Key Takeaways
- Saudi Arabia’s National Cybersecurity Authority closed public consultation in August 2026 on new AI Cybersecurity Guidelines that explicitly name agentic AI alongside generative AI as in scope — one of the first national cybersecurity regulators anywhere to draft agentic-specific requirements rather than folding it into generic GenAI risk.
- The draft guidance is built on the same four-domain structure — governance, defense, resilience, third-party cybersecurity — as NCA’s binding Essential Cybersecurity Controls (ECC-2:2024). That’s a strong signal this becomes a mandatory overlay on existing law, not a voluntary best-practice document that stays optional indefinitely.
- Saudi Arabia’s cybersecurity baseline is already more binding than most enterprises operating there assume. NCNICC-1:2025, in force since January 2026, extends mandatory controls to every private-sector company in the Kingdom, not just critical infrastructure. AI-specific obligations are landing on top of that base, not into a regulatory vacuum.
- Agentic AI’s real security problem isn’t a smarter version of chatbot risk — it’s a blast-radius problem. OWASP’s Top 10 for Agentic Applications, published in December 2025, catalogs risks like tool misuse, identity and privilege abuse, and cascading multi-agent failures that have no real equivalent in traditional generative-AI risk lists.
- Governance built for generative AI — content review, output filtering, prompt policies — does not transfer to systems that plan, call tools, and act with delegated authority. The board question needs to shift from “is our AI’s output safe” to “what can our agents actually reach, and what happens if one of them is wrong.”
Most regulators writing AI rules right now are still writing them for yesterday’s AI — content generation, chatbots, decision support that a human reviews before acting. Saudi Arabia’s National Cybersecurity Authority did something different. Its draft AI Cybersecurity Guidelines, opened for public consultation in July 2026 and closed in August, name agentic AI explicitly, in the same sentence as generative AI, as technology the guidance is built to cover. That’s not a footnote. Most enterprise AI governance programs, including plenty built in the last twelve months, still don’t make that distinction cleanly.
The timing matters as much as the content. This isn’t NCA’s first cybersecurity framework — it’s an extension of an architecture the Kingdom has been building since 2018, most recently expanded in January 2026 when NCNICC-1:2025 pulled the entire private sector, not just critical infrastructure operators, into mandatory cybersecurity compliance for the first time. The AI guidelines use the exact same four domains NCA already uses for that binding baseline. Anyone reading this as a soft, advisory document is reading it wrong.
This piece walks through what the guidance actually says, why the generative-to-agentic distinction is the part enterprise governance teams most need to internalize, and what a Saudi-operating business — or any business tracking where this kind of regulation is headed — should be doing before the draft becomes final.
What Does the NCA’s Draft AI Cybersecurity Guidelines Actually Cover?
The guidance sets cybersecurity requirements for AI systems across four domains — governance, defense, resilience, and third-party cybersecurity — with subdomains derived from each, and it applies to any entity in the Kingdom that currently uses or plans to adopt AI. NCA’s own description is direct about scope: the document is meant to ensure cybersecurity requirements are implemented for AI and to mitigate the cybersecurity risks specific to AI technologies and systems, developed against international best practice rather than written from scratch. Critically, NCA names both generative AI and agentic AI as covered technologies in the same breath not agentic AI as a future addendum, but as part of the guidance’s initial scope.
That four-domain structure is the detail worth sitting with. It’s identical to how ECC-2:2024 is organized, which is not likely a coincidence. NCA built its entire binding cybersecurity architecture ECC for government and critical infrastructure, NCNICC-1:2025 for the rest of the private sector, sector overlays for finance and cloud around this same governance/defense/resilience/third-party skeleton. Fitting AI guidance into that exact structure suggests NCA intends to eventually enforce it the same way it enforces everything else built on that skeleton: as a binding minimum, not a document that stays in “recommended practice” territory once the ink dries.
