Geneva pitch, Riyadh reality
On April 24, 2026, at the closing of the 29th session of the UN Commission on Science and Technology for Development (CSTD) in Geneva, the Saudi Data and Artificial Intelligence Authority (SDAIA) presented what officials described as "the Saudi model for regulating and developing the AI sector." The timing was deliberate: the CSTD's priority theme this year was "Science, Technology and Innovation in the Age of Artificial Intelligence," and the Saudi Cabinet declared 2026 the national "Year of AI" on March 11, 2026.
The trouble is that the "Saudi model" being marketed abroad does not yet correspond to a coherent, binding set of rules at home. The three instruments SDAIA leans on — the AI Ethics Principles, the public-sector AI Adoption Framework, and the draft Global AI Hub Law — are respectively non-binding guidance, a baseline that applies only to state entities, and a consultation text that has not been enacted. That is not, on its own, a scandal. But the gap between the international brand and the domestic statute book matters when SDAIA holds itself out as a regulatory exporter.
The steel-manned case for soft law
Before grading the pitch, the regulator's logic deserves a fair hearing. Soft-law instruments — voluntary principles, agency frameworks, sandboxes — are exactly how pro-innovation jurisdictions usually begin regulating frontier technology. The United States has leaned heavily on NIST's AI Risk Management Framework, which is voluntary. The United Kingdom's March 2023 pro-innovation AI white paper deliberately rejected a single binding statute in favour of regulator-led, principles-based guidance. Soft law avoids premature lock-in, allows iteration as capabilities change, and reduces the deadweight cost of writing the wrong rule. For a country building domestic AI capacity from a comparatively low base, that pragmatism is sensible.
SDAIA also has substantive material to show. The AI Ethics Principles, published in September 2023, codify seven workable categories — fairness, privacy, humanity, social benefit, reliability, transparency, and accountability — that broadly track the OECD AI Principles. The AI Adoption Framework, released in November 2025, sets a real governance baseline for every public-sector entity in the Kingdom across data governance, model accountability, transparency, human oversight, and risk management. The draft Global AI Hub Law is more original: it proposes three "hub" structures — private, extended, and virtual — under which foreign governments and companies could host data in Saudi territory under their own legal regimes, building on Estonia's "data embassy" idea. That is the kind of jurisdictional experimentation an open-internet position should welcome.
What is actually in force
The marketing problem is that none of this adds up to a binding national AI statute. The AI Ethics Principles are described by independent regulatory trackers as "non-binding but influential" — enforceable only indirectly, through the Personal Data Protection Law where personal data is involved, or through procurement pressure on government suppliers. The AI Adoption Framework is mandatory, but only for public-sector entities; private deployments are encouraged to align, not required. The Global AI Hub Law was put out for public consultation by the Communications, Space and Technology Commission (CST) between April 14 and May 14, 2025; more than a year later it remains a draft awaiting publication in the official gazette.
In other words, the speech in Geneva described an architecture that is at least one statute and one private-sector mandate short of being a "model." International partners weighing whether to host data in a Saudi hub, or whether to align procurement with SDAIA's frameworks, are entitled to know that the binding pieces are still pending.
The accountability gap that matters most
The deeper question is whether the principles SDAIA exports apply to the Saudi state itself. The Ethics Principles' "humanity" pillar commits to AI that respects human dignity and rights. Yet on May 20, 2026, Access Now and a coalition of partners reported that since April 30, 2026, Meta has restricted more than 100 Facebook pages and Instagram accounts from reaching audiences in Saudi Arabia and the UAE at government request, including those of NGOs such as ALQST. On May 12, the Electronic Frontier Foundation launched a renewed campaign for the imprisoned Saudi Wikipedian Osama Khalid. These are not AI-decision cases on their face, but they go directly to whether the same transparency and accountability standards SDAIA is pitching to the UN apply to the state. The "Saudi model," if it is to travel, has to answer that.
What a credible export would look like
The pro-innovation read is not that Saudi Arabia should abandon soft law and rush a heavy AI statute. Three steps would let SDAIA's pitch land harder without sacrificing flexibility:
- Finalise the Global AI Hub Law as actual law, with clear judicial-review pathways — without those, a "data embassy" promise is only as strong as the next executive order.
- Extend at least the audit and incident-reporting elements of the AI Adoption Framework to high-risk private deployments, on a proportionate, risk-based basis rather than across the board.
- Apply the Ethics Principles to state use of AI in security and content-moderation contexts, with public reporting on government requests to platforms.
The capacity story is real: Saudi AI firms have raised roughly $9.1 billion and more than a million people have been trained through the SAMAI programme. The credibility story will be made or lost on whether SDAIA's binding architecture catches up with its branding before the next CSTD session.