Capture
Inventory every source that feeds the decision, including the spreadsheets nobody lists.
Done when: Every source has a named owner, a refresh frequency and a lawful basis for use.
Data Foundation Framework (DFF)
Data Foundation Framework
The layers that turn scattered systems into data an AI system is allowed to use.
The business problem
The AI is ready. The data under it is not.
Every system tells a different version of the truth, so no model or dashboard can be trusted.
What you hear inside the organisation
Which number is right, finance or sales?
The report breaks every time the source changes.
Nobody owns this table.
We cannot share this data with the AI team.
Who it serves and what changes
Your teams, before and after the Data Foundation Framework
Client teams and what they need
Data owners
Clear accountability per domain
Data engineering
Pipelines that fail loudly, not silently
Governance and privacy
Classified, masked personal data
Analytics and AI teams
Certified data they can build on
The outcome you get
- One reconciled version of each business entity
- Data contracts enforced inside the pipeline
- Domains certified as AI-ready, with expiry
- Evidence ready for NDMO and PDPL reviews
A worked example
A retail group planning an AI demand forecast
The problem we saw
Sales came from the POS, stock from the ERP and promotions from spreadsheets. The model gave a different answer every week.
How the framework solved it
We gave each source an owner, wrote a contract per feed, reconciled products and stores to one key, and certified the sales domain.
The business result
Finance, supply chain and the AI model now read the same sales figure, and a broken feed is caught before anyone uses it.
Illustrative example based on common client situations.
In short
What is the Data Foundation Framework?
Data Foundation Framework (DFF): The layers that turn scattered systems into data an AI system is allowed to use.
Most AI programmes stall because the data underneath was never contracted, reconciled or certified.
- How it moves
- Each step closes with a check before the next begins
- Owned by
- Run by data engineering and data governance; signed off by the data owner of each domain.
- You keep
- Domain data contracts, AI-ready certificate, Metric dictionary
How it works
How the Data Foundation Framework works
Certification expires. A domain that stops passing its tests loses the certificate and the AI workloads built on it are flagged.
Contract
Write a data contract per feed: schema, semantics, freshness, ownership and breakage policy.
Done when: Contracts are enforced in the pipeline, not in a document, a breach fails the build.
Consolidate
Land, conform and reconcile into one governed layer with a single set of keys.
Done when: Reconciliation against the system of record is explainable line by line.
Curate
Define metrics once, classify sensitivity, mask what must be masked, publish for reuse.
Done when: One definition per metric, and no unclassified personal data downstream.
Certify
Score the domain against the readiness tests and issue an AI-ready certificate with an expiry.
Done when: The domain passes freshness, completeness, accuracy and access tests on a schedule, not once.
Is it right for you?
Is the Data Foundation Framework right for you?
A strong fit if
- You have AI or BI plans but data sits in several systems
- Reports disagree and teams argue about numbers
- You must show regulators how personal data is handled
Probably not yet if
- You run a single system with clean, trusted data
- You need a one-off report, not a lasting foundation
Free assessment
Discuss the Data Foundation Framework with our team
A working session with our senior team. We review what fits your situation, what does not, and where to start.
A focused conversation
We listen to your situation and goals.
Fit review
Which parts of this framework apply to you, and which do not.
A written view
Clear next steps, whether or not you work with us.
Go deeper
Applying the Data Foundation Framework in practice
Open only the part you need: how it starts, what your team keeps, maturity levels, sector rules and the evidence a reviewer will ask for.
Most AI programmes stall because the data underneath was never contracted, reconciled or certified. DFF makes the foundation an engineered deliverable with a pass mark, not a background clean-up task.
Version
v2.1
Last reviewed
July 2026
Family
AI Operating System
How this was developed: Built from delivery practice on Saudi and international engagements, then reconciled clause by clause against the published standards below. Revised when a standard is updated or a gate proves unworkable in the field.
One-pager
Download the DFF one-pager
Stages, exit gates, artefacts, standards crosswalk and FAQs for Data Foundation Framework on one printable page, share it with the committee.
- Week 1
Pick one domain the first workload depends on and register every source feeding it.
