Zeyad Y. AlSalloum
Partner

Zeyad Y. AlSalloum is a Partner at STAT with over 15 years of experience advising private sector and government clients across diverse practice areas. He specializes in large, complex transactional and regulatory projects spanning energy, infrastructure, healthcare, transportation, and financial regulations. His corporate expertise encompasses joint ventures, commercial agreements, debt capital markets issuances, and corporate governance structuring. Zeyad’s representative experience includes advising Saudi Aramco on major infrastructure and regulatory matters, and representing the Saudi Real Estate Refinancing Company on its Sukuk issuances and corporate governance. He has also advised prominent entities such as the Saudi Central Bank, Riyadh Airports Company, and the Royal Commission for AlUla. Zeyad holds an LLB (Hons) from the University of Westminster, UK, and is recognized for his strategic counsel on high-profile public-private partnerships and transformative national projects in the Kingdom of Saudi Arabia.

Richard Blackburn
Senior Counsel

Richard Blackburn is a Senior Counsel at STAT, bringing extensive expertise in conventional and Islamic banking and finance. A qualified lawyer in England & Wales, Richard advises international and regional banks, funds, and corporates on a broad spectrum of matters, including Sukuk issuances, derivatives, finance-linked hedging, structured note programmes, margin loans, and securitisation. His distinguished career includes practice in London at leading global firms such as White & Case LLP, Norton Rose Fulbright LLP, and Simmons & Simmons LLP, alongside secondments with major investment banks. Legal 500 has recognized Richard for his significant experience advising on OTC derivatives and structured products, noting him as “responsive and helpful.” His recent representative work includes acting as arranger for substantial Sukuk issuance programmes and advising global financial institutions on complex hedging, credit-linked notes, and major infrastructure financing transactions.

Abdullatif Alharbi
Associate

Abdullatif Alharbi is an Associate at STAT specializing in banking law and debt capital markets. A licensed lawyer in Saudi Arabia admitted by the Ministry of Justice and a member of the Saudi Arabian Bar Association, Abdullatif brings specialized regulatory expertise to the firm. He previously served at the Saudi Central Bank (SAMA), where he provided strategic advice on critical regulatory matters within the banking sector. Prior to his tenure at SAMA, he advised diverse corporate and governmental clients on a wide range of complex mandates, including corporate and real estate finance, investment-grade lending, and Sukuk issuances. Abdullatif holds an LL.M. from Boston University, USA, and an LL.B. from Qassim University, Saudi Arabia. His unique background, combining central bank experience with private practice, allows him to provide nuanced counsel on the evolving financial regulatory landscape in the Kingdom.

ARTIFICIAL INTELLIGENCE IN SAUDI ARABIA’S FINANCIAL SECTOR: REGULATORY FRAMEWORK, GOVERNANCE AND EMERGING DEVELOPMENTS

Introduction

The Kingdom of Saudi Arabia has positioned artificial intelligence (AI) as a cornerstone of its national economic transformation. In a signal of the highest level of political commitment, the Council of Ministers designated 2026 as the ‘Year of Artificial Intelligence’, an acknowledgment that AI is foundational infrastructure to be built, regulated and leveraged across every sector of the economy, with financial services at the centre of that ambition.¹Council of Ministers Decision No. 720 dated 21 Ramadan 1447H (10 March 2026), published in Umm Al-Qura No. 5150 (19 March 2026).

From national banks deploying real-time fraud detection systems to fintech startups offering AI-driven credit scoring and from robo-advisory platforms managing investment portfolios to insurtech firms pricing risk through machine learning, the pace and breadth of AI adoption in Saudi financial services is significant. At the same time, a regulatory framework is beginning to take shape, one that seeks to enable innovation while protecting financial system stability, consumer rights and national data.

