According to the AI Ethics Principles issued by the Saudi Data and Artificial Intelligence Authority (“SDAIA”) in September 2023 (the “Ethics Principles”), Artificial intelligence or AI is defined as “a collection of technologies that can enable a machine or system to sense, comprehend, act, and learn.”

Saudi Data & AI Authority was established to drive the national agenda for Data & AI to elevate the Kingdom of Saudi Arabia (the “Kindgom”) as a global leader in the elite league of data driven economies. To capitalize on Data & AI for the Kingdom economically and socially through national combined efforts by all stakeholders, SDAIA has developed the National Strategy for Data & AI. The strategy approval of the Custodian of the Two Holy Mosques King “Salman bin Abdulaziz Al Saud” was issued on July 17, 2020. SDAIA is currently working with other different entities on launching the strategy and activating its initiatives.

The targets and objectives of the strategy, include among others, (i) position The Kingdom as the global hub where the best of Data and AI is made reality, (ii) transform The Kingdom’s workforce with a steady local supply of Data & AI-empowered talents, (iii) enact the most welcoming legislation for Data & AI businesses and talents, (iv) attract efficient, stable funding for qualified Data & AI investment opportunities, (v) empower top Data & AI institutions to spearhead innovation and impact creation, and (vi) stimulate Data & AI adoption with the most collaborative and forward thinking eco-system.

As mentioned, the SDAIA had issued the AI Ethics Principles back in September 2023. The AI Ethics Principles were developed in accordance with The Kingdom’s commitment to human rights and its cultural values, as well as aligning to international standards and recommendations on the ethics of Artificial Intelligence and with reference to the Council of Ministers’ Resolution No. (292) dated 27/04/1441 AH, which mandates SDAIA to develop policies, governance mechanisms, standards, and controls related to data and artificial intelligence and monitor compliance therewith upon issuance.

As such SDAIA has analyzed global practices and standards to develop the AI Ethics Framework which aims to (i) support the Kingdom’s efforts towards achieving its vision and national strategies related to adopting AI technology, encouraging research and innovation, and driving economic growth for prosperity and development, (ii) develop and establish AI ethics policies, guidelines, regulations, and frameworks, (iii) govern data and AI models to limit the negative implications of AI systems (economically, psychologically, socially, etc.) and potential threats (security, political, etc.), (iv) help entities adopt standards and ethics when building and developing AI-based solutions to ensure responsible use thereof, (v) protect the privacy of data subjects and their rights with respect to the collection and processing of their data.

Further, on January 10, 2024, the SDAIA published its Generative Artificial Intelligence Guidelines for Government (the guidelines for the Government), which was created with the objective of promoting the responsible and effective utilization of GenAI tools and services in government transactions. It emphasizes the proper use and processing of government data in adherence to relevant laws and regulations in The Kingdom.

Furthermore, on January 11, 2024, the SDAIA published the Generative Artificial Intelligence Guidelines for the Public (the guidelines for the public), which serves as guidance for the public including developers and users of GenAI in The Kingdom. It aims to comprehensively address the responsible and effective development and use of GenAI in The Kingdom. These guidelines shall apply to all stakeholders designing, developing, deploying, implementing, using or being affected by GenAI systems within The Kingdom.

Currently there are no specific laws or regulations in The Kingdom that directly regulate AI or the outcome of any defective artificial intelligence systems. However, reliability and safety are one of the seven principles of the Ethics Principles which are set out to ensure that the AI system adheres to the set specifications. Reliability is described as a measure of consistency and provides confidence in how robust a system is. On the other hand, safety is described as a measure of how the AI system does not pose a risk of harm or danger to society and individuals. As an illustration, AI systems such as autonomous vehicles can pose a risk to people’s lives if living organisms are not properly recognized, certain scenarios are not trained for or if the system malfunctions. The Ethics Principles further include risk mitigation framework which is closely related to this principle as further set out below.

According to the principle of accountability and responsibility of the Ethics Principles, designers, vendors, procurers, developers, owners and assessors of AI systems and the technology itself will be held ethically responsible and liable for the decisions and actions that may result in potential risk and negative effects on individuals and communities. The designers, developers, and people who implement the AI system should be identifiable and assume responsibility and accountability for any potential damage the technology has on individuals or communities, even if the adverse impact is unintended. The liable parties should take necessary preventive actions as well as set risk assessment and mitigation strategies to minimize the harm due to the AI system.

