Saudi Arabia’s New Digital Economy: The Kingdom Makes Strides in Data Monetization, Cybersecurity, and AI Policy

Key Takeaways

The Saudi Council of Ministers designated 2026 as the Kingdom’s “Year of Artificial Intelligence” in March, reflecting a government-wide refocusing of priorities and spending toward making Saudi Arabia a global AI hub. In the months since, the Saudi Data and Artificial Intelligence Authority and other technology regulators have issued a flurry of new policies and consultations, including the Responsible AI Policy, the draft AI-First Policy, the National AI Risk Management Framework, the draft AI Cybersecurity Guidelines, the draft Enterprise Architecture Implementation Controls, the Data Monetization Policy, and three Personal Data Protection Law-related draft consultations.

Collectively, these policies signal important long-term trends in the policy landscape, including:

• The digital economy remains central to Saudi Arabia’s non-oil growth strategy. AI adoption, data monetization, and digital government services are core parts of the Kingdom’s broader effort to diversify away from oil, create new sources of public revenue, and generate more durable economic returns.
• Saudi Arabia is pursuing AI through both acceleration and control. The draft AI-First Policy issued by SDAIA for public consultation pushes AI adoption as a top priority for government entities, while the Responsible AI Policy and National AI Risk Management Framework aim to establish guardrails for safe, accountable, and risk-based use.
• The Kingdom is opening a controlled marketplace for government data products. Published in June, SDAIA’s Data Monetization Policy creates a path for government data to generate revenue through licensed data products and services, but it prohibits the direct sale of raw government data. This reflects a controlled approach to data commercialization.
• The Kingdom is using non-binding regulatory instruments to signal the future regulatory direction. While some of the newly issued policy frameworks, such as the AI Risk Management Framework, are non-binding, they provide a clear indication of the government’s policy priorities and direction and are likely to be followed in time by binding regulatory instruments.
• Companies have commercial opportunities but must position themselves as compliant implementation partners. Foreign and domestic companies can support Saudi Arabia’s AI and data agenda by offering AI governance, cybersecurity, data productization, and modernization services. However, they will need to align with Saudi data protection and oversight expectations.