Saudi Arabia does not currently regulate financial-sector AI through a single, comprehensive statute. Instead, the framework combines laws and guidance administered by the Saudi Data and AI Authority (SDAIA), the National Cybersecurity Authority (NCA) and the Communications, Space & Technology Commission (CST) with sectoral requirements imposed by the Capital Market Authority (CMA), the Saudi Central Bank (SAMA) and the Insurance Authority. The legal status of these instruments differs: some are binding laws or sector rules; others are official principles, frameworks or consultation drafts. Financial institutions should identify the source and status of each requirement rather than treating the framework as a single AI rulebook.

This article maps the regulatory framework across its three principal pillars, the national framework under SDAIA, the capital markets framework of the CMA and the banking, payments and insurance frameworks of SAMA and the Insurance Authority, and examines the principal AI use cases, governance obligations, emerging risks and key developments that financial institutions operating in the Kingdom must understand.

2. National Strategy and Policy Framework

Saudi Arabia’s approach is shaped by Vision 2030, the National Strategy for Data and Artificial Intelligence (NSDAI) and the Financial Sector Development Program (FSDP). Although these initiatives are not themselves regulatory instruments, they establish the policy objectives that underpin the Kingdom’s AI governance agenda, including the adoption of AI across the economy.

2.1 Vision 2030 and the NSDAI

Saudi Arabia’s AI ambitions are inseparable from Vision 2030, the Kingdom’s programme for economic diversification. At its heart sits the National Strategy for Data and Artificial Intelligence (NSDAI), which articulates the Kingdom’s goal of becoming a global leader in AI by 2030 and identifies priority sectors for AI deployment, including education, government, healthcare, energy and transportation. Although financial services is not identified as a standalone priority sector, the NSDAI provides the strategic foundation for the development of AI across the financial system through complementary initiatives led by SAMA, the CMA and the Financial Sector Development Program.²SDAIA, National Strategy for Data and Artificial Intelligence (NSDAI, sdaia.gov.sa)

The designation of 2026 as the “Year of Artificial Intelligence” further illustrates the Government’s commitment to accelerating AI adoption across both the public and private sectors.³Council of Ministers Decision No. 720 dated 21 Ramadan 1447H (10 March 2026), published in Umm Al-Qura No. 5150 (19 March 2026).

2.2 The Financial Sector Development Program (FSDP)

Launched in 2018 by the Council of Economic and Development Affairs (CEDA) as one of Vision 2030’s Vision Realization Programs, the Financial Sector Development Program (FSDP) is the primary vehicle through which Saudi Arabia is building a diversified, effective and digitally-enabled financial sector. It operates through four strategic objectives: enabling financial institutions to support private sector growth; developing an advanced capital market; promoting and enabling financial planning (savings and retirement); and enabling the FinTech strategy.⁴FSDP Programme Charter 2020–2025, vision2030.gov.sa

Although the FSDP is not an AI regulatory framework, many of its initiatives (managed in partnership with SAMA, the CMA and the Insurance Authority) provide the practical foundations upon which AI-enabled financial services depend. The licensing of digital banks, implementation of the Kingdom’s FinTech strategy, expansion of electronic know-your-customer (eKYC) processes and rapid growth in digital payments have created the digital infrastructure and data environment necessary for AI applications such as fraud detection, credit scoring, automated investment advice and anti-money laundering systems.

The FSDP’s 2024 Annual Report recorded 261 active fintech entities at year-end and electronic payments representing 79% of retail transactions during 2024. Its Q4 2024 newsletter reported that 98.88% of investment accounts were opened through eKYC.⁵Financial Sector Development Program, Annual Report 2024; FSDP Quarterly Newsletter, Q4 2024 More recently, the CMA reported that assets under management through fintech platforms increased by 87%, from SAR 3.43 billion in Q4 2024 to SAR 6.41 billion in Q4 2025. These developments demonstrate the scale and continuing growth of the digital infrastructure on which AI-enabled financial services can be deployed.⁶Capital Market Authority, ‘The Capital Market Authority Approves the Regulation of Robo-Advisory Services’ (5 March 2026).

