Corporate & Commercial 2026

Last Updated October 28, 2026

Saudi Arabia

Law and Practice

Authors



Al Akeel and Partners is a Saudi law firm based in Riyadh. The firm advises local, regional and international clients on corporate and commercial matters, combining knowledge of Saudi law with experience in domestic and international transactions. Its practice encompasses mergers and acquisitions, joint ventures, capital markets, banking and Islamic finance, real estate, regulatory matters and dispute resolution. It also advises on foreign investment, employment, intellectual property, franchising, family governance, restructuring and insolvency. The firm supports businesses with both ongoing legal requirements and complex new transactions, and represents clients before Saudi courts, specialist committees and arbitration tribunals. Its team includes lawyers proficient in Arabic, Russian, English and French.

The Companies Law recognises five principal company forms:

Limited liability companies (LLCs), whose owners generally bear liability only to the extent of their capital contributions.

  • Joint stock companies (JSCs), whose capital is divided into transferable shares and whose shareholders generally bear liability only to the extent of their subscription. JSCs have a more formal governance framework and are the form for businesses seeking an eventual stock exchange listing.
  • Simplified joint stock companies (SJSCs), which combine limited shareholder liability with greater flexibility in management and shareholder arrangements.
  • General partnerships, comprised of partners who are personally and jointly liable for the company’s debts and obligations.
  • Limited partnerships, comprised of at least one general partner with unlimited personal liability and at least one limited partner whose liability is generally confined to their capital contribution.

LLCs, JSCs, and SJSCs may each have a single owner. Professional companies may adopt these permitted company forms, subject to professional licensing and ownership requirements. A foreign company may also establish a licensed branch, which does not separate the parent from the branch’s liabilities.

Choice of Structure

Structure will largely depend on liability, proposed activities, governance, funding and financing, ownership restrictions and intended exits.

An LLC is a practical option where investors require limited liability and straightforward management arrangements. A JSC offers a more established framework for a wider shareholder base but entails more formal corporate procedures, and an SJSC is the best option for investors wishing to negotiate more bespoke governance and rights.

With regards to capital and financing, a JSC requires minimum issued capital of SAR500,000, with at least one quarter paid on incorporation. This minimum does not apply to SJSCs. An LLC’s capital is determined in its constitutional documents and does not have a statutory minimum capital, subject to applicable activity-specific and investment requirements. However, LLCs are commonly established with capital of at least SAR50,000, which is a practice point rather than a statutory threshold. Anticipated fundraising, share transfers, and a future listing should also inform the choice of structure.

Tax treatment depends significantly on ownership and tax residence. Resident capital companies are generally subject to income tax at 20% on taxable profits attributable to non-Saudi ownership, subject to applicable GCC treatment and statutory exceptions. Qualifying Saudi/GCC ownership is generally subject to the zakat religious tax and mixed ownership may bring both regimes into engagement.

Foreign investors must satisfy applicable Ministry of Investment (MISA) registration requirements and sector-specific rules may prescribe and statutorily determine legal form, capital, ownership, and onward licensing. There are also restricted activities which may require further approval.

Incorporation

Companies are incorporated electronically through the Saudi Business Centre (SBC). The requirements vary according to the company’s legal form, proposed activities, and ownership.

Founders should first determine the company form, ownership structure, activities, capital, and management arrangements. They should also identify any activity-specific approvals, ownership restrictions or minimum capital requirements for the proposed activities.

Foreign investors are required to register with the MISA and obtain an investment registration certificate before proceeding with incorporation through the SBC. Foreign corporate applicants ordinarily provide authenticated commercial registration documents and their latest annual financial statements, together with any activity-specific documents.

Some applicant categories may benefit from exceptions to certain investment requirements. However, these requirements depend on the proposed activities and ownership. For example, wholly foreign-owned wholesale and retail trading businesses require a minimum capital of SAR30 million, presence in at least three regional or global markets, and additional investment and operational commitments.

Following the above, founders should then select and reserve an available trade name through the SBC. Trade names may be in Arabic or English, subject to certain naming restrictions (eg, the proposed name must not be identical or confusingly similar to an existing reserved or registered name, irrespective of the business activity). A trade name may generally be reserved for 60 days pending incorporation.

The articles of association or bylaws should then be prepared according to the company form, setting out matters including its activities, capital, ownership, and management arrangements.

Supporting documents ordinarily include identification documents, incorporation and registration documents for corporate shareholders, authorising resolutions and powers of attorney where representatives act for the founders. Additional financial documentation may be required depending on the activity or regulatory approval concerned.

The incorporation application and constitutional documents are submitted electronically through the SBC. The SBC or Ministry of Commerce (MoC) may request clarification, further documents or amendments to the proposed constitutional documents. Any such comments must be addressed before the application can be finalised, and time should be allowed for this review process.

Following approval, completion of the required signatures and payment of the applicable fees, the company is registered in the Commercial Register and acquires legal personality.

Timelines and Fees

Standard electronic incorporation may be immediate once all requirements are satisfied. MISA’s ordinary registration period is ten working days after all registration requirements have been satisfied. Neither period includes document preparation, separate approvals, banking or operational set-up.

Incorporation charges include SAR1,200 for an LLC’s registration or SAR1,600 for a JSC’s, together with a SAR500 publication fee and applicable value added tax (VAT). These are components of the incorporation cost, and investment-related charges, other licenses, translation, authentication, and professional fees are additional.

Ongoing Compliance

There are principal recurring obligations which companies must observe. These include the following.

  • Annual confirmation of registered information. Commercial registrations are subject to annual confirmation rather than periodic renewal. Failure to confirm within 90 days of the due date results in suspension and any continued non-compliance for one year following suspension results in cancellation.
  • Annual financial statements, which, under Saudi-adopted account standards, must be prepared and deposited within six months of financial year-end, generally through the Qawaem platform. An auditor must be appointed where required. Qualifying micro and small companies may benefit from exemptions, subject to statutory conditions and exclusions.
  • Accounting records, ownership registers, minutes, annual corporate approvals and decisions, which must be completed and marinated as required for the company form. Changes to constitutional documents, management, and registered particulars must be recorded and filed where required.
  • Beneficial ownership identification, records, and reporting (see 1.5 Control Person Reporting).
  • Annual updates to MISA, which must be submitted by registered investors.

Companies must also maintain applicable licences and meet their tax, zakat, employment and social insurance obligations. Listed companies and regulated businesses are subject to additional reporting and supervisory requirements.

Capital and Issuance

A JSC’s issued capital comprises subscribed shares. Its bylaws may also specify authorised capital, and the board may increase issued capital once existing issued capital has been fully paid up. SJSCs may likewise have authorised capital, with their issued and paid-up capital specified in their bylaws. An LLC’s capital comprises ownership interests rather than transferable shares.

The Companies Law follows a nominal-value framework rather than a no-par-value share regime. Shares cannot be issued below nominal value and an issue above it requires constitutional authorisation or extraordinary general assembly approval. The premium is recorded separately within equity, and it cannot fund cash dividends but may fund bonus shares or absorb losses after profit-derived reserves have been exhausted. This differs from a no-par-value or stated-capital regime. Accordingly, the distinction is between nominal share capital and the separate premium account.

Capital increases may involve cash or in-kind subscriptions, capitalisation of reserves, or conversion of qualifying debt. Applicable valuation, payment, and approval requirements must be satisfied. Shareholders generally have pre-emption rights on cash issues, and a JSC’s extraordinary general assembly may disapply these where its bylaws permit and the company’s interests justify doing so. Reductions require corporate approvals and applicable creditor protections (see 1.4 Distributions and Return of Capital).

Share Classes

The Companies Law permits ordinary, preference, and redeemable shares, with different classes within these types. Shares within the same type and class carry equal rights and obligations, recorded in the bylaws.

Under the Companies Law, preference shares do not ordinarily confer voting rights at general meetings. Preference and redeemable shares must be fully paid on subscription and together cannot exceed 50% of capital. Issuance or conversion requires applicable corporate and affected-class approvals. Listed companies are subject to the applicable rules of the Capital Market Authority (CMA).

When structuring classes, class terms should address:

  • economic rights, such as dividend priority, whether preferential entitlements accumulate, participation in additional distributions and priority on liquidation;
  • level of control, voting rights, reserved matters and the interaction between class protections and corporate decision-making;
  • conversion and redemption triggers, pricing, timing and compliance with mandatory capital-maintenance requirements; and
  • future investment and exit, such as dilution, subsequent senior-ranking securities, transfer restrictions and the treatment of each class on a sale or listing.

These provisions should operate consistently across the bylaws, subscription documents, and shareholders’ agreement. Negotiated rights must be available for the chosen form and workable in later funding rounds.

Dividends and Capital Returns

The Companies Law permits JSCs, SJSCs and LLCs to distribute annual or interim dividends from distributable profits, with appropriate corporate approvals and respect for constitutional and class rights. Unlawful distributions are recoverable even from good-faith recipients. 

Distributable profits comprise retained earnings and distributable reserves. Interim distributions require constitutional authorisation, annual delegation to management, reasonable liquidity, predictable profits, and sufficient earnings supported by the latest financial statements, after accounting for subsequent distributions and capitalisations.

Returning paid-up capital requires compliance with the capital-reduction procedures. For JSCs, these include extraordinary general assembly approval, a board statement explaining the reduction and its effect on liabilities, and an auditor’s report. Where capital exceeds requirements, creditors must be invited to object at least 45 days before the meeting. Qualifying objections require payment of due debts or adequate security for unmatured debts. LLCs follow separate capital-reduction procedures.

Repurchases and Redemption

Unlisted JSC buybacks require authorisation and extraordinary general assembly approval. The shares must be fully paid up; treasury holdings cannot exceed 10% of the particular class; and their debit balance cannot exceed retained earnings. LLCs may purchase their own interests where their constitutional documents permit, subject to partner approval and waiver of the partners’ statutory recovery rights.

Listed buybacks are subject to additional CMA requirements, including:

  • sufficient working capital for the 12 months following completion;
  • assets at least equal to liabilities, including contingent liabilities, before and immediately after payment; and
  • a treasury-share debit balance not exceeding retained earnings.

The purchase price must also remain within distributable profits, even where external financing is used. Additional restrictions govern trading periods, purchase prices, trading volumes, public ownership, and disclosures.