STEP 01
Treat Agentic AI as a Distinct Risk Category, Not a Bigger Version of GenAI Risk
The single most common governance mistake right now is applying generative-AI controls output filtering, content review, prompt-injection defenses to agentic systems and assuming coverage. It doesn’t transfer. A generative AI system that hallucinates produces bad text a human reviews before acting on it. An agentic system that misjudges a plan takes an action calling an API, executing code, modifying a record with real consequences before anyone reviews anything. OWASP’s Top 10 for Agentic Applications names this category of risk explicitly: tool misuse, identity and privilege abuse, cascading failures across multi-agent systems, and rogue-agent behavior are all risks that simply don’t exist in a pure content-generation context. Real incidents already back this up a widely cited zero-click data-exfiltration vulnerability and an AI coding agent deleting a production database during a code freeze are the kind of failures this taxonomy was built to catalog, not hypothetical edge cases.
STEP 02
Map Your AI Footprint Against KSA’s Existing Binding Baseline First
Before worrying about a draft that isn’t final yet, confirm where you already stand against ECC-2:2024 or NCNICC-1:2025, whichever applies to your organization. Most enterprises assume Saudi cybersecurity mandates only apply to government bodies or critical infrastructure that assumption stopped being accurate the moment NCNICC-1:2025 took effect in January 2026, pulling every private-sector company above a modest size threshold into mandatory scope. AI-specific guidance is going to sit on top of that existing baseline, not replace it, so an organization with gaps in its current NCA compliance is building AI governance on a foundation that isn’t there yet.
STEP 03
Build AI Governance Around the Same Four Domains NCA Already Uses
Structure your AI governance program around governance, defense, resilience, and third-party cybersecurity rather than inventing a parallel taxonomy. Doing this now, ahead of the final guidance, means your existing evidence and control mapping carries forward instead of requiring a rebuild once the standard is published. It also means your governance function is speaking the same structural language NCA auditors already use for every other cybersecurity control set in the Kingdom a meaningful advantage when it comes time to demonstrate compliance.
STEP 04
Extend Vendor and Third-Party Risk Management to AI Supply Chains
Third-party cybersecurity is one of NCA’s four named domains, and it’s the one enterprise AI governance most often treats as an afterthought. An agentic system’s real supply chain includes the model provider, the tool and API integrations it calls, and increasingly the MCP servers or agent frameworks connecting it to everything else. OWASP’s own taxonomy calls out supply chain and inter-agent communication as distinct, high-severity risk categories precisely because a compromised or poorly governed third-party component becomes part of your agent’s blast radius the moment it’s connected. Vendor questionnaires built for traditional software vendors don’t ask the right questions here.
STEP 05
Give Agent Autonomy Explicit Boundaries
Define, in writing, what each agentic system is actually permitted to do: which tools it can call, which data it can touch, and where a human checkpoint is mandatory rather than optional. Least-privilege access — the oldest principle in security — is also the most underused one in agentic deployments, largely because granting an agent broad tool access is the fastest way to get a demo working. That shortcut is exactly what turns a single compromised agent into an incident that touches far more than the system it started in.
STEP 06
Build Incident Response for Agent-Specific Failure Modes
A data breach playbook doesn’t cover an agent that autonomously executed a bad multi-step plan across three connected systems before anyone noticed. Extend incident response to account for agent-specific failure patterns cascading actions across tool calls, memory poisoning that corrupts an agent’s future decisions, and agent-to-agent communication that spreads a bad instruction before a human is in the loop. This is new territory for most incident response teams, and it needs to be built before an incident forces the question, not during one.
