On 12 August, Saudi Arabia's new Copyright Law enters into force, replacing legislation that dates to 2003. Buried inside it is a provision that matters far more to anyone building or buying AI in the Kingdom than the headline modernisation story: the Gulf's first statutory exception permitting copyrighted works to be used to train AI systems.
That is the kind of clause procurement teams normally miss until a vendor's contract or a regulator's audit forces the question. This one is worth reading now, because the exception comes with conditions, and the conditions are where the risk sits.
What the law actually permits
The new Copyright Law was published in the Official Gazette on 13 February 2026 and takes effect 180 days later, on 12 August, according to client alerts from Baker McKenzie and Gowling WLG. It introduces a statutory exception allowing the copying of works for the purpose of developing AI products and algorithms, subject to three conditions:
- The work must have been lawfully published
- The copy must have been lawfully acquired
- Copying is limited to what is necessary for the intended purpose
On paper, that clears a path AI developers in most jurisdictions still have to negotiate work by work, licence by licence. In practice, every one of those three conditions is doing a lot of unresolved work.
The part nobody can answer yet
"Necessary for the intended purpose" is not defined in the law itself. The Saudi Authority for Intellectual Property (SAIP) is expected to issue implementing regulations before or shortly after the 12 August commencement date, and those regulations, not the statute, will determine how much latitude the exception actually gives developers.
Two other questions remain open, per the Gowling WLG and Baker McKenzie analyses:
- Whether the exception covers commercial AI development, or only non-commercial research
- Whether outputs generated by a model trained under the exception can themselves constitute derivative works, triggering separate rights
Neither is a technicality. A programme that assumes the training-data question is settled, and then discovers mid-build that its commercial use case falls outside the exception's scope, has a legal problem and a schedule problem at the same time.
Why this is not just a legal-team issue
A copyright exception is not a lawful basis for processing personal data. If training material contains personal information, whether scraped, licensed, or synthetic-but-derived, separate data protection obligations still apply on top of whatever the copyright exception permits. Baker McKenzie's alert flags this explicitly: the two regimes run in parallel, and clearing one does not clear the other.
The law also raises the financial stakes for getting this wrong. Maximum penalties for infringement have quadrupled to SAR 1,000,000, a new settlement mechanism allows resolution of claims up to SAR 2,000,000, and the law introduces an ISP safe-harbour regime alongside explicit protection for neighbouring rights. This is a regime with more teeth than the one it replaces, applied to a question, AI training data provenance, that most vendor contracts still handle with a single boilerplate warranty.
What to do before 12 August
- Audit what your AI vendors are training on. If a supplier cannot describe how its training data was acquired and why the copying was necessary, that is now a live compliance gap in Saudi Arabia, not a hypothetical one.
- Separate the copyright question from the data protection question in vendor due diligence. Treat them as two gates, not one.
- Watch for SAIP's implementing regulations. They will define "necessary," and procurement decisions made before that definition lands may need revisiting after.
- Update employment and contractor terms covering AI-assisted work product, which the wider law also touches.
The bottom line
Saudi Arabia has done something most jurisdictions have avoided: written a specific, statutory answer to whether AI systems can be trained on copyrighted material. That is genuinely useful, and it is likely to be cited elsewhere in the Gulf as a template. But a statutory exception with three undefined conditions is not the same as legal certainty. Until SAIP's implementing regulations land, the safest procurement position is to treat "necessary for the intended purpose" as a question your vendors need to answer in writing, not one the law has already answered for you.