USHeadquarters
United States
Florida
EST • UTC−5·Mon-Fri • 9:00, 18:00
AI Consulting in Saudi Arabia Built for the Kingdom's Rules
Vision 2030 turned AI adoption into a board-level expectation, and that has produced a great deal of procurement with very little scoping. We work in Arabic and English from Riyadh, design against SDAIA's seven AI Ethics Principles and the PDPL from the first workshop rather than the final review, and architect for in-Kingdom data residency when the workload requires it.
- Riyadh · Sunday to Thursday
- Delivery and Documentation in Arabic
- SDAIA Principles Applied Pre-Deployment
- In-Kingdom Residency Where Required
INNOVATION
SCALE
Global Reach
Overview
The Constraint Decides the Architecture, Not the Model
In most markets you choose a model on accuracy, latency and cost, then work out the compliance position afterwards. For regulated workloads in the Kingdom that order is backwards, and reversing it late is the single most expensive mistake we are asked to unwind.
The framework is layered. The Personal Data Protection Law governs personal data, and it sits alongside SDAIA's AI Ethics Principles for the AI system itself, the National Cybersecurity Authority's Essential Cybersecurity Controls and Cloud Cybersecurity Controls for the platform underneath, and then sector rules from SAMA, the Ministry of Health, the Communications, Space and Technology Commission and others depending on who you answer to. Any one of those can rule out an architecture that was otherwise the obvious technical choice.
So we establish the constraints in scoping. Where the data may be processed, what lawful basis covers it, what has to be logged and for how long, and which decisions require a human in the loop. Once those are settled, model selection is a straightforward engineering question, and it is a question with several good answers rather than one that has to be argued past a regulator.
SDAIA's Seven Principles as a Pre-Deployment Gate
Fairness
Bias testing against the groups the system actually affects, with the evaluation set and the results documented rather than asserted. For screening and eligibility decisions this is the principle regulators and complainants both reach for first.
Privacy and Security
PDPL obligations made concrete: lawful basis recorded, data minimised to what the use case needs, encryption in transit and at rest, tenant isolation for multi-customer deployments, and a retention policy covering prompt logs and model artefacts as well as source records.
Humanity
Human oversight designed into the workflow rather than promised in a policy. Any decision affecting an individual's rights, entitlements or employment keeps a person with real authority to overrule the system, and that authority is written down.
Social and Environmental Benefit
The use case is stated in terms of the benefit it creates and who receives it, alongside the run cost. In practice this is the section that stops vanity deployments, because a use case with no articulable beneficiary rarely survives writing it down.
Reliability and Safety
Validation against a held-out set of real cases, defined accuracy thresholds tied to the current process baseline, behaviour specified for degraded and failure conditions, and a documented condition under which the system should be switched off.
Transparency, Explainability and Accountability
Data sources, model design and decision logic documented to the extent feasible for the technique used, every automated decision logged with its inputs and system version, and a named owner with an escalation route and an incident reporting path.
DATA RESIDENCY
Where the Data Is Allowed to Be
Residency is the constraint that most often decides the architecture before anything else does, and the one most often discovered late by teams who scoped the model first.
01
Establish the Classification First
Personal data, sensitive personal data, and sector-regulated data carry different obligations, and a single workflow often touches more than one class. We classify what the use case actually needs at the field level, because the classification of the narrow path is what matters rather than that of the whole dataset.
02
Settle Transfer Before Selecting a Model
Whether the records may be processed outside the Kingdom, and under what conditions, determines which providers and regions are available. Establishing this after a model has been chosen is how teams end up rebuilding a working system for reasons that have nothing to do with its performance.
03
Deploy In-Kingdom or In-Tenancy Where Required
We architect for in-Kingdom cloud regions, or entirely inside your own tenancy, when residency demands it. That constrains model choice, and we would rather present you with the honest shortlist under the constraint than an ideal architecture you cannot deploy.
04
Extend Retention Policy to Model Artefacts
Prompt logs, embeddings, fine-tuning datasets and cached retrievals all contain the underlying records and are routinely omitted from retention policies written for databases. We treat them as in scope from the start, because discovering them during an audit is not the moment to start that conversation.
SECTOR OVERLAY
Who Else Has a Say
Beyond PDPL and SDAIA, the sector regulator usually adds requirements that change the design. These are the overlays we most often work under.
Banking and Finance
SAMA-regulated entities carry additional expectations around outsourcing, model risk, cybersecurity and customer data handling. Automated decisions affecting customers need an explainability position and a human review route established before build, not after a supervisory question.
Healthcare
Patient data raises both the classification and the oversight requirement, and Ministry of Health expectations apply alongside PDPL. Clinical or triage-adjacent use cases need the human-in-the-loop boundary drawn conservatively and documented in the deployment record.
Government and Semi-Government
Procurement here tends to require the governance artefacts as deliverables rather than as internal practice: the pre-deployment review, the logging design and the accountability record are part of what is handed over, and we scope them that way from the start.
Telecom and Technology
CST rules interact with subscriber data handling and with any customer-facing automated interaction. Voice and chat automation in particular needs its disclosure and escalation behaviour specified rather than left to the model's discretion.