3. The Regulatory Framework: A Hybrid Model

The current framework has two principal layers. At national level, SDAIA’s rules and guidance address data protection and AI ethics, the NCA’s requirements address cybersecurity, and CST rules govern cloud, datacentre and ICT infrastructure. Sectoral regulators such as CMA and SAMA apply licensing, governance, conduct, technology, outsourcing and operational-risk requirements to AI-enabled activities within their respective remits. The application of a particular rule therefore depends on the regulated entity, the activity, the data used and the way the technology is hosted or supplied.

Financial institutions deploying AI should also consider the National Cybersecurity Authority’s (NCA) cybersecurity requirements and Communications, Space & Technology Commission (CST) rules governing cloud, data centre and ICT infrastructure, particularly where AI systems are hosted or accessed through third-party cloud environments.

In practical terms, fraud detection engages SAMA’s counter-fraud and cybersecurity requirements, the NCA controls and the PDPL; credit scoring engages SAMA’s conduct and risk-management rules together with the PDPL and, where triggered, a DPIA; robo-advisory is governed principally by the CMA rules discussed below; and insurtech falls within the Insurance Authority’s remit together with applicable data, cybersecurity and outsourcing requirements.

3.1 Pillar One: SDAIA — The National Framework for AI Governance and Data Protection

Established by Royal Order in 2019, SDAIA is the apex national authority for data and AI policy. SDAIA’s published AI ethics principles and related guidance set out recommended governance standards for all institutions in the Kingdom, including financial services firms that design, develop, deploy or use AI systems. Version 2.0 of the AI Ethics Principles comprises seven principles. The following are the three principles most relevant to financial institutions:⁷SDAIA, AI Ethics Principles, version 2.0 (September 2023).

• Fairness and Inclusivity: Institutions should take steps to prevent bias and discrimination in the datasets on which predictive AI models are built, particularly in credit scoring and insurance pricing;
• Transparency and Accountability: AI systems should be explainable and interpretable, with mechanisms that allow individuals to trace and contest AI-driven decisions affecting their interests; and
• Pre-Deployment Assessment: Institutions should assess bias and privacy risks before deploying predictive AI models. A DPIA is mandatory only where the trigger under the PDPL Implementing Regulations is met.

SDAIA’s Generative Artificial Intelligence Guidelines for the Public (January 2024) recommend, in section 5.1, that providers supplying intensive cloud compute, particularly GPU or TPU capacity, use identity-verification processes similar to those used by financial institutions. This is non-binding guidance rather than a mandatory KYC obligation.⁸SDAIA, Generative Artificial Intelligence Guidelines for the Public, version 1.0 (January 2024), section 5.1, p. 11.

SDAIA’s National Artificial Intelligence Risk Management Framework (SDAIA-P145, version 1.0, April 2026) provides a methodology for identifying, assessing, mitigating, monitoring and reviewing AI risks across public- and private-sector organisations. It addresses risks distinct from conventional software, including emergent behaviour, model drift, limited explainability and difficulty reproducing outputs. The Framework is advisory and expressly creates no new obligations, but provides a national benchmark that may inform risk-management practices in regulated sectors.⁹SDAIA, National Artificial Intelligence Risk Management Framework, SDAIA-P145, version 1.0 (April 2026).

The principles are an important governance framework of universal application, but their status and application should be distinguished from obligations arising under the Personal Data Protection Law (PDPL) which applies where an AI system processes personal data and binding sector rules. Relevant requirements include establishing a lawful basis for data processing, complying with purpose limitations and data minimisation, protecting data-subject rights, implementing appropriate security and conducting a data protection impact assessment where the applicable conditions are met.¹⁰PDPL, Royal Decree M/19, 2021; SDAIA enforcement activity 2025

3.2 Pillar Two: The Capital Market Authority (CMA)

The CMA has moved earliest among the sectoral regulators to address a specific AI-enabled financial service. It does not currently regulate AI through a dedicated framework, but through existing capital-markets legislation and the targeted robo-advisory amendments described below.