However, the Ethics Principles do not set out specific penalties in case of non-compliance with the standards and ethics that entities and individuals are required to adopt when developing AI systems. There are, however, certain laws in The Kingdom that include liability rules which could be triggered in case of damages caused by AI systems, which include but are not limited to Personal Data Protection Law issued by Royal Decree No. M/148 dated 05/09/1444 H (“PDPL”) and its Implementing Regulations, under which penalties for non-compliance could range from a warning, a fine of up to SAR 5M , and/or imprisonment of up to 2 years. Additionally, the Copyright Law issued by Royal Decree No. M/41 dated 02/07/1424 H (the “Copyright Law”) further provides penalties for infringement of rights that could range from a warning, to a fine not exceeding SAR 200,000, to closing the violating establishment or the one which participated in the violation of the copyright, for a period not exceeding two months, to confiscation of all copies of the work along with the materials used or intended for use in the infringement on the copyrights, and last, imprisonment for a period not exceeding six months.

As mentioned above, according to the principle of accountability and responsibility of the Ethics Principles, designers, vendors, procurers, developers, owners and assessors of AI systems and the technology itself will be held ethically responsible and liable for the decisions and actions that may result in potential risk and negative effects on individuals and communities. The allocation of liability for harm caused by an AI system between the developer, the deployer, the user and the victim would highly depend on the specific circumstances and the roles of the involved parties. However, as further mentioned above, the Ethics Principles do not set out specific penalties in case of non-compliance with the standards and ethics thereunder and the penalties under other regulations as listed above may be considered where relevant.

In Saudi Arabia, the approach to damages is centered on compensating for the actual loss incurred by the victim. Saudi courts only consider damages that are “certain to have occurred.” Other forms of damages, such as loss of profit, economic loss, consequential loss, moral prejudice or punitive damages are not recognized by Saudi courts given that  they do not represent tangible losses that can be precisely valued.

In the Kingdom, insurance coverage for artificial intelligence varies and is typically addressed under existing insurance frameworks. AI-related risks can potentially be insured against, but it depends on the specifics of the AI application, the associated risks, and the terms offered by insurance providers. For reference, insurance coverage may include:

• Cyber Insurance: Policies that cover cybersecurity risks, which could encompass risks related to AI systems, such as data breaches or cyberattacks involving AI.
• Professional Liability Insurance: Coverage for errors and omissions by professionals, including developers or entities deploying AI systems, particularly in cases where their actions or decisions lead to harm.
• Product Liability Insurance: Coverage for liability arising from defective products, including AI systems, which may extend to claims for bodily injury or property damage caused by AI failures or malfunctions.
• General Liability Insurance: Coverage for a broad range of liabilities, which may include AI-related risks if not specifically excluded.

The availability and terms of AI-related insurance can vary significantly depending on the insurer and the specific circumstances of the AI use. As AI technology evolves, insurers may develop more specialized policies tailored to AI-related risks. It’s advisable for organizations deploying AI systems in Saudi Arabia to consult with insurance providers to determine the appropriate coverage and mitigate potential liabilities.

Patents in Saudi Arabia are governed by Patents, Layout Designs of Integrated Circuits, Plant Varieties, and Industrial Models Law issued under Royal Decree No. M/27 on July 17, 2004, and last amended on October 03, 2023 (the “Patent Law”).

The Patent Law does not specifically address the case where an applicant is an AI. Pursuant to the application requirements and steps as provided by the Saudi Authority for Intellectual Property, the official government body in The Kingdom responsible for the protection and supporting the intellectual property in the Kingdom, an applicant may either be a natural person, or an entity. Therefore, the recognition and rights related to inventions created with the assistance of AI are likely to remain with the human individuals or entities responsible for the AI.

In The Kingdom, Copyright Law attributes authorship to human creators who exercise creative judgment and control over the creative process. AI-generated content, including images, poses unique challenges regarding authorship and copyright ownership.

Copyright Law does not specifically address AI-generated works. However, the general principles of Copyright Law would likely apply. This means that AI-generated images would not be considered to have human authors, and thus may not be eligible for copyright protection under traditional frameworks. Ownership of AI-generated images in Saudi Arabia could be attributed to the person or entity that owns and controls the AI system. This could be the developer of the AI software, the organization deploying the AI, or the user providing the input data.

