Compliance checklists you can actually use.

1. Inventory & ownership

• List every AI system, model and AI vendor in use, with its purpose, owner and the data it touches.
• Record whether each system trains on, retrieves or generates personal data.
• Flag systems that make or support decisions about people.

2. Personal data (PDPL)

• Identify a lawful basis for training data, prompts, retrieval sources and outputs that contain personal data.
• Run a documented impact assessment where Implementing Regulation Article 25 requires it, including automated decisions and emerging technology.
• Explain AI processing in your privacy notice.
• Treat calls to AI providers abroad as personal-data transfers and document the Article 29 route.

3. Risk & ethics (SDAIA guidance)

• Build an AI risk register with the National AI Risk Management Framework (July 2026): identify, assess, treat, monitor.
• Check each system against the seven AI Ethics Principles; consider SDAIA’s AI ethics self-assessment.
• For generative AI and synthetic media, apply SDAIA’s GenAI and Deepfakes guidelines where relevant.

4. Security (NCA)

• Apply the NCA controls that already bind you (for example ECC-2:2024 or NCNICC-1:2025) to AI systems and their data.
• Track the draft NCA AI Cybersecurity Guidelines (consultation closed 5 August 2026) for governance, defense, resilience and third-party AI.
• Route AI incidents through your breach process; a personal-data breach may trigger the 72-hour SDAIA notice.

5. Sector rules

• Financial services: AI used against fraud must be auditable, not a “black box” (SAMA counter-fraud rules).
• Medical devices: follow SFDA MDS-G010 for AI/ML-based devices.
• Education: the NELC sandbox consultation deadline previously listed as 1 October 2026 has passed. Draft text checked 2 October; current closure and final adoption remain unconfirmed. Verify with NELC.

6. Vendors & evidence

• Get each AI vendor’s data location, subprocessors, retention and training-use terms in writing.
• Keep evidence: assessments, approvals, model changes and review dates.
• Re-review when a draft becomes binding; drafts are not requirements yet.

1. Lawful basis & notice

• Identify a lawful basis for every processing activity.
• Publish a PDPL-aligned privacy notice (purpose, data, retention, rights, contact).
• Where cookie processing relies on consent, obtain it before processing without preselected choices.

2. Consent & rights

• Consent is specific, informed, and withdrawable.
• Obtain marketing consent and provide a clear opt-out.
• A working process to handle data-subject requests (access, correction, deletion).

3. Records & governance

• Maintain a Record of Processing Activities (RoPA).
• Assess DPO appointment under the effective rules; do not treat a proposed amendment as binding.
• Ability to respond to SDAIA inquiries within the statutory window.

4. Security

• Technical + organizational safeguards proportionate to risk.
• Data classification applied before storage/hosting.
• Prepare SDAIA notification within 72 hours of awareness where a breach may harm personal data or subjects, or conflict with their rights or interests.

5. Cross-border transfers

• Verify any destination adequacy decision directly; this review did not locate a published list.
• Select the transfer route and safeguard with its conditions; SCCs, Binding Common Rules and accreditation are not interchangeable for every case.
• Complete risk assessment before Article 4 transfers and continuous or large-scale sensitive-data transfers.

6. Vendors

• Processor agreements with PDPL clauses.
• Sub-processor controls and locations documented.

Step 1: Are you CNI?

• For government or CNI entities, establish ECC/DCC scope and applicable supplementary controls.
• For a non-CNI private entity, verify NCA notification before determining the NCNICC duty.

Step 2: Which category?

• Category A for large entities: 65 controls across three domains.
• Category B for small and medium entities: 26 controls within one domain.
• Verify the Monshaat category and its boundaries against the notice; size alone does not establish scope.

Step 3, Category A: Governance

• Cybersecurity governance + defined roles.
• Periodic risk assessments.
• Policies reviewed and approved.

Step 3, Category A: Cybersecurity Defense

• Access management.
• Endpoint protection.
• Data classification.
• Backup management.
• Monitoring + logging.
• Incident response procedures.
• Periodic penetration testing.

Step 3, Category A: Third-party & Cloud

• Third-party/vendor cybersecurity requirements.
• Cloud computing cybersecurity controls.
• Employee awareness training.

Step 4: Category B

• Implement the 26 Category B controls specified in the official document and your notice.

Before any transfer abroad

• Identify the transfer purpose, processing basis and destination.
• Map data, recipients, foreign access and subsequent transfers.
• Verify adequacy or the specific exemption and safeguard conditions under Article 4.
• Complete risk assessment for Article 4 transfers and continuous or large-scale sensitive-data transfers.
• Document sector restrictions, national-security conditions, minimization and any exemption actually applicable.
• Approve arrangements before the first transfer and review when the flow changes.