Pasting Source Code Into a Foreign AI: What SAMA, NCA and the PDPL Say

TL;DR: A bank needs SAMA approval before it uses a public or hybrid cloud service, and "explicit approval" for one outside Saudi Arabia.¹ For government and critical infrastructure, NCA refers data location to the National Data Management Office (NDMO), while its 2023 guide, written for ECC-1:2018, expects hosting "within the Kingdom".²³ SDAIA's mandatory guideline for government limits AI tools to Public data, and unclassified code counts as Restricted.⁴⁵ Personal data in the code adds the PDPL's transfer rules.

This is for you if your developers paste code into a hosted AI service, such as a public AI chat or coding assistant, and your CISO or auditor has asked whether that is allowed. Skip this if your organization is not regulated in Saudi Arabia.

Key points

• SAMA's Rules on Outsourcing require a bank to get "a written SAMA no objection" before outsourcing to a provider overseas, and to explain "why it cannot be done within KSA".⁶
• SAMA's cloud requirement "is not applicable to private cloud services (= internal cloud)".¹
• The PDPL transfer rules apply only when code, comments, test data or logs hold personal data.⁷

Is it allowed to use ChatGPT for code review in a Saudi bank?

SAMA's Cyber Security Framework (CSF) does not forbid it, but it puts public cloud services behind an approval. It counts "cloud computing providers" among the third parties it covers.¹ Control 3.4.3 (Cloud Computing) says the policy for hybrid and public cloud services should require the following:

• "the Member Organization should obtain SAMA approval prior to using cloud services or signing the contract with the cloud provider" (consideration 4.a.2)
• "in principle only cloud services should be used that are located in Saudi Arabia, or when cloud services are to be used outside Saudi Arabia that the Member Organization should obtain explicit approval from SAMA" (4.b.1)
• "the cloud service provider should not use the Member Organization's data for secondary purposes" (4.c.1)

The CSF does not mention AI. We read a hosted AI service as a public cloud service, and training on your prompts as a use for "secondary purposes". This is CSF version 1.0 (May 2017).

SAMA's Rules on Outsourcing (December 2019) apply to licensed banks. They define outsourcing as another party performing, "on a continuing basis, a business function or activity which currently is, or could be, undertaken by the bank itself".⁶ In our reading, routine code review by a hosted AI service fits that definition. For a provider overseas, paragraph 42 requires "a written SAMA no objection", and the request must give the "Rationale for outsourcing (including why it cannot be done within KSA)".

Which rule applies to your organization?

SAMA's texts cover banks and other SAMA-regulated firms. NCA's Essential Cybersecurity Controls (ECC) cover government entities and operators of Critical National Infrastructure (CNI), and SDAIA's guideline covers government entities. The PDPL covers anyone whose code, comments, test data or logs hold personal data.

We quote the English texts. ECC-2:2024 states that its Arabic version is binding.² Readings marked as ours are not legal advice, so confirm them with your counsel.

What NCA's ECC requires of government and CNI entities

ECC-2:2024 has no control that names AI, but its third-party and cloud controls apply once an outside service holds the entity's data.² Control 4-1-2 requires third-party contracts to include "Clauses of non-disclosure and the secure removal of the entity's data by the third party upon the end of service". For IT outsourcing and managed services, which we read as including a hosted AI service, 4-1-3 adds "a cybersecurity risk assessment ... before signing contracts and agreements".

ECC-1:2018 sub-control 4-2-3-3 required the entity's information hosting and storage to be "inside the Kingdom of Saudi Arabia". ECC-2:2024 deleted it. Its change log says "entities must refer to the National Data Management Office regarding data localization before taking any action in this regard", without naming a location.² We found no published NDMO position on data location, so ask NDMO, which sits within SDAIA, in writing.

NCA's implementation guide gives a different answer. GECC-1:2023 was written for ECC-1:2018, and it lists the following guideline under control 4-2-2, which ECC-2:2024 keeps:³

Ensure that the location of hosting and storing the organization's information is within the Kingdom.

In our reading, an assessor can still apply this guide to a control that kept its number. Before the assessment, prepare a note that says where the service processes and stores the code, why that location is acceptable, what NDMO replied, and which executive approved it.

For government entities, SDAIA's guideline comes closest to a ban

SDAIA's Generative Artificial Intelligence Guidelines for Government (version 1, May 2025) call their rules "mandatory regulations governing the use of government data in generative artificial intelligence tools". Section 3.5 says:⁴

1. Employees in government entities must refrain from entering any data classified as restricted or higher (restricted, confidential, and top secret).

3. The use of generative artificial intelligence tools should be limited to data classified as "public" data.

Under the national Data Classification Policy (2020), data not classified when it is created or received "shall be treated as 'Restricted' until correctly classified", so unclassified source code is Restricted.⁵ The guideline therefore keeps it out of the AI tools it covers.

The guideline makes the entity's Data Management Office "responsible for approving the tools that are used".⁴ Its rule text does not exempt a model that the entity runs itself. Ask your Data Management Office to approve any tool, internal or hosted, before it reads Restricted code.

When does the PDPL apply to source code?

The Personal Data Protection Law (PDPL) applies when code, comments, test data or logs contain personal data. The law's definition includes "name, personal identification number, addresses, contact numbers".⁷ Sending such data to a hosted AI service outside Saudi Arabia is a transfer under Article 29.