The main legal issues to consider when using AI systems in the workplace in The Kingdom include compliance with the recently implemented PDPL when collecting, processing, and storing employee data used for the AI system. This includes obtaining appropriate consent from employees for the collection and use of their personal data and implementing robust data security measures to protect employee data from unauthorized access or misuse.

Employers must further evaluate AI algorithms for potential biases that could lead to unfair treatment or discrimination in hiring, performance evaluations, or other employment decisions. AI-based decision-making processes must be transparent to employees and undergo monitoring and auditing mechanisms to identify and address any biases in the AI system. Employers must therefore ensure that AI systems comply with the PDPL requirements pertaining to consent, data processing & collection, and security measures to protect employee and client data.

Furthermore, the Ethics Principles categorize levels of risks associated with the development and use of AI for workers:

• Little or no risk: No restrictions, but systems must be ethically compliant.
• Limited Risk: AI systems must adhere to AI ethics principles.
• High Risk: AI systems must undergo pre-post conformity assessments and adhere to relevant statutory requirements, in addition to ethical principles.
• Unacceptable Risk: AI systems posing unacceptable risks to safety, livelihood, and rights are not permitted in the workplace.

Such AI ethics principles shall apply to any and all AI stakeholders developing, deploying, implementing, using, or being affected by AI systems in Saudi Arabia, which shall include public and private entities, as well as employees, customers and individuals within The Kingdom. Employers must therefore also ensure the proper use of AI systems in the workplace aligns with the applicable risk levels and corresponding ethical and legal requirements pursuant to the Ethics Principles.

One of the primary privacy issues surrounding AI is the extensive data collection required to power these systems. AI algorithms often rely on vast troves of personal information, including user preferences, online activities, and location data, to function effectively. This data hunger raises serious questions about consent, transparency, and individual control over one’s own information. Companies and organizations deploying AI must ensure they have clear policies in place to govern the collection, storage, and use of this sensitive data that comply with the Saudi PDPL, while also empowering individuals to access, correct, or delete their personal information as needed.

The key privacy issues that arise from the use of AI include:

• Unauthorized data incorporation, where there is a risk that user data inputted into the AI system could be inadvertently or improperly incorporated into outputs provided to other users, especially if the data is sensitive in nature.
• Inadequate security protections, as AI developers may not always prioritize robust security measures and data protection controls, making it easier for unauthorized users to access and misuse the personal data collected by the AI system.
• Unclear data retention and usage policies, as AI systems often lack transparency around their data retention periods, storage locations, and usage policies for the user data they collect. This lack of clarity raises concerns about how such data may be utilized and whether the AI system is in compliance with the PDPL.

To address these issues, the AI system must be designed and implemented in alignment with the Ethics Principles issued by SDAIA, which include the following:

• The AI system should be planned and designed to respect the privacy of individuals, avoid automated decision making based on personally identifying characteristics, and apply data minimization and de identification techniques.
• Privacy and security by design principles should be integrated into the development and deployment of the AI system.
• Comprehensive privacy impact assessments and risk management evaluations should be carried out to identify and mitigate potential privacy risks.
• Accountability and responsibility, whereby vendors, developers, owners and designers of AI systems bear ethical responsibility and liability for the decisions and actions of the AI technology, which could potentially result in risks or negative effects on individuals and communities. This principle underscores the importance of human oversight, governance, and proper management across the entire AI system lifecycle to ensure that appropriate mechanisms are in place to avoid harm and misuse of the technology.

While data scraping is not explicitly defined in the Ethics Principles or PDPL, the Copyright Law in The Kingdom provides protections on databases, whether they are mechanically reasonable or can be read in any other manner, and therefore protects such databases from unauthorized copying or extraction of contents. Data scraping activities that involve copying substantial parts of a protected database or website content without permission may be considered as copyright infringement.

Furthermore, pursuant to the PDPL, scraping personal information without authorization or in violation of privacy policies can be considered a breach of the PDPL. Anonymization and data minimization principles must be applied when scraping and using personal data.

In practice, the enforceability of the terms of use prohibitions on data scraping in The Kingdom would depend on a case-by-case analysis, considering the specific circumstances, the nature of the data being scraped, and the intended use of the scraped data.

While website owners can include anti-scraping provisions in their terms of use, the enforceability of such terms will depend on whether the user explicitly agrees to the website terms of use before accessing the site, in such case the prohibition on data scraping can be considered a contractual obligation.

