Artificial Intelligence for IT Governance in Saudi Arabia: Opportunities, Challenges, and Future Directions within COBIT 2019 and ISO/IEC 38500 Frameworks

Saudi Arabia’s Vision 2030 and the National Strategy for Data & AI have accelerated the use of artificial intelligence across public services and regulated industries, creating a need to understand how AI can support information-technology governance (ITG) through established frameworks such as COBIT 2019 and ISO/IEC 38500/38507. This study carried out a structured review of academic, industry, and policy sources published between 2008 and 2025. A total of 236 records were identified; after removing duplicates and applying clear inclusion criteria (focus on AI or ITG, relevance to Saudi Arabia, and transparent methods), 78 were included. The review process followed PRISMA principles, with quality checks rating most evidence as moderate to high. Results show that AI can strengthen ITG by improving compliance monitoring, decision-making, and delivery of benefits. Reported outcomes include stronger governance links in empirical models, national adoption intent of about 63% of firms, projected government productivity gains of up to $56 billion a year, and a case reporting reductions of 93% in monitoring costs and 92% in accident fatalities. A comparison with EU, NIST, and OECD frameworks revealed gaps in Saudi guidance but also near-term opportunities such as creating an AI risk taxonomy, adapting impact assessment templates, and setting clearer rules for incident reporting. Limitations include reliance on mixed-quality data, policy-based estimates, and limited post-deployment evidence. Overall, the findings suggest that AI can measurably enhance ITG in Saudi Arabia when supported by risk-based obligations, lifecycle controls, and board-level oversight, providing regulators and boards with practical steps for improvement.