Redemption must follow the authorised terms and applicable approvals. Redeemed shares and purchased preference shares are generally cancelled, with the required capital-reduction procedures completed. Ordinary shares may be retained as treasury shares within the applicable limits, and any company-held shares carry no voting rights.

Financial Assistance

Acquisition financing requires analysis against the particular loan, guarantee or security arrangement, including authority, corporate benefit, directors’ duties, conflicts and sector-specific restrictions. The Companies Law generally prohibits JSC loans or guarantees benefiting directors or their relatives, subject to specified exceptions. Financial institutions face further restrictions, including on financing secured by their own shares. These rules should be assessed against the particular support arrangement; see 6.1 Transaction Financing and Security Interests.

Beneficial Ownership

Private companies generally fall within the Beneficial Ownership Rules. These tests apply sequentially to identity:

  • natural persons owning at least 25% of capital, directly or indirectly;
  • where the first test does not identify the beneficial owner, or doubt remains, persons exercising ultimate effective control through other means; and
  • if neither test identified a natural person, the applicable members of the company’s administrative body.

Companies disclose beneficial ownership information on incorporation and maintain an accurate, register with supporting documents at their Saudi headquarters. Records cover identity, contact details, the nature and extent of ownership or control, and when it arose.

Changes must be reported to the MoC within 15 days, with reasons, and the information must also be confirmed annually on the anniversary of registration. Confirmation may be submitted up to 30 days beforehand. Nominee shareholders must also disclose whom they represent and the relevant beneficial ownership information.

Exemptions and Enforcement

Subsidiaries of listed companies subject to beneficial ownership disclosure requirements qualify for exemption, supported by evidence. The register is available to competent supervisory authorities, rather than being a general public register. Companies must also supply information requested by financial institutions and designated non-financial businesses and professions for due diligence.

Non-disclosure and missed annual confirmations attract graduated sanctions. For example, a first breach attracts a warning and a 30 remedial period, followed by fines ranging from SAR4,000 to SAR80,000 according to company capital. Repeat annual-confirmation breaches may attract increased fines, subject to a SAR500,000 ceiling. Beneficial ownership compliance is separate from maintaining the company’s direct ownership register.

The Companies Law and its implementing regulations govern the allocation of powers between shareholders and management, directors’ and managers’ duties, reporting, and accountability. Requirements differ according to the company’s legal form. The MoC administers unlisted-company requirements, whereas the CMA regulates listed JSCs within its statutory remit, including through its separate implementing regulations.

Listed companies also follow the Capital Market Law (CML), the CMA’s Corporate Governance Regulations (CGR), Rules on the Offer of Securities and Continuing Obligations (“Offering Rules”), and Saudi Exchange’s Listing Rules. The CGR are mandatory for Main Market companies except for expressly guiding provisions. For Nomu, the Parallel Market, specified provisions are mandatory and the remainder are generally guiding, unless another rule or CMA resolution provides otherwise.

Sector requirements supplement this framework also. The Saudi Central Bank (SAMA) governance principles and sector rules address board suitability, risk, compliance and audit in supervised financial institutions. Their application depends on the institution concerned. Other regulated sectors have their own supervisory requirements.

A company’s constitutional documents define management powers and decision procedures within statutory limits. Shareholder agreements and family charters supplement them (see 3.2 Shareholder Agreements).

The MoC’s Guiding Charter for Saudi Family Companies provides a voluntary reference for ownership succession, family participation and dispute resolution. Private companies may also draw on the CMA’s governance standards when developing board charters and internal policies, although listed-company requirements do not automatically apply to them.

The Companies Law imposes duties of care and loyalty on directors and managers, including LLC managers. These require acting within authority, promoting the company’s interests, exercising independent judgement, avoiding conflicts, disclosing interests and refusing improper benefits. Company assets, information and investment opportunities must not be exploited for personal gain.

The standard combines the care expected of a reasonably careful person in the position with the director’s actual knowledge and experience. The Companies Law protects good-faith business decisions made without personal interest, on an appropriately informed basis and with a firm, rational belief that they serve the company. The claimant bears the burden of proving otherwise; commercial loss alone does not establish liability.

The Companies Law permits director personal or joint liability for damage caused by legal or constitutional breaches, wrongful acts, negligence or failures in duty, and liability may extend to losses suffered by the company, shareholders, or third parties. Absence alone does not exempt a director from liability, but they may dissent a majority decision. Shareholder discharge does not also prevent statutory liability proceedings.

Requirements by Company Type

Board composition depends on primarily on legal form.

An unlisted JSC requires at least three directors, all natural persons, with terms not exceeding four years. The Companies Law imposes no general independent-director quota for such companies.

An LLC may be managed by one or more managers, with a board of managers formed if the partners so resolve. If an LLC has three or more managers, it must form a board. General listed-company requirements on independent and non-executive directors do not apply to an LLC.

SJSCs have flexible management arrangements, which would be specified in its bylaws. The bylaws may provide for a president, managers or a board. A conventional board is not compulsory.

Main Market boards require a non-executive majority and at least two independent directors or one third of the board, whichever is greater. Nomu follows the statutory JSC framework, with CGR composition provisions generally guiding unless separately made mandatory.

Independence and Eligibility

Independence requires objective judgement free from compromising relationships. CGR disqualifications include a holding of at least 5%, specified family connections, recent employment, material business interests and excessive additional remuneration. Independence is assessed annually; non-executive status alone is insufficient.

The Companies Law does not generally require every director to be Saudi or resident. Operational administration may nevertheless require a locally authorised representative, while executive employment engages immigration and work-permit rules. Professional and regulated companies may face additional qualifications, composition requirements, and regulatory non-objections.

Diversity and Best Practice

General best practice is to select a complementary mix of financial, legal, sector and operational expertise, alongside diversity of gender, experience and perspective. Saudi Exchange-supported ESG disclosure initiatives also encourage transparency concerning gender diversity. A skills matrix, transparent nomination criteria, succession planning and periodic board evaluations can help identify gaps. Private and family-owned companies may benefit from independent external directors even where appointments are voluntary.

Binding Obligations and Reporting

ESG obligations arise across the Environmental Law, Labour Law, Companies Law, CMA, and sector rules. Environmental permits, assessments, pollution prevention and remediation depend on the activity and impact. Employment, safety and Saudisation duties apply independently of sustainability reporting. These obligations apply to private and listed companies irrespective of whether they publish sustainability reports.

Article 278 of the Companies Law encourages corporate social responsibility but does not itself impose minimum expenditure. Similarly, CGR Articles 84 and 85 address social responsibility policies and initiatives but are designated as guiding provisions.

Saudi Exchange’s ESG Disclosure Guidelines and GCC metrics support voluntary reporting on environmental, social, and governance performance. There is no general requirement for every Saudi company to issue a standalone sustainability report or apply International Financial Reporting Standards (IFRS) S1 and S2. Sector rules and contractual commitments require separate assessment under the framework.

Listed issuers remain subject to mandatory disclosure obligations on material developments under the Offering Rules. A significant environmental incident, regulatory sanction or climate-related disruption may require disclosure even without a dedicated ESG reporting obligation. Applicable board-report requirements also include social contributions, if any.

The CMA’s guidelines for green, social, sustainability and sustainability-linked debt took effect on 27 May 2025. Although guiding, departures must be disclosed for covered SAR-denominated domestic public or private issues.

Directors and Board Oversight

The duties in 2.2 Directors’ Duties and Liabilities require attention to ESG matters where they materially affect compliance, operations, financial performance or the company’s interests. They do not create a separate duty owed to every stakeholder. Main Market professional-conduct requirements also address stakeholder rights, while detailed CGR stakeholder-relationship provisions are guiding.

Boards should adopt arrangements proportionate to the company’s activities and risk exposure. Recommended practices include:

  • assigning clear board/management responsibility;
  • incorporating risks and opportunities into strategy and investment decisions;
  • assessing physical climate risks;
  • approving measurable targets;
  • monitoring compliance, incidents, and remedial action; and
  • reviewing public sustainability claims.

Conflicts and Authorisation

The Companies Law requires managers and directors to disclose interests and avoid unauthorised conflicts. Interested transactions and competing activities require approval by the partners, shareholders or general assembly, or a duly authorised delegate, subject to statutory exceptions. Company assets, information and opportunities cannot be appropriated for personal benefit.

Exceptions to transaction authorisation include public tenders and ordinary-course transactions meeting personal needs on standard customer terms. Unauthorised transactions may support invalidation and recovery of benefits.

JSCs and LLCs

A JSC director must disclose an interest for recording in the board minutes and abstain from the relevant board and general assembly vote. The board informs the general assembly, supported by a special auditor’s report. Approval does not eliminate liability for unfair transactions causing shareholder loss.

For unlisted JSCs, delegated board approval is subject to conditions: the transaction or annual aggregate must be below both 1% of latest annual revenue and SAR10 million, within ordinary activities and without preferential terms. Delegation cannot exceed one year or the board’s remaining term. Listed companies follow the corresponding CMA framework.

Under the Companies Law, JSC delegation controls apply to LLC boards unless their articles prescribe different controls. An interested LLC manager may deliberate and vote where the articles expressly permit this.

Listed-Company Disclosure

CMA rules cover a wider related-party category, including substantial shareholders, directors, senior executives and specified connected persons. Main Market companies require a conflicts policy and exclusion of conflicted directors from relevant deliberations and voting. Audit committee review and recommendations on related-party contracts are also mandatory for Nomu under Article 52 of the CGR.

Article 65 of the Offering Rules requires prompt disclosure of related-party transactions and specified joint investment or financing arrangements reaching 1% of latest audited annual gross revenue. Smaller transactions may satisfy the general materiality test. Disclosure thresholds do not replace approval requirements. Applicable annual board-report and disclosure-register obligations also remain relevant.

Voting and Information

Rights depend on company form, constitutional documents, and share class. They generally include participation in decisions, prescribed information, lawful distributions and liquidation proceeds. See 1.3 Share Issuances and 1.4 Distributions and Return of Capital for class rights and distributions.

JSC shareholders may attend, discuss and vote at assemblies. The ordinary general assembly elects and removes directors and appoints the auditor where required. In an LLC, each partner has votes corresponding to the number of interests held. The more flexible governance arrangements for SJSCs, discussed in 1.1 Business Organisations, allow their articles to determine decision-making procedures, subject to matters reserved by law to shareholders.