STEP 07
Track the Consultation-to-Final-Standard Timeline and Prepare for It to Become Mandatory
NCA’s public consultation on the AI Cybersecurity Guidelines closed on 5 August 2026. Treat the gap between now and a finalized, published standard as a preparation window, not a reason to wait. Given how closely the draft mirrors NCA’s existing binding architecture, the realistic planning assumption is that this becomes a compliance requirement on a defined timeline, the same way NCNICC-1:2025 turned “recommended for private companies” into “mandatory” in a single publication.
| NCA Domain | Generative AI Risk Focus | Agentic AI Risk Focus |
| Governance | Policy on acceptable content use, output review, model selection | Defined authority limits per agent, named accountability for autonomous actions taken |
| Defense | Prompt-injection defenses, content filtering, access to the model itself | Tool-access controls, least-privilege scoping, defenses against memory poisoning and plan manipulation |
| Resilience | Recovery from bad outputs, model rollback, incident response for content harms | Recovery from cascading multi-step actions, containment of an agent’s ongoing access mid-incident |
| Third-Party Cybersecurity | Model provider due diligence, data-handling terms | Supply-chain review of tool integrations, MCP servers, and inter-agent communication channels |
Summary
The gap between generative AI and agentic AI isn’t a marketing distinction it’s the difference between software that suggests and software that acts, and Saudi Arabia’s cybersecurity regulator built its first AI-specific guidance to recognize exactly that. Enterprises operating in or selling into the Kingdom now have a clear signal about where binding requirements are headed: the same four-domain architecture already governing every other cybersecurity control in Saudi Arabia, extended to cover systems that plan, call tools, and act with delegated authority. Waiting for the final published version before building governance for agentic AI means building it under a deadline instead of ahead of one. The organizations that map their agent inventory, define tool-access boundaries, and extend third-party risk management to their AI supply chain now will be the ones with a real answer when NCA or a customer, or a board member asks what an autonomous agent in their environment is actually allowed to do.
Frequently Asked Questions
Is the NCA’s AI Cybersecurity Guidelines legally binding yet?
Not yet in its current form — it went through public consultation, which closed in August 2026, as a draft. But it’s built on the same four-domain structure as NCA’s binding frameworks, and NCA has a track record of moving guidance into mandatory territory, as it did with NCNICC-1:2025 for general private-sector cybersecurity.
How does this relate to SDAIA’s existing AI guidelines?
They sit at different layers. SDAIA’s Generative AI Guidelines and AI Adoption Framework address ethical use, responsible adoption, and organizational maturity — largely non-binding policy guidance. NCA’s AI Cybersecurity Guidelines address the specific cybersecurity controls needed to secure AI systems, sitting alongside NCA’s existing binding cybersecurity architecture. A mature governance program needs to account for both layers, not treat them as interchangeable.
Does this apply to foreign companies operating in Saudi Arabia?
NCA’s existing frameworks already apply broadly — ECC-2:2024 covers government entities and critical infrastructure operators including subsidiaries and affiliates, and NCNICC-1:2025 extends mandatory baseline controls to non-CNI private-sector companies operating in the Kingdom regardless of where they’re headquartered. There’s no indication the AI-specific guidance would carve out a narrower scope.
What’s actually different about agentic AI risk versus generative AI risk?
Generative AI risk is largely about outputs — bad, biased, or hallucinated content a human typically reviews before acting on. Agentic AI risk is about actions an autonomous system executing multi-step plans, calling tools, and touching real systems and data with reduced human oversight. The failure modes, and the controls needed to catch them, are genuinely different categories, not points on the same scale.
Should we wait for the final version before doing anything?
No. The core exposure not knowing your AI systems’ actual blast radius, not having least-privilege tool access defined, not extending vendor risk management to AI supply chains exists regardless of whether a specific regulation has been finalized. Waiting means building governance under a compliance deadline instead of ahead of one.
How does this fit with the ECC-2:2024 or NCNICC-1:2025 compliance work we’re already doing?
It should extend it, not duplicate it. Building AI governance around the same governance/defense/resilience/third-party structure already used for your existing NCA compliance means your evidence, ownership structures, and audit relationships carry forward rather than requiring a separate program.
What’s the single biggest governance gap enterprises have right now for agentic AI?
Not knowing, system by system, what an agent is actually authorized to touch. Most organizations can describe what their AI systems are supposed to do; far fewer can produce a clear, current answer to what each one is technically capable of doing if something goes wrong — which tools it can call, what data it can reach, and where a human checkpoint actually exists versus where it’s assumed.
