AI development in Saudi Arabia: PDPL, data residency and Arabic models (2026).
What Saudi companies need to know before building an AI system: the Personal Data Protection Law, transfer and localisation rules, Arabic-first models, and what to ask a partner.
Building an AI system for a Saudi company means designing for the Personal Data Protection Law from day one. The PDPL has been fully enforceable since 14 September 2024, with fines of up to SAR 5 million. It also means knowing early where your data may be processed, because cross-border transfers and, in some sectors, localisation rules shape which models and hosting you can use.
This guide sets out the rules, the choices they force and the questions to ask a development partner.
The PDPL in brief
- Timeline. The law came into force on 14 September 2023 with a one-year grace period. It has been fully enforceable since 14 September 2024.
- Regulator. The Saudi Data and AI Authority (SDAIA) supervises it. Sector regulators such as the Saudi Central Bank (SAMA) add their own requirements for the companies they regulate.
- Penalties. Administrative fines go up to SAR 5 million, doubling for repeat offences. Disclosing sensitive data with intent to harm carries up to two years in prison and a fine of up to SAR 3 million.
- Transfers abroad. The regulation on transferring personal data outside the Kingdom was amended in September 2024. Transfers can rely on safeguards such as standard contractual clauses, backed by a risk assessment, and SDAIA published a guideline on transfer risk assessments in 2025.
For an AI system, the practical consequences are a documented purpose for each kind of data it uses, data minimisation in what it retrieves and logs, and a clear record of which providers process data and where.
Data residency: when data has to stay in the Kingdom
The PDPL doesn’t ban sending data abroad, but other rules can require local hosting. The National Cybersecurity Authority’s Cloud Cybersecurity Controls were updated in 2024 to reflect data localisation requirements. Government bodies, critical sectors and regulated financial institutions face the strictest rules. Read the controls for your sector before you commit to a model provider or a hosting region.
This is the choice that most shapes the architecture:
| Option | Fits when | Trade-off |
|---|---|---|
| International model API with transfer safeguards | Non-sensitive data, sectors without localisation rules | Fastest to build; transfer assessment required |
| Model hosted in an in-Kingdom cloud region | Data must stay local but you want a managed service | Fewer model choices; check what each region offers |
| Open-weight model on your own infrastructure | Strictest requirements, or full control needed | Most engineering and operations work |
Build the system so the model behind it can change. Rules and regional availability are both moving, and a design tied to one provider makes every change a rebuild.
Arabic-first models are an option
Saudi Arabia has its own large language model, ALLaM, developed by SDAIA and now offered through HUMAIN. HUMAIN is the AI company launched by the Public Investment Fund in May 2025 and chaired by the Crown Prince, working across data centres, cloud and models. The UAE’s Jais and Falcon models are also strong in Arabic. International models handle Arabic well too. The right choice depends on your hosting requirement and on scores from your own evaluation set, with Saudi dialect, Modern Standard Arabic and mixed Arabic-English messages all represented.
WhatsApp is usually the channel
For customer-facing agents, WhatsApp is the channel that matters most. Figures reported from the Communications, Space and Technology Commission’s Saudi Internet 2025 report put WhatsApp use above 90% of internet users. An agent there should handle Arabic and English, work within Meta’s rules for business AI, and hand over to a person with the full conversation. Our WhatsApp sales agent write-up shows how one works in production.
Vision 2030 and the national AI strategy
The National Strategy for Data and AI aims to place the Kingdom among the top 15 countries in AI by 2030, attract around SAR 75 billion of investment, and train 20,000 data and AI specialists. SDAIA has also published AI ethics principles. For companies selling into government and the giga-projects, expect tenders to ask about data residency, Arabic capability, explainability and governance. The engineering habits that answer those questions (evaluation sets, logging, human oversight and documentation) are worth building in anyway.
What to ask a development partner
- Where will our data be processed? Name the providers and regions for each component, and say whether any of it leaves the Kingdom.
- How will you test Arabic? With a test set drawn from real messages, in dialect and Modern Standard Arabic, scored on every change.
- Can the model be swapped for a locally hosted one if our requirements change?
- What does the system log, and how long are logs kept? Logs often contain personal data too.
- What can it do without a person? Set the limits on what an agent can commit to, and the route to a human when it’s unsure.
Questions Saudi buyers ask
Can we use ChatGPT, Claude or Gemini for a customer assistant?
Often yes, through their business APIs with transfer safeguards in place, if your sector has no localisation requirement and the data isn’t sensitive. Regulated sectors should confirm with their regulator’s rules first.
Does the PDPL cover data that’s only processed by an AI model?
Yes. Personal data in prompts, retrieved documents and logs is processed like any other personal data.
How long does a project take?
A focused assistant or agent typically takes six to ten weeks. Add time where in-Kingdom hosting or a regulator’s review is needed.
Modulus Labs AI builds AI agents, assistants and the apps around them for companies in Saudi Arabia and across the Gulf. Tell us about the project, and we’ll reply within one business day.