How can boards in Saudi Arabia maintain effective oversight and accountability as AI becomes embedded in business-critical decisions? Explore how to strengthen AI governance, define accountability for AI-assisted decisions and establish effective risk management controls. Gain practical insights from Mohammad Elkady, CIA, CMA, Director and Deputy Head of Risk Advisory at BDO Saudi Arabia.
The Kingdom of Saudi Arabia has designated 2026 as the Year of Artificial Intelligence, and AI is moving from innovation teams into core business processes. Regulatory developments are progressing alongside this adoption.
The Saudi Data and Artificial Intelligence Authority (SDAIA) has published its National AI Risk Management Framework, providing guidance for identifying, assessing, treating and monitoring AI risks. Separately, SDAIA consulted on a draft Responsible AI Policy addressing governance responsibilities and risk management. The draft should not be treated as an enforceable requirement unless and until it is formally adopted.
The National Cybersecurity Authority (NCA) has also consulted on AI Cybersecurity Guidelines covering emerging technologies including generative and agentic AI. Together, these developments indicate the direction of AI governance and cybersecurity expectations in the Kingdom. Meanwhile, existing obligations under the Personal Data Protection Law (PDPL), cybersecurity requirements and applicable sector regulations already warrant management attention. The PDPL provides for warnings and financial penalties for certain violations.
For boards, AI governance is increasingly becoming a question of accountability.
Use these three questions to assess whether your organisation is ready for AI governance
1. Could management answer the board today?
If a board asked tomorrow where and how AI is used across the organisation, many management teams would need time to assemble a complete response. Some might return with a list of software licences, which provides limited insight into the organisation's actual AI exposure.
A board-ready view should show, at a minimum:
- Where AI is used: tools built in-house, tools purchased and AI features enabled within existing ERP, CRM, HR and productivity platforms
- What it influences: drafting support, recommendations or decisions affecting customers, employees, financial reporting or regulatory submissions
- Who owns it: a named business owner, rather than ownership defaulting to the IT department
- What data it touches: particularly personal and confidential data, including where that data is processed and hosted
- Where people intervene: who reviews the output and what happens when they disagree with it
- Who sits behind it: the providers involved and what they may do with the organisation's data
- What has gone wrong: incidents, complaints and near misses
- How significant the risk is: the potential impact of an incorrect output or decision, the degree of automation and whether additional approval or oversight is required
SDAIA's National AI Risk Management Framework starts from a similar principle. Before risks can be assessed effectively, organisations need to understand the purpose and context of the AI system, the data involved, its users and the degree of human involvement.
For listed companies, the underlying governance expectation is not new. The Corporate Governance Regulations issued by the Capital Market Authority (CMA) establish responsibilities around ensuring that boards receive complete, clear, accurate and timely information. AI creates a new test of how effectively that information reaches the board.
An honest "we don't know yet" can be a reasonable first answer. By the next meeting, it should be accompanied by a plan, an accountable owner and a date.
2. When an AI-assisted decision goes wrong, who answers for it?
Management owns the decision. Responsibility for an AI-assisted decision remains with the organisation and the individuals accountable under its governance arrangements and applicable law. Introducing AI does not, by itself, transfer those responsibilities to the technology provider.
Using AI does not reduce the responsibilities of the business owner or the control functions involved. Management also owns the deployment, the controls around it and any reliance on its output, within the risk level approved by the board. "The model recommended it" is unlikely to provide an adequate response to a regulator, customer or court.
International cases demonstrate the consequences of inadequate oversight. In 2023, the US Federal Trade Commission announced a five-year prohibition on Rite Aid using facial recognition technology for surveillance purposes to settle allegations that the retailer had deployed the technology without reasonable safeguards, resulting in consumers being incorrectly identified as potential shoplifters.
The provider answers for what it committed to. This includes the obligations established in the contract, such as performance, security, data handling, notification of model changes and incidents and cooperation when something fails.
Standard contractual terms may also limit liability below the potential cost of a material failure. A contract can allocate part of the financial exposure to the provider, but it does not automatically remove the organisation's responsibilities towards customers, regulators or shareholders.
