Saudi NCA AI Cybersecurity Guidelines: Control Mapping for Agentic AI

Saudi Arabia’s NCA AI Cybersecurity Guidelines (AICG-1:2026) are still a draft. NCA consulted on them from 5 July to 5 August 2026, the draft says they are not mandatory, and we found no final version as of 9 October 2026. They already name agentic AI explicitly, so mapping your agent controls to them now is cheap preparation.

This post walks through what the draft contains, maps its agent-relevant guidelines to practical controls, and shows how they line up with NCA’s ECC-2:2024 and the OWASP Top 10 for Agentic Applications. Treat every clause number below as draft numbering that may change in the final text.

What are the NCA AI Cybersecurity Guidelines?

The National Cybersecurity Authority published the draft for public consultation in July 2026. According to the consultation draft itself:

• It contains 4 main domains, 15 subdomains and 42 guidelines.
• The scope “includes emerging AI technologies such as generative AI and agentic AI”.
• It covers the whole lifecycle: design and development, deployment, operation, and retirement.
• NCA “advises every entity in the Kingdom that adopts or plans to adopt” AI systems to follow it, while stating plainly that “these guidelines are not mandatory”.

The draft also says it applies cybersecurity requirements previously defined in other NCA documents to the AI context specifically. It borrows definitions from SDAIA’s AI Adoption Framework, which tells you NCA sees this as part of the national AI governance stack rather than a standalone rulebook.

What we do not know yet: whether the final version keeps the same numbering, whether any guidelines become mandatory for government entities or critical national infrastructure operators, and whether sector regulators will reference it. Plan for the content; do not hard-code the clause numbers into contracts yet.

How is the draft structured, and how does it relate to ECC-2:2024?

The four domains deliberately mirror the Essential Cybersecurity Controls (ECC-2:2024), which are already mandatory for government organisations and operators of critical national infrastructure in the Kingdom.

The practical consequence: if you already run an ECC compliance programme, you do not need a second framework. You need an AI overlay on the controls you have, plus evidence for the agent-specific items below.

Which draft guidelines matter most for agentic AI?

Most of the 42 guidelines are general AI hygiene. About a dozen are directly about how agents plan, call tools and act. Here they are, with a practical control for each and the closest OWASP Top 10 for Agentic Applications risk (published December 2025, ASI01 to ASI10).

ASI07 (insecure inter-agent communication) has no dedicated guideline in the draft, though network segmentation (2-3) and identity controls (2-2) cover part of it. If you run multi-agent systems, add authenticated, integrity-protected messaging between agents anyway.

For how these risks show up in real attacks, our posts on prompt injection in AI agents and pentest.ae’s how AI agents get hijacked cover the mechanics. Tool connectors deserve special attention; pentest.ae’s MCP server security assessment shows what testing them involves.

Where do SDAIA’s AI Ethics Principles fit?

SDAIA, not NCA, owns AI ethics. Its AI Ethics Principles (version 2.0, published September 2023) set out seven principles: fairness; privacy and security; humanity; social and environmental benefits; reliability and safety; transparency and explainability; and accountability and responsibility.

The NCA draft is the security layer underneath two of those: privacy and security, and reliability and safety. The accountability principle lines up with the draft’s governance asks: named owners, approval gates and human oversight. If your organisation has done an SDAIA self-assessment, reuse the AI inventory and risk classification from it; it is the same starting point the NCA draft asks for in 1-1 and 2-1.

How does this compare with the EU AI Act?

Different instruments, overlapping evidence. The EU AI Act is binding law with risk tiers, conformity assessment for high-risk systems and fines. The NCA draft is non-mandatory security guidance focused on how AI systems are protected and operated. A GCC company selling into both markets will find that the same artefacts serve both: AI inventory, risk assessments, adversarial test results, logging and human oversight design.

If Europe is also on your roadmap, see our EU AI Act compliance checklist and the EU AI Act security requirements breakdown.

What should you do before the final version lands?

1. Inventory every AI component, including agents, prompts, tools, MCP servers and third-party models, with an owner and lifecycle status.
2. Write the action register for each agent: what it can do, how reversible each action is, and which actions need human approval.
3. Give agents their own identities with least-privilege scopes and short-lived credentials.
4. Turn on tool-call logging and route it to the SIEM you already use for ECC.
5. Test the kill switch and manual fallback, then run an adversarial test against your highest-impact agent, following an approach like pentest.ae’s AI agent penetration testing field guide.
6. Add AI clauses to vendor contracts for any third party that builds or hosts AI components for you.

None of this is wasted if the final text changes. These are the controls every serious agent framework asks for, and they map to ECC controls you are probably already audited on.

Get a KSA AI security gap assessment

infosec.qa runs a fixed-scope KSA AI security gap assessment against the draft NCA AI Cybersecurity Guidelines, cross-referenced to ECC-2:2024 and the OWASP Top 10 for Agentic Applications. We inventory your AI estate, check each draft guideline against real evidence, test your riskiest agent paths, and hand you a prioritised remediation plan that we update when NCA publishes the final text. Book a KSA AI security gap assessment.