The Year of AI: the rules that already govern your AI systems

On 10 March 2026 the Council of Ministers designated 2026 the Year of Artificial Intelligence. The designation sets a national priority; it is not a new statute. The Kingdom has no single AI law, and the draft Global AI Hub Law, put to public consultation by the Communications, Space and Technology Commission in April 2025, deals with hosting data and digital services for foreign states rather than with how AI systems behave. At the time of writing it has not been issued in final form.

The binding rules come from existing law. The Personal Data Protection Law, in force since 14 September 2023, applies whenever a model is trained on, or makes decisions about, personal data: a lawful basis, purpose limitation, data subject rights and, for transfers outside the Kingdom, the safeguards in SDAIA's transfer regulation. SDAIA's AI Ethics Principles and generative AI guidelines are not binding on the private sector, but regulators and counterparties increasingly treat them as the benchmark.

The new Copyright Law, in force since 12 August 2026, adds rules written for AI. It permits works to be copied to develop AI products and algorithms, subject to conditions that protect rights holders. It also makes software licences enforceable by statute and gives the employer, unless agreed otherwise, the rights in works an employee creates in the course of the employer's business. Both matter to anyone building or buying models.

For boards the practical test is unchanged. For each material AI system, can the company say what data it uses and on what legal basis, who owns its outputs, and how a wrong decision is detected and remedied? Development, licensing and cloud agreements should answer the same questions before the system reaches customers.