On 15 September 2026, at the opening of the 4th UNESCO Global Forum on the Ethics of AI in Riyadh, Saudi Data and AI Authority (SDAIA) President Abdullah Alghamdi urged governments to "turn shared principles into action" and said the Kingdom is developing a comprehensive national AI framework, according to Arab News. The line applies to the host too. Saudi Arabia has no dedicated AI statute. Its AI governance rests on the Personal Data Protection Law (PDPL) and SDAIA's non-binding ethics guidance.
What the forum showed
The Riyadh forum ran 14–17 September 2026, co-hosted by UNESCO, SDAIA and the International Centre for AI Research and Ethics (ICAIRE). UNESCO's summary reports more than 6,300 participants and delegations from more than 50 Member States. It was the first such forum in the Gulf region, and it marked five years since the 2021 Recommendation on the Ethics of AI. UNESCO also launched an updated Readiness Assessment Methodology (RAM 2.0), which ICAIRE helped translate into Arabic.
Alghamdi also cited investment in people: more than 40 academic programmes in data and AI, and more than 1.2 million graduates of the One Million Saudis in AI initiative. That matters for the policy argument. A country that has trained talent at this scale has a stake in rules that let its builders ship products.
The case for binding rules
The strongest argument for a statute is that voluntary principles do not bind anyone. SDAIA's ethics guidance sorts systems by risk and expects compliance, but guidance is not law. Ethical commitments are hard to enforce when no one is liable for breaking them. The same gap leaves affected people without a clear route to redress when an automated decision harms them. Investors and public-sector buyers also want to know what they must do and what happens if they fail.
The UNESCO Recommendation adds weight to this view. It was adopted in November 2021 by UNESCO's Member States, and the forum's theme was moving from principles to implementation. Regulators and citizens in a rapidly digitising economy can fairly ask what "implementation" means when the governing text is advisory.
Why the answer is not a heavy statute
A law is not automatically better than guidance. Early, broad AI statutes tend to be written around today's technology and risk locking in compliance costs that fall hardest on small firms and universities. Saudi Arabia's current mix has real advantages: it lets firms and regulators learn from deployment, and it avoids freezing definitions before the technology settles.
The PDPL already covers one of the biggest practical risks, which is how personal data is used to train and run AI systems. SDAIA is still tuning it. In April 2025 it opened a third public consultation on amendments to the PDPL Implementing Regulations. The draft would add a 10-business-day deadline for controllers to answer requests from the competent authority and remove the time limit for data subjects to file complaints. The data layer, in other words, is being refined through iterative consultation, which is a sound pattern to copy for AI.
A parallel track is less settled. The Communications, Space and Technology Commission (CST) ran a consultation on a draft Global AI Hub Law from 14 April to 14 May 2025. A policy tracker lists it as still processing the consultation and records no later development. The draft is framed around attracting foreign investment in digital infrastructure. If it stays unresolved, AI developers face two regulators and no single rulebook.
What the comprehensive framework should do
If the framework Alghamdi described becomes law, five design choices would keep it consistent with both safety and growth.
- Regulate by risk, not by technology. Reserve binding duties for high-impact uses such as credit, hiring, public benefits and criminal justice. Leave low-risk tools such as spam filters and recommendation features to voluntary codes.
- Anchor duties to existing law. Where the PDPL already governs data, do not write a second regime. Add AI-specific duties only where there is a documented gap, such as human review of consequential automated decisions.
- Give firms predictable process. Publish draft rules, hold consultations of the kind used for the PDPL regulations, and set transition periods before enforcement.
- Protect expression and research. Obligations on generative AI should target demonstrable harms. They should not impose broad pre-publication approval of outputs, which would chill speech and open-source work.
- Use sandboxes and safe harbours. Firms that follow published codes and report incidents should receive regulatory credit instead of automatic liability.
Bottom line
Saudi Arabia deserves credit for hosting a global conversation and for training a large AI workforce. UNESCO's own readiness work, including a meta-analysis of 55 country reports, shows that most governments are still working out how to turn principles into practice. The test now is the text of the framework SDAIA says it is drafting. A narrow, risk-based law that keeps the PDPL as the data backbone, publishes drafts for comment, and spares low-risk innovation would give builders and citizens the certainty that voluntary guidance cannot. A sprawling law that treats every model as a hazard would not. No draft has been published, so the details remain to be seen.