Saudi Arabia introduces a draft Global AI Hub Law
Overview of the law
Saudi Arabia’s Communication, Space, and Technology Commission (CST) released a draft Global AI Hub Law, a first-of-its-kind legal framework to establish the Kingdom as a global digital infrastructure hub, for public consultation until May 14, 2025.
The draft law provides a regulatory framework for the establishment and operation of sovereign and foreign-affiliated data centers – referred to as “AI Hubs” – within Saudi Arabia. It aims to position the Kingdom as a global digital epicenter by attracting foreign governments and private sector players to develop and host AI infrastructure.
The draft law outlines three types of AI Hubs:
- Private Hubs, operated solely by a Guest Country;
- Extended Hubs, operated by authorized entities serving themselves or others under a Guest Country’s laws; and
- Virtual Hubs, managed by local service providers but subject to the jurisdiction of a Designated Foreign State.
Private and Extended Hubs require bilateral agreements with the Kingdom and must comply with cybersecurity, data protection, and international legal standards. Virtual Hubs allow data to be governed entirely by the foreign state’s laws, though Saudi authorities retain emergency and oversight rights in cases where national interests are at risk. The draft law also empowers the Council of Ministers to regulate, enforce, and – if necessary – terminate agreements to protect national sovereignty or in the absence of diplomatic ties.
The global context
The draft law should be viewed in the context of the U.S. AI Diffusion Rule, introduced by the Biden administration in early 2025. The rule is scheduled to take effect May 15, though the Trump administration is expected to amend the rule in some form. The diffusion framework is designed to control the global dissemination of advanced American AI chips and models, particularly to adversarial nations. It categorizes countries into three tiers, granting unrestricted access to some while imposing licensing requirements or outright bans on others. There are 18 countries that are classified as tier one; Saudi Arabia is not currently included, potentially hindering its ability to secure the AI infrastructure required to fulfill its AI ambitions. Notably, the future of the rule remains uncertain, as the Trump administration has the authority to revise or revoke it.
Considerations for companies
Review the draft Global AI Hub law. Companies, particularly hyperscalers and developers, should carefully review the draft law and assess its potential implications on business operations in Saudi Arabia. This includes evaluating the impact of setting up Private, Extended, or Virtual Hubs in the Kingdom. Firms should also begin assessing their readiness to comply with the law, should the final version closely resemble the current draft.
Engage with Saudi digital authorities. Proactively engaging with relevant government stakeholders, most notably the CST, will help companies better understand how the law may be implemented and allow them to navigate the public consultation process more effectively.
Respond to the public consultation. Participating in the public consultation provides companies with a unique opportunity to shape the policy environment in the Kingdom. Early input can help ensure the final version of the law is fit for purpose.