On April 14, 2025, the Communication, Space & Technology Commission (CSTC) of Saudi Arabia released the first draft of the Global AI Hub Law. According to the CSTC, the proposed legislation aims to create an attractive environment for foreign governments and private sector entities to develop, deploy, and host technologies within Saudi Arabia. Central to this initiative is the concept of “sovereign data centers”, often referred to as data embassies, which are designed to allow foreign data to be stored and processed in Saudi Arabia under the legal protections of a foreign country.

Background: The rise of data embassies

The idea of Saudi Arabia´s data embassies is not entirely new. In January 2025, Saudi Arabia’s Minister of Finance, Mohammed Al-Jadaan, announced at the World Economic Forum in Davos that Saudi Arabia was actively working on a regulatory framework to support this embassy concept. A data embassy is essentially a data center physically located in one country but under the legal jurisdiction and control of another, typically a foreign state. This approach was first realized in 2017 through an agreement between Estonia and Luxembourg, which set a global precedent for international data sovereignty and security.

Key provisions of the draft Global AI Hub Law

While the law’s title emphasizes artificial intelligence, its scope is notably broader, encompassing a wide range of "advanced technologies". The draft law introduces a structured approach to the establishment and operation of three distinct types of “hubs” (a data center or a clearly defined segment within a data center):

1. Private hub

Location: Situated within Saudi Arabia. 

Purpose: Exclusively hosts data belonging to a foreign state that enters to a “Bilateral Agreement” with Saudi Arabia (guest country).   

Jurisdiction: Operates strictly under the laws and regulations applicable in the guest country. 

Compliance: The guest country is responsible for ensuring compliance with all relevant international legal requirements.

2. Extended hub

Expansion: Builds upon the private hub model by permitting private data center operators to host services, provided there is an additional arrangement with the relevant guest country. 

Agreements: Requires agreements between the data center operator and the competent authority, as well as between the guest country and the competent authority. 

Jurisdiction: The laws and regulations of the guest country continue to apply.

3. Virtual hub

Operation: Managed by a private “service provider”. 

Service model: The service provider offers virtualized data hosting and management services to their customers, in accordance with the rights and regulations of a designated foreign state.

4. Termination

The Council of Ministers or its delegate has the authority to terminate any agreement, bilateral agreement, or other arrangements made under the Global AI Hub Law “to protect the Kingdom's safety, national security, and sovereignty”. The privileges granted under the Global AI Hub Law will remain in effect for an agreed period or up to 120 days, depending on the type of hub involved.

What's next?

The draft law is open for public consultation until May 14, 2025. Once the law is published in the Official Gazette, it will come into effect sixty days thereafter. The Global AI Hub Law has the potential to transform the landscape of data governance and technological collaboration, not only within Saudi Arabia but  across the broader region and internationally.