Holders of at least 10% of a JSC’s voting shares may require an ordinary general assembly; the board must issue the invitation within 30 days. LLC partners holding at least 10% of capital may also request an assembly.

Owners receive prescribed financial statements and management and auditor reports and may question management on agenda matters. JSC shareholders dissatisfied with an answer may refer the matter to the assembly. LLC partners, similarly, may discuss agenda items and question management Under Article 171 of the Companies Law, non-managing LLC partners may inspect records at headquarters, personally or through a representative, twice each financial year. The company must respond within 15 days. Confidentiality and restrictions on harmful use apply.

Fundamental Changes

JSC constitutional amendments generally require two-thirds of voting shares represented at a duly constituted extraordinary general assembly. Article 93 of the Companies Law requires three-quarters for specified changes, including capital alterations, mergers, divisions, term extensions and early dissolution.

LLC constitutional amendments generally require three-quarters of total capital, unless the articles require more; specified matters require unanimity. SJSC bylaws determine thresholds, subject to reserved shareholder matters and applicable unanimity and class-consent rules under Article 145 of the Companies Law.

Statutory Remedies

Available remedies include the following.

  • Personal claims for individually suffered loss and derivative claims by holders of at least 5% of capital, or a lower constitutional threshold, where the company fails to act. Derivative claims require valid grounds, good faith, the company’s interest and at least 14 days’ notice to management.
  • Challenges to unlawful JSC or LLC resolutions, generally within 90 days, subject to objection or absence conditions and continued ownership throughout proceedings.
  • Judicial inspection sought by JSC shareholders holding at least 5% of capital where management or auditor conduct raises suspicion.
  • Judicial removal of LLC management at the request of partners holding at least one quarter of capital.

Underlying duties and conflict remedies are addressed in 2.2 Directors’ Duties and Liabilities and 2.5 Conflicts of Interest and Related-Party Transactions.

Use and Enforceability of Shareholder Agreements

Article 11 of the Companies Law recognises shareholder agreements and family charters, provided they do not conflict with the Law or constitutional documents.

Shareholder agreements commonly supplement the statutory rights described in 3.1 Shareholder Rights through board nomination rights, reserved matters, enhanced information rights, funding commitments, dividend policies, deadlocks, defaults, and exit. Transfer provisions commonly include rights of first refusal, permitted transfers, lock-in periods, and tag/drag rights.

Key governance and transfer terms should be reflected in the constitutional documents where corporate effect requires. A contractual undertaking between shareholders does not, by itself, replace statutory approval or registration. Incoming shareholders should ordinarily execute an accession agreement and exit provisions should clearly identify their triggers, valuation methodology, payment terms and completion procedures.

Transfer Restrictions

For LLCs, Article 178 of the Companies Law provides notification and recovery rights when interests are transferred to a non-partner. The ordinary exercise period is 30 days; articles may extend it and regulate notification and valuation. Contractual rights of first refusal, permitted transfers, and other restrictions should accommodate this framework.

JSC bylaws may restrict transfers without permanently prohibiting them. Article 113 permits prescribed drag-along and tag-along provisions with approval from holders of at least 90% of voting shares for such placement in its bylaws.

SJSCs have broader flexibility under Articles 151 to 154, including approval requirements, lock-ins of up to ten years, extendable unanimously, and compulsory-transfer provisions. Introducing or amending the specified restrictions requires unanimous approval. All transfers remain subject to ownership and regulatory restrictions.

Dispute and Protection

Commercial Courts ordinarily determine corporate disputes, subject to valid arbitration agreements and specialist jurisdiction, including securities dispute committees. Agreements may provide for negotiation, mediation, expert valuation and arbitration. Arbitration agreements must be written and authorised; SJSC and LLC constitutional documents may include arbitration and alternative dispute resolution under Articles 153 and 173 of the Companies Law, excluding criminal matters.

Breach may justify performance or damages. Article 164 of the Civil Transactions Law (CTL) permits performance in kind where possible, subject to statutory conditions. Saudi enforcement remains subject to Sharia and public policy.

The personal and derivative actions, resolution challenges, judicial inspection and management-removal remedies described in 3.1 Shareholder Rights are the principal statutory protections. Directors’ underlying duties are addressedin 2.2 Directors’ Duties and Liabilities and interested-transaction remedies in 2.5 Conflicts of Interest and Related-Party Transactions.

The Companies Law does not establish a general unfair-prejudice petition automatically entitling a dissatisfied shareholder to a buyout. A complaint should identify the breached statutory, constitutional or contractual right and the appropriate remedy.

Article 243 of the Companies Law dissolution by final judgment, but disagreement alone does not automatically justify winding up. Article 46 permits judicial dissolution of a general partnership where continuation is infeasible, and removal of a partner on valid grounds. Financial distress engages the Bankruptcy Law; agreed deadlock and exit mechanisms remain particularly useful for otherwise viable companies.

Framework and Structures

Private M&A are governed principally by the Companies Law and CTL, supplemented by constitutional documents and shareholder agreements. Public transactions also engage the CML, the CMA’s Merger and Acquisition Regulations (“M&A Regulations)”, Offering Rules and Listing Rules. The M&A Regulations cover specified acquisitions reaching 10% of a listed target’s voting shares, including concert-party holdings, rather than only majority acquisitions.

Both public and private deals require competition analysis under the General Authority for Competition (GAC) regime. Foreign investment and sector change-of-control approvals are separate requirements; see 8.1 Competition and Merger Control and 8.2 Foreign Investment Restrictions and Sector-Specific Rules.

Common structures include the following.

  • Share or interest purchases, preserving the target’s identity, contracts and liabilities. Historic exposure, warranties, indemnities and change-of-control consents are central.
  • Asset or business transfers, allowing an agreed perimeter but potentially requiring individual conveyances, assignments, employee arrangements and licence approvals. Mandatory liabilities cannot necessarily be excluded.
  • Subscriptions, often combined with secondary purchases, to fund growth or establish joint ventures. Capital approvals, pre-emption, dilution and class require consideration under 1.3 Share Issuances and 3.1 Shareholder Rights.
  • Statutory mergers, producing succession to the absorbed company’s assets, rights and obligations.
  • Listed-stake acquisitions, takeover offers and securities exchange offers, subject to their respective CMA procedures.

Structuring should address control, cash or share consideration, tax and zakat, VAT and real estate transaction tax, financing, security, consents and the sequence of registration steps. Minority veto rights can confer control for merger notification. Capital, conflicts and transfers are addressed in 1.3 Share Issuances, 2.5 Conflicts of Interest and Related-Party Transactions and 3.2 Shareholder Agreements.

Mergers and Court Involvement

Articles 225 to 229 of the Companies Law permit absorption into an existing company or combination into a new company. The proposal must address terms, consideration and debt-servicing capacity, supported by valuation and corporate approvals. Each participant announces the proposal at least 30 days before the decision.

Creditors have statutory objection rights and may seek judicial protection where payment or adequate security is not provided. Under Article 227, the court may suspend or postpone the merger in prescribed circumstances. Registration makes the merger effective and produces statutory succession.

An ordinary Saudi merger does not require routine judicial sanction equivalent to a foreign scheme of arrangement. Court involvement instead arises through creditor objections, corporate disputes or insolvency proceedings. For distressed transactions, the Bankruptcy Law’s protective settlement, financial restructuring and liquidation procedures may provide a framework for a restructuring or disposal, with court, creditor and trustee involvement depending on the procedure.

Public Offers

Public deals require prescribed announcements, documents, independent advice and shareholder communications, with restrictions on dealings and frustrating action. Shareholders within the same class must receive equal treatment.

Under Article 23 of the M&A Regulations, reaching 50% or more of a listed voting class in the specified circumstances gives the CMA discretion to require an offer for the remainder. Crossing 50% does not alone impose an automatic offer. A required offer includes cash or a cash alternative under the pricing rules. Acquiring all shares through a securities exchange offer requires CMA and prescribed extraordinary general assembly approval.

Recent Developments

Several developments have materially affected transaction planning, as follows.

  • The amendments to the Companies Law expanded structuring flexibility, including through SJSCs, share classes and express transfer and exit mechanisms.
  • The GAC’s fifth-edition guidelines clarified control, notification thresholds and the local nexus for acquisitions. This affects minority investments, joint ventures and foreign-to-foreign transactions.
  • From 1 February 2026, direct Main Market investment opened to all foreign investor categories, removing Qualified Foreign Investor eligibility requirements while retaining applicable ownership restrictions. In April 2026, the CMA also introduced the framework for special purpose acquisition companies on Nomu; see 5.1 Securities Regulation and Public Offerings.

Framework and Authorities

The CMA regulates securities offers, market conduct, intermediaries and continuing disclosure under the CML and instruments identified in 2.1 Legal Framework.

Saudi Exchange operates the Main Market and Nomu – Parallel Market and administers admission and continuing listing requirements under CMA-approved rules. Edaa and Muqassa perform the relevant depository, settlement and clearing functions. Securities disputes fall within the specialised securities dispute committees.

Public Offerings and Listing

A Main Market equity IPO ordinarily requires financial and legal advisers, underwriting, corporate and sector approvals, and parallel applications to the CMA and the Exchange. Eligibility generally includes three years of operating and audited financial history and sufficient working capital for the following 12 months.

An Arabic prospectus must provide prescribed business, financial, ownership, governance, risk, litigation, contract and offer information sufficient for an informed decision. Material developments or significant omissions may require a supplementary prospectus and investor withdrawal rights.

Ordinary Main Market admission requires expected market capitalisation of at least SAR300 million, 200 public shareholders and a public holding of 30% of the relevant class, subject to permitted dispensations. Public distribution requirements also continue after admission. CMA offering approval and Exchange listing approval are complementary.

Nomu has a lighter regime, generally restricted to Qualified Investors. Baseline public distribution requirements are 50 public shareholders and 20% of the relevant class or shares worth SAR30 million, whichever is less. A Nomu offer is a separate regulatory category, not simply a private placement.

The 2026 Nomu framework permits special purpose acquisition companies (SPACs), with sponsor, redeemable-share and escrow safeguards and minimum post-offer capital of SAR100 million. A qualifying acquisition or merger ordinarily must complete within 24 months of listing, with a possible 12-month extension subject to the prescribed approval process.

