evidoria

← Back to browse

Good practice Imported

SDAIA's Regulatory Sandbox — Saudi Arabia's Region-First Testing Ground for Privacy-Enhancing AI

Saudi Arabia · Riyadh · See the Saudi Arabia profile · See the Riyadh profile

Evidence: Descriptive / self-reported Top 46% 60/100 · Ask Evidence Copilot about this practice

SDAIA's Data & Privacy Regulatory Sandbox, launched Feb 2023 as the region's first, lets MSMEs test privacy-enhancing AI and data products under supervised rules; its 2025 second-edition launch drew 150+ attendees, though no participant-outcome tally is yet public.

150+ people
Attendees at second-edition launch ceremony (2025)
SDAIA's Regulatory Sandbox — Saudi Arabia's Region-First Testing Ground for Privacy-Enhancing AI

Details

Maturity
Scaling
Promoter
Saudi Data & AI Authority (SDAIA) — National Data Management Office
Period
2023-2025
Keywords
data protection, AI governance, regulatory sandbox

Context

The Saudi Data & AI Authority (SDAIA) launched the Data and Privacy Regulatory Sandbox on 6 February 2023 — described as the first regulatory sandbox of its kind in the region for data and privacy — run by SDAIA's National Data Management Office out of the National Center for AI (NCAI) in Riyadh.

Objectives

Let micro, small and medium enterprises and entrepreneurs test products and services built on privacy-enhancing technologies within a defined, supervised regulatory framework before wider market entry, as part of the Kingdom's Vision 2030 digital transformation goals.

Activities

A second edition, the "Regulatory Sandbox Program 2025", opened for applications from 21 May to 31 July 2025 and was formally launched at a ceremony at SDAIA headquarters attended by more than 150 participants — digital service and product providers, developers, experts, policymakers and entrepreneurs.

Results

Neither edition has a published tally of companies accepted, tested, or graduated, nor any measured privacy or compliance outcome. The 150+ figure reflects launch-ceremony attendance, not sandbox throughput.

Conclusions

Treat impact claims as unverified until SDAIA publishes a results report.

Implementation
Indicative cost
Medium (€50k–€500k)
Time to results
Short (< 1 year)
Staffing & skills
SDAIA National Data Management Office staff, National Center for AI (NCAI) hosting/venue

Conditions for success

  • clear eligibility criteria for participating MSMEs
  • a defined, supervised regulatory framework with a legal safe harbour
  • government backing tied to national digital-transformation strategy (Vision 2030)

Common failure modes

  • lack of published participant-level outcomes undermines demonstrated impact
  • risk of remaining an announcement-heavy but outcome-light programme

Where it fits

Governance type
national data/AI authority-run regulatory sandbox
Scale
national
Income level
high-income

Commonly funded by

National / regional programmes

Indicative funding routes for practices of this type — always check each programme's current calls and eligibility rules.

Do you run this practice? Claim it — verified implementers get a public contact pathway and can propose corrections.

Data sources

Where this practice's information was retrieved from, and when.

Attachments

Similar practices you may find useful