At the data layer
Ownership, lineage, quality thresholds and residency become explicit, so a workload can be certified to stand on a defined domain rather than on assumption.
Frameworks for Saudi Arabia
Methods judged by the business result they leave behind
Each framework starts from a business problem, names the teams involved, and ends with something you keep: clean data, agreed KPIs, an owner for every AI use case.
In Saudi Arabia
Which Saudi requirement each framework answers
In Saudi Arabia a method is judged by what it hands a reviewer. Before the stage names, here is the obligation each family of frameworks is written against and the artefact it produces.
AuthorityWhat it requiresWhat we buildWhat you keep
SDAIA, PDPL
AI systems handling personal data need a lawful basis, a stated purpose and a disclosure the data subject can act on.
The assurance and governance stages fix purpose, lawful basis and subject-rights handling as an exit gate, not a closing document.
Processing register entry and a subject-rights runbook per released workload.
NDMO data management controls
Data domains carry named owners, classification, quality thresholds and measurable maturity across the control domains.
The data foundation and quality frameworks certify a domain before any workload is allowed to build on it.
Domain certificate with owner, lineage, classification and a maturity baseline you can re-run.
NCA ECC
Security controls are evidenced continuously, and autonomous actions need an authorisation path that can be shown.
Agent operations sets action classes, hard stops and containment tests before an agent is allowed to write anywhere.
Action-authority matrix and a replayable log per autonomous action.
Sector authority, SAMA, NPHIES and MOH, ZATCA
The sector regulator adds its own review: model risk in finance, clinical safety in health, invoicing integrity in retail and logistics.
Each framework carries a sector overlay that changes the gates and the controls, while the structure stays the same.
Sector review pack aligned to the authority that will actually read it.
Where it runs
Assessments, control registers and evidence generated by these frameworks stay inside your environment in Saudi Arabia and remain yours after the engagement closes.
Arabic, as it is spoken here
Policies, gates and control descriptions are issued in Arabic as the governing version, because that is the version an inspector in Saudi Arabia will read.
The operating system
How the AI operating system fits together
Nothing enters build on an uncertified data domain, nothing launches without evaluation evidence, and nothing acts autonomously without a tested containment path.
Decide
Build & act
Each framework hands the next one an artefact: a readiness score, a funded sequence, a certified data domain, a governed release, an attested control set.
Where the value lands
What these methods change
A framework is only worth the change it produces. Ours are written to move the data layer, the decision layer and the measures at once, and each stage states which one it is moving.
At the decision layer
Decisions move from opinion to evidence: a named owner, a gate that must be passed, and a record an auditor, a regulator or the board can inspect after the fact.
In the business measures
The change is reported in the measures leadership already tracks, cycle time, cost to serve, risk exposure, service levels and revenue captured, not in model metrics alone.
Framework selector
Choose your AI framework
Answer a few questions and we point you to the framework to start with, and what follows it.
1
Your industry
2
What you are trying to do
3
Where you are today
Pick all three to see your recommendation, 0 of 3 chosen.
The library
The framework library
The methods that carry an AI programme from a readiness score to a governed release a regulator can inspect, trusted data, evidenced decisions, measurable business outcomes.
DFFv2.1
Data Foundation Framework
The layers that turn scattered systems into data an AI system is allowed to use.
- 1Capture
- 2Contract
- 3Consolidate
- 4Curate
- 5Certify
Each step closes on an exit gate, so the control is evidenced before the next decision is taken.
- Data layer
- Foundation
- Decision layer
- Every source has a named owner, a refresh frequency and a lawful basis for use.
- Business measures
- Domain data contracts
- Accountable
- Run by data engineering and data governance; signed off by the data owner of each domain.
- First pass
- A first certified domain on a timeline agreed with you; each additional domain runs shorter as the contracts and tests are reused.
AIRMv2.0
AI Readiness Model
One honest picture of what your organisation can actually run with AI today.
- 1Scope
- 2Evidence
- 3Gap
- 4Sequence
- 5Re-score
Each step closes on an exit gate, so the control is evidenced before the next decision is taken.
- Data layer
- Diagnose
- Decision layer
- The scope names decisions, not departments.
- Business measures
- Scored maturity profile
- Accountable
- Run jointly by the CDO or CIO office and the business sponsor of the first workload.
- First pass
- Agreed with you, including interviews, evidence review and the roadmap workshop.
VALUEv1.4
AI Value Framework
From use-case long list to booked benefit, with unit economics attached at every step.