Follow-On Issues and Timing

Follow-on issues include rights issues, issues suspending pre-emption, capitalisation, debt conversion and acquisition consideration shares. The required prospectus or circular depends on the structure. Specified issues benefit from prospectus exemptions, including an increase not exceeding 10% of an already listed class within 12 months and qualifying capitalisation, conversion or acquisition issues. Approval, circular and other disclosure requirements may remain. Public debt offers follow separate provisions.

The CMA’s ordinary equity-offer review period is 45 business days after complete submission, subject to enquiries or deferral. An approved prospectus is ordinarily published at least 14 business days before the offer, or the relevant assembly for rights issues and issues suspending pre-emption. These periods exclude preparation, restructuring, due diligence and bookbuilding; the overall process commonly takes several months. Continuing disclosure is addressed in 5.2 Continuous Disclosure.

Exemptions and Private Placements

The Offering Rules distinguish exempt offers from private placements as follows.

  • Institutional/Qualified Client placements are limited to those CMA client categories and do not use the limited-offer numerical and subscription caps.
  • Limited placements have no more than 100 offerees, excluding Institutional and Qualified Clients, and a SAR200,000 maximum payable by each other offeree. Same-class repetition is restricted within the prescribed 12-month period.
  • Small exempt offers require aggregate subscriptions below SAR10 million, no more than 50 offerees excluding Institutional and Qualified Clients, and a SAR200,000 cap for each other offeree. Risk acknowledgements and restrictions on repetition apply.
  • Corporate exemptions cover specified existing-shareholder, affiliate, employee, debt-conversion and insolvency offers, each subject to its conditions. Authorised-platform crowdfunding has separate issuer, fundraising and investor limits.

Institutional Clients include specified governmental and financial bodies, funds and qualifying entities with net assets exceeding SAR50 million. Qualified Clients include eligible entities with net assets from SAR10 million to SAR50 million and individuals meeting wealth, trading, experience or qualification tests. An individual wealth route requires at least SAR5 million net assets. Nomu’s Qualified Investor definition is distinct.

Private placements generally require an appropriately licensed arranger, CMA notification ten business days before commencement, prescribed declarations and offering documents. Specified domestic debt offers use a shorter notification route. Completion information is generally due within ten business days. Exempt offers may retain quarterly reporting obligations. Materials must be clear, complete and not misleading and the CMA may prohibit an offer.

Privately placed securities generally must be resold through a capital market institution using a permitted route: a price not exceeding SAR200,000; transfer to an Institutional or Qualified Client; or another prescribed circumstance. Exceptions address appreciation and specified whole-holding disposals. Restrictions follow later transferees until listing of the same class is approved, rather than automatically expiring after a fixed period.

Crowdfunding and other exempt categories have their own conditions. Constitutional and contractual restrictions also apply. Breach can lead to offer or transfer prohibitions, sanctions and investor remedies.

Periodic and Event Reporting

Listed issuers must make complete, clear, accurate and non-misleading disclosures under the Offering Rules, Listing Rules and Instructions for Companies’ Announcements.

Main Market interim financial statements are generally due within 30 business days of the period-end; annual statements within three months of the year-end and at least 21 calendar days before the annual assembly. The annual board report is also due within three months. This covers the company’s operations and factors relative to assessing its financial position, together with the corporate governance disclosures. Nomu has modified requirements, including semi-annual rather than quarterly interim statements.

Non-public developments affecting an issuer or subsidiary must be disclosed without delay where they may reasonably affect securities prices or significantly affect listed-debt commitments. Materiality considers the information’s likely importance to a prudent investor.

Specified events independently trigger disclosure, including qualifying asset transactions, borrowing and losses at the applicable 10% of net assets threshold; disputes involving at least 5% of net assets; and entry into or unexpected termination of contracts generating at least 5% of annual gross revenue. Management and auditor changes, capital decisions, dividends, assemblies and insolvency events also require announcements. Related-party disclosure is addressed in 2.5 Conflicts of Interest and Related-Party Transactions.

Publication and Control

Announcements are published through the Saudi Exchange’s designated electronic disclosure system using the applicable announcement templates. Main Market issuers must disclose in Arabic and English and Nomu issuers must disclose in Arabic and may provide an English translation. Arabic prevails in the event of inconsistency.

Publication must follow the applicable trading-window rules and occur as soon as possible before the next trading period. Events during trading are generally announced after closing, with confidentiality maintained; threatened leakage may require a temporary halt request.

Information must remain confidential before publication, with measures to prevent leakage and restrictions on disclosure to persons who are not bound by confidentiality. Where disclosure would be unduly detrimental and omission would not mislead investors, the issuer may apply confidentially to the CMA for permission to delay or waive disclosure. Commercial sensitivity alone does not permit unilateral postponement. Issuers must also assess whether market rumours require a response.

Issuers should maintain designated disclosure contacts, emergency authority, confidentiality controls and procedures for rumours. Responsibility for content remains with the issuer.

Prohibited Conduct

Articles 49 and 50 of the CML and the Market Conduct Regulations prohibit manipulation and insider trading. Manipulation includes fictitious trades, matched orders, artificial prices and misleading statements or rumours, including through social media.

Inside information includes non-public securities or order information whose disclosure would materially affect price or value. Restrictions cover insiders, connected persons and recipients who know or should know the nature of the information, as well as direct and indirect trading. Tipping is prohibited where the discloser knows or should know that the recipient may trade. Confidential client orders can therefore engage these rules.

Enforcement

The CMA may investigate, require records, summon witnesses, direct correction, suspend issuance or trading and exercise licensing powers. Its administrative fines may reach SAR5 million per violation. The Saudi Exchange monitors its rules and refers suspected breaches.

Criminal cases may proceed through the Public Prosecution before the securities dispute committees. Available sanctions include fines reaching SAR25 million per intentional violation, payments up to three times gains or avoided losses, compensation, seizure and professional bans. Relevant offences may also attract imprisonment up to five years. Investor compensation claims remain available where statutory conditions are met. A recent financial-reporting enforcement example is provided in 2.2 Directors’ Duties and Liabilities.

Substantial Interests

Under the Offering Rules, a person acquiring ownership of, or an interest in, at least 5% of a class of voting shares or convertible debt instruments must notify the Exchange by the end of the third trading day after the transaction or event. The rule covers individuals and entities, including foreign investors, in Main Market and Nomu issuers.

Specified relatives’, controlled companies’ and concert parties’ interests are aggregated. The notice identifies holders, acquisition details and financing. Changes to the notified list of persons whose interests are included must also be reported within three trading days.

Controls and Reporting

No single prescribed compliance programme applies to every private company. Requirements depend on form, listing and activity, and should support the duties in 2.2 Directors’ Duties and Liabilities.

Main Market companies require board-approved internal controls, risk management, independent internal audit and an annually updated audit plan under CGR Articles 70 to 74. Internal audit is accountable to the audit committee and needs unrestricted access to relevant records. Outsourcing does not remove corporate responsibility. Nomu’s differentiated rules are discussed in 2.1 Legal Framework.

Main Market companies require confidential reporting, investigation and follow-up arrangements and protection for reporting stakeholders. SAMA-supervised institutions have applicable whistle-blowing requirements. Financial institutions and designated non-financial businesses and professions must maintain anti-money laundering controls and report suspicious transactions externally; internal reporting is insufficient.

A proportionate programme should allocate board oversight and operational responsibility, identify legal obligations and risks, maintain policies and training, and test compliance. Priorities include conflicts, bribery, reporting, data protection and sector risks. Reporting channels should support confidential escalation, independent investigation, documented remediation and monitoring. Disclosure controls in 5.2 Continuous Disclosure should form part of this framework.

Security Framework

The principal laws are the Law on Securing Rights over Movable Assets, Commercial Pledge Law, Registered Real Estate Mortgage Law, Enforcement Law and Bankruptcy Law. The CTL supplements them on obligations, assignments and guarantees.

Security can cover movable assets, shares and interests, receivables, accounts and real estate. The movable-assets regime accommodates present and future assets and collective collateral descriptions. Foreign labels such as floating charge do not independently create effective Saudi security.

Perfection and Priority

Creation, third-party effectiveness and enforcement are distinct. Movable security generally uses the Unified Register for Rights on Movable Assets, with possession or legally recognised constructive possession relevant to specified assets, including accounts. Real estate follows the applicable registry or notarisation regime. Shares require the relevant company or securities procedures; Edaa has separate pledge-registration requirements.

Priority ordinarily follows the applicable perfection method and time, subject to statutory exceptions and effective priority waivers. Searches, collateral descriptions and existing-lender releases are important. Qualifying movable security permits agreed non-judicial enforcement through statutory procedures; other cases may require the Enforcement Court. Bankruptcy stays, avoidance and distribution rules can affect enforcement.

Acquisition Financing

Financing commonly combines buyer equity with bank facilities, including murabaha, supported by share pledges, account and receivables security, asset security, guarantees and promissory notes. A promissory note supports debt enforcement but does not create proprietary security.

Target support requires authority, approvals, corporate benefit and conflict analysis, particularly where debt funds the buyer’s acquisition. Related restrictions are addressed in 1.4 Distributions and Return of Capital and 2.2 Directors’ Duties and Liabilities.

Intercreditor terms should allocate enforcement control, waterfalls, standstills, releases and subordination consistently with perfected priorities and mandatory insolvency rules.

The 2020 movable-security reforms established a broader framework for modern collateral and registration and the CTL subsequently clarified general obligations and guarantees. Transaction documents should use the applicable statutory mechanisms rather than assume that imported security concepts achieve the same result, as contractual agreements alone does not cure defective perfection. For example, in real estate mortgages, changes to priority require the relevant recording to bind third parties.

Formation and Validity

The CTL governs commercial contracts subject to special legislation and applicable Sharia principles. Formation generally requires offer and acceptance, capacity, valid consent and a lawful, sufficiently ascertainable subject matter. Common-law consideration is not a separate universal requirement.

Consent may be oral, written or inferred from conduct unless formalities apply. Corporate signatories need appropriate authority. Electronic contracts and signatures are recognised under the Electronic Transactions Law. Some transactions require writing, notarisation or registration.

Incapacity, material mistake, fraud, duress, unlawful subject matter or purpose, and failures of mandatory form can invalidate a contract or permit avoidance. The consequences differ for void and voidable contracts. Exploitation can justify intervention under statutory conditions, and an unfavourable bargain alone is insufficient.

Interpretation and Enforceability

Performance must accord with good faith. Clear wording generally governs; otherwise, interpretation seeks the parties’ common intention, considering context, custom and prior dealings.

