The Saudi Data and Artificial Intelligence Authority (SDAIA) used the country's self-declared "Year of AI 2026" to complete a regulatory rollout it has been building since 2019: on June 8, 2026, it published ten documents covering AI ethics principles, generative AI guidance for both government and the public, deepfake guidelines, a national professional-standards framework for data and AI occupations, and an academic framework for AI qualifications — layered on top of the Personal Data Protection Law (PDPL) and existing data-governance tools. Together they form the most complete AI governance architecture in the Gulf, and one of the more instructive models globally for how to regulate AI without a standalone AI statute.
The Steelman: Soft Law Can Mean No Law
Critics of principles-based regulation have a real point, and it is worth stating plainly. Non-binding guidelines let a government claim the reputational credit of "comprehensive AI governance" while retaining the discretion to enforce selectively or not at all. SDAIA's own deepfake guidance is explicit that it is non-binding, aimed at developers, platforms, and public-sector entities, and reliant on "preferred mitigation techniques" like watermarking rather than mandatory technical standards. In a jurisdiction with no independent judiciary review of executive rulemaking and a documented record of using platform-level tools to suppress dissent — Access Now and partner NGOs reported in May 2026 that Meta had geo-blocked over 100 Facebook and Instagram accounts belonging to Gulf human-rights researchers and activists at the Saudi government's request since March 2026 — a skeptic is entitled to ask whether "AI ethics principles" function as governance or as a compliance veneer that coexists comfortably with continued digital-rights restrictions. That skepticism should not be waved away by a self-congratulatory press release.
Why the Model Still Deserves Credit
The fair response is that the alternative to soft law is not necessarily better law — it is often premature law. The EU's AI Act, finalized in 2024, locked in a risk-tiered compliance regime before generative AI's dominant use cases and failure modes had stabilized; European firms are now absorbing compliance costs for categories the drafters could not have anticipated three years earlier. SDAIA's approach — separate, revisable guidance documents for government generative AI use, public generative AI use, deepfakes, and professional standards, rather than one omnibus statute — is structurally suited to iterate as the technology moves. A government guideline can be revised in a policy memo; a statute requires re-legislation. For a jurisdiction explicitly trying to attract AI investment as part of Vision 2030 diversification away from oil revenue, that flexibility is a genuine competitive asset, not just a way to dodge accountability.
More importantly, the claim that this is pure atmospherics doesn't survive contact with SDAIA's own enforcement record on the PDPL, the one piece of this architecture that is binding law rather than guidance. Since the PDPL's compliance grace period expired in September 2024, SDAIA's enforcement committees have issued 48 enforcement decisions as of early 2026, covering unlawful data collection, inadequate security controls, and unconsented marketing communications — with fines running up to SAR 5 million (roughly $1.3 million) per violation, doubling on repeat offenses. That is a meaningfully more active enforcement cadence than several longer-established European data authorities managed in their first eighteen months of enforceability. A regulator willing to actually fine domestic and multinational firms under its one binding statute is a different animal from a regulator issuing purely decorative ethics documents.
The Occupational Layer Is the Sleeper Story
The least-covered piece of the June 8 package may be the most consequential for market development: a National Occupational Standard Framework defining roughly sixteen distinct data and AI job categories, paired with an academic qualifications framework for AI specialties. Regulatory clarity on AI ethics gets headlines; standardized professional certification is what actually lets a labor market scale. Saudi Arabia's SAMAI upskilling program has already reached into the hundreds of thousands of participants, and pairing that pipeline with formal occupational standards addresses a bottleneck — qualified AI talent — that constrains far more mature AI ecosystems than Saudi Arabia's.
The Right Read
The honest assessment sits between the two poles. SDAIA's guidance-heavy model is not a substitute for independent oversight, and the coincidence of an AI "ethics" push with continued platform-level censorship of Saudi human-rights defenders is a legitimate reason for outside observers — investors and civil-society groups alike — to keep scrutinizing implementation rather than the announcement. But dismissing the whole exercise as governance theater ignores that the PDPL, the one enforceable piece of this stack, now has a real docket of fines behind it. For a government trying to build AI-sector credibility fast, pairing flexible soft law with one hard, enforced statute may be a more proportionate sequencing than either a rushed omnibus AI act or no formal governance at all. The test now is whether the other nine documents follow the PDPL's path from principle to enforcement, or stay guidance in name and in practice.