Saudi Arabia's AI framework is mandatory for the public sector

SDAIA released an AI Adoption Framework in November 2025 that sets a mandatory baseline for how Saudi public sector entities adopt and govern artificial intelligence. It covers five pillars: data governance, model accountability, transparency, human oversight and risk management. Saudi Arabia has separately declared 2026 its official Year of AI , and has opened public consultation on a draft Responsible AI Policy with submissions due by 3 May 2026 — a move from stated principles toward operational rules. Mandatory is the operative word. Most national AI frameworks are advisory. They describe good practice, invite adoption, and are followed by the organisations that were going to follow them anyway. A mandatory baseline for the public sector is a different instrument, particularly in a country where the public sector is the dominant technology buyer. If a ministry cannot deploy a model without satisfying five governance pillars, then every vendor selling to that ministry has to satisfy them too. The framework reaches the private sector through procurement rather than through direct regulation. That is the more efficient route in Saudi Arabia specifically, because of how much of the technology market runs through government and government-linked entities. The framework is also aligned to Saudi Arabia's Personal Data Protection Law, which means AI governance obligations and data protection obligations are converging into a single compliance programme rather than running as two. The PDPL is not a paper regime. It is fully enforced, actively investigated, and carries penalties of up to SAR 5m per breach. For an organisation deploying AI in the Kingdom, the practical consequence is that model governance failures can surface as data protection breaches with a real financial number attached. The two frameworks share a regulator, and that regulator has enforcement history. The draft Responsible AI Policy is where the private-sector perimeter gets drawn. The Adoption Framework binds public entities; the policy under consultation is the instrument that could extend obligations more broadly. Companies with a view on where that line should sit had until 3 May 2026 to say so through the consultation. For those that did not file, the published policy will be the first sight of where it landed — which, given how directly the PDPL's penalties attach, is worth planning around early.