Liability limitations are generally permissible, but cannot exclude the debtor’s fraud or gross negligence, and liability for harmful acts cannot be contractually excluded. Courts may amend unfair adhesion terms or relieve the adhering party from them. Contractual freedom therefore operates within mandatory law and public policy.

Breach and Termination

Remedies include performance, compensation and termination. Compensation may cover proven loss and lost profit, subject to causation, foreseeability and avoidable-loss rules. Under CTL Articles 178 and 179, agreed compensation may be reduced if excessive or the obligation partly performed, and is unavailable where no loss occurred. It cannot be predetermined for an obligation to pay money.

After notifying the defaulting party, a party to a bilateral contract may seek performance or termination, with compensation where justified. A court may refuse termination for an insignificant breach. Agreed termination without a court ruling is permitted, but notice remains necessary unless expressly waived.

Termination generally entails restitution, with different treatment for continuing contracts. Termination without a contractual or statutory basis may itself constitute compensable breach.

Force Majeure and Hardship

Article 110 addresses impossibility beyond the debtor’s control: the obligation and its counterpart are extinguished, and full impossibility automatically terminates the contract. Article 174 permits contractual allocation of force majeure risk. Partial and temporary impossibility require separate analysis.

Unforeseeable general exceptional events making performance excessively onerous and threatening heavy loss engage Article 97. The affected party may promptly seek negotiations, without suspending performance. If agreement fails, the court may reduce the obligation to a reasonable level. This mandatory protection differs from impossibility; a frustrated commercial expectation alone does not establish either test.

Transactions and Ownership

Intellectual property is governed by patent legislation, the GCC Trademark Law, Copyright Law and confidential commercial information regulations. The new Copyright Law took effect on 12 August 2026.

Due diligence should establish ownership, registrations, licences and encumbrances. Assignments and licences should identify the rights, territory, term, exclusivity, sublicensing, improvements and enforcement, with Saudi Authority for Intellectual Property recordals where required. Trade secrets require contractual and practical protection of secrecy.

Employment-related inventions generally belong to the employer where statutory conditions are met, subject to contrary agreement and inventor remuneration. Under Article 18 of the Copyright Law, works created during employment and relating to the employer’s activities generally belong to the employer unless otherwise agreed. For commissioned works outside that rule, economic copyright generally remains with the creator absent agreement. Joint development requires clear allocation of ownership and exploitation rights alongside statutory co-authorship rules.

Ownership of purely artificial intelligence generated content should not be assumed. The conditional exception permitting copying for AI development concerns inputs, not automatic ownership of outputs. Contracts should allocate input permissions, human contributions and infringement responsibility.

Remedies

Depending on the right, remedies include cessation orders, compensation, seizure or destruction and border measures. Copyright compensation may include infringer profits under Article 51 of the new Copyright Law. Specified offences also attract criminal sanctions through the Public Prosecution and competent courts.

Principal Protections

The E-Commerce Law, Anti-Commercial Fraud Law, CTL and product and sector rules provide the principal protections. Online suppliers must disclose identity, contact information, essential characteristics, total charges, payment, delivery and warranties. Advertisements must not mislead and form part of the contractual framework.

Article 13 of the E-Commerce Law generally permits cancellation within seven days of receiving goods or concluding a service contract, provided the consumer has not used or benefited from them. Exceptions cover specified customised products, publications and services. Article 14 provides cancellation and refund rights where delivery or performance is delayed beyond the applicable 15-day period, subject to agreed extensions and force majeure.

Enforcement and Unfair Practices

The MoC may investigate complaints and require corrective action, including withdrawal of misleading advertisements. E-commerce sanctions include warnings, fines of up to SAR1 million, suspension of activity and blocking online stores. Consumers may pursue contractual remedies and compensation before the competent court and defective or counterfeit goods also engage applicable refund and anti-fraud protections.

Courts can apply the good-faith, fraud and unfair adhesion-term protections discussed in 7.1 Contract Formation and Enforceability. Contractual wording, including blanket “no refunds” policies, cannot displace mandatory consumer rights. Regulatory action and consumers’ civil claims may proceed through their respective channels.

Notification Thresholds

The Competition Law and its Implementing Regulations govern economic concentrations, administered by the GAC. Acquisitions of control, mergers and qualifying full-function joint ventures are covered, including foreign transactions with the required Saudi nexus.

Under the April 2025 guidelines, the thresholds apply cumulatively as follows.

  • Acquisitions: combined worldwide annual sales exceed SAR200 million; target worldwide sales exceed SAR40 million; combined Saudi sales exceed SAR40 million; and the target generates Saudi sales.
  • Mergers and qualifying joint ventures: combined worldwide annual sales exceed SAR200 million; at least two participants each have worldwide sales exceeding SAR40 million; and combined Saudi sales exceed SAR40 million.

Sales must be calculated using the applicable group aggregation rules. A minority investment can be caught if it confers control and an acquisition without a change of control generally falls outside merger notification requirements.

Procedure and Assessment

Notification is required at least 90 days before completion. Review starts when the GAC accepts a complete filing and may be suspended for information requests. Parties must await clearance or expiry of the applicable statutory period without a decision. Filing fees are 0.02% of participating undertakings’ annual sales, capped at SAR250,000.

The GAC assesses whether the transaction is likely substantially to lessen competition in a relevant Saudi market, considering market structure, barriers to entry, competitive constraints, consumer effects and substantiated efficiencies. It may approve, prohibit or impose conditions, including structural or behavioural remedies.

Enforcement

Anti-competitive agreements and abuse of dominance are prohibited, including price-fixing, market allocation and bid-rigging. Non-notification, premature completion and substantive infringements may attract fines up to 10% of annual sales subject to the violation, or SAR10 million where those sales cannot be estimated. Alternatively, fines of up to three times gains may apply. Corrective orders, divestiture, publication and damages claims are also possible; repeat violations attract increased exposure.

Registration and Review

As discussed in 1.2 Incorporation and Ongoing Compliance, foreign investors must generally register with MISA before investing, with separate approval requirements for excluded or restricted activities. There is no general transaction-value threshold below which these requirements cease to apply.

Establishments, acquisitions and changes to existing investments require registration or amendment of registration. Investment in an excluded activity, and changes in ownership of an investment carrying on a restricted activity, require prior approval as well. Listed securities are principally subject to the separate CMA frameworks.

Sector Restrictions and National Security

Full foreign ownership is available in many activities, subject to the selected activity conditions. Others require Saudi participation, minimum capital, professional qualifications or specific regulatory consent. For example, MISA specifies minimum Saudi participation of 40% for communications activities and 30% for supporting communications activities, subject to the precise activity classification.

Investment Law breaches can lead to warnings, fines up to SAR300,000 and cancellation, alongside sector sanctions. Property ownership follows the separate regime in 11.1 Requirements for Land Ownership.

The Law also permits suspension on national security grounds. Competent authorities may assess investments before or after implementation, request information and consider mitigation. Decisions require objective grounds and are challengeable. This power is separate from merger control and has no general transaction-value threshold.

Incentives and Recent Developments

Available incentives depend on the activity, location and compliance with programme conditions, as follows.

  • With regards to regional headquarters, qualifying headquarters benefit from a 30-year package including 0% corporate income tax on eligible income and withholding tax relief on qualifying payments, subject to substance requirements.
  • For entities registered in special economic zones, qualifying businesses may access a 5% corporate income tax rate for up to 20 years, together with specified customs and VAT benefits.
  • There are also industrial support, in where qualifying projects may receive grants under designated programmes, including support of up to 35% of initial investment, capped at SAR50 million, subject to eligibility and programme terms.

Recent developments include the registration reforms, expanded property access from January 2026 and broader foreign Main Market access from February 2026. Transaction implications are discussed in 4.1 Legal Framework and 11.1 Requirements for Land Ownership.

Framework and Obligations

The Personal Data Protection Law (PDPL), its Implementing Regulations and the Regulation on Personal Data Transfer Outside the Kingdom establish the principal framework, supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA). The PDPL covers domestic processing and overseas processing of personal data concerning Saudi residents. Finance, telecoms, healthcare and government-related activities have additional requirements.

Processing requires consent or another statutory basis, such as performance of an agreement with the individual, legal compliance or qualifying legitimate interests. Legitimate interests cannot justify sensitive-data processing.

Controllers must provide notices, minimise collection, restrict use and disclosure, maintain accuracy and security, and destroy data when retention is unjustified. They must facilitate individual rights, contract appropriately with processors and maintain processing records. Impact assessments and data protection officers are required in specified circumstances.

Breaches and Transfers

Controllers must notify SDAIA within 72 hours of awareness where a breach potentially harms personal data or individuals or conflicts with their rights or interests. Individuals must be notified without undue delay where the statutory test applies. Sector and cybersecurity reporting may also be required.

International transfers require a permitted purpose, minimisation and an applicable mechanism, such as adequacy, standard contractual clauses or approved binding common rules. Transfer risk assessments apply in prescribed cases. The PDPL does not impose blanket localisation, but sector, government-data and cybersecurity rules may restrict offshore hosting or access. Overseas cloud services, group systems and remote access therefore require individual assessment under the framework.

Money Laundering and Terrorist Financing

The Anti-Money Laundering Law and terrorism-financing legislation impose preventive duties on financial institutions and designated non-financial businesses and professions, including specified real estate, precious-metals, legal, accounting and corporate-service activities. Criminal prohibitions apply more broadly.

Duties include risk assessment, customer and beneficial-owner identification, enhanced due diligence, monitoring, controls, training and records generally retained for ten years. Suspicious and attempted transactions must be reported promptly to the Saudi Financial Intelligence Unit. Tipping off is prohibited.

Sanctions and Trade Controls

Saudi Arabia implements UN Security Council sanctions and domestic terrorism designations, including asset freezes, restrictions on providing funds or economic resources, and reporting. SAMA rules impose detailed screening and controls on supervised institutions. Foreign sanctions require separate assessment where the transaction has a relevant nexus.

Customs and sector restrictions govern controlled imports and exports, including weapons and hazardous materials. Classification, counterparties, destinations and authorisations require checking. Breaches can attract seizure, fines, licence action or criminal liability.

Bribery and Enforcement

The Anti-Bribery Law covers public-sector and specified private-sector bribery and intermediaries. Certain private personnel are treated as public officials. Benefiting companies may face fines and public-procurement exclusion; individuals face imprisonment, fines and confiscation.

