The Saudi Data & AI Authority (SDAIA) approved a national Data Monetization Policy on June 21, 2026, the Kingdom's first comprehensive rulebook for turning government-held data into commercial AI and data products. The policy bans the outright sale or transfer of raw government data, but opens a structured path for private firms to build licensed products on top of it through registration systems, data-use licenses, and regulatory sandboxes (entARABI; MIT Sloan Management Review Middle East).
What the Policy Actually Does
The framework rests on seven principles: data as a national asset, revenue generation, privacy by design, promoting open data, a culture of data sharing, preventing monopolistic practices, and transparency (Let's Data Science). In practice, that means raw datasets stay off the market — value can only be captured through processing, analysis, or enrichment — while data classified "Confidential" or above is excluded entirely. Firms that want to build on government data must register, obtain a data-use license, and in many cases prototype inside a sandbox before commercial release. SDAIA says access must be granted on a "fair and non-discriminatory basis," and that monetization cannot override existing open-data publication or freedom-of-information commitments (MIT Sloan ME).
This is not an isolated move. Three weeks later, on July 14, 2026, SDAIA launched a National Framework for AI Risk Management — a parallel governance layer covering how any organization, public or private, should identify and monitor AI-system risk (Arab News). SDAIA has also been running an AI sandbox program in digital learning, which the World Bank called "a pioneering national model" for controlled AI experimentation (Arab News). Read together, these three moves show a regulator building a full stack — data access rules, experimentation rules, risk-management rules — in under a month, well ahead of most peer jurisdictions.
The Case For It
There is a real policy problem here worth taking seriously. Selling raw government datasets outright — population registries, health records, geospatial layers — creates privacy exposure and lets a single well-capitalized buyer lock up a public asset for competitive advantage. Banning raw resale while requiring licensing is a defensible middle path: it lets the state extract economic value from data it already collects (funding better public services, per Vision 2030's diversification goals) without ceding control over sensitive information wholesale. The non-discriminatory-access and anti-monopoly language, if enforced, is a genuine safeguard against exactly the kind of exclusive-access deal that critics of "data colonialism" warn about elsewhere. Compared with simply auctioning data to the highest bidder, this is the more responsible design.
The Tension
But licensing regimes have a predictable failure mode: they reward whoever can absorb the compliance overhead, not whoever has the best idea. Registration, license applications, sandbox slots, and revenue-sharing disclosures are trivial costs for a well-funded incumbent or a state-linked champion, and real friction for a five-person startup. SDAIA's policy says access should be fair and non-discriminatory, but says nothing public yet about processing-time guarantees, fee caps, or a fast-track for small entrants — the details that determine whether "open to all qualified firms" means genuinely open or open in name only.
The timing sharpens this contrast. The same week Riyadh finalized this licensed-access model, Beijing's Xi Jinping was in Shanghai launching the World AI Cooperation Organization, explicitly urging member states to "encourage open source, openness, collaboration and sharing" in AI development (MediaNama). Saudi Arabia is pursuing something closer to a curated marketplace than an open commons — a defensible choice for sovereign data, but one that will slow the kind of permissionless experimentation that has driven open-source AI's fastest gains elsewhere. The Kingdom is separately learning that policy alone doesn't guarantee competitive dynamism: its AI buildout remains structurally dependent on Nvidia hardware regardless of how its data rules are written, because diversifying suppliers is a much harder problem than diversifying regulation (Rest of World).
What Would Make This Work
SDAIA has the harder parts right: banning raw resale, requiring privacy-by-design, and stating an anti-monopoly commitment are all sound defaults. What's missing from the public record so far is the execution detail that separates a genuinely competitive licensed marketplace from one that quietly favors incumbents — published turnaround times for license approval, capped or waived fees for early-stage firms, and sandbox capacity sized for more than a handful of flagship participants. Saudi Arabia doesn't need to copy China's open-source model to get this right. It needs its own licensing regime to be fast and predictable enough that a startup, not just a national champion, can actually use it.