AI & Data Governance
We help organisations move from an AI idea to an accountable deployment: identify the decision and data at stake, classify the risk, test the supplier, allocate responsibility in the contract, and preserve a record that management can defend.
The legal question begins with the decision
“Using AI” is not a useful legal category on its own. A drafting assistant, recruitment screen, fraud model, customer chatbot and medical decision tool create different consequences. The first task is to describe the use case precisely: what the system receives, what it produces, who relies on the result, and what happens if it is wrong.
That description determines the review. Personal data may bring the PDPL into scope. Hosted processing may require cloud and transfer analysis. A regulated activity may carry sector conditions. Confidential material, third-party works and generated output raise ownership and use questions. Integration and access design engage cybersecurity controls.
A deployment file that management can use
We structure AI governance around a decision record, not a generic policy. The record should identify the business owner, approved purpose, affected people, data sources, supplier, material risks, controls, residual risk and approval authority. It should be updated when the model, data, purpose or supplier changes.
For higher-impact uses, the organisation should be able to show why automation is appropriate, where human review occurs, how exceptions are escalated, and how a person can challenge or correct an outcome. A policy without this operating evidence is incomplete.
Procurement is where accountability becomes enforceable
Supplier diligence and contracting should test the claims on which the deployment depends. Relevant issues include data retention, training on customer inputs, subprocessors, hosting location, cross-border access, security evidence, model updates, output restrictions, performance commitments, incident notification, regulatory cooperation, audit rights and termination assistance.
The contract should distinguish between the supplier’s platform risk and the customer’s use-case risk. Broad disclaimers or a promise of “responsible AI” do not resolve that allocation.
Our work
We advise on AI use-case inventories and classification, governance frameworks, procurement and vendor diligence, privacy impact analysis, data and IP rights, acceptable-use rules, contract negotiation, board and management reporting, incident preparation and review of higher-impact deployments. The same governance method can support connected products and emerging technologies, but the applicable Saudi instrument is mapped separately for each activity.
Saudi authority basis
SDAIA publishes the National AI Risk Management Framework (2026) and AI Ethics Principles. We describe those materials according to their official status and do not present them as a comprehensive AI statute. Where personal data is processed, the separate Personal Data Protection Law and implementing instruments are analysed on their own terms.
Frequently asked questions
Is there a single Saudi AI law?
AI deployments can engage several instruments rather than one comprehensive statute. The applicable framework depends on the data, sector, use case, decision impact, contracting model and cybersecurity perimeter.
What should an AI procurement review cover?
At minimum: intended use, prohibited uses, training and input data, output ownership, confidentiality, security, localisation and transfers, model changes, audit evidence, human oversight, incident support and exit.
Does the PDPL apply to an AI system?
It applies where the system processes personal data. The organisation must still identify its lawful basis, transparency duties, processor arrangements, transfer position, security measures and data-subject rights.
Who should own AI governance inside a company?
Accountability should be assigned across management, legal, privacy, security, procurement and the relevant business owner. The allocation should be documented rather than left implicit.
Tell us about your matter.
A few sentences are enough. We aim to respond within one business day. Please leave out confidential details at this stage.