SDAIA AI Ethics Principles and Generative AI Guidelines

Before entering the Saudi market, tier each AI system against the “Scope” section of the AI Ethics Principles: little or no risk, limited risk, high risk, unacceptable risk. For systems assessed as high risk the document requires pre- and post-conformity assessments and compliance with the relevant statutory requirements in addition to ethics. Uses falling into the unacceptable tier — social profiling, exploitation of children, likely distortion of behaviour — must not be deployed. Record the tiering conclusion and reasoning in the product compliance file and re-assess on functional change.

Applies when

Providers and deployers developing, deploying or supplying AI systems in Saudi Arabia, including Chinese vendors entering indirectly through a local partner.

Evidence to retain

• · Risk tiering worksheet (system, use case, tier, reasoning)
• · Pre-deployment conformity assessment report for high-risk systems
• · Post-deployment monitoring and post-conformity assessment records
• · Excluded-use list for the unacceptable tier and technical evidence of enforcement in the product

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Map the seven principles — Fairness, Privacy & Security, Humanity, Social & Environmental Benefits, Reliability & Safety, Transparency & Explainability, and Accountability & Responsibility — onto concrete controls in the four lifecycle stages: plan and design, prepare input data, build and validate, deploy and monitor. Under Humanity the document requires the model to be designed and built on fundamental human rights and Saudi cultural values, and requires designers to define how the system and its outcomes align with them. Under Fairness it requires fairness-aware design to start at the beginning of the lifecycle as a collaborative effort. Under Privacy & Security it sets the specific controls described above (no personally identifying characteristics as automated decision criteria; profiling only with compliance-officer approval or under a sector regulator’s code; data classification and profiling planned at the data architecture stage; de-identification planned for sensitive or personal data with group-based read/write/update authorisation). Each control needs an owner, execution evidence and a review cycle.

Applies when

Vendors delivering AI systems to Saudi government, state-owned enterprises or large corporates; these controls are routinely written into technical proposals and acceptance criteria.

Evidence to retain

• · Control mapping from the seven principles to the four lifecycle stages, with owners and review cycles
• · Fairness assessment reports and bias mitigation records
• · Compliance approval record for profiling use cases (compliance officer sign-off or reference to a sector regulator’s code)
• · De-identification design, data classification output and the group-based authorisation matrix

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

The Generative AI Guidelines for the Public apply to all stakeholders designing, developing, deploying, implementing, using or affected by GenAI systems within the Kingdom. They distinguish “Users” (any natural or legal person consuming or making use of goods or services produced by GenAI systems, covering companies, NGOs and individuals) from “Developers” (any natural or legal person developing GenAI systems to achieve certain goals, including AI developers, data scientists and researchers), and set out GenAI principles, risks and potential mitigations. Build a Saudi-facing GenAI risk register on that basis: map each risk the guidance lists onto your product, state the mitigations adopted and the residual risk, and reflect them in user terms and in-product notices. SDAIA also publishes a government edition of the GenAI guidance and a deepfakes document; align to those as well when delivering to government customers.

Applies when

Developers and deployers offering LLM APIs, conversational assistants, content generation, voice synthesis or image/video generation in Saudi Arabia; deepfake-adjacent capabilities additionally need to align to SDAIA’s deepfakes document.

Evidence to retain

• · GenAI risk register (risk, mitigation, residual risk, owner)
• · Technical note and test records for content safety and abuse prevention
• · User terms, acceptable use policy and in-product notices
• · Alignment note against the government edition of the guidance for public-sector deliveries

Estimated first-time effort: 6–15 person-days (estimate, not a commitment)