Generative Artificial Intelligence Guidelines for Government
Saudi Arabia · Guideline · Saudi Data & AI Authority (SDAIA)
Our summary
This document provides regulatory guidance for government employees on using generative AI tools responsibly while handling government data. It sets mandatory principles covering fairness, reliability, transparency, accountability, and privacy to ensure responsible and effective use of GenAI in government operations. The guidelines require human review of AI outputs, restrict use of restricted data, and align with Saudi Arabia's existing regulations on data governance, security, and human rights.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
7 sections
Jump to a chapter
4 Roles and responsibilities within the entity
3 sections
This part introduces guidelines for government employees on using generative AI with government data, addressing associated risks and limitations. It outlines the roles of three stakeholder groups: the Data Management Office, individual users, and government entities collectively.
4.1 Data Management Office
The Data Management Office approves GenAI tools after reviewing compliance with Saudi Arabia's privacy, disclosure, and data-sharing policies. It manages data handling practices, validates data source legitimacy, audits training data quality for bias, and works with legal experts to ensure compliance with data protection and AI ethics regulations.
4.2 Users
Government employees must think critically about GenAI-generated content, recognizing it may be unreliable and supplementing it with trusted sources. They should report errors, biases, or inappropriate outputs to their entity and stay current on the technology's capabilities and limitations. When using such content, they must ensure relevant parties are informed and may apply watermarks to indicate AI generation.
4.3 Government Entities
Government entities in Saudi Arabia must establish transparent policies for responsible generative artificial intelligence use, including legal risk assessment and compliance verification by consulting experts. They must disclose machine-generated content, enable users to identify it, offer human communication alternatives, and run educational programs to help users evaluate and use such tools critically.
5 Crisis Response
During emergencies, GenAI can process information from multiple sources and allocate resources efficiently to support crisis control operations.
6 Content Creation
GenAI simplifies creating various content formats including text, audio, video, reports, and summaries with reduced time and effort for government staff.
7 Translation
Government employees using generative AI for translation and related tasks such as content simplification, summarization, project planning, and data analysis must follow safeguards including: excluding classified, sensitive, and restricted information from inputs; verifying accuracy through back-translation and testing multiple versions; specifying context, target audiences, and command formats; reviewing all output for bias and accuracy; obtaining explicit subject consent before analyzing personal data unless under an open license; and complying with data classification and anonymization requirements. Government entities must verify that generative AI tools comply with Kingdom regulations, the Personal Data Protection Law, and AI Ethics Principles; ensure use is consistent with entity privacy and data classification policies; provide continuous staff training on benefits, risks, policies and technical aspects; limit access to authorized personnel with detailed usage records; and ensure users acknowledge that outputs may be inaccurate, outdated, biased or misleading and must verify results before official use.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 10 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 1 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Impact assessment, not covered
Data and privacy 1 of 4
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 2 of 4
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 3 of 4
- Testing and evaluation, not covered
Assurance and lifecycle 1 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 2 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 16 are shown.
4.1 4 controls
- ObligationApplies to: Public authorityDrafted by the Index
The Data Management Office must approve GenAI tools after reviewing compliance with Saudi Arabia's privacy, disclosure, and data-sharing policies.
- ObligationApplies to: Public authorityDrafted by the Index
The Data Management Office must verify that data sources are legitimate and obtain necessary approvals before processing and maintaining data.
- ObligationApplies to: Public authorityDrafted by the Index
The Data Management Office must examine training data quality and identify potential bias in generative artificial intelligence systems.
- ObligationApplies to: Public authorityDrafted by the Index
The Data Management Office must work with legal experts to address privacy concerns and ensure compliance with the Personal Data Protection Law and Saudi Data & AI Authority policies.
4.2 4 controls
- ObligationApplies to: DeployerDrafted by the Index
Government employees must apply critical thinking and proceed cautiously when working with generative artificial intelligence-created content.
- ObligationApplies to: DeployerDrafted by the Index
Government employees must supplement generative artificial intelligence-generated content with information from trustworthy sources because such content is not inherently reliable.
- ObligationApplies to: DeployerDrafted by the Index
Government employees must inform their entity about any errors, biases, or inappropriate outputs produced by generative artificial intelligence tools.
- ObligationApplies to: DeployerDrafted by the Index
Government employees must ensure relevant parties are informed when utilizing generative artificial intelligence-generated content, and may apply watermarks to indicate such generation.
4.3 6 controls
- ObligationApplies to: Public authorityDrafted by the Index
Government entities must create clear policies and guidelines governing responsible use of generative artificial intelligence in the Kingdom of Saudi Arabia.
- ObligationApplies to: Public authorityDrafted by the Index
Government entities must consult experts to assess legal risks and verify compliance with applicable laws and regulations for generative artificial intelligence use.
- ObligationApplies to: Public authorityDrafted by the Index
Government entities must disclose that content has been created with generative artificial intelligence in order to maintain transparency.
- ObligationApplies to: Public authorityDrafted by the Index
Government entities should supply straightforward methods that help users recognize content generated by generative artificial intelligence technology.
- ObligationApplies to: Public authorityDrafted by the Index
Government entities should offer human-delivered communication as an alternative when users prefer non-automated interactions.
- ObligationApplies to: Public authorityDrafted by the Index
Government entities must actively support educational programs to improve user understanding of generative artificial intelligence, including critical evaluation and responsible use.
5 2 controls
- Applies to: Public authorityDrafted by the Index
During crisis or emergency situations, generative AI may process and distribute vital information to support emergency response operations.
- Applies to: Public authorityDrafted by the Index
During crisis or emergency situations, generative AI may help employees allocate resources efficiently.
Change history
No changes recorded since we began monitoring this policy.