads, though not yet a general-purpose commercial platform. |
| [**Mobily**](https://www.mobily.com.sa/wps/portal/web/business/digital/hosting-and-cloud/details/mobily-cloud-services) | A colocation and connectivity player with mixed ownership: UAE's [e& holds its largest single stake at 27.99%](https://www.mobily.com.sa/wps/portal/web/corporate/investor-relations/details/company-overview/fact-sheet), with the remainder held by other Saudi and foreign institutional and retail investors. It has committed [around US$905 million](https://www.datacenterdynamics.com/en/news/saudi-telco-mobily-invests-905m-in-data-centers-and-subsea-cables/) to data centres and subsea cables, with 39MW of planned capacity, and is landing the SEA-ME-WE 6 subsea cable at Yanbu. | A local colocation alternative for AI workloads that need onshore infrastructure without depending on the stc/HUMAIN stack. |
| [**SITE**](https://cloud.site.sa/en) (Saudi Information Technology Company) | A narrow but specific role: a shareholder in SCCC, and the supplier of the [external key-management product](https://cntxt.com/external-key-manager-ekm/) that CNTXT runs for Google Cloud customers in the Kingdom. Not an independent hosting operator. | Relevant through key custody rather than hosting – it keeps a foreign hyperscaler's encryption keys under local control. |
| **Hyperscaler regions** (AWS, Azure, Google Cloud, Oracle) *Onshore hosting, offshore ownership* | Oracle has been live in [Jeddah since February 2020](https://docs.oracle.com/en-us/iaas/releasenotes/changes/b38848ee-ecd2-4c36-9491-95628f16dffd/index.htm) and in [Riyadh since July 2024](https://docs.oracle.com/en-us/iaas/releasenotes/changes/45cb2bf5-290f-40fb-af89-b7b9455f35fe/index.htm). Google Cloud has been live in Dammam since November 2023, with [access through CNTXT](https://docs.cloud.google.com/docs/dammam-region-access), its exclusive reseller in the Kingdom. Microsoft's [Saudi Arabia East region](https://news.microsoft.com/source/emea/2026/08/microsoft-announces-saudi-arabia-east-datacenter-region-will-be-available-in-november-2026/) is due in November 2026, and [AWS's Saudi region](https://www.aboutamazon.com/news/aws/aws-cloud-region-saudi-arabia) in December 2026. | A genuine partnership reality: local operators typically supply the building, connectivity and key custody, while the region itself belongs to the hyperscaler. |
*Saudi Arabia's in-Kingdom hosting providers: stc Cloud, center3, HUMAIN, Mobily, SITE and the hyperscaler regions.*
## Frequently asked questions
Does Saudi PDPL apply to AI systems?
Yes, whenever an AI system processes personal data. PDPL's notice duties apply as they do to any processing. Decisions based solely on automated processing need explicit consent, and automated decision-making and emerging technologies are among the triggers for a Data Protection Impact Assessment. SDAIA enforces the law.
What does SDAIA require for AI governance?
SDAIA's AI Ethics Principles, its Generative AI Guidelines for Government and its AI Adoption Framework are all non-binding. Even so, they set the working baseline most government AI use is measured against, and misuse can still trigger consequences under PDPL or other binding Saudi law. All three are linked in the regulators table above.
Is there an AI law in Saudi Arabia?
Not yet. Saudi Arabia has no AI-specific law. The draft Global AI Hub Law, published for consultation in April 2025, covers data embassies and sovereign data hosting rather than AI systems' conduct. AI systems are governed today through PDPL, sector cybersecurity rules and SDAIA's non-binding guidance.
Can AI compliance run in-Kingdom?
Yes, on stc Cloud, HUMAIN, Mobily's onshore infrastructure, or the Oracle and Google Cloud regions already live. Microsoft's Saudi Arabia East region is due in November 2026 and AWS's Saudi region in December 2026.
Does NCA's ECC apply outside government?
Yes. It also binds private-sector organisations that own, operate or host critical national infrastructure. NCA encourages other organisations to adopt it voluntarily.
Is SAMA relevant if we're not a bank?
Often, yes. The SAMA Cyber Security Framework also applies to finance companies, credit bureaus, financial market infrastructure and payment service providers. If you supply a SAMA-regulated entity, the framework's third-party risk requirements mean you are likely to be expected to meet much of the same standard contractually.
***
This page is general information about how Solcis supports work against Saudi instruments. It is not legal or regulatory advice. Confirm your obligations with a qualified professional and the primary source. Last reviewed: 23 September 2026.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.solcis.ai/references/ai-regulatory-landscape/the-middle-east/ai-compliance-in-saudi-arabia.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.