Introduction
On April 14, 2025 [2] [5], Saudi Arabia’s Communications [2] [4] [6], Space and Technology Commission (CST) unveiled a consultation draft for the “Global AI Hub Law,” a pioneering legal framework aimed at establishing Saudi Arabia as a leader in data infrastructure and artificial intelligence (AI) among G20 nations. This initiative introduces the concept of a data embassy [6], designed to facilitate investment and development in this domain.
Description
On April 14, 2025 [2] [5], Saudi Arabia’s Communications [2] [4] [6], Space and Technology Commission (CST) released a consultation draft for a comprehensive legal framework known as the “Global AI Hub Law.” This initiative positions the Kingdom of Saudi Arabia (KSA) as the first G20 nation to propose a legal structure that incorporates the concept of a data embassy [2], aimed at facilitating investment in and the development of data embassies [2]. The draft law is significant as it represents the first comprehensive legal framework of its kind among G20 nations, establishing the KSA as a leading destination for data infrastructure and a global leader in digital infrastructure and artificial intelligence (AI).
The proposed Global AI Hub Law addresses the challenge of maintaining data sovereignty for nation-states when data must be hosted abroad. Essentially [2], a data embassy operates as a data center in one country governed by the laws of another [2] [3] [4], exempting it from the local jurisdiction of the hosting country [2]. The draft outlines a framework for three distinct hub models for data hosting: the ‘private hub,’ ‘extended hub,’ and ‘virtual hub.’ The private hub model allows foreign governments to exclusively host data and services [1], enjoying specific immunities and privileges akin to diplomatic immunities defined by bilateral agreements with the KSA. The extended hub model permits approved foreign operators to host data according to their own national laws [1], requiring compliance with relevant regulations and international best practices for data protection and cybersecurity [1] [5]. The virtual hub model enables local service providers to designate the legal regime of another country to govern the content they host in the KSA [1], meaning that jurisdiction and liability for customer content would fall under the designated country’s legal system [1], provided that the customer is domiciled or incorporated there [1]. However, the KSA retains the right to intervene under its own or international law if hosting activities are deemed harmful to its interests [1].
The draft law outlines the responsibilities of Guest Countries to ensure compliance with international law [2], enforce technology-use restrictions [2] [3] [4], and collaborate with Saudi authorities to enhance digital infrastructure [2] [4]. Operators are accountable for managing the hubs in compliance with applicable laws [5], international standards [1] [5] [6], and best practices in data protection and cybersecurity [1] [5]. Customer content within a Virtual Hub will fall under the jurisdiction of designated foreign courts [2] [3] [4], although Saudi courts may offer necessary assistance [3] [4].
A designated Competent Authority [2] [6], yet to be defined by the Council of Ministers, will oversee the approval of Guest Countries, Operators [1] [2] [3] [4] [5] [6], and Service Providers [2] [3] [4] [6], facilitating the establishment of private hubs [3] [4]. This authority may potentially be the CST or the Saudi Data and AI Authority (SDAIA). Distinct rules will apply to different categories of AI hubs [3] [4], including those for foreign government data centers [3] [4], foreign company data centers [2] [3] [4], and local data centers that comply with foreign laws [2] [3] [4]. Additionally, the proposed law includes provisions for the termination of hub arrangements [1], allowing the KSA’s Council of Ministers to cancel agreements to safeguard national security and sovereignty [1]. A stipulated 120-day period for the migration of data and services to other providers will follow any termination [1].
This initiative represents a foundational step in creating a data embassy ecosystem in Saudi Arabia [3], reflecting the country’s strategy to enhance international partnerships and digital infrastructure investment [6]. It presents both opportunities and regulatory challenges for stakeholders navigating multiple jurisdictions [6], with expectations for future iterations and implementing regulations to clarify the distinctions between hub types and the establishment processes [3] [4], all while ensuring that the provisions will not compromise the KSA’s safety [1], national security [1] [6], or diplomatic relations [1].
Conclusion
The introduction of the Global AI Hub Law marks a significant advancement in Saudi Arabia’s digital strategy, positioning the nation as a forerunner in the global data infrastructure landscape. By pioneering the concept of data embassies, Saudi Arabia is poised to attract international investment and foster technological collaboration. This initiative not only enhances the Kingdom’s digital infrastructure but also sets a precedent for other nations, potentially reshaping global data governance and sovereignty norms. The law’s implementation will require careful navigation of regulatory challenges to ensure it aligns with national security and international diplomatic relations.
References
[1] https://www.pinsentmasons.com/out-law/news/saudi-arabia-data-sovereignty-ai-hub-law
[2] https://www.lexology.com/library/detail.aspx?g=015b8434-0c62-4645-9839-dc7cd8066b63
[3] https://www.jdsupra.com/legalnews/saudi-arabia-pioneers-data-embassies-8553390/
[4] https://www.lawfuel.com/saudi-arabia-pioneers-data-embassies-with-publication-of-draft-global-ai-hub-law/
[5] https://www.tamimi.com/news/saudi-arabia-unveils-draft-ai-law-a-framework-for-global-tech-collaboration/
[6] https://www.twobirds.com/en/insights/2025/japan/ksa-public-consultation-on-draft-ai-hub-law