- 1Discover
- 2Size
- 3Sequence
- 4Commit
- 5Realise
Each step closes on an exit gate, so the control is evidenced before the next decision is taken.
- Data layer
- Decide
- Decision layer
- Each candidate names a decision and the person who makes it today.
- Business measures
- Sized use-case portfolio
- Accountable
- Owned by the business sponsor with finance as co-signer on the benefit definition.
- First pass
- Agreed with you for a portfolio pass; benefit tracking then runs quarterly.
TRUSTv2.2
AI Assurance Framework
One control set that answers NIST, ISO 42001, the EU AI Act and the Saudi regulators at once.
- 1Classify
- 2Control
- 3Evidence
- 4Attest
- 5Monitor
Each step closes on an exit gate, so the control is evidenced before the next decision is taken.
- Data layer
- Assure
- Decision layer
- The tier is recorded before any model touches production data.
- Business measures
- Tiered control matrix
- Accountable
- Owned by risk and compliance, operated with the delivery team that builds each workload.
- First pass
- Control set stood up on a timeline agreed with you; evidence then accrues automatically per release.
DELIVERv2.0
AI Delivery Framework
A gated path from idea to live service, with evidence at every step.
- 1Frame
- 2Ground
- 3Prototype
- 4Evaluate
- 5Harden
- 6Launch
- 7Operate
Each step closes on an exit gate, so the control is evidenced before the next decision is taken.
- Data layer
- Build
- Decision layer
- A written definition of a wrong answer exists.
- Business measures
- Golden dataset and evals
- Accountable
- Run by the delivery lead; each gate is signed by the business owner and by risk where the tier requires it.
- First pass
- A first governed release once the data domain is certified, timeline agreed after the assessment.
AGENTv1.6
Agent Operations Framework
Autonomy tiers, tool boundaries and human checkpoints, so agents can act without becoming a liability.
- 1Tier
- 2Bound
- 3Checkpoint
- 4Evaluate
- 5Observe
- 6Contain
Each step closes on an exit gate, so the control is evidenced before the next decision is taken.
- Data layer
- Act
- Decision layer
- Irreversible actions never sit above the reviewed tier.
- Business measures
- Autonomy tier policy
- Accountable
- Owned jointly by the process owner and security; operated by the platform team.
- First pass
- Tiering and boundaries defined on a timeline agreed with you; then applied per agent at delivery time.
SOVEREIGNv1.5
Sovereign AI Framework
Residency, key custody, model routing and Arabic quality treated as architecture, not policy text.
- 1Classify residency
- 2Place the stack
- 3Custody keys
- 4Route models
- 5Assure Arabic
- 6Plan the exit
Each step closes on an exit gate, so the control is evidenced before the next decision is taken.
- Data layer
- Sovereignty
- Decision layer
- No workload starts before its data classes have a residency rule.
- Business measures
- Residency matrix
- Accountable
- Owned by the CISO and the data protection officer, with architecture accountable for the design.
- First pass
- Reference design on a timeline agreed with you, then applied to every workload as a standing constraint.
Why this exists
Standards say what good looks like. These say what to do on Monday.
1
Every stage ends with an artefact, so progress is evidenced instead of reported.
2
Every framework crosswalks to the standards a regulator or auditor already uses.
3
Every framework carries industry overlays, and Arabic quality is a release condition, not a translation task.
FAQ
Frequently Asked Questions
Which framework fits my problem?
Start from the problem: scattered data points to the Data Foundation Framework, unclear KPIs to the KPI framework, and AI ideas without owners to the AI value framework. Each page explains the problem, who takes part, and what you keep. Where a regulation such as PDPL applies, the page shows how the work helps you meet it.
Do these replace NIST AI RMF or ISO 42001?
No. Saudi controls sit on top of the recognised standards, and reviewers check both. Every control row carries its international counterpart, so a single control set answers the local authority and the auditor without duplicating work.
Where do the workloads and the evidence live?
Inside Saudi Arabia, in your environment. Assessments, registers and gate evidence stay yours after the engagement ends, and any component that sits outside that boundary is written down as an exception with a data class, a reason and an expiry date.
Where should a Saudi enterprise start?
With a readiness baseline against the NDMO control set, then the data foundation framework applied to the one domain the first workload depends on. A certified domain is what lets a release pass its gate instead of stalling in review.
Topic cluster
Explore the topic cluster
Curated links across our Saudi hubs, sector pages and long-form blog research.