How to Read the SDAIA National Strategy

SDAIA is more important than its press coverage suggests

The Saudi Data and Artificial Intelligence Authority sits at the regulatory and strategic core of the Kingdom’s AI program in 2026. SDAIA owns the National Strategy for Data and AI (NSDAI), runs the National Data Bank, hosts the National Information Center, oversees the Personal Data Protection Law’s implementing regulations, sets the AI ethics framework, and increasingly controls the sovereign-cloud classification regime. Its decisions shape what Humain can deploy, what foreign clouds can lawfully host, and what AI products can be sold inside the Kingdom. Reading SDAIA accurately is therefore the single highest-leverage Saudi-policy reading exercise an analyst can do.

The challenge is that SDAIA’s strategic communications operate across multiple document types, multiple Arabic-and-English mirrors, and multiple time horizons. Different documents carry different binding weights. Different sections speak to different audiences. And the gap between SDAIA’s stated priorities and its actual operational priorities is non-trivial. This guide gives the five-document core stack, the 2025-2026 stated priorities and what they actually mean, what gets de-prioritized, and the recurring mis-readings that cost analysts credibility.

A note on SDAIA’s institutional position: SDAIA was established in 2019 by Royal Decree under the chairmanship of the Crown Prince, which gives it unusual institutional authority within the Saudi regulatory architecture. It sits above MCIT and adjacent to NCA in policy weight, with direct reporting access to the Royal Court. This positioning matters because SDAIA’s publications carry implicit Royal Court endorsement that the formal text does not always articulate; reading SDAIA without understanding its institutional position systematically under-weights the binding effect.

The five-document core stack

Document 1 — The National Strategy for Data and AI (NSDAI). First published in 2020 and refreshed periodically, the NSDAI is the foundational document. It articulates the Kingdom’s ambition to become a global AI leader, sets quantitative targets (AI contribution to GDP, AI workforce size, data-economy share), and frames the regulatory and institutional architecture. The NSDAI is the most-cited document but the least operationally specific. Read it for direction-of-travel and target-setting; do not expect implementation detail. The 2020 NSDAI’s quantitative targets — 20% of GDP from data-and-AI by 2030, 20,000 specialists, top-15 global ranking — should be read as aspirational anchors rather than binding commitments; periodic refreshes recalibrate the trajectory.

Document 2 — SDAIA annual reports. SDAIA’s annual reports document concrete activity over the prior year — projects launched, regulations published, data assets onboarded, partnerships formed. Annual reports are the highest-information-density public document SDAIA produces, and the gap between the report and the prior year’s NSDAI commitments is itself a useful signal of execution velocity. The annual report’s typical structure — strategic-pillars review, project portfolio, regulatory-publications inventory, talent-program metrics, international-partnership inventory — is consistent enough year-to-year that comparative analysis is straightforward.

Document 3 — Cabinet decrees and SDAIA implementing regulations. Where the NSDAI is direction, cabinet decrees and SDAIA’s binding regulations are the operational law. The PDPL implementing regulations, the AI ethics binding framework, the data-classification regime, and the sovereign-cloud cybersecurity controls all sit here. These documents are typically Arabic-only at first publication and require careful translation. Cabinet decrees in particular carry the highest binding weight in the Saudi legal hierarchy. The PDPL specifically has gone through multiple implementing-regulation rounds since its 2021 enactment, and each round has materially shifted operational compliance burdens; a compliance practice that monitors only the original PDPL text is significantly out of date.

Document 4 — SDAIA position papers and white papers. SDAIA periodically publishes position papers on specific topics — generative AI guidelines, data-classification methodology, sovereign-cloud architecture, AI ethics in healthcare. These documents are advisory rather than binding but signal the regulatory direction 6 to 18 months ahead of binding rule-making. Read them as leading indicators. The 2024 Generative AI Guidelines, for example, telegraphed substantial portions of what became the 2025 binding GenAI deployment framework.

Document 5 — Leadership speeches and public communications. The SDAIA president’s speeches at LEAP, FII, the World Government Summit, and similar venues, plus published interviews, are the most-discounted-but-most-widely-read tier. Use them to confirm direction-of-travel rather than as primary signal. The exception is genuinely policy-substantive speeches that introduce new framings or quantitative targets; these merit close-reading even when they appear ceremonial.

