From principles to binding rules: A one health governance readiness analysis of Saudi Arabia's AI health policy against global regulatory benchmarks

Abstract

Background AI is entering clinical care, disease surveillance, and health-data systems faster than governance frameworks can accommodate. Stakes for public health systems include algorithmic safety in diagnosis and triage, data interoperability, and workforce capacity to supervise AI tools safely. Saudi Arabia has built substantial AI health governance infrastructure through its Data and Artificial Intelligence Authority and Food and Drug Authority, but no binding, AI-specific health law had been enacted as of mid-2026. Methods A ten-dimension governance scoring framework anchored in WHO and EU AI Act standards covered legal bindingness, risk classification, health-specific AI provisions, transparency, post-market surveillance, data governance/interoperability, independent auditing, codified ethics, and workforce/capacity building. Nineteen policy documents across Saudi Arabia, the EU, the USA, and China were scored 0–2 (absent, partial/non-binding, codified/binding), citing source passages. A genuine second coder was unavailable; reliability was assessed via single-coder self-consistency on a random subsample, and a separate post-hoc construct-validity review checked cross-jurisdictional consistency of rubric application. RTGI (Regulatory Transition Gap Index) was computed under two weighting schemes and stress-tested with a randomized-weight sensitivity sweep. Results Saudi Arabia scored 15 of 20 (RTGI = 0.25), second only to the EU (16/20, RTGI = 0.20) and ahead of the USA (14/20, RTGI = 0.30) and China (6/20, RTGI = 0.70; sensitivity band 5–11/20 accounting for translation limitations). Rank order was stable across weighting schemes and a 1000-draw randomized-weight sensitivity sweep (China's largest-gap position held in 99.3% of draws; full baseline order reproduced in 53.5% of draws). Single-coder self-consistency agreement on a random subsample was 83.3% (kappa = 0.64, substantial). Saudi Arabia's largest gaps were independent third-party conformity assessment, data governance/interoperability, codified ethics, and workforce/capacity building. Conclusions Saudi Arabia's AI health governance is strong on device-specific technical guidance but relies on internal quality-management auditing rather than independent third-party conformity assessment, and has not converted ethics principles into binding rules with the public-health reach of the EU AI Act. Four near-term actions are identified to close the highest-priority gaps.