The draft Global AI Hub Law (10-page / 350KB PDF), which has been opened to public consultation by the KSA Communications, Space, and Technology Commission (CST), represents the latest move by the KSA to establish itself as a leader in digital infrastructure and technologies, according to technology law experts at Pinsent Masons.
The primary objective of the Global AI Hub Law is to position the KSA as “a global digital hub and a pioneer in advanced technologies by fostering an attractive environment for foreign governments and private sector entities to develop and adopt such technologies for peaceful purposes and uses”.
Provisions providing for data hosted in the KSA to be governed by the laws of “guest countries” are a notable feature of the proposed new law.
There are three distinct ‘hub’ models providing for data hosting in the KSA, under the new law. The hubs described are essentially data centres, or isolated and clearly demarcated parts of a data centre.
The ‘private hub’ model proposed provides for the exclusive hosting of data and services by foreign governments, under which they would enjoy “appropriate immunities and privileges for the staff, premises, communications, data and technology stack”. The parameters for those immunities and privileges would be determined by the contents of a bilateral agreement that foreign states would need to enter into with the KSA to operate a private hub in the KSA.
The ’extended hub’ model envisages foreign operators hosting data and services according to laws applicable in relevant foreign countries. Under that model, foreign governments would have to guarantee the compliance of operators with relevant laws and regulations, as well as with international best practices for data protection, cybersecurity and the provision of data centre related services. Like with the private hub model, a bilateral agreement would need to be put in place to enable an extended hub to be operated in the KSA.
Under the ‘virtual hub’ model, service providers would be able to designate another country’s legal regime to govern the ‘customer content’ it hosts in KSA. It means that when those service providers host software, applications, data, text, audio, video or images that an organisation or its end users store, transmit or process via the hub, it would be “subject to the exclusive jurisdiction, responsibility and liability of the competent courts and public authorities” of the designated country. Only the laws of countries where the customer is domiciled or incorporated could be designated, under this model.
Under the virtual hub model, the KSA would retain rights to “take action” under KSA or international law where its authorities “reasonably considers” that the act of hosting or processing customer content “could constitute, a harmful act against the Kingdom or any other state or a form of interference in the internal affairs of another state”.
The proposed new law also provides for termination conditions for the global AI hub arrangements: the Council of Ministers in the KSA or its delegate would have the power to order the termination of any agreement, bilateral agreement or other arrangements entered into, or to cancel any approval issued, to protect the KSA’s safety, national security and sovereignty, or if the KSA ceases to enjoy diplomatic relations with a guest country.
Where a hub arrangement is terminated, the provisions of the law would continue to apply for 120 days from the effective date of termination – or longer as can be specified in the termination notice – to facilitate the migration of data and services to other hosting providers.
Under the proposed law, a new competent authority would be established to take on responsibility for implementing its provisions. The law also provides that nothing in the law is to be interpreted as prejudicing the KSA’s safety, national security, diplomatic relations or sovereignty.
Martin Hayward of Pinsent Masons said: “The Global AI Hub Law represents a significant step towards establishing the KSA as a global digital leader. By fostering investment in AI, cloud computing, and sovereign data centres, the law supports innovation, sustainable growth, and international collaboration. The introduction of advanced models, data sovereignty provisions, and government immunity ensures that the KSA is well-positioned to attract high-quality investments and drive the digital economy forward.”
Nils Rauer, Frankfurt-based expert in AI law at Pinsent Masons, added: “This is a remarkable step that could intensify, notably, the collaboration between KSA and EU member states. The EU is known for its comprehensive and bespoke legal framework on data in general, data privacy and lately also AI. Creating an extraterritorial hub allowing for regulations such as the GDPR, the Data Act and the AI Act to apply without any complex implementation procedure could form the fundament and help building prospering digital business cooperation.”
The CST, whose consultation on the draft Global AI Hub Law closes on 14 May 2025, said the KSA already has “cutting-edge digital infrastructure” among the very best in the G20, as well as rapidly growing telecommunications and technology markets.
