AI in Healthcare - Kingdom of Saudi Arabia

Healthcare & Life Sciences Focus

AI in Healthcare - Kingdom of Saudi Arabia

Andrea Tithecott
Partner,
Head of Healthcare & Life Sciences

Andrew Fawcett
Partner,
Digital & Data

Christine Khoury
Senior Counsel,
Digital & Data

Saudi Arabia is one of the leading countries in the region in adopting and regulating artificial intelligence (‘AI’) across several sectors including the healthcare sector. The country has issued ministerial resolutions, guidelines and policies concerning the use of AI and Big Data in medical devices, data management, and AI governance.

By virtue of Council of Ministers Resolution No. 292, the Saudi Data & Al Authority (‘SDAIA’) is the competent authority mandated to develop policies, governance mechanisms, standards, and controls related to data and AI and to monitor compliance upon issuance. AI is defined by SDAIA as: systems that employ methods that can gather data and use it to predict, suggest, or make decisions with varying degrees of autonomy and select the best course of action to accomplish particular objectives.

In September 2023, SDAIA issued the Principles and Controls of AI Ethics (the ‘Principles’); then in January 2024, issued two versions of Generative Al Guidelines, one for the government, and the second for the public (together the ‘Al Guidelines’). SDAIA has analyzed global practices and standards to develop these Principles and Guidelines which aim to support the Kingdom's efforts towards achieving its vision and national strategies related to adopting AI technology, encouraging research and innovation, and driving economic growth for prosperity and development.Similar to principles/standards adopted by many countries and international companies, the Principles set out seven pillars, (i) fairness; (ii) privacy & security; (iii) humanity; (iv) social & environment benefits; (v) reliability & safety; (vi) transparency & explainability; and (vii) accountability & responsibility.As for the Guidelines, the first document titled “Generative Artificial Intelligence Guidelines Public” applies to the public, including developers and users of generative AI (‘GenAI’) based in the Kingdom. Comparable to the Principles, the Guidelines emphasize fairness, reliability, safety, transparency, accountability, privacy, and social and environmental benefits. They aim to mitigate risks such as deepfakes, misuse, and security threats, ensuring that GenAI systems are used ethically and responsibly.

The government GenAI Guidelines emphasise compliance with data governance, privacy laws, and ethical AI use.

SDAIA also issued the “Generative Artificial Intelligence Guidelines for Government” regulating the use of GenAI by government employees. It also outlines the same principles for a responsible use of GenAI. The Guidelines assert the importance of compliance with existing regulations, such as data governance and privacy laws offering practical advice for using GenAI, addressing potential risks, and ensuring the ethical use of AI systems. Specific best practices and examples are provided to guide government entities implementing these guidelines effectively. This framework also sets out the roles and responsibilities of SDAIA and its bodies, such as the National Information Center, the National Center for Artificial Intelligence, and the National Data Management Office. It is worth noting that apart from the Principles and the AI Guidelines, there are no AI specific laws or regulations promulgated, however, there are many other regulations indirectly tackling AI, such as data protection laws, intellectual property laws, cloud computing regulations, the internet of things framework, and the cybercrime law, to name a few. These measures aim to ensure the safety, quality, and effectiveness of AI-based solutions including the healthcare sector, as well as to protect the privacy, confidentiality, and rights of patients and users. With respect to healthcare specifically, the Saudi Food & Drug Authority (‘SFDA’) has published specific guidance on the use of AI and Big Data in medical devices. This guidance covers the review and approval process for AI-based medical devices, ensuring they meet standards for accuracy, security, and clinical efficacy. The guidance also defines medical 'Big Data' as various kinds of medical information, including medical records, biometric information, medical images, and genetic information. Software is classified as a medical device based on its intended use, with certain types of software excluded. Security requirements include server access control, user authentication, encryption, and de-identification. These measures are part of Saudi Arabia's broader efforts to integrate AI into various sectors while maintaining high standards of accountability and transparency. The country has launched several initiatives and projects to leverage AI for improving healthcare outcomes, such as the National Unified Medical Record, the Saudi Health Information Exchange, and the National Strategy for Data and Artificial Intelligence. The country is also actively participating in international forums and collaborations related to data and AI, such as the Global Partnership on Artificial Intelligence and the G20 Digital Economy Task Force. Saudi Arabia's progress in AI in healthcare is evident from its achievements and innovations in this field. For example, the country has developed and deployed AI-based solutions for detecting and diagnosing diseases, such as breast cancer, COVID-19, and diabetic retinopathy. The country has also established specialized data and AI centers, such as the Saudi Center for Disease Prevention and Control, the Saudi Health Council, and the King Abdulaziz City for Science and Technology. The country has also invested in building national expertise and capacities in data and AI sectors, such as through the Saudi Data and AI Academy and the National Center for Artificial Intelligence. Saudi Arabia's developments in AI in healthcare present significant opportunities for healthcare companies and digital tech providers in this country. Companies can seek medical device marketing authorizations for AI-based medical devices by adhering to the new SFDA guidelines. There is an opportunity to develop AI software that can be configured with hardware for clinical decision support or computer-aided detection/diagnosis. Manufacturers must establish data management policies for training/learning data integrated into the software. The guidelines provide for different cloud configurations (private, public, hybrid), presenting opportunities for cloud service providers. Moreover, companies can benefit from the data and AI capabilities and infrastructure provided by the SDAIA and its bodies, as well as from the research and innovation ecosystem supported by the government and academia.In conclusion, Saudi Arabia has made remarkable progress in AI in healthcare and has established a robust regulatory and governance framework for data and AI. The country is in line with international best practices and standards and is open to cross-border collaboration and harmonization of laws and standards to maximize the benefits of AI and use of data while maintaining patient safety, privacy, confidentiality. Saudi Arabia offers a promising market and a conducive environment for healthcare companies and digital tech providers who wish to tap into the potential of AI in healthcare.

For further information,
please contact Andrea Tithecott, Andrew Fawcett and Christine Khoury.

^{Published in}^{January 2025}