Saudi Arabia just opened a regulatory sandbox for AI-era data products
The regulator behind the Kingdom's data protection law will now test your product before the market does. The 2025 graduate list, published on the regulator's own platform, tells you more about what "compliant" means here than most legal memos.
The announcement, precisely
On October 6, 2026, the Saudi Data and AI Authority (SDAIA) opened registration for the Personal Data Protection track of its Data Regulatory Sandbox, according to the state-run Saudi Press Agency. Registration stays open for two months. To apply you need to be a licensed private entity operating in the Kingdom, your product or service has to process personal data, and you must already be in the National Personal Data Protection Register on the platform.
The sandbox page on SDAIA's National Data Governance Platform puts the service duration at 60 days and the cost at free. That last part is easy to miss while everyone reads "sandbox." A national regulator offering structured, supervised testing of your privacy measures, with expert consultations included, at no charge, is not a common offer anywhere.
You don't buy a certificate, you earn one
The participant journey has seven stages: application, assessment and admission, a jointly defined testing plan, supervised testing, an assessment against the plan's requirements, graduation, and post-exit monitoring. Only at graduation does SDAIA issue a completion certificate and a digital badge, and only then does the product appear on a public graduates list.
Post-exit monitoring is the stage I keep coming back to. The regulator checks whether you kept applying the measures you were tested on, after the badge, after the publicity. Sandboxes in fintech tend to end at graduation. This one goes on watching.
The graduate list is the real spec
The current cohort enrolled in September 2025 and graduated in April 2026. Four products made the list, and their published descriptions read like a shopping list of what the regulator wants to see:
- Codata, a B2B platform that masks and analyzes sensitive data using anonymization, pseudonymization, differential privacy, federated learning and homomorphic encryption. Data is processed and encrypted locally; only aggregated outputs are shared.
- Hojjah, an AI legal research platform that analyzes case documents while keeping encryption and security controls on data in transit.
- Smart Reach, an AI marketing platform that consolidates customer data into one profile while, per its own sandbox listing, expanding reach "without compromising targeting accuracy" on privacy.
- WAKI, a cashless payment system for schools that processes children's biometric data under access controls and data deletion procedures.
Notice what these have in common. Every one puts the technical measure inside the data path itself: masking before analysis, encryption during transmission, deletion rules around biometrics. None of them passed by writing a better policy document.
The eligibility wrinkle that matters in Dubai
Here's the detail most coverage skipped. SPA's announcement says applicants must be licensed private entities operating in the Kingdom. SDAIA's own eligibility FAQ uses broader wording: private entities within the Kingdom, "as well as entities outside the Kingdom that process Personal Data related to individuals residing in the Kingdom." A short state-news item and the regulator's platform disagree on how wide the door is. Arabian Current flagged the same gap and advises applicants to confirm cross-border eligibility through the platform rather than the announcement.
That second reading is the one a DIFC or ADGM professional-services firm should watch. If your clients include anyone resident in Saudi Arabia, the FAQ says you may be exactly who this track is for, even with no Saudi entity.
Why a 40-person consultancy in DIFC cares
Because the activity being audited here is the one your staff do every day without thinking about it. When someone pastes a Riyadh counterparty's signatory details into a model to summarize an NDA, that personal data crossed a border on the way to an inference endpoint. The PDPL treats that as processing, and SDAIA has now built a supervised route for testing whether your measures around it hold up.
The practical fix lives in front of the models rather than inside any one vendor contract: a gateway that strips person names, organization names, addresses, phone numbers and emails from prompts in English and Arabic before they reach a model, and keeps a hash-chained audit log of what went in and what came out. That is roughly the shape of evidence the sandbox rewards. It is also, full disclosure, what we build at LLM Fusion, at the gateway layer, hosted on Cloudflare.
Before the window closes
Check whether your firm is registered in the National Personal Data Protection Register, because the application requires it. Submit an interest through the National Data Governance Platform so you get alerts when each track opens. And if you serve Saudi-resident clients from a UAE free zone, ask the platform directly whether the out-of-Kingdom wording admits you. The answer to that question is worth more than another compliance memo.
The Data Monetization track opens in January 2027. Registration for the privacy one closes in December. Whatever you think of supervised compliance, the calendar is decided, and the firms that miss enrollment will build the same controls later, under worse time pressure and without the free consultations.