Robo-Advisor Regulations

In March 2026, the CMA approved amendments governing robo-advisory services. Following implementation of such amendments, the Capital Market Institutions Regulations now permit licensed investment management firms to offer robo-advisory services, defined as the use of algorithms to manage client investments with no or limited human intervention. Key conditions include:¹¹CMA, ‘CMA Approves Regulation of Robo-Advisory Services’ (5 March 2026); Capital Market Institutions Regulations, Annex 3.2, paragraph 8, and articles 19(b)(8), 20(b)(5) and 55(e).

• Advance notification: Portfolio-construction and management strategies, and material updates, must be notified to the CMA in advance, before they are made available to clients;
• Algorithm integrity: A Capital Market Institution offering robo-advisory services must establish systems and control procedures to ensure the integrity and efficiency of the algorithms and technological tools used. It must test their reliability and effectiveness periodically, with such testing conducted at least ten days before the service is offered to clients on the platform;
• Portfolio and foreign securities: Portfolios must not be concentrated in one asset or issuer and foreign securities must be supervised in a jurisdiction with standards and requirements at least equivalent to the CMA’s;
• Disclosure requirements: A Capital Market Institution that offers robo-advisory services must disclose the performance record of the investment portfolios since inception. This must include the criteria and methodology used to measure portfolio performance, the total returns achieved after deducting actual expenses, and any updates thereto.
• Information Technology Officer: A registered Information Technology Officer must be maintained.

The regulations therefore treat AI as a means of providing discretionary investment management while imposing additional controls tailored to algorithmic delivery. The CMA reported that assets under management on fintech platforms rose by 87% to SAR 6.41 billion in Q4 2025, from SAR 3.43 billion a year earlier.¹²CMA, ‘CMA Approves Regulation of Robo-Advisory Services’ (5 March 2026).

FinTech ExPermit Sandbox

The CMA’s FinTech ExPermit Instructions establish a regulatory sandbox through which FinTech firms may test innovative financial technology products within a controlled “sandbox” environment before seeking full CMA authorisation. The sandbox allows the CMA to supervise new technologies in a controlled environment, understand their potential risks and consider whether changes to the regulatory framework are required.

Firms remain responsible for regulatory compliance and subject to the instructions and any conditions imposed by the CMA throughout the testing period. They may not exclude or limit their liability to clients for losses arising from the products being tested or agree to share in clients’ investment losses. The sandbox is therefore intended to encourage innovation without compromising investor protection.¹³CMA FinTech ExPermit Instructions

3.3 Pillar Three: The Saudi Central Bank (SAMA) and the Insurance Authority

SAMA does not currently regulate AI through a dedicated AI rulebook. Instead, AI systems used by SAMA-regulated institutions fall within generally applicable technology, cybersecurity, counter-fraud, outsourcing, cloud-computing and operational-risk requirements.

IT Governance Framework

SAMA’s Information Technology Governance Framework targets Level 3 maturity and requires periodic self-assessments. These should be reviewed by internal audit and reported to SAMA, which may also review or audit them. Although the Framework does not address AI in terms, it extends by implication to the technology infrastructure and governance supporting AI systems.¹⁴SAMA, Information Technology Governance Framework, including section 2.3 (Self-Assessment, Review and Audit).