Controls should cover intermediaries, gifts, hospitality, payments, records, training and confidential reporting. Regulators inspect and direct remediation; the financial intelligence unit analyses reports and Nazaha investigates corruption within its remit. Competent prosecutors and courts pursue offences. Ordinary money laundering attracts two to ten years’ imprisonment and/or fines up to SAR5 million, with higher aggravated penalties.

Environment and Transaction

As discussed in 2.4 ESG and Disclosure Obligations, the Environment Law and implementing rules govern permits, assessments, pollution and rehabilitation. Projects require construction and operating permissions appropriate to their classification, plus emissions, wastewater, waste and monitoring compliance.

The contaminated-site regime applies the polluter-pays principle: responsible persons must stop pollution, undertake remediation and bear applicable rehabilitation and compensation costs. Transaction due diligence should examine historic uses, contamination, permit compliance and outstanding orders. Contractual indemnities allocate costs between parties but do not displace regulatory obligations.

Saudi Arabia’s carbon-credit initiatives principally operate through voluntary mechanisms; these should not be described as a general mandatory carbon tax or economy-wide emissions trading scheme. Climate-specific litigation remains relatively undeveloped. Potential claims must establish an available legal basis, causation and compensable harm; national climate commitments should not automatically be treated as directly enforceable corporate obligations. Environmental enforcement and ordinary civil liability remain more established sources of exposure.

Safety and Licensing

Saudi Arabia has a national occupational-safety system, not separate federal and provincial regimes. Employers must provide safe workplaces, explain hazards and supply protective equipment and training without charging workers. Injury reporting, Civil Defence rules, sector requirements and seasonal heat restrictions also apply.

Businesses commonly require commercial registration, municipal and premises approvals, fire-safety permissions and activity licences. Finance, energy, mining, pharmaceutical and healthcare businesses face additional regulators and change-of-control requirements. Cannabis is not a generally permitted commercial industry; controlled-substance activities require specific lawful authorisation.

Transaction planning should identify licence-transfer restrictions and essential approvals before signing and make necessary consents completion conditions.

Saudi Arabia regulates artificial intelligence principally through data protection, cybersecurity, IP, consumer and sector laws, supplemented by SDAIA’s AI Ethics Principles and responsible-adoption guidance. Guidance and proposals should be distinguished from binding legislation.

Organisations should allocate accountability, assess risks, test bias, maintain human oversight and explain systems appropriately. Binding duties arise where AI processes personal data, supports regulated decisions or produces misleading commercial claims. Assessments and supplier controls should cover training, deployment, security and lawful inputs. Data and IP are addressed in 9.1 Privacy and Data Protection and 7.3 Intellectual Property in Commercial Transactions.

Other applicable regimes include tax and zakat, VAT, withholding tax, transfer pricing, electronic invoicing and customs. Activities may also engage anti-concealment rules, commercial agency and franchise law, product conformity, cybersecurity, public procurement and local-content conditions. These supplement the corporate, ownership, competition and sector requirements described above. Companies should maintain a compliance register identifying licences, deadlines, responsible personnel and transaction-triggered approvals.

Employment Standards

The Labour Law and Implementing Regulations govern most private-sector employment, supplemented by social insurance, immigration, wage protection, Saudisation, health insurance and safety rules. Major Labour Law amendments took effect on 19 February 2025.

Contracts should specify remuneration, duties, location, duration and termination, observing Qiwa documentation requirements. Non-Saudi contracts must be written and fixed-term. Where no term is stated, Article 37 provides one year from commencement, renewable for a similar period if employment continues. Expressly agreed probation cannot exceed 180 days, subject to calculation rules.

Ordinary limits are eight hours daily or 48 weekly, reduced for Muslims during Ramadan to six daily or 36 weekly, subject to exceptions. Overtime generally attracts the hourly wage plus 50% of the basic hourly wage; paid compensatory leave may be agreed under the rules.

Annual leave is at least 21 days, increasing to 30 after five consecutive years. Sick leave generally comprises 30 days at full pay, 60 at three-quarter pay and 30 unpaid within the relevant year. Maternity leave is 12 weeks at full pay. Public holidays and other statutory leave also apply.

Employers must maintain work authorisations, applicable social insurance and health insurance, and comply with Saudisation and reserved occupations. Non-compliance may restrict recruitment and work-permit services. Safety is addressed in 9.3 Environmental, Health and Safety, and Industry-Specific Regulation.

Termination and Resignation

For indefinite-term monthly paid contracts, Article 75 requires a legitimate reason and written notice of at least 60 days from the employer or 30 from the employee. For non-monthly pay, both ordinarily give 30 days. Insufficient notice attracts payment in lieu.

Fixed-term contracts expire according to their terms and renewal arrangements. Early termination is different: notice alone does not eliminate premature-termination liability.

Unless the contract specifies compensation for unlawful termination, Article 77 provides 15 days’ wages per service year for indefinite contracts or remaining-term wages for fixed-term contracts, with a minimum of two months’ wages. Notice pay and accrued rights are separate.

Article 80 permits dismissal without notice, compensation or end-of-service benefits only on listed grounds, subject to applicable warnings, procedures and an opportunity to object. Article 81 allows workers to leave without notice while retaining statutory rights for specified employer wrongdoing, including conduct forcing an apparent resignation. This provides protection relevant to constructive-dismissal situations.

Under the amended fixed-term resignation procedure, a request is deemed accepted after 30 days without response. For work-related reasons, acceptance may be postponed up to 60 days, calculated from the written explanation delivered before the initial period expires. The employee may withdraw within seven days unless already accepted. Obligations continue while the request is pending.

Final Settlement

Settlement should separately identify wages, accrued leave, notice pay, termination compensation and end-of-service benefits. Article 84 generally awards half a month’s final wage for each of the first five years and one month for each later year, proportionately for partial years.

Ordinary resignation generally gives no award before two years, one-third for two to five years, two-thirds for more than five but less than ten, and full entitlement from ten years, subject to exceptions. Article 88 ordinarily requires settlement within one week after employer termination or two weeks where the employee terminates. Contractual entitlements more favourable to the worker must also be honoured.

Compensation

Salary, allowances, bonuses and equity awards should be clearly distinguished. Contractual or customary bonuses may form part of statutory wages despite a discretionary label. Article 86 permits agreed exclusion of specified fluctuating commissions and similar elements from end-of-service calculations.

Equity plans should address approvals, vesting, performance, leavers and change-of-control acceleration, alongside 1.3 Share Issuances and 5.1 Securities Regulation and Public Offerings. Share acquisitions ordinarily preserve the employer’s identity. Where Labour Law Article 18 applies to a business transfer or reorganisation, employment continuity and accrued-rights liabilities must be addressed.

Employment earnings generally attract no Saudi personal income tax. Cross-border plans nevertheless require assessment of overseas taxes, social insurance, employer deductions and group recharges.

Restrictive Covenants

Under Article 83, a non-compete must protect a legitimate interest arising from access to customers, be written and specify duration, geography and activity. It cannot exceed two years after termination.

Confidentiality obligations protecting business secrets must also be written and sufficiently specific. Non-solicitation terms should identify protected relationships and conduct and an indiscriminate employment ban is generally vulnerable to risk.

Enforcement requires evidence of the protected interest and breach and compensation additionally requires actual loss and proper basis for the claimed loss. Proceedings under Article 83 may be brought within one year after discovery of the breach.

Recognised interests include full ownership, co-ownership, separately registered units, usufruct and easements. Leases confer contractual occupation rights and state-owned property are subject to special regimes.

The Law of Real Estate Ownership by Non-Saudis took effect on 22 January 2026. Foreign ownership depends on designated areas, ownership limits and investor categories. Lawful residents may additionally own one residence outside those areas, excluding Makkah and Madinah. Individual ownership in those cities is limited to Muslims. Saudi companies with foreign participation, listed companies and funds have separate rules. More favourable GCC and Premium Residency rights are preserved.

Implementing regulations published on 3 July 2026 require non-resident individuals to obtain a digital identity, Saudi bank account and linked Saudi telephone number. Foreign companies register with MISA, disclose ownership and establish a Saudi account. Applications use the designated portal and ownership is completed through the Real Estate Registry. Specified foreign-company ownership or control changes must be reported within 15 days.

Real estate transaction tax generally applies at 5%, subject to exemptions. A separate 2% non-Saudi disposal fee applies to relevant dispositions in Riyadh, Makkah, Madinah and Jeddah, with zero-rate cases.

The CTL, Real Estate Registration Law, Registered Real Estate Mortgage Law and development, brokerage and leasing rules govern commercial property transactions. Title registration is being introduced by geographical area and the relevant registry or Ministry of Justice procedure must be identified for each property.

Due diligence covers title, boundaries, authority, mortgages, restrictions, planning, permitted use, access, occupation, building approvals, disputes, environmental condition and taxes or land fees. A corporate acquisition also requires review of the property-owning company’s liabilities. Available title insurance supplements these checks. See 9.3 Environmental, Health and Safety, and Industry-Specific Regulation and 6.1 Transaction Financing and Security Interests for information on environmental allocation and mortgage perfection, priority and enforcement.

Leases should regulate use, rent and VAT, service charges, maintenance, fit-out, insurance, assignment, subletting, renewal and reinstatement. Ejar’s mandatory terms and registration requirements apply. Default remedies depend on the contract, notice and enforcement rules; qualifying registered leases may be directly enforceable, but unrestricted self-help eviction should not be assumed.

From 25 September 2025, residential and commercial rents within Riyadh’s urban boundaries are frozen for five years. Lease-renewal rules apply nationally: contracts generally renew automatically unless the prescribed notice is given at least 60 days before expiry, subject to exceptions and applicable model terms. Riyadh landlords also require a permitted non-renewal ground where tenants wish to remain. Personal occupation relates to residential units, not a general commercial redevelopment right.

Leases should address permitted use, rent and VAT, service charges, maintenance, fit-out, insurance, assignment, subletting, renewal and reinstatement. Ejar’s mandatory provisions and registration requirements must be observed. Assignment and subletting should be expressly addressed, including any landlord consent requirements.

Default remedies depend on the contract, statutory notice requirements and the applicable enforcement route. Qualifying registered leases may support direct enforcement, but landlords should not assume unrestricted self-help eviction rights.