Separately, as mentioned above, the Copyright Law protects original databases and website content from unauthorized copying or extraction. As such, scraping activities that copy substantial parts of a protected website or database may be considered copyright infringement, even if the terms of use do not explicitly prohibit it. Additionally, scraping personal information without proper consent can be a violation and enforceable under the PDPL, regardless of the terms of use.

Yes, as mentioned above, the AI Ethics Principles were issued by SDAIA in September 2023 and outlines a set of principles and guidelines to promote the responsible and ethical use of AI in The Kingdom. The key principles include:

1. Fairness: Entities within the scope must take necessary actions to eliminate bias, discrimination, or stigmatization of individuals or groups at each step of the AI system life cycle. This includes conducting fairness assessments of the AI system.
2. Privacy and Security: AI systems must be built in a way that respects the privacy of collected data and upholds the highest levels of data security processes and procedures to keep the data confidential and prevent data and system breaches.
3. Humanity: AI systems must be developed using ethical methodology based on intrinsic and fundamental human rights and cultural values, with the goal of generating a beneficial impact on individual stakeholders.
4. Social and Environmental Benefits: AI systems must not cause or accelerate harm, or otherwise adversely affect individuals. Rather, they must contribute to complementing social and environmental progress while addressing associated social and environmental issues.
5. Reliability and Safety: AI systems must adhere to set specifications and operate exactly as their designers intended and anticipated. Reliability measures consistency and provides confidence in the robustness of the system.
6. Transparency and Explainability: AI systems must be developed with a high level of clarity, explanation, and features to track the stages of automated decision-making. The data, algorithms, capabilities, processes, and purpose of the AI system must be transparent and communicated to those directly or indirectly affected.
7. Accountability and Responsibility: Designers, vendors, procurers, developers, owners, and assessors of AI systems, as well as the technology itself, are ethically responsible and liable for the decisions and actions that may result in any potential risks. Individual oversight, governance, and proper management must be demonstrated across the entire AI system lifecycle to ensure proper mechanisms are in place to avoid misuse of the technology.

Such information is not generally available to the public in The Kingdom. However, SDAIA has emphasized the importance of adhering to the Ethics Principles for AI development and deployment, including respect for individual privacy, fairness, transparency, and accountability. The authority has also stressed the need for ongoing collaboration between regulators in The Kingdom, AI developers, and end users to address emerging privacy concerns through the use of AI technologies.

The precise judicial handling of cases involving AI technologies within The Kingdom legal system remains opaque, as details of such proceedings are not readily available in the public domain. However, it is evident that The Kingdom has been actively developing a legal and regulatory framework to govern the utilization of AI across various sectors.

It is important to note that the Ethics Principles referenced is not a legally binding instrument. To the best of our knowledge, SDAIA does not explicitly enforce the Ethics Principles, where SDAIA uses an optional registration option to encourage entities to consider and implement the AI ethics when developing their AI systems to ensure responsible usage thereof. SDAIA further offers “motivational badges” to incentivize entities into registering with them and adhering to the AI Ethics Principles which shall reflect the level of progress and compliance thereof.

Moreover, although the PDPL does not specifically address AI systems, several of its provisions will have implications for the enforceability of the misuse of AI technologies, particularly in instances where such systems involve the processing of personal data. Key requirements under the PDPL to note include obligations of data subject rights, sensitive data, data processing principles, legal basis for processing, the implementation of data protection impact assessments.

As such, the evolving nature of the legal and regulatory landscape surrounding AI suggests that courts may have begun addressing AI-related matters, but the specific nature and outcome of such cases are not clearly discernible.

Pursuant to the established Ethics Principles, SDAIA is tasked with monitoring and overseeing compliance with these principles. SDAIA’s authority includes the ability to measure the compliance of entities and individuals based on the defined compliance mechanisms or through coordination with the relevant sector regulators. Additionally, SDAIA may conduct audits of AI ethics-related activities when deemed necessary.

Further, SDAIA is empowered to investigate potential violations and audit adherence to the Ethics Principles. SDAIA may exercise these oversight responsibilities with the support and collaboration of other pertinent authorities in The Kingdom. Through these mechanisms, SDAIA seeks to ensure the development and deployment of AI technologies in alignment with the Ethics Principles within The Kingdom.

