AI Ethics Principles
Saudi Arabia · Guideline · Saudi Data and Artificial Intelligence Authority
High impact. A reviewer confirms each change before it is listed here.
Our summary
A framework setting out core values and standards for the design, development and deployment of AI systems within Saudi Arabia. It applies to all public entities, private organisations, non-profit entities and individuals working with AI. The document defines AI ethics principles including fairness, risk management approaches, and requirements for responsible AI development across the system lifecycle.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
3 sections
Jump to a chapter
Sdaia
The Sdaia AI Ethics framework applies to all AI stakeholders in Saudi Arabia designing, developing, deploying, or using AI systems, classifying them into four risk categories from little or no risk to unacceptable risk (prohibited for systems enabling social profiling, child exploitation, or behavior distortion) and requiring risk management throughout the system lifecycle. Six core principles govern AI development: Fairness requires eliminating bias and discrimination across the lifecycle through fairness metrics, threshold definition, representative training data, and monitoring of sensitive groups; Privacy & Security demands that personal information use be limited to system necessity, data classified by sensitivity with de-identification mechanisms and authorized access controls, profiling requires compliance officer approval or sector ethics code alignment, and security must withstand cyberattacks; Ethics based on human rights and cultural values requires systems to be human-centric and respect Saudi cultural preferences; Social and Environmental Impact requires recognition of AI's disruptive potential and prevention of harm to humans and ecosystems; Reliability requires systems resilient to uncertainty with standards, protocols, documentation, stakeholder sign-off at critical points, and for life-critical systems human review; and Transparency requires clear communication of data, algorithms, capabilities and purpose with information sections on model decision overviews, logged issue resolution, documented datasets enabling traceability, and assessment of data accuracy and source. Across all lifecycle stages from planning through monitoring, organizations must perform fairness-aware design with technical and non-technical teams, ensure data quality and integrity for all population segments, apply causality-based feature selection with stakeholder review, conduct comprehensive evaluation and stress testing, and obtain approval and sign-off of datasets before model development with clear ownership of feature selection, hyperparameter tuning, and metric selection.
Sdaia
SDAIA develops, monitors, and measures compliance with AI ethics principles through designated responsible individuals, a Responsible AI Officer, and AI System Assessors who use fairness position statements, ethical impact assessments, privacy and security standards, and trustworthy AI architecture aligned with international standards including ISO, IEEE, NIST, CIS Controls, PCI-DSS, and COBIT. SDAIA provides guidance on fairness assessment using tools like Google Model Card Toolkit and AI Fairness 360, algorithm auditing, safety self-assessments, data protection methods including de-identification, anonymization, masking, pseudonymization, encryption, tokenization, data loss prevention, and data governance, and data minimization practices. Organizations must establish ethics checklists across AI system lifecycle phases (Plan, Design, and Data Management) covering human oversight, bias mitigation, risk management, fairness assessment of disadvantaged groups, reliability and safety testing, privacy controls with consent mechanisms and revocation options, data quality measurement and diversity evaluation, interpretable algorithms with transparent outcomes, KPI thresholds with fallback plans, staff training on accountability, ethics governance structures with internal or external audit mechanisms, assessment of data integrity and accuracy, validation of human rights and cultural preferences alignment, testing against unexpected situations and adversarial attacks, and completion of interpretability examination of trained models.
Sdaia
AI systems must have defined and tested failure processes, mechanisms to communicate reliability and explain decisions to end-users, fallback plans for adversarial attacks, interpretable design with post-training examination, and quantitative analysis during development to test for and monitor biases with protections for disproportionately affected individuals or groups, while preventing systems from encouraging human attachment or simulating feelings. Sensitive data use requires justification, AI approaches aligned with human rights and cultural values, stakeholder approval of tests and user acceptance testing before production, and deployment monitoring including disclosure to chatbot users, vulnerability assessments, mechanisms to measure inaccurate predictions, strategies to verify systems meet intended goals, data accessor competence requirements, assessments of influence on user decision-making, outcome explanation processes, feedback collection, fairness and bias monitoring, impact assessments for system variability on fundamental rights, accessibility for assistive technology users, and social and environmental impact measurement. Deployed systems must apply fundamental human rights mechanisms, demonstrate compliance against stated principles, maintain third-party or worker reporting processes for vulnerabilities and risks, provide redress mechanisms for harm or adverse impact with user information about redress opportunities, undertake continuous monitoring for privacy and security, and undergo periodic assessments to ensure compliance with fundamental human rights and cultural values.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 8 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 2 of 4
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 2 of 4
- Labelling of synthetic content, not covered
- Technical documentation, not covered
Technical safeguards 1 of 4
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 1 of 4
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 2 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 9 are shown.
Sdaia 9 controls
- ObligationApplies to: ProviderDrafted by the Index
Providers of limited-risk AI systems, such as technical tools for function and development, must adhere to the ethics principles in this framework.
- ObligationApplies to: ProviderDrafted by the Index
Providers of high-risk AI systems that threaten basic rights must complete conformity assessments before and after deployment and must follow applicable legal requirements alongside ethics principles.
- ProhibitionApplies to: ProviderDrafted by the Index
AI systems that pose unacceptable risk to safety, livelihood, or rights, including those involving social profiling, child exploitation, or behavioral manipulation, are prohibited.
- ObligationApplies to: Public authorityDrafted by the Index
SDAIA shall develop, release, and refresh its AI ethics principles and framework on a regular basis to address emerging developments in regulations, communities, and the environment.
- ObligationApplies to: Public authorityDrafted by the Index
SDAIA must provide guidance materials and ongoing support to adopting entities to help them implement this ethics framework.
- ObligationApplies to: Public authorityDrafted by the Index
SDAIA shall assess adopting entities' compliance with the framework regularly through direct measurement or via sector regulators and conduct audits of AI ethics activities when necessary.
- ObligationApplies to: DeployerDrafted by the Index
All adopting entities must publish AI ethics documents that comply with these principles and designate individuals responsible for carrying out AI ethics activities.
- ObligationApplies to: DeployerDrafted by the Index
The head of the entity or chief data officer must approve and oversee implementation of the entity's AI ethics plan, designate roles for AI ethics oversight, approve annual reports, and act as the main contact with SDAIA.
- ObligationApplies to: DeployerDrafted by the Index
The chief compliance officer or compliance officer, reporting to the chief data officer, shall lead the organization's AI ethics program.
Change history
No changes recorded since we began monitoring this policy.