SDAIA AI ethics principles in plain language

SDAIA's AI ethics principles are seven rules for anyone who builds, buys or uses AI in Saudi Arabia: fairness, privacy and security, humanity, social and environmental benefits, reliability and safety, transparency and explainability, and accountability and responsibility. How strictly they apply depends on the system's risk level. The text sets no fines, and companies that offer AI products can register voluntarily for an incentive badge.

This guide explains each principle in everyday terms and shows what it asks of a company that uses AI rather than one that researches it. It is based on the current text, SDAIA's AI Ethics Principles dated May 2025 (document SDAIA-P114E), a 50-page document with a checklist annexed to it [1]. If your question is whether your company is ready to adopt AI at all, our guide to the SDAIA AI Adoption Framework covers readiness and risk scoring. This article stays with the ethics principles.

What SDAIA's AI ethics principles are, and who they apply to

The document applies to everyone who designs, develops, deploys, implements or uses AI systems in the Kingdom, or is affected by them. That explicitly includes public entities, private companies, non-profits, researchers, workers and consumers [1]. A trading company that uses an AI assistant for customer messages is inside the scope, just as a bank that builds its own credit model is.

SDAIA lists five aims for the document. Two of them matter most to a business: governing data and AI models to limit their negative effects, and protecting the privacy and rights of the people whose data is processed [1].

The principles follow an AI system through four stages, which SDAIA calls the AI system lifecycle [1]:

1. Plan and design: define the problem, the approach and the performance indicators.
2. Prepare input data: gather, assess, clean and transform the data.
3. Build and validate: train, tune and test the model, and evaluate its risks.
4. Deploy and monitor: put it into use, version it, and review its performance periodically.

Each principle comes with controls for each of the four stages. That is what turns a list of values into something a team can check.

Are the principles mandatory for private companies?

The answer has two parts. The document says it "shall apply" to all AI stakeholders in the Kingdom, and it gives SDAIA the role of measuring and monitoring compliance, directly or through sector regulators [1]. Yet it contains no penalties, and its compliance section is built on optional registration, optional reports and incentive badges [1]. SDAIA's regulations page still links the file under the label "draft of Principles of AI Ethics", while the document itself is marked as a regulatory document, version 1 [2][1].

In practice, treat the principles as the national reference for responsible AI. Obligations with penalties come from laws such as the Personal Data Protection Law (PDPL) and its implementing regulation, which SDAIA lists on the same page [2]. This is general information; for a specific case, read SDAIA's text or ask a licensed advisor.

The seven principles, in plain words

The table summarises each principle as SDAIA defines it and what it means in a company's daily work. The middle column is our plain-language reading; the right column draws on the controls in the document [1].

For a company that buys AI rather than builds it, two principles usually carry most of the weight: transparency and accountability. The others still apply, but they are mostly tested through the supplier.

The same seven principles apply to generative AI. SDAIA's Generative AI Guidelines for Public (May 2025) translate them for chat assistants and content tools: tell people when they are dealing with AI, label AI-generated content, offer a non-automated channel for anyone who prefers a human, use watermarks where they help, and check content for factual accuracy before it spreads [3].

The four AI risk levels: how strict the principles get

SDAIA sorts AI systems into four levels and ties a different duty to each [1]:

• Little or no risk, such as spam filters: no restrictions, though compliance with the principles is recommended.
• Limited risk, such as technical programs related to function, development and performance: the principles apply.
• High risk to basic rights: conformity assessments before and after deployment, plus the relevant statutory requirements.
• Unacceptable risk to people's safety, livelihood or rights, such as social profiling, exploitation of children or distortion of behaviour: not allowed.

SDAIA gives no example for the high-risk level. The table below applies the definitions to common business uses. Illustrative example: it is our reading, not an SDAIA classification, so confirm the level with SDAIA or your sector regulator before you rely on it.

The document also asks entities to build risk management into the project from the start, covering data, algorithm, compliance, operational, legal, reputational and regulatory risk [1]. For the scoring itself, SDAIA launched a National AI Risk Management Framework on 14 July 2026 that rates each risk on a likelihood-and-impact matrix [4]. Our adoption framework guide works through that matrix with an example, so we do not repeat it here.

Buying AI instead of building it: what changes

Many companies buy AI inside a product rather than train their own models. The principles still reach them. The document distinguishes the AI system owner, who applies or uses a system, from the developer who builds it and the assessor who audits it [1]. A company that deploys a vendor's chatbot is the owner.

