By George Titus · 13 August 2026 · 4 min read

The exception is one of the first of its kind in the Gulf. The detailed rules that govern how it works are still to come. Saudi Arabia’s new copyright law took effect on 12 August 2026. It replaces a law that has governed the Kingdom since 2003. Baker McKenzie calls it the biggest overhaul of Saudi copyright in a generation.

For AI companies, one clause stands out. The law allows protected works to be copied for the purpose of developing artificial intelligence products and algorithms. No permission from the author is needed. No payment is required. Conditions apply, and they matter. But the basic position is clear: training an AI model on copyrighted material now has a statutory basis in Saudi Arabia. Baker McKenzie describes this as one of the first statutory AI training-data exceptions in the Gulf Cooperation Council.

Getting the dates right. What the conditions are

The law was approved by Royal Decree No. M/169, issued on 2 February 2026. It was published in the Official Gazette on 13 February. Some legal trackers list 1 August 2026 as the start date. That appears to be wrong. Baker McKenzie, writing in July, gives 12 August. Other recent coverage agrees. Use that date.

The exception is not open-ended. The copying must be limited to what serves the purpose. The work must have been lawfully acquired. And the use must not unreasonably harm the rights holder’s interests.

A&O Shearman, which analysed the law in February, made two observations worth carrying. First, the phrase “limited to what serves the purpose” is a judgement call. There is no number attached to it. The firm says this proportionality test needs clarification. Second, the law does not spell out whether the exception covers commercial development or only non-commercial work. It also does not say whether AI outputs trained on protected works count as derivative works. Those are significant gaps for anyone building a product rather than running research.

The detail has now arrived

The operating rules were published in the Official Gazette on 31 July 2026. Under the law, the Saudi Authority for Intellectual Property must issue an Implementing Regulation within 180 days. It takes effect on the same date as the law itself. Baker McKenzie expected that regulation to clarify how the exception works in practice.

Gowling WLG made a similar point, noting that the scope of what counts as necessary for the intended purpose awaited the implementing regulations, and will probably be tested through enforcement cases later. So the position is straightforward to state and harder to apply. The right exists. The boundaries are now drawn in the regulation.

What companies are being told to do

Law firms advising on this are giving consistent guidance, and it is practical rather than legal. Document where your training data came from. Keep records showing the material was lawfully acquired. Review your data sourcing now that the regulation has landed. Baker McKenzie’s guidance to technology and AI clients is to review data sourcing, content moderation, take-down procedures and licensing terms now.

That advice costs little. Firms that can show a clean record of provenance will be in a better position now that the detailed rules have arrived. Firms that cannot will be reconstructing history under pressure.

The rest of the law affects more companies

The AI clause has drawn the attention, but the law changes several things that touch ordinary businesses. Software licences are now expressly enforceable. Shrink-wrap, click-wrap and installation-time licences bind the user, subject to public order and morality. Owners of lawful software copies get specific permitted uses, including backup, maintenance, error correction, interoperability and security testing.

There is a new safe harbour for internet content providers. Platforms are shielded from liability for user infringement if they meet conditions, including handling content automatically, removing infringing material within a reasonable time after notice, and providing a way for rights holders to notify them.

Employment rules changed too. Works created by employees during their job, and related to the employer’s business, now belong to the employer by default. Commissioned works are different. Those stay with the author unless the parties agree otherwise, which is the opposite of what many companies assume.

Enforcement is stronger. Criminal cases now go to the Public Prosecution. Rights holders can seek seizure of infringing goods, compensation that includes the infringer’s profits, and orders requiring an infringer to name upstream and downstream parties.

Why this reaches beyond Saudi Arabia

Where a model is trained is now a legal decision, not only a technical one. A company with the option to run training work in Riyadh or elsewhere is choosing between different rules on what it may lawfully use. That was not true in the Gulf before 12 August.

The commercial question is how much weight that carries. Training location depends on compute availability, cost, latency and talent, and a copyright exception is only one factor among several. But it is a new factor, and it points one way. For firms already weighing Saudi compute capacity, the legal position on training data is now something they can point to rather than something they have to argue about. The Implementing Regulation, now in force, will decide how much that is worth in practice.