The use of AI by businesses in The Kingdom can be described as an emerging trend, with a mix of early adopters and businesses exploring the potential benefits and implications of integrating AI into their operations, especially with startups. The Kingdom has been making concerted efforts to promote the adoption of AI and similar technologies across various industries such as finance, healthcare, e-commerce, and logistics as part of the Vision 2030. However, the level of adoption by businesses in The Kingdom is likely uneven across different company sizes as larger, more technologically advanced enterprises may have a higher propensity to invest in and deploy AI-based systems compared to smaller more traditional family-owned businesses.

The Kingdom legal market has experienced a surge in adoption of AI and other AI based legal technologies as this latest wave of AI innovation builds upon earlier generations of legal AI tools, with both industry specific and general AI applications now being utilized across various legal practice areas. The adoption of AI in the legal sector is attributed to the ability of these technologies to enhance efficiency and effectiveness for tasks such as contract drafting, legal research, and case analysis.

It is expected that adoption of these AI-powered legal technologies in The Kingdom market will continue growing as law firms and in-house legal departments recognize the potential benefits in terms of enhanced productivity, reduced costs, and improved client service. However, the integration of AI in the legal sector also necessitates consideration of regulatory compliance, data privacy, and ethical implications to ensure the ethical deployment of these technologies.

1. Key Challenges

• Integration Barriers: Achieving seamless end-to-end AI-powered legal processes remains a significant challenge, as existing AI tools often address specific tasks or stages within a larger legal workflow, rather than providing comprehensive, interoperable solutions.
• Compliance: The enforcement of the PDPL and the existing IP laws in The Kingdom pose compliance challenges for the deployment of AI technologies as AI systems and developers that rely on personal data or generate content must navigate these legal requirements, while also addressing the potential for AI driven misinformation, as such technologies may not always be up-to-date or accurate.
• Mass Requirement: Multi-sided and multi-party AI legal technology requires a critical mass of engagement for the technology to supersede previous, non-AI processes. Reaching this level of adoption may take time in The Kingdom
• Skills Gap: The effective deployment of AI in legal practice requires specialized skills and expertise that may not be readily available, necessitating investment in training and upskilling of legal professionals.
• Ethical Concerns: The use of AI in the legal sector raises potential ethical considerations, such as issues of transparency, bias, and accountability, which must be carefully navigated within the existing regulatory framework.

2. Key Opportunities

• Increased Efficiency and Effectiveness: AI-powered tools can enhance the efficiency and effectiveness of a wide range of legal activities, from contract drafting to legal research and case analysis.
• Competitive Advantage: The strategic deployment of AI technologies can provide law firms and in-house legal departments in The Kingdom with a competitive edge, allowing them to deliver higher-quality services and streamline their operations.
• Improved Client Experience: AI-driven legal services can improve the overall client experience by automating routine tasks, reducing turnaround times, and providing more personalized and data-driven insights.
• Expanded Service Offerings: The integration of AI can enable lawyers to offer new, innovative services, expanding the scope of their practice and enhancing their value proposition to clients.
• Knowledge Management and Collaboration: AI-powered tools can facilitate more effective knowledge management and collaboration within legal organizations, fostering knowledge sharing and institutional learning.

It is highly likely that both the public and private sectors in The Kingdom will make substantial investments in AI technology through partnerships and joint ventures with foreign tech companies, as well as local initiatives aimed at harnessing the benefits of AI for domestic applications.

In January 2024, SDAIA issued the Generative AI Guidelines to address the responsible and effective development and use of generative AI by the public and private sectors, including developers and users. Generative AI refers to a sub-field of AI that can generate new content, such as text, images, sounds, and icons, by interpreting user requests and queries. The Generative AI Guidelines provide measures to mitigate risks associated with the unauthorized use or replication of copyrighted material, which may lead to legal liabilities under the applicable IP laws in The Kingdom. To address these risks, generative AI developers are required to obtain licenses and permissions from original IP content holders prior to generating information based on their IP. Additionally, generative AI services should establish compensation measures to remunerate creators whose IP has been utilized by the AI systems.

Further, the impending enforcement of the PDPL in September 2024 will have significant implications for a large number of organizations in The Kingdom that incorporate personal data as part of their AI model datasets. Additionally, Saudi regulatory bodies such as SDAIA and the Saudi Authority for Intellectual Property are expected to issue further laws and regulations focused on the development, operation, and utilization of AI technology within the Kingdom.

AI developers and system/processes, as well as businesses utilizing such AI, will likely need to ensure that internal monitoring and compliance mechanisms are aligned with the evolving regulatory requirements and framework within The Kingdom.