Industrial Policy & Trade Monitor· 2666 actions· ✨ 90 recent

On 16 January 2026 the Saudi Council of Ministers, via Cabinet Decision No. 468/1447 (issued 30 December 2025 / 9 Rajab 1447H), published in the Umm Al-Qura Official Gazette four sets of implementing regulations governing the King Abdullah Economic City (KAEC), Ras Al-Khair, Jazan, and Cloud Computing & IT Special Economic Zones. The regulations entered into force on 16 April 2026 (90 days after gazette publication) and operationalise the SEZ framework first launched by ECZA in April 2023. Each zone has its own standalone framework but they share a common headline tax package: 5% corporate income tax for up to 20 years, zero VAT on intra-SEZ and SEZ-import flows, customs-duty suspension on qualifying imports, withholding-tax exemption on dividends and approved cross-border payments, and exemption from key provisions of the Saudi Companies Law, Commercial Register Law, and Trade Names Law. KAEC focuses on advanced manufacturing, automotive, consumer goods, ICT and pharmaceuticals; Ras Al-Khair targets shipbuilding, offshore rigs and MRO; Jazan covers food processing, metals conversion and logistics for Africa-bound trade; the Cloud Computing SEZ is a virtual zone (data centres can sit anywhere in KSA, headquarters must be in Riyadh) for cloud and AI-compute workloads. The package is the operational implementation layer for the 2024 Investment Law and a core Vision 2030 FDI-attraction instrument.

On 12 May 2025, Saudi Arabia's Crown Prince and PIF Chairman Mohammed bin Salman launched HUMAIN, a new PIF-owned company mandated to "operate and invest across the artificial intelligence (AI) value chain as a unified operating company" — spanning next-generation data centers, AI/cloud infrastructure, and a multimodal Arabic large language model (ALLAM). PIF's wholly-owned Saudi Company for Artificial Intelligence (SCAI) was folded into HUMAIN at launch. The company is a Vision 2030 vehicle for economic diversification away from oil into a state-controlled AI industrial base, and has since signed multi-billion-dollar infrastructure and chip-supply deals with NVIDIA, AWS, AMD, Cisco, and xAI, and a USD 1.2bn financing package with Saudi's National Infrastructure Fund toward a stated 6.6GW domestic data-center capacity target over the next decade.

Saudi Arabia's Personal Data Protection Law (PDPL), issued under Royal Decree M/19 (16 September 2021) and substantively amended by Royal Decree M/148 (27 March 2023), entered into force on 14 September 2023 with a one-year transition period that ended on 14 September 2024 — at which point the Saudi Data & Artificial Intelligence Authority (SDAIA) became the binding regulator with full enforcement powers. Alongside the Implementing Regulations and the Regulations on the Transfer of Personal Data Outside the Kingdom (both issued 7 September 2023), SDAIA published in 2024 a set of four pre-approved Standard Contractual Clauses templates (C2C, C2P, P2P, P2C) governing cross-border transfers. The regime establishes consent requirements, DPO appointment, a 72-hour breach notification duty, and prior-clearance / SCC-or-BCR-style conditions on personal-data exports out of Saudi Arabia.