The foreign-ownership reforms in 11.1 Requirements for Land Ownership, expanding title registration and revised land-fee rules, also affect transactions. Acquisition models should test rent growth, vacancy and redevelopment assumptions against these requirements.

Al Akeel and Partners

Al Nakhlah Tower
11th Floor
King Fahad Road
Riyadh 13315
Kingdom of Saudi Arabia

(966) 11 299 0500

info@alakeellaw.com.sa www.alakeellaw.com.sa
Author Business Card

Trends and Developments


Authors



Khalid Nassar & Partners is a Saudi law firm established in 2017, with over 25 legal professionals across its Jeddah and Riyadh offices. The firm advises on corporate and M&A, capital markets, investment funds, real estate, regulatory and governance, projects and public-private partnerships, employment, intellectual property, and arbitration & litigation. Its corporate and M&A practice has acted on public and private transactions, corporate structuring, acquisitions, disposals, joint ventures and strategic investments, handling high-value transactions involving listed companies, multi-party negotiations and regulatory approvals across the healthcare, education, real estate, aviation, technology, and financial service industries. KN&P’s corporate and M&A work spans the entire transaction life cycle, with recent matters including advising GASCO on a SAR125 million strategic investment, leading Kingdom School’s acquisition of Knowledge Tower for over SAR130 million, and advising Jahez on its strategic investment in Doos.

AI in Saudi Business: Navigating Legal Risks Across Employment, IP, Data and Disputes

Artificial intelligence has moved quickly from pilot projects to embedded infrastructure across Saudi businesses. Employers now use AI platforms in recruitment and workforce management; companies deploy generative AI in drafting, data analysis and content production; and investors are backing AI-driven ventures as part of the Kingdom of Saudi Arabia’s wider economic diversification agenda under Vision 2030. This pace of adoption has outstripped regulation, leaving businesses operating in or investing into the Kingdom to navigate these questions within a still-developing framework.

Five areas illustrate this most clearly. The first is employee data, where the use of AI platforms and third-party service providers engages the Personal Data Protection Law (PDPL) and its requirements around processing, disclosure and cross-border transfer. The second is ownership of AI-generated content, where the existing Copyright Law predates generative AI and a Draft IP Law addressing the question directly has yet to be enacted, leaving the position to be inferred rather than settled. The third is the commercialisation of data as a business asset, where Saudi law does not treat data as conventional property and entitlement instead depends on the nature of the data, the relationship between the parties and contractual allocation. The fourth is the evidential status of AI-generated material, which Saudi courts and arbitral tribunals are beginning to assess under the existing Law of Evidence and Electronic Transactions Law, by reference to authenticity, reliability and integrity rather than the involvement of AI as such. Finally, the fifth is dependence on third-party AI platforms, where Saudi businesses building on infrastructure supplied by external providers face standard terms that limit provider liability and leave the business exposed if access is restricted, withdrawn or changed.

These questions are no longer hypothetical. They are arising in live transactions, employment matters and disputes, frequently without direct statutory guidance to resolve them. The sections that follow examine each in turn, drawing on current advisory experience to set out where the position remains unsettled and what businesses should do to protect themselves in the meantime.

Protecting employee data under the PDPL: employer use of AI platforms and third-party service providers

Saudi employers are adopting artificial intelligence tools at speed. Human resources teams use them to screen candidates, transcribe interviews and draft appraisals, and many businesses have licensed enterprise AI assistants for their workforce. Almost every one of these uses involves employee personal data, and involves a third party. That combination is what brings data protection law into the picture.

The PDPL is administered by the Saudi Data and Artificial Intelligence Authority(SDAIA). It applies to any processing of personal data in the Kingdom, and employee data is not carved out. Salary records, identity documents, performance reviews and medical certificates are all personal data, and some of it is sensitive data that attracts stricter rules.

Where the risk sits

An employer that uploads employee information into an AI platform is disclosing that information to the platform provider, and disclosure is a regulated act. Article 15 of the PDPL permits disclosure only on limited grounds, with the two most relevant to employers being consent and the employer’s legitimate interest. Consent is a weaker basis than it looks. Article 7 prevents consent from being made a condition of a service or benefit, and the Implementing Regulation requires that it be freely given, documented and easy to withdraw, which is hard to demonstrate where the employee may feel unable to refuse.

Legitimate interest is often the more realistic basis, but it carries conditions. Article 16 of the Implementing Regulation requires the processing to fall within the reasonable expectations of the employee, excludes sensitive data altogether, and requires the employer to carry out and document an assessment before it starts. Article 10 of the PDPL adds a second constraint, because data collected to run payroll cannot be re-purposed for an AI tool without a fresh basis and fresh notice.

The provider is a processor, and the contract matters

Where the AI provider handles employee data on the employer’s instructions it is a processor, and the employer remains the controller with full responsibility. Article 8 of the PDPL and Article 17 of the Implementing Regulation require the employer to select only providers offering sufficient guarantees, to put in place an agreement covering purpose, data categories, duration, breach notification, subcontractors and whether the provider is subject to foreign laws, and to assess compliance periodically. Click-through terms for consumer AI products do not meet this standard. Many reserve the right to use inputs for model training, which would make the provider a controller in its own right and the employer the author of an unlawful disclosure.

Cross-border transfer

Most major AI platforms are hosted outside the Kingdom of Saudi Arabia, so using them will usually amount to a transfer of personal data abroad. Article 29 of the PDPL allows transfers only for defined purposes, and only where the destination offers adequate protection the data is kept to the minimum and national security is not prejudiced. The Regulation on Personal Data Transfer Outside the Kingdom, revised in August 2024, makes this workable. It recognises central processing of human resources operations as a permitted purpose, and it allows an employer to rely on standard contractual clauses issued by SDAIA, binding common rules within a group or a certification from a licensed body where the destination is not on SDAIA’s adequacy list. A documented risk assessment is required before relying on any of these safeguards, and the transfer must be entered in the employer’s record of processing activities.

Security, notice and the cost of getting it wrong

Article 19 of the PDPL and Article 23 of the Implementing Regulation require organisational and technical security measures, which, for most private businesses, means either the controls of the National Cybersecurity Authority or a recognised international standard. A breach that may harm employees must be reported to SDAIA within 72 hours and to the affected employees without undue delay. Employees must also be told, before their data is collected, to whom it will be disclosed and whether it will leave the Kingdom, so privacy notices written before AI adoption are now frequently inaccurate.

The penalties are real. Fines can reach SAR5 million per violation and double on repetition; disclosure of sensitive data with intent to harm carries up to two years’ imprisonment; and an affected employee may claim compensation before the courts. Banning these tools rarely works, since employees will use them anyway on personal accounts outside any controls. Employers that are managing this well have instead identified which tools in the business receive employee data, replaced free consumer versions with enterprise contracts that contain proper processor terms and exclude use of the data for training, and decided which transfer mechanism they are relying on before the tool is rolled out.

Intellectual property ownership of AI-generated content in the Kingdom of Saudi Arabia

The use of generative artificial intelligence systems (AI) to produce text, images, code and other output (AI Generated Content) has become increasingly widespread across personal, commercial and professional activity. This raises the legal question of who, if anyone, owns the rights in AI Generated Content. In the Kingdom of Saudi Arabia, no law or regulation currently in force expressly addresses this question; the position is instead inferred from the Copyright Law and supplemented by a Draft IP Law that has not yet been enacted.

The existing statutory framework

The Copyright Law issued by the Saudi Authority for Intellectual Property (SAIP) does not refer to the ownership or protection of AI Generated Content. It defines an author as the person who creates a work. These provisions are generally understood to be limited to a natural person and an act of creation attributable to that person, although neither the definition of author nor the scope of protection specifies the degree of human involvement required for a work to qualify, while expressly excluding ideas, procedures and methods from the scope of protection.

The Copyright Law’s treatment of collective works offers a point of comparison, where several contributors participate in producing a single work under the direction of another person, ownership of the copyright is vested in the natural or corporate person who directed and organised the work as a whole. Commentary has sometimes pointed to this provision as a possible model for attributing ownership of AI Generated Content to the person who directs the use of the AI, on the reasoning that both scenarios involve a coordinating party overseeing input that is not entirely their own.

The Draft IP Law

The Draft IP Law was released for public consultation in April 2023, and addressed the treatment of AI Generated Content directly. The Draft IP Law proposed that intellectual property generated through the use of AI would be eligible for protection where the contribution of a natural person to that output is prominent, and in the absence of such a prominent human contribution, the output would fall into the public domain. Nevertheless, where protection is available, ownership would vest in the first person who made the arrangements necessary to obtain and register that protection, with a fast-track examination procedure in these cases. The Draft IP Law has yet to be enacted, and its final form will likely differ from the version published for consultation to reflect feedback from industry professionals and developments in other jurisdictions.

The Saudi Data and Artificial Intelligence Authority (SDAIA) regulatory framework

The Generative AI Guidelines and the AI Ethics Principles issued by SDAIA are both non-binding instruments and neither determines the ownership of AI Generated Content. Their relevance to the ownership question is indirect rather than direct. By emphasising human oversight, accountability, transparency and disclosure of AI involvement in generating content, these instruments tend to encourage the kind of documentation, such as prompts, review steps and human revisions, by reference to which a human contribution to AI Generated Content might later be evidenced.

Application and comparative approaches

In the absence of a statutory rule in the Kingdom, the allocation of rights in AI Generated Content is largely governed by contract and by the terms of use of the relevant AI platform, which vary in the rights they grant to the user. In practice, the relative degree of human and AI input varies by content type and platform, and can be difficult to prove.

Legal issues and risks in data ownership and commercialisation in Saudi Arabia

Data is a valuable economic asset, but its ownership, use, transfer, and commercialisation raise legal issues. Saudi law does not treat data as conventional property with an absolute ownership right. Rights arise under the Personal Data Protection Law (PDPL, Royal Decree No M/19, as amended by Royal Decree No M/148), the Copyright Law (Royal Decree No M/41), the Confidential Commercial Information Regulations, and the Civil Transactions Law (Royal Decree No M/191), of which Article 19 subjects intangible things capable of financial rights to specific statutory regimes. Data must be assessed under privacy, IP, confidentiality, and sectoral rules, not as unrestricted property.

