Saudi Arabia's AI regulation now has a shared rulebook for risk. The Saudi Data and AI Authority (SDAIA) has issued a National AI Risk Management Framework that gives government bodies and private companies one method to identify, assess, treat and monitor the risks of the AI they build or use. For brands and agencies running AI work in Saudi campaigns, it is a clear signal of what good practice looks like: know your tools, know your data, and be ready to show your working.
We are iklipse, a creative and AI production agency working across the GCC, Egypt, North Africa and the US, and a good share of our AI production lands on Saudi screens. Here is what the framework says, what it leaves open, and what we think marketing teams should do about it.
Here is what SDAIA's framework actually covers.
SDAIA launched the framework in July 2026, and Arab News reported on it again at the end of September as the Kingdom pushed adoption in what it has named its Year of AI. The framework is meant as a national reference for both the public and private sectors, at any level of digital maturity.
It works in four stages:
- Define the context and scope of the AI system.
- Identify and assess its risks.
- Treat those risks.
- Keep monitoring and reviewing the system over time.
Risk levels come from a matrix that weighs how likely a problem is against how much damage it would do, so teams can rank what to fix first. The framework sorts AI risks into seven main categories and rests on seven principles: integrity and fairness, privacy and security, humanity, reliability and safety, transparency and explainability, accountability and responsibility, and social and environmental benefit.
SDAIA also explains why AI needs its own approach. Its risks can appear unexpectedly once a system is running, performance can drift over time, and behaviour can be hard to explain or reproduce. Anyone who has asked an image model for the same shot twice will recognise that last point.
What the framework does not spell out yet.
The public coverage does not say whether the framework is mandatory, and it does not set fines. It is also a general risk method, so it does not contain advertising rules. We would treat it as the standard a Saudi client, regulator or procurement team will measure you against, whatever its legal status turns out to be.
The framework sits on top of rules that already touch advertising.
For marketers, the risk framework matters most alongside two things SDAIA already has in place. The first is the Personal Data Protection Law, which governs how personal data is collected and used. The second is SDAIA's Deepfakes Guidelines, updated in May 2026, which ask creators to get explicit consent before using anyone's likeness, keep auditable consent records, and put visible watermarks on synthetic content. Fraud, impersonation and defamation through deepfakes are banned outright.
Put together, the direction is plain. If AI touches a real person's face, voice or data in a Saudi campaign, someone should be able to show who agreed to it and how the result is marked.
Here is what this means for brands using AI in Saudi campaigns.
Most brand teams will never fill in a risk matrix for a model. Their agencies and vendors will, and the questions will travel up the chain. These are the ones we expect to hear more often in Riyadh and Jeddah briefs.
Which tools made this, and on what data?
The framework treats data and third parties as real sources of risk, since most AI work runs on outside models and software. Keep a simple log for each campaign: the tools used, whether any client or customer data went into them, and where the files live. It takes ten minutes per project and saves a week of digging later.
Whose face and voice is on screen?
Synthetic presenters, cloned voices and digital twins of talent need written consent that covers AI use, the markets and the time period. A standard talent release usually does not. Fix the paperwork before the shoot.
How will viewers know it is AI?
Transparency is one of the seven principles, and the deepfake guidelines ask for visible marks on synthetic content. We covered when and how to label AI in our post on AI disclosure in ads. The short version: if a viewer could mistake an AI person or event for a real one, tell them.
Is the AI implying a result that is not real?
This is the line we drew in our post on responsible AI in advertising. AI for sets, light and a premium look is fair. AI that fakes a product result, a customer or a testimonial creates exactly the integrity and accountability risk the framework is built to catch.
This is how we run AI production for Saudi clients.
Our AI Production team works with human creative direction at every step, and that makes the framework easier to follow because a person signs off each choice. On Toyota's Saudi National Day film with Abdul Latif Jameel, produced with NaF+, we built the children's imagined worlds and transitions with AI, and every frame was delivered in line with Toyota, ALJ and Saudi advertising guidelines. You can see the work at Toyota | Saudi National Day.
If your team is planning AI work for the Kingdom and wants a tool log, consent check and labelling plan built into the production, talk to us.
Frequently asked questions about Saudi AI regulation.
Who issued Saudi Arabia's AI risk framework?
The Saudi Data and AI Authority (SDAIA), the Kingdom's lead body for data and AI matters. It launched the National AI Risk Management Framework in July 2026.
Does the framework apply to private companies?
Yes. It is written for both government entities and private organisations, across every sector and level of digital maturity.
Is the framework mandatory?
The public reporting does not say, and no fines have been announced. Separate laws such as the Personal Data Protection Law do carry legal duties, so brands should treat the framework as the expected standard.
Do I need consent to use AI versions of real people in Saudi ads?
SDAIA's Deepfakes Guidelines ask creators to get explicit consent before using anyone's likeness and to keep records of it. Treat it as required.
Sources: Arab News, Saudi Press Agency, Gowling WLG, SDAIA Deepfakes Guidelines as reported by Arab News. Cover image: B.alotaby, Wikimedia Commons, CC BY-SA 4.0.
