AI security and governance for Saudi enterprises
Saudi Arabia enforces. The Personal Data Protection Law has been fully enforceable since September 2024 and SDAIA has published formal enforcement decisions across sectors. Kapālins gives Saudi banks, government entities and Vision 2030 programmes proof that every AI they run handles data as approved.
What changes for Saudi Arabia enterprises, and when.
SDAIA's enforcement committees had issued 48 formal PDPL decisions by early 2026, with fines up to SAR 5 million and doubled for repeat violations. SAMA's Cyber Security Framework and the NCA's Essential Cybersecurity Controls already bind the sectors adopting AI fastest. There is no AI-specific statute yet, which means the PDPL is the AI law in practice, and every copilot that reads customer data is in scope.
- In force
Saudi PDPL fully enforceable after the grace period. The baseline every AI deployment is measured against. Source (secondary)
- In force
SDAIA enforcement committees reach 48 formal PDPL decisions. Enforcement is active, not theoretical. Fines up to SAR 5 million, doubled for repeat violations. Source (secondary)
Dates: each entry links to its source. A source marked secondary is a law firm, analyst or vendor summary; check the primary text before relying on the date. The full calendar is on the AI regulation tracker.
Mapped on the platform for Saudi Arabia.
Also mapped at onboarding: Saudi PDPL, SAMA CSF and NCA ECC are mapped to your controls at onboarding; they are not yet published as framework pages.
Every framework page says which controls are proved by a live signal from the gateway, probes or device sensor, and which by assessment evidence. Both are exported in the regulator evidence pack.
Hosting and residency.
Today the platform and its data are hosted in Australia. A Sovereign plan for on-premises or air-gapped deployment, designed for government, defence and tier-1 financial services, is announced as coming soon.
Industries and cities.
Questions buyers in Saudi Arabia ask.
Is Kapālins available in Saudi Arabia?
Yes. Kapālins is delivered remotely from Melbourne, Australia, and through partners in the Authorised, Premier and Elite tiers. Organisations in Riyadh, Jeddah are served in the same way: a briefing on your own estate, then onboarding.
Which Saudi Arabia frameworks does the platform map?
ISO/IEC 42001, ISO/IEC 27001, SOC 2, OWASP LLM Top 10, NIST AI RMF. Each framework page lists the controls mapped and whether a control is proved by a live platform signal or by assessment evidence. Saudi PDPL, SAMA CSF and NCA ECC are mapped to your controls at onboarding; they are not yet published as framework pages.
Where is our data hosted?
Today the platform and its data are hosted in Australia. A Sovereign plan for on-premises or air-gapped deployment, designed for government, defence and tier-1 financial services, is announced as coming soon.
Does Saudi Arabia have an AI law?
Not a binding AI-specific statute as of mid-2026. SDAIA's AI guidelines are non-binding unless connected to other laws, which is why the PDPL, SAMA CSF and NCA ECC are the frameworks that govern AI in practice and the ones mapped at onboarding.