Saudi Arabia releases a draft Global AI Hub Law redefining digital jurisdiction

On 14 April 2025, the Communications, Space and Technology Commission (CST) in the Kingdom of Saudi Arabia (KSA) issued a public consultation on the draft Global AI Hub Law. The draft proposes a revolutionary framework for establishing three types of AI hubs in the KSA, as well as introducing the concept of “data embassies” – private data centres dedicated to hosting data, applications, infrastructure and services of a foreign entity in accordance with the laws of a foreign country. If implemented, this legislation would solidify the KSA’s position as a global leader in digital governance and innovation, and have real implications on how organisations build, deploy and govern systems across borders. This article summarises key principles introduced by the draft and the relevance of this consultation to global organisations.

Why the draft Global AI Hub Law matters

Key objectives of this draft include:

1. Establishing foreign-affiliated data centres in the KSA to enable data-heavy business across borders, enhanced security, business continuity and sustainable infrastructure solutions; and
2. Maximising KSA’s strategic geographical location to offer technology solutions globally by enhancing access to technology and bridging the digital divide.

In a globalised economy, data localisation requirements remain at the forefront of business considerations. Extensive requirements for cross-border transfers of personal data and multiple data localisation regulations are a testament to this. These concerns are exacerbated by the proliferation of AI and data-heavy advanced technologies. 

With a pioneering move, the draft revolutionises the mainstream perspective on digital jurisdiction and takes a ‘bottom-up approach’ by regulating the infrastructure first. Data centres are therefore at the heart of this draft which proposes various options for infrastructure, ensuring robust and secure digital environments. 

The technical implications of the draft for the deployment of advanced technologies are also far-reaching. With AI growing more energy-intensive and sophisticated by the day, the possibility to bring computation closer to the point of delivery has material benefits in terms of efficiency, latency, real-time processing and continuity.

If implemented, this law could have tangible and significant implications on how organisations build, deploy and govern software solutions, not just AI systems.

Pragmatically, if the draft law is enacted, it would offer corporations new infrastructure options to consider based on their legal, business, and customer needs, in an area where questions on data localisation requirements remain at the forefront of many organisations’ infrastructure design and investment decisions.

From a legal, compliance and policy perspective, the proposed approach combines regulatory flexibility and operational clarity by enabling multinationals to continue to operate within a framework that they are familiar with and that is consistent with their broader global policies and procedures. This would provide a compelling option to reach a new level of cross border operational and cost efficiency.

Who should review the draft?

In addition to companies developing and deploying AI systems, this draft is relevant to all technology service providers wishing to offer their services to KSA residents, and to their customers and tenants. The reason being that the draft proposes a new outlook on data centres and digital jurisdiction that can materially alter options and expectations on technology infrastructures moving forward. 

The revolutionary ‘Global Hub’ model

The draft law introduces the concept of a “Hub”, which is defined as either a standalone data centre or a physically isolated and clearly demarcated section of a data centre, located in KSA. 

The draft law introduces three different types of hubs which are (1) private hubs, (2) extended hubs, and (3) virtual hubs. Each type serves a different purpose and operational model.

Below is a summary outlining the key differences between them:

Redefining digital jurisdiction: ‘Guest country’ vs. ‘designated foreign state’

The options introduced in the draft law redefine digital jurisdictions, allowing foreign governments and multinationals to operate in foreign hubs under their own laws. 

The draft law differentiates between a ‘guest country’ and a ‘designated foreign state’, each playing a different role depending on the type of hub involved and the process for their identification. 

A ‘guest country’ is a foreign state that has entered into a bilateral agreement with the KSA to establish and operate a private or an extended hub. The guest country’s laws will govern the data and services within these hubs based on the terms of the bilateral agreement. 

On the other hand, a ‘designated foreign state’ is any foreign state or states approved by the KSA for the purpose of operating a virtual hub. In this case, customer content hosted in the virtual hub will be subject to the laws and regulations of the designated foreign state, even though no bilateral agreement is necessarily required. 

This distinction is important because whilst private and extended hubs rely on formal state-to-state agreements, virtual hubs operate under a more flexible approval process, offering broader accessibility for international data hosting. Furthermore, the privileges and protections granted to each type of hub are dependent in part on this distinction.

Next steps

The draft law is open for consultation until 14 May 2025, offering the public an opportunity to share feedback. 

If you would like any support with reviewing the draft law, considering how it may impact your business and engagement with AI, and preparing your input, please contact Lamisse Bajunaid, who leads the KSA’s Intellectual Property, Technology and Commercial practice.