PDPL obligations constrain commercialisation. Article 5, as amended, prohibits processing or repurposing personal data without the data subject’s express consent, subject to exceptions. Articles 10 and 11 require purpose limitation and data minimisation, including 1444H amendments adding public-interest and legitimate-interest grounds. Commercialisation needs a lawful basis, particularly for profiling, disclosure, or third-party sharing. Article 29, as amended, restricts cross-border transfers to fulfilling an agreement obligation, serving the Kingdom’s interests, or other Regulations-permitted purposes, provided national security is unaffected, protection is adequate, and the transfer is necessary.

Contracts should allocate rights to collect, access, reuse, license, and commercialise data generated by employees, customers, contractors, or users, as ambiguity risks disputes over exploitation. The Confidential Commercial Information Regulations, issued by the Ministry of Commerce, protect qualifying confidential information against use or disclosure inconsistent with honest commercial practices. The Copyright Law protects creative database selection under Article 3(5) and computer programmes under Article 2(11); Article 4(3) excludes ideas, procedures, and facts, so raw data needs another protection theory.

Sector rules may restrict commercialisation involving government entities, critical infrastructure, financial services, healthcare, or national security. NDMO, under SDAIA, issues classification and governance requirements through its National Data Governance Policies (the Council of Ministers Resolution No 292).

Commercialisation creates cybersecurity and liability exposure. PDPL Article 20, as amended, requires controllers to notify the Competent Authority on becoming aware of leakage, damage, or unauthorised access, and to notify the data subject where harm or a rights impact results. The National Cybersecurity Authority’s data cybersecurity controls also apply, and SAMA requires financial institutions to implement applicable NCA controls.

Businesses should treat data commercialisation as a regulated activity, requiring clear contractual rights, PDPL-compliant processing, appropriate security, and review of sectoral and cross-border requirements, under the PDPL, Copyright Law, the Confidential Information Regulations, the Civil Transactions Law, SAMA regulations, and NDMO governance requirements.

The legal status of AI-generated evidence in Saudi disputes

As artificial intelligence becomes embedded in business communications, document review and financial analysis, AI-generated or AI-assisted material will increasingly find its way into Saudi disputes. Saudi law does not currently establish a separate evidential category for AI-generated material. Its admissibility and evidential value must therefore be considered within the Kingdom’s existing framework for digital evidence.

Admissibility and evidential weight

According to Article 53 from the Saudi Law of Evidence, issued pursuant to Royal Decree No (M/43) dated 26/05/1443H, it defines digital evidence broadly as evidence derived from data created, issued, received, stored or communicated digitally and capable of being retrieved in an understandable form. Moreover, Article 54 expressly includes digital records, documents, correspondence, communications and media, as well as other forms of digital evidence. Digital evidence is generally given the same evidential treatment as written evidence under Article 55.

This framework is broad enough to accommodate material produced or assisted by AI, but admissibility should not be confused with evidential weight. An AI-generated summary of correspondence, for example, does not necessarily establish the accuracy of the underlying correspondence or the conclusions drawn from it. Where AI has processed, reconstructed or interpreted primary material, the reliability of the output may become central to the court’s assessment.

Authenticity, reliability and integrity

The principal challenge is establishing how the material was produced and whether it has remained reliable. Under the Electronic Transactions Law, which was issued pursuant to Royal Decree No (M/18) dated 08/03/1428H, it stipulates that the reliability of electronic evidence is assessed by reference to the method used to create, store or communicate the electronic record, the possibility of alteration, the measures used to preserve the integrity of the information and the method used to identify its originator.

These considerations are especially relevant to generative AI because the outputs may vary depending on the source material, prompt, and system or model used. An output presented without its underlying records may therefore be challenged if its provenance or accuracy cannot be established. Parties relying on material produced with significant AI assistance should preserve the original records, relevant prompts and outputs, and information showing how the material was generated and whether it was later altered.

AI-generated evidence in arbitration

Similar considerations arise in Saudi arbitration. Under the SCCA Arbitration Rules, a tribunal determines the admissibility, relevance, materiality and weight of evidence, giving it flexibility to consider AI-assisted material while scrutinising its reliability.

Although Saudi law does not specifically regulate AI-generated evidence, such evidence can be assessed under the existing rules governing digital evidence. As its use in litigation and arbitration increases, questions of authenticity, integrity and evidential weight are likely to become increasingly significant. The key issue will not necessarily be whether AI was involved in producing the evidence, but whether the party relying on it can establish where it came from, how it was produced and that it remains an accurate and reliable representation of the underlying information.

The hidden liability in AI investments: dependence on third-party AI platforms

A Saudi startup may appear to own a valuable AI product, while the technology that makes it work is supplied by a provider such as OpenAI, Anthropic, Google or Meta. The startup may own its application, brand and customer contracts, but not the underlying AI model. Its business may therefore depend on continuing access to someone else’s platform.

This creates a practical risk for investors. The provider may change its prices, technical interface or acceptable-use policies, restrict particular activities or countries, or suspend the service. Even a temporary interruption could prevent the startup from serving customers, and rebuilding around another model if access is withdrawn may be expensive, slow or technically difficult.

Contractual protection may also be limited. AI platforms are commonly provided under standard terms that give the provider considerable flexibility to modify or discontinue features, restrict access, and disclaim guarantees regarding service availability or output accuracy. Those terms may also exclude certain categories of loss and cap the provider’s total liability, often by reference to the fees paid by the customer. Accordingly, a service interruption could cause the startup losses far exceeding any compensation recoverable from the provider. Where Saudi law applies, Article 173 of the Civil Transactions Law generally permits contractual limitations of liability but prevents a party from excluding liability for its fraud or gross negligence. Article 180 further provides that, in the absence of fraud or gross negligence, contractual compensation is generally limited to harm that was foreseeable when the contract was entered into. The startup should therefore reduce its exposure through service-level commitments, continuity arrangements and alternative providers, rather than assume that a damages claim will adequately protect the business.

Personal data creates an additional risk. If customer or employee information is included in prompts, uploaded documents or AI-generated outputs, the Saudi company may remain the “Controller” responsible for PDPL compliance, while the platform acts as its processor. Article 8 therefore requires the company to assess the provider’s safeguards, impose appropriate contractual obligations and monitor its compliance, not merely accept standard platform terms. The company must also limit the data submitted, maintain appropriate security and ensure prompt reporting of breaches under Articles 19 and 20. If the provider processes data abroad, the company must also satisfy Article 29 and the Personal Data Transfer Regulations, including assessing the transfer and implementing the required safeguards.

Ownership also requires examination. A contractual right to use AI-generated output does not necessarily mean that the output is unique, legally protectable or free from third-party intellectual-property claims.

Investors should therefore ask: could the business continue if this provider became unavailable tomorrow? Due diligence should examine service levels, suspension and change rights, confidentiality, data use and deletion, intellectual-property protection, liability caps and data-export rights. The company should also maintain backups, a migration plan and, where practical, an alternative provider. Dependence on one AI platform is therefore not merely a technology issue; it is a business-continuity, compliance and valuation risk.

Conclusion

The five areas examined in this chapter share a common feature: existing Saudi law was not written with AI in mind, and each is being applied to AI by analogy, inference or extension rather than by direct rule. The PDPL addresses employee data without contemplating third-party AI processors, the Copyright Law addresses authorship without contemplating machine-generated output, the general law of evidence addresses authenticity without contemplating outputs that vary by prompt, and standard contract law addresses limitation of liability without contemplating dependence on a single external platform. In each case, businesses are not without a legal framework, but the framework requires careful, sometimes creative, application.

This has practical consequences for AI adoption in the Kingdom. Compliance cannot be achieved simply by identifying the relevant law and checking a box; it requires assessing how that law’s underlying principles – consent, authorship, reliability, foreseeability – map onto a technology those principles did not anticipate. Contracts, internal governance and documentation therefore carry more weight than they would in a more settled area of law, because they are often what determines the outcome where the statute itself is silent.

The direction of travel is towards greater clarity. The Draft IP Law, if enacted, would settle the ownership question that currently depends on inference. SDAIA’s guidelines, though non-binding, are shaping how AI use is documented and evidenced. Saudi courts and arbitral tribunals are beginning to develop a body of practice on digital and AI-assisted evidence. Businesses that build sound practices now, rather than waiting for the law to catch up, will be better placed both to take advantage of AI and to withstand scrutiny as the regulatory picture becomes more defined.

For businesses operating in or investing into the Kingdom of Saudi Arabia, the practical task in the meantime is less about avoiding AI and more about using it in a way that can be explained, evidenced and defended if it is ever tested.

Khalid Nassar & Partners

The Headquarters Business Park
36th Floor
Unit 3602
Kurnaysh Road
Al-Shatea District
Kingdom of Saudi Arabia

(+966) 12 611 1012

info@knp.legal www.knp.legal
Author Business Card

Law and Practice

Authors



Al Akeel and Partners is a Saudi law firm based in Riyadh. The firm advises local, regional and international clients on corporate and commercial matters, combining knowledge of Saudi law with experience in domestic and international transactions. Its practice encompasses mergers and acquisitions, joint ventures, capital markets, banking and Islamic finance, real estate, regulatory matters and dispute resolution. It also advises on foreign investment, employment, intellectual property, franchising, family governance, restructuring and insolvency. The firm supports businesses with both ongoing legal requirements and complex new transactions, and represents clients before Saudi courts, specialist committees and arbitration tribunals. Its team includes lawyers proficient in Arabic, Russian, English and French.

Trends and Developments

Authors



Khalid Nassar & Partners is a Saudi law firm established in 2017, with over 25 legal professionals across its Jeddah and Riyadh offices. The firm advises on corporate and M&A, capital markets, investment funds, real estate, regulatory and governance, projects and public-private partnerships, employment, intellectual property, and arbitration & litigation. Its corporate and M&A practice has acted on public and private transactions, corporate structuring, acquisitions, disposals, joint ventures and strategic investments, handling high-value transactions involving listed companies, multi-party negotiations and regulatory approvals across the healthcare, education, real estate, aviation, technology, and financial service industries. KN&P’s corporate and M&A work spans the entire transaction life cycle, with recent matters including advising GASCO on a SAR125 million strategic investment, leading Kingdom School’s acquisition of Knowledge Tower for over SAR130 million, and advising Jahez on its strategic investment in Doos.

Compare law and practice by selecting locations and topic(s)

{{searchBoxHeader}}

Select Topic(s)

loading ...
{{topic.title}}

Please select at least one chapter and one topic to use the compare functionality.