Cybersecurity Framework (CSF)

The SAMA Cyber Security Framework does not expressly address AI. It applies generally to regulated institutions’ information technology assets, including business applications and infrastructure, as well as outsourced services and new technologies. Accordingly, AI systems forming part of, or supporting, those information assets are subject to the Framework’s relevant cybersecurity governance, risk-management, monitoring and third-party controls, although the Framework imposes no AI-specific requirements.¹⁵SAMA Cybersecurity Framework (CSF)

Cross-Border Data, Cloud and Outsourcing

For a foreign-hosted AI model, the first question is whether the proposed data flow and hosting arrangement are permissible. If personal data will leave the Kingdom, the controller must establish a lawful route under the PDPL and the Regulation on Personal Data Transfer Outside the Kingdom, including any required safeguard, data minimisation, security and transfer risk assessment. The analysis should cover prompts, retrieved documents, logs, embeddings, support access and onward transfers, rather than only the contractual hosting location.

That data-law analysis is separate from SAMA’s prudential gate. SAMA’s cloud requirements state a principle of in-Kingdom hosting and require approval before using a cloud service or signing the contract; explicit approval is required for services outside the Kingdom. Material outsourcing also requires SAMA’s prior non-objection under the applicable outsourcing rules. A foreign-hosted model is therefore not automatically prohibited, but should not be deployed until both the PDPL transfer route and the relevant SAMA approval or non-objection route are established. SAMA’s Open Banking Framework is also an AI data enabler by permitting consented, standardised access to customer-permissioned financial data, subject to its business rules and technical standards.¹⁶Regulation on Personal Data Transfer Outside the Kingdom, including articles 2, 4 and 7; SAMA Cybersecurity Framework, section 3.4.3 (Cloud Computing); applicable SAMA outsourcing rules; SAMA Open Banking Framework.

Regulatory Sandbox

SAMA’s Regulatory Sandbox permits eligible financial innovations, including AI-enabled services, to be tested under defined conditions before wider deployment. It provides a supervised route to address licensing questions, gather evidence and evaluate risks.¹⁷SAMA Regulatory Sandbox Framework; FSDP Programme Charter 2020–2025

On 28 June 2026, SAMA launched an enhanced Regulatory Sandbox Service through its e-services portal to automate applications and status tracking. This was an administrative portal upgrade rather than a new regulatory rule.¹⁸SAMA, ‘SAMA Launches Enhanced Regulatory Sandbox Service’ (28 June 2026).

Insurance Authority and InsurTech Rules

The Insurance Authority has been the standalone regulator responsible for supervising and regulating Saudi Arabia’s insurance sector since 23 November 2023. Legacy insurance regulations and instructions remain in force until replaced or updated; the InsurTech Rules are now published within the Authority’s own regulatory materials and its rulemaking pipeline should be monitored separately from SAMA’s banking and payments framework.¹⁹Saudi Central Bank (SAMA), InsurTech Rules (approved 30 July 2023), now administered by the Insurance Authority.

4. Emerging Risks

AI-Enabled Fraud and Deepfakes

Generative AI can facilitate impersonation, synthetic identities, social engineering and fabricated documents or instructions. SDAIA’s Deepfakes Guidelines describe the ethical, privacy and transparency risks associated with manipulated media.²⁰SDAIA, Deepfakes Guidelines. In addition, sectoral regulators’ counter-fraud and cybersecurity frameworks provide more general requirements to prevent, detect and respond to fraud and technology risk.²¹Saudi Central Bank, Counter-Fraud Framework.

Algorithmic Bias

Bias in AI training data can produce systematically unfair outcomes in credit scoring and insurance pricing. SDAIA’s non-binding instruments indicate that institutions should assess and mitigate bias before deployment and monitor outcomes after deployment. A mandatory assessment arises only where a binding legal trigger applies, including a DPIA where required under the PDPL Implementing Regulations.

Cybersecurity and Regulatory Fragmentation

AI systems introduce attack surfaces, adversarial inputs, model poisoning and data leakages that traditional cybersecurity frameworks were not designed to address. The NCA’s Essential Cybersecurity Controls and SAMA’s CSF provide the primary regulatory response. In addition, on 5 July 2026, the NCA opened consultation on draft AI Cybersecurity Guidelines covering governance, defence, resilience and third-party cybersecurity. The draft expressly addresses generative and agentic AI. The consultation closed on 5 August 2026; the Guidelines remain a draft pending final issuance and should not be described as binding regulation.²²National Cybersecurity Authority, ‘Public Consultation on AI Cybersecurity Guidelines’ (5 July 2026); Draft AI Cybersecurity Guidelines.