A sixth document type worth tracking, though it sits adjacent to the core stack: the SDAIA-published international-partnership announcements, which over 2024-2026 have included substantial cooperation frameworks with the EU, UK, France, China, India, Japan, and South Korea. These bilateral frameworks frequently carry policy substance that does not appear in the unilateral SDAIA documents.

The 2025-2026 stated priorities

SDAIA’s 2025-2026 stated priorities cluster around five themes, each of which has a stated public framing and a more nuanced operational reality.

Priority 1 — Sovereign foundation models. The public framing is that Allam — the Saudi sovereign LLM developed under SDAIA leadership — is the centerpiece of national AI capability and will increasingly serve government and regulated-industry workloads. The operational reality is that Allam is one of several models in actual deployment, with Claude, GPT, Gemini, and Llama-derived models continuing to dominate practical workloads in the Kingdom. SDAIA’s actual priority is sovereign capability rather than sovereign-only deployment — that is, ensuring the Kingdom has the option to operate without dependence on foreign models, while not mandating exclusive use of Allam.

Priority 2 — Sovereign cloud. The public framing is that Saudi data should sit on Saudi-domiciled, Saudi-controlled cloud infrastructure under the CCC and SDAIA classification frameworks. The operational reality is a tiered classification regime in which most data is permitted on hyperscaler infrastructure with appropriate controls, while specific classifications are restricted to Tier 2 sovereign platforms. The framework is genuinely tightening over time, but the headline “sovereign cloud only” reading misses the nuance.

Priority 3 — National data infrastructure. The National Data Bank, the National Information Center, and the data-sharing framework across Saudi government entities is the most operationally important and least publicly visible SDAIA workstream. The data integration project is genuinely advanced — Saudi Arabia has built one of the most comprehensive government-data integration platforms of any major economy — and is the foundation on which Allam, sovereign AI services, and citizen-facing AI applications are built. The data-sharing-as-a-service products SDAIA is rolling out to the regulated-industry private sector in 2025-2026 are an under-discussed competitive moat.

Priority 4 — AI ethics and the binding ethics framework. The public framing is global leadership in AI ethics, with explicit alignment to UNESCO and OECD frameworks. The operational reality is a Saudi-specific binding ethics framework that aligns broadly with international norms but adds Kingdom-specific provisions on religious-and-cultural appropriateness, consumer-protection in Arabic-language deployments, and content classification. Foreign deployers should not assume the Saudi framework is identical to GDPR-AI Act expectations; the differences are meaningful.

Priority 5 — Talent. The Saudi AI workforce target — published variously as 20,000 to 40,000 specialists by 2030 — is operationally pursued through KAUST and KFUPM funding, the SDAIA Academy, the Tuwaiq Academy bootcamps, and a returning-expat program. Execution is uneven; the workforce target is more aspirational than tracking, but the institutional capacity to deliver is real. The Tuwaiq Academy bootcamp pipeline specifically has been more successful than the original 2020 NSDAI projections suggested and is materially reshaping the mid-tier applied-AI talent pool.

What gets de-prioritized

Reading SDAIA’s strategy is also reading what it does not prioritize, and the de-prioritized themes are themselves informative. Open-source AI infrastructure receives less attention than in the EU framework. AI safety research at the frontier-model alignment level is mentioned but not heavily funded relative to applied AI. International standard-setting is pursued cooperatively but the Kingdom rarely takes leadership positions; the priority is import-and-adapt rather than originate. SME and consumer AI tooling receives less attention than enterprise and government deployment. And — notably — academic research outside KAUST and KFUPM receives modest funding relative to the applied-deployment workstream.

Each de-prioritization signals where the Kingdom is comfortable being a fast-follower rather than a leader. Foreign organizations whose value proposition aligns with the de-prioritized themes will find smaller addressable opportunity in 2026 than the headline strategy might suggest. Conversely, foreign organizations aligned with the prioritized themes — sovereign capability, regulated-industry deployment, talent capacity-building, government data integration — will find unusually receptive counterparties in SDAIA and the broader Saudi government apparatus.

Common mis-readings

Mis-reading 1 — treating Allam as a Microsoft-Office-for-AI mandate. Allam is positioned as sovereign capability, not as the only permitted model. Foreign labs reading Allam’s prominence as a market-closure are over-reading.

