Andrea Tithecott, Partner, Head of Regulatory Practice, Healthcare & Life Sciences at Al Tamimi & Company, considers a new era of regulation, innovation, and global opportunity

As Saudi Arabia accelerates its Vision 2030 transformation, the Kingdom’s healthcare sector is undergoing a profound legal and regulatory overhaul. With a focus on privatisation, digital innovation, and international collaboration, the government is reshaping the sector to meet global standards while addressing the needs of local communities. Key legal developments across licensing, competition, insurance, data privacy, and digital health offer insights for investors, providers, and innovators eyeing opportunities in the region.

A unified legal framework for growth
Saudi Arabia’s Unified Health Law and the Private Health Institutions Law form the backbone of the Kingdom’s healthcare licensing regime. These laws streamline the establishment and operation of healthcare facilities, defining clear categories such as hospitals, clinics, radiology centres and same-day surgery centres. Notably, it includes some relaxations permitting foreign ownership (particularly under Public-Private Partnership) and Build-Operate-Transfer models. The Regional Headquarters (RHQ) Program, launched by the Ministry of Investment, further incentivises multinational healthcare companies to establish their regional bases in Saudi Arabia. RHQ status offers benefits such as tax exemptions, visa facilitation, and streamlined licencing, making it an attractive gateway for foreign investors. The Health Holding Company, a new state-owned enterprise, is central to the institutional transformation of the Ministry of Health (MoH). It manages service delivery, while the MoH retains regulatory oversight. This separation of roles is designed to enhance efficiency, transparency, and accountability across the healthcare system.

Fostering a fair and open market
The General Authority for Competition (GAC) plays a pivotal role in ensuring fair market practices. Under the Competition Law, the GAC has expanded its oversight to include merger control, abuse of dominance, and anti-competitive agreements. Healthcare, as a priority sector under Vision 2030, is under increasing scrutiny. Entities with a market share exceeding 40 per cent are considered to hold a dominant position and must exercise caution to avoid practices such as predatory pricing, exclusive dealing, or refusal to deal, which could stifle competition. The GAC has also introduced economic concentration thresholds and pre-merger notification requirements, ensuring that consolidation does not compromise market diversity or patient access. Recent enforcement actions demonstrate the GAC’s willingness to impose significant penalties, including fines of up to 10 per cent of annual revenues or SAR 10m, and even structural remedies such as divestitures.

Health insurance & reimbursement
In a landmark move, Saudi Arabia established the Insurance Authority (IA) in 2023, consolidating regulatory oversight previously split between the Saudi Central Bank (SAMA) and the Council of Health Insurance (CHI). As of March 2024, the IA is the sole regulator of the insurance sector, including health insurance. The IA’s mandate includes licencing, market conduct supervision, consumer protection, and digital transformation. The IA is expected to introduce a National Insurance Strategy, aligning with Vision 2030’s goals of increasing private sector participation and expanding insurance coverage. Integration challenges remain, particularly in aligning legacy systems and ensuring seamless data exchange between insurers, third-party administrators (TPAs), and healthcare providers. However, the IA’s centralised approach is expected to improve fraud detection, risk-based pricing, and claims management.

PDPL and cross-border health data transfers
The Personal Data Protection Law enforced by the Saudi Data and Artificial Intelligence Authority (SDAIA) is a cornerstone of the Kingdom’s digital transformation. The regulations govern the cross-border transfer of personal and health data, aligning with global standards such as the EU’s GDPR. Key provisions include: • Adequacy Assessments: Data can only be transferred to jurisdictions deemed to offer an ‘adequate’ level of protection. SDAIA is expected to publish a ‘white list’ of such countries. • Risk Assessments: Organisations must conduct structured risk assessments before transferring sensitive data. • Sensitive Data Controls: Health data, genetic information, and biometric identifiers are subject to enhanced safeguards, particularly for continuous or large-scale transfers. Non-compliance can result in fines up to SAR 5m and criminal penalties, including imprisonment for intentional misuse of sensitive data.

Digital health & AI regulation
Saudi Arabia is emerging as a regional leader in digital health and AI regulation. The Saudi Food and Drug Authority (SFDA) has issued the MDS-G010 Guidance, which sets out the requirements for AI and Machine Learning (ML) technologies used in medical devices. Key elements of the guidance include: • Classification Criteria: AI-based soware is classified as a medical device if it is used for diagnosis, treatment, or disease prediction. • Marketing Authorisation: Developers must demonstrate clinical efficacy, data integrity, and cybersecurity compliance to obtain approval. • Liability Considerations: While the guidance incorporates international best practices, it leaves open questions about legal liability in cases of algorithmic error or harm. The evolving nature of AI—particularly adaptive algorithms—poses challenges for traditional regulatory models. The SFDA’s approach is informed by frameworks from the FDA and International Medical Device Regulators Forum (IMDRF), but also reflects local priorities including data sovereignty and national security.

A market ripe for innovation and collaboration
Saudi Arabia’s healthcare legal landscape is rapidly aligning with international norms while maintaining a distinct regulatory identity. The convergence of legal modernisation, digital transformation and foreign investment incentives creates a fertile environment for innovation and collaboration. For international stakeholders, whether investors, digital health companies, or legal advisors, the Kingdom offers a compelling proposition. As the Saudi Global Health Conference 2025 in Riyadh approaches, now is the time to engage with Saudi regulators, explore partnerships, and contribute to shaping the future of healthcare in one of the world’s most dynamic markets.

CONTACT INFORMATION
www.tamimi.com