Deepfake Guidelines Saudi Arabia: What Businesses Do

The deepfake guidelines Saudi Arabia’s data authority issued this year speak to a risk that now reaches ordinary companies: a phone call or video message that sounds and looks like your boss, your supplier or your customer, but is not. The Saudi Data and Artificial Intelligence Authority (SDAIA) published its Deepfakes Guidelines in May 2026. This guide is written for owners and managers in Dammam, Khobar, Riyadh and Jeddah, and it sets out what the guidelines say, what they mean for finance, HR and customer teams, and six checks you can put in place this month. It is a business briefing, not legal advice.

Deepfake guidelines Saudi Arabia: what SDAIA published

The Saudi Press Agency reported on 8 May 2026 that SDAIA had issued “Deepfakes Guidelines: Mitigating Risks While Fostering Innovation”. The document defines deepfakes as content manipulated through deep learning, and it warns that telling such media from reality is becoming harder as the tools become more accessible.

Arab News, in a report based on the full document, says the guidelines treat the technology as neutral and judge it by intent and use. They name positive uses in marketing, entertainment, retail, education, healthcare and culture, and they separate those from three malicious threats: impostor scams, non-consensual manipulation of a person’s image, and disinformation.

The risk that reaches your finance team

Impostor scams matter most to a company. Arab News says the guidelines describe deepfakes that copy the voice and face of a trusted person to authorise fraud or to extract data, and that they cite a multinational employee who wired a large sum after a video call with a fake senior executive. The report adds that near-perfect AI voice scams are an emerging threat.

Biometric Update, writing on 26 August 2026, notes that the guidelines name voice and facial biometric impersonation as practices used to get past traditional security systems, and says fast growth in digital onboarding has outpaced security. It gives no Saudi fraud statistics, and we found none in the sources we checked, so we cannot say how common these attacks are here. The point is the method: a convincing voice is no longer proof of identity.

What the guidelines ask of developers and creators

According to Arab News, developers are expected to follow the Personal Data Protection Law (PDPL) and the Anti-Cyber Crime Law, build in privacy by design, add non-intrusive digital watermarks, document their models and keep a human in the loop at critical stages. Content creators are told not to use deepfake tools for fraud, impersonation or defamation, to apply visible watermarks to synthetic content and to get explicit consent before using anyone’s likeness, with auditable records.

This matters if you commission AI videos or voice-overs for marketing, or use an avatar in customer service. Get written consent from anyone whose face or voice is used, label synthetic content and keep the record. The sources we read describe the document as guidance and do not mention fines for ordinary companies, so ask your legal adviser how it applies to your sector.

How the public is told to spot a fake

Arab News lists a three-step method for the public: assess the source and context of a message, look for audio and visual signs such as irregular facial movement, lip-sync delay, unnatural blinking or odd lighting, and verify with detection and provenance tools. Step one is the one that works for a business. A request that arrives with pressure, secrecy or a new bank account should be checked through a second channel, however real it looks.

Six checks to put in place this month

• Use a call-back rule. Confirm any change of bank details, or any urgent payment request, by calling a number you already hold, never the one in the message.
• Require two approvals. Payments above a limit you set need a second person who was not on the call.
• Never rely on a voice or a face alone. For customer onboarding or password resets, add a second check, such as a one-time code or a document check.
• Agree a verification phrase. Executives and finance staff can use it to confirm urgent requests made by phone or video.
• Train the teams that get targeted. Show finance, HR and customer service staff what a fake call looks like, and tell them they may pause any urgent request.
• Prepare a response. If you are targeted, keep the evidence and report it. Arab News says the guidelines point victims to the platform, the Kollona Amn app or the Ministry of Interior’s Cybercrime Unit, and to the Saudi Central Bank for financial fraud.

How Scalor Systems can help

Most deepfake losses happen where a process lets one person move money or change records on trust. Our AI Integration service adds approval, call-back and logging steps to the systems you already run. Our Document Processing Automation solution reads IDs, invoices and bank letters into your systems and sends unusual items, such as a changed bank account, to a person for review. For the wider picture, read our guides to the SDAIA AI risk management framework and to AI cybersecurity guidelines in Saudi Arabia. To discuss your own controls, book a free discovery call with Scalor Systems at scalorsystems.com/contact.

Sources

1. Saudi Press Agency: SDAIA Issues Deepfakes Guidelines to Regulate Responsible AI Use (8 May 2026)
2. Arab News: SDAIA issues deepfakes guidelines to regulate responsible AI use (9 May 2026, updated 11 May 2026)
3. Biometric Update: Saudi Arabia issues deepfake guidelines as AI-driven identity threats rise (26 August 2026)