When the regulator certifies itself: SDAIA, ISO 42001 and what KSA organisations should do now

In July 2024, SDAIA — the Saudi Data and Artificial Intelligence Authority — became one of the first government agencies in the world to achieve ISO 42001 certification. Most commentators treated it as a press release moment. I read it differently.

Regulators do not certify against standards they do not intend to reference. When the body responsible for shaping Saudi Arabia's AI governance posture chooses to validate itself against ISO 42001, it is doing something deliberate: setting a benchmark before a legal obligation exists to meet it.

What has actually changed

Fast forward to November 2025: SDAIA released its AI Adoption Framework — mandatory for public sector entities, covering five core pillars: data governance, model accountability, transparency, human oversight, and risk management. Anyone familiar with ISO 42001 Annex A will recognise the territory immediately.

Then, in early 2026, Saudi Arabia declared the Year of AI. Ninety-eight percent of public sector workers reportedly use AI tools. A dedicated AI law — expected within the next two years — is being drafted against exactly this regulatory backdrop.

What ISO 42001 actually does in this context

ISO 42001 does not guarantee compliance with any specific national regulation — it was never designed to. What it does is build the governance infrastructure that makes compliance achievable: the policies, risk assessments, accountability structures, and audit trails that regulators — including SDAIA — have themselves validated as a credible foundation.

Think of it this way. PDPL requires you to govern data in AI systems responsibly. The AI Adoption Framework requires model accountability and human oversight. A future AI law will require demonstrable governance. ISO 42001 is the management system that operationalises all of those requirements — one framework, not three separate compliance exercises.

For organisations supplying technology to Saudi government entities, AI governance controls are increasingly a procurement requirement, not a nice-to-have. That shift is already underway.

The timing question

The organisations taking a "wait and see" position will eventually be right — they will get to compliance. They will just be doing it under pressure, on a shorter timeline, against a harder enforcement environment, with fewer options for how they structure it.

The organisations that move now do so on their own terms. They define scope, build capability incrementally, and arrive at certification with a governance system that actually works — not one assembled in a hurry to satisfy a procurement questionnaire.

Where to start

For most organisations, the honest answer is that they do not know where they actually stand against ISO 42001. They have AI in deployment — often more than they have formally inventoried — and limited visibility of what controls exist, where the gaps are, and what the priority risks look like.

The right starting point is a structured readiness assessment: scope the AI landscape, identify what governance exists, map the gaps against the standard, and build a pragmatic roadmap. That typically takes two to four weeks and gives leadership the information they need to make a real decision — not a theoretical one.

I have been working with organisations across the GCC on exactly this. If you are actively thinking through your AI governance position in KSA, I am happy to have a direct conversation — whether that is an initial scoping discussion, a readiness assessment, or joining one of our upcoming ISO 42001 practitioner-led training cohorts.