4 instrument(s) held in this jurisdiction, each cited to its official text. What an instrument says — not whether it reaches you.
General personal-data law reaching AI systems that process personal data. Issued by Royal Decree M/19, amended by Royal Decree M/148, effective 14 September 2023 with a one-year compliance grace period that ended 14 September 2024.
Implements the Personal Data Protection Law: definitions, lawful processing, direct marketing, personal data breach handling and controller obligations.
Market-risk capital framework. Its 'Model validation standards' section sets validation expectations for internal models used to calculate regulatory market-risk capital. It is not an AI-specific instrument: SAMA has issued no AI-specific model risk guidance as at August 2026.
National AI ethics principles with a four-tier risk scope — little or no risk (unrestricted), limited risk (principles apply), high risk (pre- and post-conformity assessments plus statutory requirements) and unacceptable risk (not allowed) — and controls mapped across a four-stage AI system lifecycle.