Saudi Arabia's Year of AI: What SAMAI 2, SDAIA's Guidelines and the PDPL Mean for Enterprise Builds

On 10 March 2026 the Saudi Cabinet approved designating 2026 as the Year of Artificial Intelligence, and the Saudi Data and Artificial Intelligence Authority unveiled the year's logo and hashtag the next day, Arab News reported. The designation is easy to read as branding. The numbers behind it are not. In a 15 June statement carried by the Saudi Press Agency, SDAIA said the beneficiaries of its training programmes had exceeded 1,563,983 citizens, including 14,495 data and AI specialists and experts, that it had trained more than 278 government leaders, and that it had launched the second phase of its SAMAI initiative in partnership with 11 ministries to enable the government workforce to use AI technologies practically and responsibly. Coverage of the programme lists ministries including health, finance, media, justice, industry and mineral resources, transport and logistics, education and human resources.

Arab News' reporting on the designation adds the infrastructure picture: a National Data Lake integrating more than 430 government systems, the Hexagon data centre described as the world's largest government data facility at 480 megawatts, the Shaheen III supercomputer, a 14th-place ranking in the 2025 Global AI Index, government spending on emerging technologies up more than 56 percent in 2024 and 9.1 billion dollars of funding secured by AI companies.

For an enterprise or a vendor deciding what to build for the Kingdom, the important reading is the combination: a public sector being trained at national scale to use AI in its daily work, data infrastructure being consolidated, and — as set out below — a regulatory surface that is narrower and more principles-based than many assume.

The regulatory surface, precisely

Saudi Arabia does not have an AI-specific law and has not announced a legislative process to enact one. Bird & Bird's regulatory horizon tracker notes that a draft AI Hub Law went to public consultation in April 2025 but, despite its title, did not propose an AI regulatory framework. What governs AI in practice is a centralised, risk-based system administered by SDAIA: the Personal Data Protection Law, which SDAIA enforces, the National Data Governance Framework, and a set of non-binding but influential instruments — most relevantly the SDAIA Generative AI Guideline, which CMS's regulatory scanner summarises as principles of transparency, accountability, privacy protection, human oversight and risk management aligned with the PDPL. Sector regulators add their own layer for financial institutions and telecommunications.

The consequence for engineering is that compliance in the Kingdom is mostly not a checklist against an AI act. It is the PDPL applied rigorously to AI data flows, plus the ability to demonstrate the guideline's principles in how a system behaves — which is a design problem rather than a documentation one.

What the demand signal means

SAMAI's first phase trained more than a million participants, per Arab News; the second phase is sector-specific, targeting the workforce of named ministries with training on applications relevant to their work. A ministry whose staff have been trained to use AI for case triage, document processing or citizen services becomes a buyer of those systems — and a demanding one, because the users know what the tools should do.

Three properties follow for anything built for this market.

Arabic first, not Arabic added. Government workflows in the Kingdom run in Arabic, with Gulf dialect in speech and formal Arabic in documents. Retrieval, extraction and conversational agents that were built for English and localised afterwards degrade exactly where these users will notice. Tokenisation, evaluation sets and OCR pipelines need to be Arabic-native from the start, and the human-oversight interfaces need to be right-to-left by design.

In-Kingdom by default. With the National Data Lake integrating hundreds of government systems and the PDPL's rules on cross-border transfer administered by SDAIA, data residency is the opening question in any public-sector or regulated engagement, not a late-stage configuration. Models, vector stores, logs and agent sandboxes that can run in a Saudi region — the pattern we describe as sovereign AI — keep that conversation short.

Oversight you can show. The generative AI guideline's principles — transparency, accountability, human oversight, risk management — translate directly into artefacts: disclosure surfaces that tell a user when AI produced an output, decision logs that record what a system did and why, approval steps for consequential actions, and evaluation records that document the risk assessment. Systems that produce these as a by-product of running are compliant without a separate compliance programme; systems that do not will be retrofitted under pressure.

Where to start

The workloads most aligned with the Year of AI's direction are the ones the trained ministries will reach for first: Arabic document understanding and extraction for justice, finance and industry; citizen-service assistants with escalation to human officers for health, education and human resources; and agentic workflow automation over the case-management systems those ministries already run. Each of them is well understood technically. The difference between a pilot and a production system in the Kingdom will be the three properties above, and whether the evidence a regulator or an auditor might ask for exists on day one.

Where Masarrati fits

Masarrati builds Arabic-first AI agent systems and conversational and document AI for enterprises and public-sector programmes in Saudi Arabia, the UAE and the wider Gulf, with in-Kingdom deployment under our sovereign AI for GCC approach and oversight artefacts — disclosure, decision logs, approval gates, evaluation records — designed in from the first sprint. Our GRC and compliance automation work maintains the PDPL and guideline evidence as the system runs. We build and hand over: your team, or your ministry's, operates the result. Regulatory approvals and classifications remain with your advisers and the relevant authority; our job is to make sure the system can demonstrate what they ask. More on our work in the Kingdom is on our Saudi Arabia page.