Saudi Arabia
Saudi Arabia's AI and data regulation is shaped by Vision 2030, SDAIA's national AI governance framework, and SAMA's detailed fintech and open banking rules.
Regulatory Bodies
Frequently Asked Questions
What does Saudi Arabia's PDPL require for AI systems?
The Saudi PDPL (2021, implemented 2023) requires explicit consent for processing sensitive personal data including health, financial, and biometric data. AI systems making automated decisions with legal or significant effect require a human review mechanism. Critically, sensitive personal data of Saudi nationals must be stored within the Kingdom — routing such data through US-based LLM APIs without a Saudi-region deployment likely violates this requirement.
What are SDAIA's AI Ethics Principles?
SDAIA published AI Ethics Principles in 2023 covering: human-centricity, privacy by design, transparency, explainability, accountability, safety, and non-discrimination. While aspirational in nature, they are referenced in government procurement requirements and increasingly influence SAMA's supervisory expectations for AI use in financial services.
How does SAMA regulate fintech and AI in financial services?
SAMA operates a Regulatory Sandbox for testing fintech products before full licensing, covering payments, digital lending, open banking (Open Banking Framework, 2022), and insurance technology. SAMA has published specific AI/ML guidance for credit scoring that requires model explainability and bias testing. The Fintech Saudi initiative provides regulatory clarity for startups.
Need a specific answer? Search the full Saudi Arabia regulatory corpus with AI.
Open GCC LexAI →