AI Doesn't Stall on the Model, It Stalls on the Data Underneath It
Most Saudi AI pilots that never reach production fail for the same reason: nobody classified the data, nobody owned it, and nobody checked whether personal data could legally sit inside a training set. Bilytica starts at that layer, not at the model.
- Quality dimensions scored
- NDMOQuality dimensions scored
- Lawful basis checked before training
- PDPLLawful basis checked before training
- Data classes mapped to residency
- 4Data classes mapped to residency
- Named data owner per domain
- 1Named data owner per domain
What a Saudi board should ask before approving a model build
- 01
Ask who owns the data, not who owns the model
A model has a project owner by default. The data behind it needs its own named owner, or nobody can approve its ongoing use.
- 02
Ask whether personal data has a lawful basis, in writing
PDPL doesn't accept 'the model needed it' as a lawful basis after the fact. The check belongs before training starts.
- 03
Ask which data class the retrieval layer actually touches
A single residency assumption across a whole dataset is how a retrieval pipeline ends up touching data it was never cleared to move.
In Saudi Arabia
What each data class has to satisfy before a model can use it
PDPL, NDMO and sector residency rules apply to the data before a model is ever trained on it, not after.
SDAIA / PDPL
A documented lawful basis before any personal data is processed for training or retrieval.
A PDPL review of the dataset naming the lawful basis, filed before training begins.
NDMO
A classification and quality score for every domain the model or pipeline will consume.
A classification map and quality scorecard against NDMO's own dimensions.
Sector regulator (SAMA and others)
Evidence that sensitive data classes are held to sector-specific handling rules before model exposure.
A sign-off record from the client's own risk function, filed against the data domain, not just the model.
Residency by data class
Each data class mapped to its own residency obligation rather than one rule assumed for the whole dataset.
A residency map naming where each data class may be stored, processed and retrieved from.
Pre-model data readiness assessment
Before any model is scoped, a scored view of quality, ownership, lawful basis and residency for the data it would consume.
NDMO classification and ownership assignment
A domain with no classification and no named owner gets both, so quality and access decisions have someone accountable behind them.
PDPL review of a training or retrieval dataset
A dataset destined for fine-tuning or retrieval-augmented generation reviewed for personal data and the lawful basis it needs.
Residency mapping by data class
Data is separated by class, each mapped to its residency obligation, before a retrieval layer or model endpoint is built on top of it.
Remediation of a stalled pilot
A pilot that worked on a curated sample gets the same rigor applied to the production feed it actually needs to run on.
Lineage and audit-trail build for AI outputs
A model's outputs traced back through every transformation to the source record, so an audit request is an export, not a project.
Where Bilytica starts the data-foundation work
Where the data layer actually breaks
Nobody owns the data the model will consume
A dataset with no named accountable owner has no one who can approve its use in a model, correct it when it drifts, or answer for it when a regulator asks.
Quality was never measured against NDMO dimensions
Completeness, accuracy, consistency, timeliness and validity are NDMO's own vocabulary for data quality, and a model trained on data that fails them inherits the failure silently.
Personal data enters a training set without a lawful basis
PDPL requires a lawful basis before personal data is processed, and 'we needed it for the model' is not one, so the check has to happen before training starts, not after an incident.
Residency was assumed rather than mapped
Not every data class carries the same residency obligation, and assuming one rule for all of it is how a retrieval pipeline ends up querying data it was never cleared to leave Saudi Arabia.
Lineage stops at the warehouse, not the model
An auditor asking which raw record produced a model's output needs an answer that traces through every transformation, not just back to a table.
The foundation gap is discovered after the pilot, not before it
A demo can run on a curated sample that hides every one of these gaps, and they only surface once real volume and real users hit the system.
Fix the data foundation first or let the model surface the gap, decided by what's at stake
Some organisations can afford to learn the data foundation is broken from a failed pilot. Most Saudi enterprises handling personal or regulated data cannot. This is how we help a board decide.
| Dimension | Build the model first | Assess the data first |
|---|---|---|
| Personal data involved | None, or already cleared for this use | Personal data present, lawful basis not yet documented |
| Regulatory exposure | Internal tool, no sector regulator involved | Sector regulator or PDPL exposure if the data is wrong |
| Data ownership | Domain already classified with a named owner | Ownership and classification still unclear |
| What happens if it's wrong | A rebuild, on a low-stakes internal tool | An incident, an audit finding, or a stalled production launch |
What's checked before we let a model touch the data
- NDMO classification recorded for every domain feeding the model
- A named accountable owner for each data domain in scope
- PDPL lawful basis documented for any personal data involved
- Residency confirmed by data class, not assumed for the whole set
- Quality dimensions tested against NDMO's own vocabulary
- Lineage captured from raw source through to model output
A retailer's chatbot pilot is paused at the retrieval layer, not the model
A Saudi retail group asked Bilytica to move a customer-service chatbot pilot into production, expecting a scaling exercise.
- 01The data readiness assessment traced the chatbot's retrieval layer back to a customer support archive that had never been classified under NDMO.
- 02The archive contained personal data, including phone numbers and order histories, with no documented lawful basis for use in an AI retrieval pipeline.
- 03Bilytica separated the archive by data class, confirmed which fields required masking before retrieval, and documented the lawful basis for the fields that could remain.
- 04The chatbot went to production on the cleared subset of the archive, with the unresolved fields excluded until the client's compliance function signed off a separate basis for them.
The client launched on a smaller but lawful dataset instead of pausing the whole pilot, and knew exactly which fields to resolve before expanding the archive the chatbot could draw on.
Continue exploring Bilytica's Saudi AI stack
Frequently Asked Questions
Why does an AI pilot fail even when the model itself works?
A model can perform well on a curated sample and still fail in production if the underlying data has no consistent ownership, no NDMO classification, or no documented lawful basis for the personal data it touches. Book a data readiness assessment and we will score the data before recommending a build.
Does PDPL actually apply to data used for AI training or retrieval?
Yes. PDPL applies to any processing of personal data, and training a model or running a retrieval pipeline over personal data is processing. The lawful basis has to be documented before that data is used, not after. Book a data readiness assessment and we will review your dataset against PDPL directly.
What are the NDMO data quality dimensions and why do they matter for AI?
NDMO defines dimensions such as completeness, accuracy, consistency, timeliness and validity for enterprise data. A model trained on data that fails these dimensions inherits the failure silently, which is why we score against them before a build, not after a pilot breaks. Book a data readiness assessment for a scored view of your own data.
Does every type of data need to stay inside Saudi Arabia?
No, residency obligations differ by data class, and treating every dataset the same way is how a retrieval pipeline ends up touching data it was never cleared to move. Book a data readiness assessment and we will map residency by data class for your specific dataset.
Who ends up owning the data after the assessment?
The assessment names an accountable owner inside your organisation for each data domain in scope, because a domain with no owner has no one who can approve its ongoing use in a model. Book a data readiness assessment and we will help identify the right owner for each domain.
Do we need a new data platform before we can build with AI?
Usually not. Most data foundation failures are ownership, classification and lawful-basis failures rather than platform failures, so the assessment starts with your existing systems before recommending any platform change. Book a data readiness assessment to find out what applies to your data.
Find the gap before the model does
In a data readiness assessment, Bilytica scores the data feeding your intended use case against NDMO quality dimensions, checks the PDPL position on any personal data involved, and maps residency by data class, before recommending anything be built.