Shaping the future of data sovereignty: Saudi Arabia issues new draft global AI hub law
Saudi Arabia has issued a draft Global AI Hub Law, aiming to establish a comprehensive legal framework to globalise data centres within the Kingdom. The proposed Law introduces the concept of “data embassies” allowing foreign entities to host data within Saudi Arabia under their own legal jurisdictions. Currently open for public consultation until 14 May 2025, the draft Law sets the stage for Saudi Arabia to become a global base for international data hosting.
Introduction
The Kingdom of Saudi Arabia has been quick in realising opportunities and enhancing its role in adopting and developing advanced digital technologies to establish itself as a global AI and technology hub. Saudi Arabia’s Communications, Space & Technology Commission (CST) issued the draft ‘Global AI Hub Law’ on April 14, 2025, which seeks to attract foreign governments and private sector entities by offering a legal framework that supports the establishment of sovereign data centres – termed ‘hubs’ – within Saudi territory. With this law, Saudi Arabia aims to foster innovation, attract further investment into the country and enhance the way business, consumers and governments do business in the region and globally.
In this article, we set out the key objectives of the draft Law and explore its benefits and implications for various stakeholders.
Overview of the Draft Law
What makes this draft Law groundbreaking is the introduction of ‘data embassies’, a concept already known to the world of data centres and advanced technologies but one that has yet to be applied on a global scale. Similar to a physical embassy, a data embassy is a data centre hosted in one country where another country maintains data sovereignty and can apply its laws and regulations (rather than the laws and regulations of the hosting country). Subject to the release of the final Law, Saudi Arabia will be the first G20 nation to establish a comprehensive legal framework focusing on the establishment of sovereign data centres.
While the term “AI” is not used throughout the draft Law (other than in the title), “advanced technologies” is used in connection with data centre operations implying that AI and other advanced technologies may be used in the operation of the data centres and the handling of cross-border data.
The draft Law’s primary objectives include fostering an attractive environment for foreign governments and private companies to develop and adopt advanced technologies for peaceful purposes, leveraging Saudi Arabia’s strategic geographical location (connecting three continents) to enhance global digital access, and establishing data centres that provide continuity of service with enhanced security and data sovereignty beyond borders. In essence, the Law seeks to encourage foreign investment in Saudi data infrastructure by assuring that data hosted in the Kingdom can remain under the jurisdiction of the data owners’ home country.
The draft Law will be regulated by a “Competent Authority” to be designated by a resolution of the Council of Ministers. It remains to be seen whether this will be CST, the Saudi Data & Artificial Authority (currently overseeing the implementation of the Saudi Personal Data Protection Law) or another regulatory authority.
The Three Hub Categories
The key takeaway from the draft Law is the establishment of three categories of ‘hubs’ (data embassies) located in Saudi Arabia: Private Hubs, Extended Hubs and Virtual Hubs. These can be entire data centres or an isolated and clearly demarcated part of a data centre. Each hub has distinct structures and requirements for operation, as highlighted in the table below:
| Private Hubs | Extended Hubs | Virtual Hubs | |
|---|---|---|---|
| Purpose | Hosting data, applications, infrastructure and services of a foreign government (“Guest Country”) for the sole use of the Guest Country | Hosting data, applications, infrastructure and services of a third party “Operator” | Hosting data, applications, infrastructure and services of a third party Saudi-incorporated “Service Provider’s” Customers data |
| Operator of Hub | Guest Country | “Operator” | “Service Provider” operating and incorporated in Saudi Arabia and approved by the Competent Authority |
| Governing Law | Guest Country’s laws and regulations
| Guest Country’s laws and regulations
| Designated Foreign State’s laws and regulations (and at all times in compliance with international law) |
| Requirements | Bilateral Agreement between Guest Country and Saudi Arabia |
|
|
| Privileges | Diplomatic-like immunities and extensive privileges to staff within parameters and consistent with relevant international treaties and the Bilateral Agreement | Although the draft law hints at making the same or similar privileges available to Extended Hubs, the wording is not crystal clear as it is for Private Hubs | N/A |
| Safeguards | The draft Law provides for a mechanism whereby the Saudi Council of Ministers can intervene in certain circumstances to terminate Bilateral Agreements or approvals previously granted. Such circumstances would be in relation to protecting Saudi Arabia’s national security or when a Guest Country no longer has diplomatic relations with Saudi Arabia. | ||
Data Sovereignty and Customer Data
A key feature of the draft Law is its approach to data sovereignty within the concept of Virtual Hubs. These hubs will be operated by Service Providers in Saudi Arabia but governed by the laws of the ‘Designated Foreign State’ – the country where the Customers are domiciled. This represents a major shift in cross-border data governance: authorities and courts of the Designated Foreign State will have the ability to issue binding orders concerning Customer Data hosted within Saudi Arabia. In effect, foreign governments will be able to extend their legal oversight into Saudi Arabia, with the added benefit from Saudi local authorities’ cooperation in enforcing such binding orders. Nevertheless, businesses considering establishing a Virtual Hub should remain mindful that Saudi local authorities will retain the right to intervene at any time if any activity is deemed to threaten Saudi Arabia’s national interests.
Strategic Implications and Potential Benefits
For global technology companies, foreign governments and others operating cloud, data-driven, or content services, the draft Global AI Hub Law offers significant strategic benefits. By establishing sovereign or semi-sovereign data hubs in Saudi Arabia, these companies could meet increasingly complex cross-border data transfer and localisation requirements while maintaining control under their home jurisdiction’s legal standards. This structure may reduce regulatory friction, offer faster regional service delivery to Middle East users, and enhance data security assurances for governments and corporate customers. However, companies will also need to navigate the operational and compliance complexities of managing foreign law obligations within Saudi territory, including potential tensions between the laws of their home jurisdictions and Saudi national interests.
What comes next?
The CST has initiated a public consultation process for the draft law through the Saudi ‘Istitlaa’ platform – click here for further details. Inquiries can also be directed to: AIHub@cst.gov.sa. The consultation process is open until 14 May 2025.
Government and private entities, investors and others who are interested in the draft Law and its potential implications on business operations in Saudi Arabia should carefully review it to assess whether setting up a Private, Extended of Virtual Hub aligns with their business objectives in Saudi Arabia. At this early stage, interested parties should proactively engage with the CST, participate in the public consultation process and put forward any enquiries they may have. This presents a valuable opportunity to influence the development of a policy framework in Saudi Arabia that could have lasting global implications.
The international community is likely to embrace the creation of sovereign and foreign-affiliated data centres in Saudi Arabia. The Global AI Hub Law could set a new benchmark, encouraging other countries to follow in Saudi Arabia’s footsteps and increasing competition in the region, ultimately driving innovation forward.
For any further information relating to the draft Global AI Hub Law or assistance in formulating a response to the consultation, please reach out to our team; Ken Wong, Ben Gibson, Masha Ooijevaar, Simos Schizas.