Three provisions apply directly to buyers:

• Due diligence before signing. If a third party builds the system, the owner should carry out AI ethics due diligence and make sure the documentation is accessible and traceable before procurement or sign-off [1].
• Contractual guarantees. The compliance officer's duties include making third-party systems comply with the principles through contractual guarantees [1].
• Questions flagged for suppliers. Every question in the annexed checklist is marked as binding for third parties or not, so you can see which questions a supplier should be able to answer [1].

In practice, ask the supplier in writing how it tests for bias, how a person can override or stop the system, what it logs, and how it will tell you about failures or data breaches. If personal data leaves the Kingdom in the process, our guide to data residency in Saudi Arabia covers the PDPL conditions.

Who owns AI ethics inside the company

The document names four roles for adopting entities [1]. They were written with large organisations in mind, but a small company can map them onto people it already has.

The point is separation: the person who chose the tool should not be the only one judging whether it behaves well.

The AI ethics checklist, self-assessment and incentive badge

The document ends with an AI ethics checklist, organised by lifecycle stage. We counted 75 questions: 28 for plan and design, 14 for preparing input data, 13 for build and validate, and 20 for deploy and monitor [1]. Each question names the principle it tests. Typical examples ask whether you designed the right level of human oversight, whether fallback plans were tested, whether end users are told the reasons behind an outcome, and whether there is a way to seek redress when something goes wrong [1].

Annex A lists supporting tools: a fairness position statement, an ethical impact assessment, an algorithm assessment, an explanation report on AI methods, a safety self-assessment and data protection methods such as anonymisation, pseudonymisation, masking, encryption and tokenisation [1].

Registration is optional. The document says SDAIA may award motivational badges that reflect a product's or entity's level of compliance [1], and on 26 May 2025 SDAIA called on AI firms to join the National Data Governance Platform to receive incentive badges for AI products [5]. The platform offers two related services:

1. AI ethics self-assessment. Log in to the platform, choose the AI ethics assessment tool, compare your current practices with the set criteria, and receive a result for the ethical compliance level of your AI model [6].
2. AI service provider accreditation. Register the entity on the platform, appoint an AI officer, log in from that officer's account, add a product, and complete the questionnaire with the required files. After a committee review, the product receives an incentive badge, and the entity receives an AI service provider accreditation certificate [7].

SDAIA listed the AI ethics incentive badges among the initiatives behind Saudi Arabia's fifth place for AI trust in the IMD World Competitiveness Yearbook 2026 [8].

How the principles fit with the PDPL and SDAIA's other AI documents

The ethics principles sit in a wider set of rules. In June 2026 SDAIA said it had issued 10 regulatory documents on the ethical and responsible use of AI [9]. Four related texts are worth knowing next to the principles:

• The PDPL and its implementing regulation: binding law for any processing of personal data, including inside AI tools [2].
• The Generative AI Guidelines for Public: the principles applied to chat assistants and content generation [3].
• The Deepfakes Guidelines, announced on 8 May 2026: explicit consent, protection of personal data and technical safeguards such as digital watermarks [10].
• The draft Responsible AI Policy, opened for public comment on 2 April 2026, which focuses on preventing risks and clarifying roles across the AI lifecycle [11]. SDAIA's regulations page did not list a final version when we checked on 14 October 2026 [2].

Common misreadings of SDAIA's AI ethics principles

• "They are for government entities." The scope names private companies, non-profits, workers and consumers as well [1].
• "We only use ready-made tools, so they do not concern us." A company that uses an AI system is its owner under the document, and due diligence on third-party systems is part of the transparency principle [1].
• "Low risk means nothing to do." For little-or-no-risk systems, compliance is still recommended [1].
• "A badge means we comply with the law." The badge reflects the adoption of AI ethics; PDPL obligations stand on their own [1][2].
• "Ethics is a statement of values." Every principle comes with controls for each lifecycle stage and questions you can answer yes or no [1].

Your next step

Choose the one AI system your company relies on most, whether it is a chat assistant, a scoring model or a tool inside your office suite. Place it on SDAIA's four risk levels, then answer the checklist's plan-and-design questions on human oversight and fallback plans. If the answers are mostly yes, run the AI ethics self-assessment on the National Data Governance Platform to see where SDAIA's AI ethics principles would rate it. If you are building AI into your own product, you can read about O AI, a software and AI company in Al Khobar, on our home page.