Simultaneously, the multi-body regulatory architecture spanning SDAIA, SAMA, CMA and NCA creates compliance complexity that institutions must invest in managing proactively as the framework develops.

5. Looking Ahead

Several developments warrant close attention from financial institutions operating in or entering the Kingdom:

• Draft Responsible AI Policy: SDAIA consulted through Istitlaa from 3 April to 3 May 2026 on a policy applying across the public, private and non-profit sectors. The draft classifies AI systems into four risk categories—critical, high, limited and low—and proposes tiered requirements including registration of certain systems, safety testing and monitoring, audit and assurance requirements for high-risk systems, and watermarking and content-tracking measures. The consultation has now closed and final issuance of the Responsible AI Policy is awaited.²³https://www.spa.gov.sa/en/N2551533
• Draft AI-First Policy: SDAIA consulted through Istitlaa from 29 June to 28 July 2026 on a draft policy intended to embed a structured and responsible ‘AI-first’ approach across public-sector entities. The consultation has closed and final issuance is awaited.²⁴SDAIA, Draft AI-First Policy consultation, Istitlaa (29 June-28 July 2026), https://istitlaa.ncc.gov.sa/ar/transportation/ndmo/aifirstpolicy/Pages/default.aspx.
• Global AI Hub Law: CST published a draft framework for sovereign data centres, data embassies and cross-border hosting for consultation on 14 April 2025. The consultation closed on 14 May 2025, and the law had not been enacted at the time of writing. The proposal could become relevant to international data and AI infrastructure arrangements and, once enacted, would reshape cross-border AI deployment strategies and create new data hosting and infrastructure opportunities for international financial institutions. Note however it is not a general AI-governance statute.²⁵Communications, Space & Technology Commission, ‘CST Publishes a Public Consultation for the Global AI Hub Law’ (14 April 2025; consultation closed 14 May 2025).
• PDPL Compliance: The PDPL is fully operational following the end of its statutory grace period on 14 September 2024. Financial institutions should review key compliance areas e.g. whether AI data pipelines have a documented lawful basis and purpose, use proportionate data, support data-subject rights, trigger a data protection impact assessment where required and comply with breach-notification and record-keeping requirements.²⁶SDAIA, https://dgp.sdaia.gov.sa/wps/wcm/connect/f579bc32-fda8-47bd-bc6f-66b8cb77985c/ENG-Guide%2Bto%2Bthe%2Bsaudi%2BPDP%2Blaw%2Bfor%2Bcontrollersprocessors.pdf?MOD=AJPERES
• SAMA AI guidance: More targeted SAMA guidance on model risk management, algorithmic credit underwriting and AI in AML and KYC processes is anticipated.
• FSDP targets and FinTech expansion: The FSDP’s ongoing targets (for example, the number of fintech companies, SME lending and stock-market capitalization) will continue to drive digitalisation and create expanded opportunities for AI-driven financial services.
• Arabic-language AI: Saudi Arabia’s launch of HUMAIN, a PIF-owned AI company focused on AI infrastructure, cloud capability, data centres and Arabic-language models, reflects the Kingdom’s broader sovereign AI strategy. Although not itself a regulatory development, HUMAIN may influence the AI tools available to financial institutions, particularly for Arabic-language customer engagement, compliance support and locally hosted AI services.

Financial institutions that invest now in robust AI governance frameworks, encompassing board accountability, pre-deployment assessments, data governance, cybersecurity controls and vendor management, will be best positioned to navigate this evolving landscape and to harness the substantial opportunities that AI presents in one of the world’s most dynamic financial markets.