Searchlight AI
Kingdom of Saudi Arabia

KSA's Personal Data Protection Law (PDPL) is the principal governing law for privacy and personal data protection matters. It applies to any processing of personal data by any means that takes place in KSA, including any processing of personal data related to individuals residing in KSA by entities outside KSA.

AI is not specifically mentioned in the PDPL, but it governs the use of AI in its provisions including where personal data is processed using new technology and where automated decision-making technology uses personal data. Non-compliance with the PDPL – for example, disclosure of personal data and sensitive personal data with the intention to cause harm – may result in enforcement action, which can include imprisonment and/or fines.

KSA's National Intellectual Property Strategy promotes innovation and creativity. KSA is a member of various international treaties on intellectual property protection and has established laws and regulations for different types of intellectual property – including patents, trademarks, copyrights, and trade secrets.

The intellectual property regime in KSA does not have specific AI rules; it only recognises natural or legal persons as authors of works that qualify for intellectual property protections, as opposed to algorithms. It includes concepts like 'lawful use' for fair use of copyrighted material, which may extend to the use of protected materials in AI solutions.

The Saudi Authority for Intellectual Property (SAIP) oversees intellectual property protection, aiming to regulate, support, and enhance IP fields. In April 2023, SAIP proposed amendments to KSA's intellectual property laws, including AI-related intellectual property rules. The draft reaffirms that only natural or legal persons can be authors of IP-protected content, with intellectual property rights granted to content with significant individual contribution. Content created by AI without such contribution enters the public domain. To date, such amendments have not been enacted.

The AI Principles also address IP, requiring input data to comply with IP standards and controls.

The National Cybersecurity Authority (NCA) – the competent authority for cybersecurity in KSA – is mandated to develop a regulatory framework related to cybersecurity and deal with cybersecurity incidents.

The NCA issued the Essential Cybersecurity Controls (ECC) which was amended in 2024. The ECC are the foundational cybersecurity controls that apply to government organisations in KSA – including ministries, authorities, establishments, and others (inside and outside the Kingdom) – as well as to private sector organisations that own, operate, or host critical national infrastructure. 
AI systems may be classified as critical national infrastructure based on their use and impact. In this case, the AI system would be subject to the provisions of the ECC, including requirements to implement robust cybersecurity measures and systems – which must also be able to address cyber risks presented by AI.

Separately, the Anti-Cybercrime Law prohibits causing harm to others using information technology devices, which will likely include harm caused using AI systems. It provides for penalties including imprisonment and/or fines.

The Evidence Law is one of the four laws to reform KSA's judicial regulatory framework. Following its issuance, the Ministry of Justice issued the Procedural Guidelines of the Evidence Law which allows the usage of new technologies, including AI, in evidence procedures before the judicial courts in KSA.

Separately, the Implementing Regulations of the Commercial Court further allow the use of AI technologies in the electronic procedure of the commercial courts in KSA.