When will the EU AI Act come into effect?

The AI Act will become fully applicable in 2026 (except for a few provisions) with a phased enforcement timeline that began on August 1, 2024. Various provisions came into effect after their effective date. Provisions on prohibited AI practices came into effect in February 2025, with various other obligations and chapters coming into effect gradually in 2025, 2026, and 2027.

Which AI systems are considered high-risk?

High-risk AI systems include any AI systems that pose significant impacts on health, safety, or fundamental rights. These include AI used in critical infrastructure, medical devices, law enforcement, recruitment, education, and financial services. Any providers or deployers of such systems must adhere to the requirements related to risk management, data governance, transparency, and human oversight.

How will the EU AI Act be enforced?

The newly created European AI Office will oversee the enforcement of the AI Act. This office will work with the various supervisory authorities in the EU member states and coordinate efforts related to compliance, audits, investigation of violations, and future recommendations.

What penalties exist for non-compliance?

Non-compliance with the AI Act can result in fines of up to €35 million or 7% of a company's annual turnover, whichever is higher. The penalties are tiered based on the severity of the violation. Violations of prohibited AI practices carry the highest penalties, while non-compliance with other obligations (such as those for high-risk systems) can result in fines up to €15 million or 3% of global turnover. Providing incorrect information to authorities carries the lowest penalties, up to €7.5 million or 1% of global turnover.

Saudi Arabia’s Personal Data Protection Law (PDPL)

Saudi PDPL Deadline Passed. Compliance Didn’t.

Know where Saudi personal data lives, keep your records current, and prove your controls to SDAIA, continuously, not once a year.

Penalty decisions in 2025. Unlawful processing and disclosure, weak safeguards, marketing without consent.

72h

Breach notice to SDAIA. Notify affected individuals in hours, not weeks.

Arabic and English discovery. Across cloud, SaaS, and on-premises systems.

See it in Action

Request a Demo

See how Securiti runs Saudi PDPL compliance continuously.

SDAIA Is Issuing Penalties

Saudi PDPL has been fully enforceable since September 2024, and SDAIA is issuing penalties. In January 2025, SDAIA’s committees for reviewing PDPL violations reported 48 decisions confirming violations and imposing penalties on data controllers. The violations included:

processing and disclosing personal data without legal justification,
failing to implement appropriate organizational and technical safeguards, and
sending marketing messages without consent.

Your policies and assessments are in place. The hardest part is keeping them true as your data changes: knowing where personal data lives, managing rights and transfers at scale, and proving it all when SDAIA asks.

SAR 5M

Fines can be as high as five million Riyals, with penalties doubled for repeated infractions.

2 years

Imprisonment, a fine of up to 3 million Riyals, or both, for unlawful disclosure of sensitive data.

The Solution

Securiti, a Veeam company, helps organizations run Saudi PDPL as an ongoing operation rather than a one-time project.

With PrivacyOps, you can:

Discover and classify personal and sensitive data across cloud, SaaS, and on-premises systems, including bilingual Arabic and English data.
Automate rights requests, consent, retention, and transfer controls as your data and processing change.
Keep your RoPA, assessments, and processing records audit-ready, with evidence you can produce when SDAIA asks.

Request a Demo

Continuous Visibility. Automated Privacy
Operations. Evidence on Demand.

Automate Data Subject Request Handling

PDPL 5, 4, 21

Automating the delivery and generation of secure data access reports will greatly reduce the risk of compliance violations and reduce the workforce required to comply with all requests.

Monitor and Track Consent

PDPL 5, 6, 7

Track data subjects’ consent revocations to prevent the transfer or processing of data without their consent. Accommodate consent requirements according to regulations and data subjects.

Govern Personal Data Transfers Outside the Kingdom

PDPL 11, 26

Securiti maps every system, vendor, and cloud region that holds Saudi personal data, flags flows leaving the Kingdom, and links each transfer to its purpose, safeguards, and risk assessment.

Breach Response Notification

PDPL 26

Automates compliance actions and breach notifications to concerned stakeholders in relation to security incidents.

Saudi PDPL Readiness Assessment dashboard

Assess Saudi PDPL Readiness

PDPL 1, 16, 18, 35, 32, 51

Gauge your organization’s posture against Saudi PDPL requirements, identify the gaps, and address the risks.

Govern the Personal Data Feeding AI

PDPL 1, 26, 22, 31

Discover and classify that data, flag high-risk uses like AI training purposes, control access, enforce reclassification and retention, and evidence what data was used, when, and by whom.