International cases also illustrate the risks of relying on inaccurate chatbot information. In Canada, a 2024 Civil Resolution Tribunal decision held Air Canada responsible for misleading information provided through a chatbot on its website, highlighting the importance of appropriate controls over customer-facing AI.
The board owns oversight. The board is not responsible for every individual AI-assisted decision. Its role is to oversee whether appropriate boundaries exist: an agreed appetite for AI risk, appropriate policies, clear ownership and reporting capable of surfacing material issues in time.
Under the CMA's Corporate Governance Regulations, the board retains responsibility for the company's business even when responsibilities are delegated. The same governance principle is relevant when AI becomes part of business decision-making.
The practical point is timing. Accountability that has not been agreed before an incident is often determined afterwards, potentially by a regulator, court, customer or other external stakeholder.
The use of AI does not remove responsibility for how its outputs are used. In September 2025, the Saudi Authority for Intellectual Property (SAIP) imposed a SAR 9,000 penalty in a copyright infringement case involving a personal photograph that had been modified using AI and republished without the copyright owner's permission.
Although the case arose under the Copyright Law, rather than an AI-specific law, it illustrates a broader principle: using AI does not, by itself, exempt individuals or organisations from existing legal obligations relating to how content and outputs are used.
3. How can organisations integrate AI into core processes without losing control?
Speed comes from clarity. When teams understand what is permitted, what requires approval and who is responsible for the decision, organisations can enable AI adoption without encouraging teams to work around governance processes.
BDO Saudi Arabia highlights five key mechanisms to help organisations maintain control over data, decisions and reputation as AI becomes embedded in business-critical processes:
- Risk-tiered approval: Low-risk uses, such as drafting or summarising non-sensitive material in approved tools, can be pre-approved under clear acceptable-use rules. Uses affecting customers, employees, financial reporting or regulatory filings should pass through a defined review process with an agreed turnaround time.
- Data guardrails: Establish clear rules on which data may enter which tools, use enterprise-grade instances for confidential information and assess hosting and transfer arrangements. Breach response procedures should support prompt assessment and, where the notification threshold under Article 24 of the PDPL Implementing Regulation is met, notification to the competent authority within 72 hours of becoming aware of the incident.
- Decision controls: Apply human review proportionate to the potential impact, conduct testing before deployment, monitor accuracy and drift against defined thresholds and introduce change control when a provider updates its model.
- Contracting discipline: Address disclosure of AI use by vendors and advisers, restrictions on using organisational data for model training, model and incident notification, audit rights and workable exit terms. The NCA's AI Cybersecurity Guidelines consultation included third-party cybersecurity as a dedicated domain, highlighting the significance of third-party exposure.
- Escalation and assurance: Establish a practical definition of an AI incident, define thresholds for escalation to executive management and the board and provide regular AI risk reporting to the responsible board committee. Internal audit can then provide independent assurance that the framework operates as intended: high-risk uses are identified, approvals are documented, controls are effective and incidents are escalated appropriately.
Organisations do not need to wait for a single dedicated AI law before strengthening governance. Existing laws, regulatory requirements and published national frameworks already provide a foundation on which organisations can build.
Where should Saudi boards start to strengthen AI governance?
Three steps can fit within the next board cycle:
- Commission an AI inventory and develop the board-ready view described above.
- Approve AI risk boundaries and a tiered approval policy.
- Assign oversight to an existing board committee or equivalent governance body, establish regular management reporting and commission an independent assessment of AI governance readiness from internal audit or an external provider.
Organisations that establish this visibility early will be better positioned to answer the board's first question when it is asked and to demonstrate how AI risk is being governed as adoption expands.
Connect with BDO Saudi Arabia
BDO Saudi Arabia's Risk Advisory team helps boards and management assess AI governance, define accountability and test the controls around AI in business-critical processes. Our approach focuses on helping organisations understand their AI risk exposure, establish clear oversight responsibilities and integrate appropriate controls into existing governance and risk management frameworks.
We also help organisations clarify accountability between boards, management, business owners and technology providers, while strengthening oversight of data protection, cybersecurity and regulatory compliance.