In mid-October 2026, the Saudi Data and Artificial Intelligence Authority (SDAIA) and the Communications, Space and Technology Commission (CST) launched "It's AI", a public awareness campaign on deepfakes under the Kingdom's Year of Artificial Intelligence 2026. According to Middle East AI News' report of the SPA announcement, it urges people to verify content before they believe or share it, and to protect their faces, voices and personal data. The same report notes the announcement describes no new technical safeguards or rules.
That restraint is the campaign's strength. It is also a reminder of how little dedicated law sits behind it.
The strongest case for tougher rules
The case for binding deepfake rules is serious. Synthetic voices and faces make impersonation fraud cheap, and victims of non-consensual manipulation are usually harmed before any awareness message reaches them. Individual vigilance does not scale against industrial-grade fakes. SDAIA's own deepfake guidelines, as reported by Arab News on 9 May 2026, identify three malicious categories: impostor scams, non-consensual manipulation, and disinformation or propaganda. A regulator that sees those harms has good reason to want more than a slogan.
What Saudi law actually does today
Saudi Arabia has no dedicated AI law. Deepfake harms are handled through existing statutes, and the enforcement record so far is thin.
The best-known case is the first reported AI-related copyright penalty. The Saudi Authority for Intellectual Property (SAIP) fined a man SR9,000 after he used AI to alter a personal photograph and republished it without the owner's consent. Gulf News reported it on 14 September 2025 and says a specialised committee confirmed the violation under the Copyright Law. The IPKat analysis dates the decision to 23 September 2025 and cites Royal Decree M/41. The two sources disagree on the date, so treat it as September 2025.
The case shows the limits of the tool. Copyright protects whoever owns the photograph, which is not always the person whose likeness was manipulated. A fine of SR9,000 was a useful signal, but it is a workaround, not a deepfake framework.
The heavier backstop is the Anti-Cyber Crime Law, Royal Decree No. M/17 of 26 March 2007. In the official translation, Article 3 sets up to one year in prison and a fine of up to SR500,000, or either, for offences that include invasion of privacy through camera-equipped mobile phones and defamation through information technology. Article 6 sets up to five years and up to SR3 million, or either, for producing, transmitting or storing material "impinging on public order, religious values, public morals, and privacy." Article 12 says the law does not prejudice intellectual property rules.
The proportionality problem
This is where a pro-innovation, pro-speech reading becomes critical. Article 3 and Article 5-style harms such as fraud and blackmail are well-defined. The Article 6 category is not. "Public order" and "public morals" are elastic terms, and the law was written years before synthetic media existed. Applied to deepfakes, they can reach a fraudster cloning a bank manager's voice, and they can equally reach a satirical clip, a parody or a political edit. The penalty ceiling is five years, which is a heavy deterrent for a creator unsure which side of the line a piece of content falls on.
Vague offences chill legitimate creative and journalistic uses of generative tools, and they do little to catch determined fraudsters, who ignore the law anyway. A narrower, harm-based approach would target what is clearly wrongful: impersonation for fraud, non-consensual intimate imagery, and deceptive synthetic media that causes concrete financial or personal harm.
The pending policy and the guidelines
SDAIA's draft Responsible AI Policy opened for consultation on 3 April 2026 and closed on 3 May 2026 on the Istitlaa platform, according to Digital Policy Alert's tracker. The tracker lists it as applying to government bodies, the private sector, the non-profit sector and individuals, with design requirements touching bias, safety and transparency, and shows it as still "processing consultation." We could not confirm that a final text has been issued, and the official draft was not accessible to us. Publishing a final text, with a regulatory impact assessment and responses to submissions, would be the single most useful step for businesses planning compliance.
The deepfake guidelines point in a more demanding direction. Arab News reports they ask developers to embed non-intrusive watermarks, creators to apply visible, tamper-resistant ones, and say regulators should approve deepfake technologies before commercial deployment. Watermarking is a reasonable, testable transparency measure, though it is easy to strip and cannot prove a piece of content is authentic. Pre-deployment approval is a different matter. Prior approval of a general-purpose capability can slow startups and researchers while sophisticated bad actors work around it. Proportionate rules would reserve pre-approval, if used at all, for narrow high-risk uses.
What a better sequence looks like
- Keep the campaign. Verification habits and reporting channels such as the Kollona Amn app and the Ministry of Interior's cybercrime unit (named in the guidelines coverage) are cheap, speech-neutral and useful.
- Define the harms. Say in statute or regulation what a harmful deepfake is, so that fraud and non-consensual manipulation are covered and satire and reporting are not.
- Match penalties to harm. Reserve the Article 6 ceiling for demonstrable, serious cases, with intent as an element.
- Finalise the policy openly. Publish the Responsible AI Policy with the evidence behind it, and say how it relates to the guidelines.
Saudi Arabia is right to start with public literacy. The risk is that the gap between the campaign and a clear legal framework is filled by broad, decades-old offences. Clear, narrow rules would protect the people deepfakes actually hurt and leave room for the AI sector the Kingdom is trying to build.