Energy, Industrial and Logistics
Usually lighter on personal data and heavier on operational technology boundaries. The design questions move to network segmentation, what may cross from the OT side, and what a model is permitted to actuate versus merely recommend.
Retail and Consumer
High personal-data volume with marketing and profiling use cases attached, which is where consent, lawful basis and the individual's rights under PDPL become the practical constraint rather than a formality noted in a policy document.
HOW WE WORK HERE
Delivery, Not Just Advice
Arabic as a Working Language
Workshops, interviews with operators, the report and the runbook are delivered in Arabic where the team works in Arabic. Documentation your staff cannot read is documentation that does not transfer ownership, whatever the handover meeting concluded.
- Shadowing and interviews conducted in Arabic
- Report and runbook in Arabic and English
- Arabic-language evaluation sets for text workloads
- Right-to-left interfaces treated as a requirement, not a port
On the Kingdom's Calendar
We run Sunday to Thursday, plan around Ramadan working hours and the Eid periods, and schedule stakeholder time in Riyadh rather than expecting your team to take calls at the end of their day for someone else's convenience.
- Riyadh presence at Al Munsiyah, Riyadh
- Sunday to Thursday working week
- Delivery plans that account for Ramadan and Eid
- On-site shadowing rather than remote-only discovery
Related Reading
AI Consulting
The hub: how scoping, roadmap and build fit together across both the Saudi and US markets.
ReadAI Workflow Audit
The two-week method that produces the baseline, the ranked opportunities and the governance blockers.
ReadAI Readiness Assessment
Five dimensions scored separately, with the governance dimension assessed against SDAIA and PDPL.
ReadCustom AI Development in Saudi Arabia
The build side: models, pipelines and integrations delivered for Saudi organisations.
ReadSaudi AI Consulting Questions
They are the Kingdom's framework for responsible AI, organised around seven principles: fairness, privacy and security, humanity, social and environmental benefit, reliability and safety, transparency and explainability, and accountability and responsibility. In practice they function best as a pre-deployment checklist rather than a values statement: each principle maps to something you can evidence, such as a bias test result, a documented lawful basis, a named human with authority to overrule the system, a validation run against held-out cases, or a decision log an auditor could follow.
The Personal Data Protection Law governs how personal data is collected, processed, transferred and retained, and an AI system is simply another processing activity under it. The obligations that most often change a design are lawful basis for the specific processing, data minimisation to what the use case actually needs, the rules around transfer outside the Kingdom, and retention. That last one catches teams out most, because prompt logs, embeddings and fine-tuning datasets contain the underlying personal data and are frequently omitted from a retention policy written with databases in mind.
It depends on the data classification and your sector, so it is a question to settle in scoping rather than assume in either direction. Some workloads can be processed outside the Kingdom under the conditions the framework allows; others, particularly in regulated sectors, cannot. Because that constraint limits which providers and regions are available, we establish it before selecting a model rather than after, and we architect for in-Kingdom regions or your own tenancy where it applies.
We are an engineering firm and we do not claim certifications we do not hold. What we provide is delivery practice: designing against SDAIA's principles and PDPL obligations from the first workshop, producing the pre-deployment review and decision logging as deliverables, and architecting for residency where it applies. Your legal counsel and, where relevant, your regulator confirm the final compliance position. Any consultancy telling you it can certify your compliance on its own authority is describing something that does not work that way.
Yes, as a working language rather than a translation step at the end. Shadowing and operator interviews happen in Arabic where the team works in Arabic, the report and runbook are delivered in Arabic, and text workloads get Arabic-language evaluation sets rather than English ones translated across. Handover documentation your staff cannot read does not transfer ownership regardless of what the closing meeting concluded.
It has moved AI from an experiment to a board-level expectation, which is good for budgets and hard on scoping. The pattern we see most is a mandate to adopt AI arriving without a specified workflow, a metric or an owner, which produces procurement that is difficult to evaluate and pilots that cannot be judged. The remedy is unglamorous: pick one process, measure it, and put a number on the table that a CFO can check.
Yes, and it is common. We are frequently brought in for the scoping and governance layer alongside an incumbent integrator who owns the platform relationship, or asked for an independent review of a proposal before it is signed. Because we have no reseller relationships, our recommendation on model and platform is not steered by a margin, which is usually the reason for the second opinion in the first place.
Banking and finance under SAMA supervision, healthcare, government and semi-government entities, telecom and technology under CST rules, energy and industrial operations, logistics, and retail. The sector matters because it determines the overlay on top of PDPL and SDAIA, and that overlay frequently changes the architecture: an approach that is straightforward for a logistics operator can be unavailable to a bank handling the same class of document.
We operate from Al Munsiyah in Riyadh on a Sunday to Thursday week, with on-site shadowing rather than remote-only discovery for engagements that need it. Delivery plans account for Ramadan working hours and the Eid periods, which matters more than it sounds when a two-week audit has to fit around them.
Have an AI idea? Let's get it into production.
Book a free 30-minute call with our engineers. You'll leave with a clear scope, timeline, and estimate, whether or not we end up working together.
