The draft law proposes the creation of a comprehensive data embassy ecosystem, positioning Saudi Arabia as a prominent global AI hub with far-reaching implications for international technology collaboration.

By Brian Meenagh, Ksenia Koroleva, and Faisal Imam*

On April 14, 2025, Saudi Arabia’s Communications, Space and Technology Commission (CST) took a significant step forward by issuing a consultation draft of the “Global AI Hub Law.” This landmark draft positions Saudi Arabia as the first nation within the G20 to introduce a comprehensive legal framework that not only embraces the innovative concept of data embassies but also lays down a strategic pathway for investment in the development of these embassies. Such advancements could greatly enhance Saudi Arabia’s standing in the international arena as a leader in artificial intelligence technology and data management.

This blog post outlines the principal objectives and provisions contained within the draft law, which is currently available for public consultation until May 14, 2025.

Understanding Data Embassies: A New Paradigm

The concept of data embassies appears as a novel solution to a critical issue faced by modern digital societies: How can a nation-state uphold its data sovereignty while ensuring compliance with legal standards when its data is hosted abroad? To put it simply, a data embassy functions as a data center located in one country but operates under the laws and regulations of another country, thereby avoiding liabilities imposed by the host nation.

The initial pilot of this concept can be traced back to Estonia in 2017, where it entered into a bilateral agreement with Luxembourg to store essential government data securely. Subsequently, in 2021, Monaco entered a similar agreement with Luxembourg. In these cases, bilateral treaties were necessary because the existing Vienna Convention on Diplomatic Relations, established in 1961, was deemed insufficient to cover the nuances of setting up a data embassy in a unique data center rather than a traditional diplomatic mission abroad.¹

While other countries have begun to explore the notion of data embassies, Saudi Arabia is pioneering the effort by creating a detailed legal framework that fosters the establishment of sovereign data centers. This framework also categorizes various forms of AI hubs, promoting international collaboration and technological advancements.

Detailed Overview of Saudi Arabia’s Draft Law

As per the information released on the consultation portal, the draft law outlines several core aims:

• Enhance Saudi Arabia’s positioning as a global leader in AI and advanced technologies by cultivating an appealing environment for foreign governments and private sector entities to develop and adopt cutting-edge technologies for peaceful applications and uses.
• Maximize the advantages of Saudi Arabia’s strategic geographical location, which serves as a bridge connecting three continents, to provide technological solutions that cater to global businesses and consumers, ultimately advancing access to technology and sustainably narrowing the digital divide.
• Facilitate the establishment of sovereign data centers that strengthen bilateral ties with foreign countries, hyperscalers, and other digital service providers, ensuring continuous service, data sovereignty across borders, enhanced security protocols, and a future-proofed digital infrastructure.

The draft law categorizes “AI Hubs” into three distinct types, which can either be an entire data center or a clearly delineated section of one:

• Private Hub: Operated by a “Guest Country” under a bilateral agreement with Saudi Arabia, solely for the use of that Guest Country while adhering to its local laws and regulations.
• Extended Hub: Managed by a third-party “Operator” through an agreement with the “Competent Authority” and in coordination with a Guest Country’s stipulations according to its legal framework.
• Virtual Hub: Run by an approved third-party “Service Provider” offering virtual services from within Saudi Arabia, subject to the laws of a “Designated Foreign State.”

Guest Countries must ensure compliance with international law and adhere to specific technological-use restrictions while collaborating with Saudi authorities to bolster digital infrastructure. Any content from Customers operating within a Virtual Hub falls under the jurisdiction of the relevant courts in Designated Foreign States, although Saudi courts may offer necessary assistance when required.

The draft law empowers the Competent Authority to engage in discussions with prospective Guest Countries, Operators, and Service Providers for the establishment of relevant bilateral agreements, although the specific identity of the Competent Authority remains unspecified. This identity will be determined by the Council of Ministers and could likely be the CST or the Saudi Data and AI Authority (SDAIA).

Each type of AI Hub is subject to distinct rules, with the possibility for further elaboration in upcoming regulations. The CST seems to recognize the necessity for specialized provisions for foreign government data centers (Private Hubs) that demand digital diplomatic immunity, foreign corporate data centers (Extended Hubs), and data centers wanting to abide by foreign government regulations while hosting data in Saudi Arabia (Virtual Data Centers).

AI legalese decoder: A Vital Resource in Navigating New Legislation

As stakeholders navigate through the complexities introduced by this draft law, the AI legalese decoder plays a crucial role in simplifying legal jargon and making the provisions understandable for individuals and organizations alike. With the evolving landscape of AI legislation, legal professionals and businesses can rely on this tool to decode convoluted legal texts, enabling them to grasp the implications of the law effectively.

By using the AI legalese decoder, users can identify pertinent regulations, comprehend compliance requirements, and assess the potential risks associated with establishing AI hubs in accordance with Saudi Arabia’s new legal framework. This tool not only democratizes access to legal knowledge but also enhances informed decision-making in the increasingly complex realm of data embassies and international technology collaborations.

Conclusion and Next Steps

The draft law is currently a consultation document, and the consultation process is available until May 14, 2025. We anticipate that subsequent versions of the draft law or implementation regulations and guidelines from the Competent Authority will provide greater clarity on the distinctions between the various types of hubs and the procedures involved in establishing them. As a foundational step towards the creation of a data embassy ecosystem, the draft law is viewed as both progressive and necessary for Saudi Arabia’s ambitious tech vision.

*Admitted to practice in England & Wales only