Saudi Arabia's new Copyright Law enters into force on 12 August 2026, replacing the 2003 regime that governed the Kingdom for more than two decades. Issued under Royal Decree No. M/169 on 2 February 2026 by virtue of Cabinet Decision No. 560/1447 dated 27 January 2026, the Law was published in the Official Gazette on 13 February 2026 and takes effect 180 days later.
Its most consequential provision for technology companies is Article 26, which permits reproduction of lawfully published works — without the author's permission and without compensation — for the purpose of developing artificial intelligence products and algorithms. It is among the first statutory AI training-data exceptions enacted in the Gulf Cooperation Council.
Key Highlights
- Entry into force: 12 August 2026. Several advisory alerts circulated "1 August" — that date is incorrect. The Gazette date of 13 February plus the statutory 180 days lands precisely on 12 August.
- Article 26 creates an express carve-out for copying works to develop AI products and algorithms.
- Maximum fines quadruple from SAR 250,000 to SAR 1 million, with up to SAR 2 million for repeat violations.
- Maximum imprisonment doubles from six months to one year, and penalties may be doubled for repeat offences within three years.
- The implementing regulation is still pending and will decide how much the exception is actually worth in practice.
What Article 26 Actually Permits
The exception is not a blanket licence to scrape. Reliance on Article 26 is conditioned on the work having been lawfully published, the original copy having been lawfully acquired, and the reproduction being limited to what is necessary for the intended purpose. Further conditions require that the use not conflict with normal exploitation of the work and not cause unreasonable prejudice to the rights holder's legitimate interests.
That final pair of conditions is the familiar Berne three-step test, and it is where the provision's apparent breadth narrows sharply. "Limited to what is necessary" is a proportionality test with no settled meaning in Saudi practice, and it will be resolved either by the implementing regulation from the Saudi Authority for Intellectual Property or, eventually, through enforcement.
Why This Matters Beyond Riyadh
Saudi Arabia has legislated in the opposite direction from Europe. The EU's Digital Single Market Directive grants a text and data mining exception that rights holders can reserve against — an opt-out regime — layered with a copyright policy obligation on general-purpose model providers under Article 53 of the AI Act. Riyadh has instead legislated permission at the outset, with conditions attached rather than an opt-out.
For a jurisdiction that has declared 2026 its Year of Artificial Intelligence and is funding sovereign Arabic-first model development through HUMAIN, the sequencing is deliberate: a domestic legal basis for training-data acquisition arrives ahead of the models that need it. Arabic-language training corpora are scarce compared with English, and a statutory exception materially lowers the cost of assembling them lawfully inside the Kingdom.
What It Does Not Address
The Law is silent on the questions that dominate AI copyright litigation elsewhere. It does not address authorship of AI-generated output, nor whether outputs from a model trained on protected works constitute derivative works. Companies deploying generative systems in the Kingdom therefore gain clarity on the input side and none on the output side.
The Law also modernises the wider framework: protection runs for the author's life plus 50 years, 50 years from publication for legal persons and anonymous works, 50 years from first showing for audiovisual works, and 25 years for applied arts. Neighbouring rights run 20 to 50 years by category. Confiscation and destruction of infringing materials become mandatory.
What's Next
The implementing regulation is the document to watch. Until it issues, the practical scope of Article 26 — particularly what counts as "limited to what is necessary" and what evidence of lawful acquisition a regulator will expect — remains unsettled.
Organisations training or fine-tuning models on Saudi-sourced content have five days to get the input side of their pipeline defensible. In practice that means provenance records showing each corpus item was lawfully published and lawfully acquired, retention policies that can demonstrate reproduction was proportionate to the training purpose, and licensing positions reviewed against the new penalty ceiling rather than the 2003 one.
This is a governance problem before it is a legal one. The teams that will struggle are those whose training and retrieval pipelines were assembled without any record of where the data came from — the same gap that makes cross-border AI data transfers under the Saudi PDPL difficult to evidence after the fact. Contrast the approach with the EU AI Act's transparency rules, which push disclosure obligations onto providers rather than conditioning the underlying copying.
If you are unsure whether your AI pipeline's data provenance would survive scrutiny after 12 August, talk to us — we will review where your training and retrieval data actually comes from and what evidence you would be able to produce.
Source: Baker McKenzie — Saudi Arabia: New Copyright Law Modernises KSA IP Framework