Mis-reading 2 — assuming the NSDAI is binding. The NSDAI is strategy, not law. Operational binding rules sit in cabinet decrees and SDAIA implementing regulations. Compliance practitioners who key off the NSDAI alone miss the actual rule changes.

Mis-reading 3 — under-weighting the Arabic-only documents. A meaningful share of SDAIA’s binding regulations are published Arabic-first with English translation lagging by weeks to months. Analysts and compliance teams without Arabic capability miss the freshest signal and operate on stale information.

Mis-reading 4 — treating SDAIA in isolation. SDAIA coordinates with MCIT, NCA, CITC, SAMA, and the cabinet. A binding rule on AI ethics published by SDAIA may have a parallel CCC update from NCA and a CITC licensing update — the integrated rule change is what matters operationally, not any single SDAIA publication.

Mis-reading 5 — discounting leadership speech themes that don’t yet have framework backing. When SDAIA leadership repeatedly raises a theme in public speeches over 6 to 12 months, the binding framework arrives. Analysts who wait for the binding framework to act are reactive; the calibrated practice is to identify the theme cadence and prepare 6 to 12 months ahead.

Mis-reading 6 — ignoring the implementation-capacity constraint. SDAIA’s stated priorities exceed its execution capacity by a meaningful margin in 2026. The priorities that actually advance are those with strong leadership sponsorship, dedicated funding, and active project teams; the priorities that lag are those that have public framing but no operational anchor. Distinguish between the two by checking the SDAIA annual report’s project-portfolio inventory.

How to actually read SDAIA

A serious SDAIA-reading practice runs three exercises monthly. Exercise 1 — document sweep: read every new SDAIA publication in the prior 30 days, in Arabic where available, with structured notes on binding-vs-advisory, topic, and operational implication. Exercise 2 — gap analysis: compare the prior 30 days against the NSDAI commitments and the prior annual report; flag execution gaps and execution accelerations. Exercise 3 — coordination scan: check whether SDAIA’s recent activity aligns with parallel publications from MCIT, NCA, CITC, and the cabinet, and identify the integrated cross-authority story. Output a one-to-two-page synthesis distributed to the operating teams that need to act on it.

A fourth exercise pays unusual dividends for serious analysts: the predictive-write-down. At the end of each quarter, write down a 90-to-180-day prediction of what SDAIA will publish next, in what topic area, and at what binding-tier. Time-stamp the prediction. Score yourself when the time elapses. Over 6 to 8 quarters, this exercise builds calibrated predictive capacity that distinguishes serious SDAIA-watchers from press-cycle reactors.

Done well, this practice gives you 60 to 180 days of forward visibility on the Kingdom’s regulatory direction, which is enough lead time to shape product, compliance, and commercial strategy ahead of the news cycle.

SDAIA’s evolving relationship with the private sector

A meaningful 2024-2026 shift worth flagging: SDAIA’s relationship with the Saudi private sector has materially evolved from a primarily-regulatory posture toward a regulator-and-platform posture. The National Data Bank now offers data-sharing-as-a-service products to qualified private-sector consumers, the SDAIA Academy operates substantial industry-collaboration tracks, and the AI ethics framework increasingly incorporates private-sector consultation into its rule-making cycles. For foreign organizations engaging with SDAIA, this shift creates genuine partnership opportunity that did not exist three years ago — a credible foreign AI capability with relevant Saudi commercial application can pursue formal partnership tracks with SDAIA’s industry-collaboration arm rather than purely regulatory engagement. The partnership tracks are not yet codified in a single public framework; navigating them requires direct engagement with SDAIA’s Strategy and Partnerships function. Foreign organizations that approach SDAIA as a partner rather than purely a regulator find substantially better outcomes on both regulatory clarity and commercial access. The shift also implies that SDAIA’s own institutional capacity-building — its hiring, its technical depth, its commercial fluency — has become an important second-order factor for the Saudi AI ecosystem’s competitiveness, and SDAIA’s annual report’s staffing-and-capability sections now warrant the same close-reading discipline as the regulatory-publication sections.

For deeper reading: How to monitor Saudi policy changes, How to track the Humain roadmap, Players: SDAIA, How to evaluate an Arabic LLM.