Two things happened in Saudi Arabia this year that change how you would architect an AI product for the Kingdom. One is legal, one is infrastructure, and together they answer the two questions every AI project in the region gets stuck on: can we train on this data, and where does it run.
The legal part: an AI training exception, with conditions
Saudi Arabia published the Implementing Regulations of the Copyright Law in the official gazette on 31 July 2026, under Royal Decree No. (M/169). The updated Copyright Law entered into force on 12 August 2026.
Article 26(4) permits using copyrighted works for developing AI products and algorithms without the author's permission and without compensation, provided that:
- the work has been lawfully published,
- the original copy was lawfully acquired, and
- copying is limited to what is necessary for that purpose.
That is a genuine text-and-data-mining exception written into primary copyright law, which puts Saudi Arabia ahead of most jurisdictions in answering the question at all. But the conditions in Article 30 are where the engineering work lives:
- No downstream exploitation of the underlying works. The exception does not extend to republication, distribution, or direct commercial exploitation of the works themselves.
- Commercial use is restricted. Purely commercial contexts are excluded unless the use is non-substantial or does not affect the normal exploitation of the work. Latham & Watkins notes that the boundaries here remain unclear pending guidance from SAIP, the Saudi Authority for Intellectual Property.
- You must keep records. Developers must maintain records of the works used — type, source, purpose and date — and produce them to the authorities on request. Required detail level and retention period are not yet specified.
- No unjustified harm to the author's legitimate interests or to their exploitation opportunities.
- Output restrictions. Developers cannot adapt, republish, or incorporate copyrighted works into the final product without the rights-holder's consent, unless the work is public domain.
Read that record-keeping obligation again, because it is the part that lands on an engineering team rather than a legal one. "Type, source, purpose and date, producible on request" is a dataset manifest, and it is dramatically cheaper to emit at ingestion time than to reconstruct from a bucket of scraped files eighteen months later.
If you are building anything trained or fine-tuned on Arabic corpora for the Saudi market, add the manifest now. A minimum viable version is one row per source: identifier, origin URL or licence reference, acquisition method and date, acquisition legality basis, the processing purpose, and which training run consumed it. That is a day of work at the start of a project and an archaeology expedition at the end of one.
Be honest about the ambiguity, too. "Non-substantial" and "does not affect normal exploitation" are not engineering criteria, and SAIP has not yet defined them. The exception is a real basis to build on; it is not a blanket permission, and the conservative reading is the one you want on record until guidance arrives.
The infrastructure part: Azure lands in-Kingdom in November
Microsoft has announced that the Saudi Arabia East datacentre region will be available in November 2026. It sits in the Eastern Province and comprises three Azure availability zones, offering in-country data residency, low-latency access to cloud and AI services, and the multi-zone high availability that a single-region deployment otherwise cannot give you.
For a lot of Saudi enterprise and public-sector work this removes the recurring blocker. Until now, "process and store the data inside the Kingdom" and "use the managed AI services we actually want" were frequently in conflict, and the resolution was usually an awkward split architecture or a stalled procurement.
Microsoft also cites an IDC study projecting roughly $44 billion in new revenues for the Saudi economy between 2027 and 2030 across Microsoft, its partners and its customers, with the new region contributing about 13.4% of that, alongside around 100,000 new jobs. Treat those numbers for what they are: a vendor-commissioned economic projection published as part of a launch announcement, not a measured outcome. The availability date and the three-zone configuration are the facts you can plan against.
What this changes
If you are building AI products for Saudi clients, you now have two things you did not have a year ago: a statutory basis for training on lawfully acquired published works, and — from November — a way to keep the whole pipeline inside the Kingdom. The practical sequence is:
1. Start the dataset manifest immediately, regardless of where you are in the project. It is the one obligation that is already in force and already concrete.
2. Separate "works used in training" from "works reproduced in output" in your architecture and in your documentation. Article 30's output restrictions mean a RAG system that returns source passages verbatim is a different legal question from a model trained on the same corpus. Design the retrieval layer knowing that.
3. If data residency was the blocker on a Saudi deal, re-open it. The November region changes the answer, and procurement cycles are long enough that now is the time to revisit it rather than in November.
4. Do not assume the exception covers the commercial case you have in mind. Get a Saudi-qualified opinion on your specific use before you rely on it — particularly if your product's value depends on the substance of the copied works rather than on statistical learning from them.
If you are building anywhere else in the GCC, watch this as a template. Saudi Arabia has now legislated on AI training data in primary law while the UAE is still governing AI through adapted general instruments. Divergence between the two largest GCC markets is an architecture problem for anyone selling into both — the answer is usually a per-market data governance configuration rather than one policy applied everywhere.
We build regulated-market software in the GCC, including ZATCA Phase 2 e-invoicing integration, Nafath identity integration and Saudi PDPL-compliant application architecture. If you want help mapping this to a live system, that is what we do.
This is engineering context, not legal advice. Article 26(4) and Article 30 interact in ways that depend heavily on the specific data and the specific product; confirm with counsel qualified in Saudi Arabia.