Article 29 allows a transfer for these purposes:

• an obligation under an agreement "to which the Kingdom is a party"
• to serve "the interests of the Kingdom"
• an obligation "to which the Data Subject is a party"
• "other purposes as set out in the Regulations"

The Transfer Regulation adds central processing, a service to the data subject, and research.⁸ In our reading, none of these covers routine code review. Any transfer also needs "an adequate level of protection for Personal Data outside the Kingdom" and is limited to "the minimum amount of Personal Data needed".

Under Article 3 of the Transfer Regulation (August 2024), the competent authority, SDAIA, publishes a list of countries with adequate protection. We found no such list published. Article 4 exempts listed cases from the adequacy or minimum-data condition. One is a transfer that is "non-recurring or for a limited period and involves a limited number of data subjects". It needs standard contractual clauses, or a recipient with an approval certificate when the data is not sensitive, and Article 7 adds a risk assessment.

Daily use by a development team is not a one-off transfer. In practice, the route is to strip personal data before any code leaves your network.

What to have on file before code goes to a hosted AI service

Have these records on file before any repository goes out:

1. The repository's classification: the national levels for government entities, or the bank's scheme under CSF 3.3.3 ("information asset classification, labeling and handling").¹
2. A personal-data check of code, comments, test data and logs, with the data removed, or one of two documented routes: an Article 29 purpose with adequacy and minimum data, or an Article 4 exemption with its safeguard and the Article 7 risk assessment.
3. For banks, the CSF 3.4.3 steps (provider risk assessment and due diligence, SAMA approval, and a contract before use that rules out "secondary purposes"), plus SAMA's written no objection for a provider overseas.
4. For ECC entities, the 4-1-3 risk assessment, a contract with the 4-1-2 clauses, and NDMO's reply on data location.
5. The assessor note described in the NCA section.

Where the model runs changes the answer

On your own GPUs, the code stays inside your network. We read that as the CSF's "private cloud services (= internal cloud)", which 3.4.3 excludes. On a provider's GPUs in the Kingdom, the data stays where the CSF and NCA's guide expect it. The provider is still a third party, so the contract, risk assessment and SAMA cloud approval remain. Neither option sends personal data abroad, and SDAIA's tool approval applies to any model.

Disclosure, and how Haxset can help

Haxset offers a product in this category. Haxset deploys the Engine and its models in your country on Haxset GPUs, or on-prem on your own GPUs. The full AI runs locally.

Haxset does not keep the prompts its AI models process and does not train models on them. It stores only scan metadata and scan results. To work out which option fits your approvals, contact us.

FAQ

Does SDAIA's generative AI guideline apply to banks?

It is written for government entities and government data. Its definitions count contractors among government data users, and include data held by entities that operate public facilities or national infrastructure, so it can reach a contractor's development team. A bank answers to SAMA on this question, and to the PDPL when personal data is involved.

Does removing personal data from the code settle it?

It settles the PDPL question. SAMA's approvals, the ECC contract and risk-assessment controls, and the classification rules still apply, because they cover the entity's data in general.

Related research

• What Is AI SAST? AI-Native vs AI-Assisted Static Analysis, and What the LLM Actually Does
• AI-Powered SAST and DAST: How LLM Agents Find & Validate Vulnerabilities in Your Code and Running Apps
• Security on Every Pull Request, and Every Week: AI CI/CD Scanning and Continuous Monitoring

References

1. Saudi Arabian Monetary Authority (now the Saudi Central Bank), Cyber Security Framework, version 1.0, May 2017, sections 1.4, 3.3.3, 3.4 and 3.4.3 (pp. 6, 25, 36–38). ↩ ↩² ↩³ ↩⁴

2. National Cybersecurity Authority (NCA), Essential Cybersecurity Controls (ECC-2:2024), English version, 2024, binding-language statement (p. 1), scope (p. 9), controls 4-1 and 4-2 (pp. 30–31), Appendix C change log (p. 47). ↩ ↩² ↩³ ↩⁴

3. NCA, Guide to Essential Cybersecurity Controls (ECC) Implementation (GECC-1:2023), 2023, written for ECC-1:2018, control 4-2-2 (pp. 164–165). ↩ ↩²

4. Saudi Data and Artificial Intelligence Authority (SDAIA), Generative Artificial Intelligence Guidelines for Government, version 1, May 2025 (SDAIA-P116E), definitions (p. 6), sections 3, 3.5 and 4.1 (pp. 8, 12, 14), common risks (p. 20). ↩ ↩² ↩³

5. SDAIA, National Data Governance Policies, Data Classification Policy, version 1, 5 May 2020, sections 1.3 and 1.4 (PDF p. 16). ↩ ↩²

6. Saudi Central Bank (SAMA), Rules on Outsourcing, No. 41027017, 15 December 2019, section I.B (definitions) and section V, paragraph 42. ↩ ↩²

7. SDAIA, Personal Data Protection Law, English text, V2 (April 2023), Articles 1 and 29. ↩ ↩²

8. SDAIA, Regulation on Personal Data Transfer outside the Kingdom, August 2024, Articles 2, 3, 4 and 7. ↩