Saudi Arabia Unveils Draft AI Law: A Framework for Global Tech Collaboration

In the Kingdom of Saudi Arabia (KSA) the Communication, Space & Technology Commission (CST) has issued a new draft law on artificial intelligence (“Draft Law”), aimed at positioning KSA as a hub for the development of AI systems. The Draft Law seeks to foster a collaborative environment where foreign governments and private entities can develop and adopt advanced technologies for peaceful purposes. Additionally, the Draft Law leverages KSA’s strategic geographic location to promote sustainable technology solutions, enhance global digital accessibility, and drive innovation, entrepreneurship, and research within the digital economy.

The Draft Law is currently open for public consultation for a period of one month, with the consultation window starting on April 14, 2025, and closing on May 14, 2025.

Key Highlights:

Private Hubs (Art. 3–4)

• Establishment. Requires legal compliance and bilateral agreements with guest countries.
• Operation. Guest countries are fully responsible for managing the operations of the hubs while ensuring compliance with all requirements and compatibility with the Draft Law. KSA provides protection and necessary resources. Operations must follow international laws and not compromise KSA’s infrastructure or digital goals.
• Emergency Access. Local authorities may intervene during emergencies.

Extended Hubs (Art. 5–6)

• Establishment. Requires formal agreements with both, guest countries and third-party operators, subject to approval by the competent authority.
• Operation. Operators are fully responsible for managing the hubs and must adhere to applicable laws, international standards, and best practices in data protection and cybersecurity. Guest countries must ensure compliance by their operators. Provisions applicable to Private Hubs also apply unless otherwise agreed.
• Jurisdiction. Operators outside the Extended Hub remain subject to KSA’s laws unless specifically exempted.

Virtual Hubs (Art. 7–8)

• Establishment. Operated by approved service providers under agreements granting data sovereignty to designated foreign states or other relevant authorities.
• Operation. Data is governed by the laws of the designated foreign states in which the customer is domiciled or incorporated.
• Jurisdiction. to be handled by that state’s authorities, which shall exercise appropriate oversight, investigation and enforcement powers in respect of the customer content.

Termination (Art. 9)

• Agreements or approvals can be revoked to protect national interests or due to diplomatic issues.
• Privileges granted shall continue to be applicable in respect of any Private Hub or Extended Hub for the period specified in the relevant bilateral agreement with such guest country; as for Virtual Hubs transitional periods apply post-termination (e.g., 120 days for Virtual Hubs).

Role of the Competent Authority (Art. 10)

• Oversees implementation, compliance, and coordination of agreements.
• Has the authority to recommend and manage terminations or modifications under national or diplomatic considerations.

David Yates, Partner and Head of Digital & Data, and Christine El Khoury, Senior Counsel, Digital & Data, are available to provide further insights and guidance on this subject.