- Week 2
Write and enforce the data contracts; a breach must fail the pipeline, not an inbox.
- Week 3
Reconcile to the system of record and settle one definition per metric in dispute.
- Week 4
Run the readiness tests and issue the first dated certificate with a renewal date.
- End of the first thirty days
Domain data contracts
Machine-enforced contracts with tests wired into the pipeline.
AI-ready certificate
A dated scorecard per domain with the exact tests that were run.
Metric dictionary
One definition per business metric, with lineage back to source.
L1
Reactive
Data is fixed per report, and the same defect returns.
L2
Contracted
Feeds have owners, schemas and enforced contracts.
L3
Reconciled
One governed layer reconciles to the system of record.
L4
Certified
Domains hold a live certificate and re-test on a schedule.
Banking & finance
Reconcile to the ledger first; SAMA reporting definitions become the metric dictionary's baseline.
- Who reviews it
- SAMA, plus PDPL and NCA controls
- Systems in scope
- Core banking, cards, KYC and AML systems, credit bureau feeds, the general ledger
- Where it lands first
- KYC and AML review, credit decisioning support, complaint and dispute handling
1
Capture
- Source register
- Lineage sketch
- Lawful-basis note
2
Contract
- Data contracts
- Contract tests
- Breakage runbook
3
Consolidate
- Conformed model
- Entity resolution rules
- Reconciliation report
4
Curate
- Metric dictionary
- Classification matrix
- Masking policy
5
Certify
- AI-ready certificate
- Quality test suite
- Renewal schedule
Certification expires. A domain that stops passing its tests loses the certificate and the AI workloads built on it are flagged.
Stage
Exit gate
Artefacts
1
Capture
Inventory every source that feeds the decision, including the spreadsheets nobody lists.
- Signed off by
- Domain data owner
- Typical duration
- Scoped with you
Exit gate
Every source has a named owner, a refresh frequency and a lawful basis for use.
Evidence: Signed source register with lawful basis per feed
Artefacts
- Source register
- Lineage sketch
- Lawful-basis note
2
Contract
Write a data contract per feed: schema, semantics, freshness, ownership and breakage policy.
- Signed off by
- Data engineering lead
- Typical duration
- Scoped with you
Exit gate
Contracts are enforced in the pipeline, not in a document, a breach fails the build.
Evidence: Contract files in version control with failing tests demonstrated
Artefacts
- Data contracts
- Contract tests
- Breakage runbook
3
Consolidate
Land, conform and reconcile into one governed layer with a single set of keys.
- Signed off by
- Data owner with finance or operations counterpart
- Typical duration
- Scoped with you
Exit gate
Reconciliation against the system of record is explainable line by line.
Evidence: Line-by-line reconciliation report against the system of record
Artefacts
- Conformed model
- Entity resolution rules
- Reconciliation report
4
Curate
Define metrics once, classify sensitivity, mask what must be masked, publish for reuse.
- Signed off by
- Data governance lead
- Typical duration
- Scoped with you
Exit gate
One definition per metric, and no unclassified personal data downstream.
Evidence: Metric dictionary and classification matrix approved and published
Artefacts
- Metric dictionary
- Classification matrix
- Masking policy
5
Certify
Score the domain against the readiness tests and issue an AI-ready certificate with an expiry.
- Signed off by
- Chief data officer or equivalent
- Typical duration
- Scoped with you, then recurring
Exit gate
The domain passes freshness, completeness, accuracy and access tests on a schedule, not once.
Evidence: Dated AI-ready certificate with the test run attached
Artefacts
- AI-ready certificate
- Quality test suite
- Renewal schedule
Standard
What this framework satisfies
DAMA-DMBOKCh. 11 Data Quality · Ch. 12 Metadata · Ch. 10 MDM
Data quality, metadata, master data and governance knowledge areas.
NDMOData Quality · Metadata · Data Governance domains
Data management and personal data protection domains, evidenced per domain.
PDPLArt. 5–6 lawful basis · Art. 10 minimisation
Lawful basis, minimisation and masking captured at Capture and Curate.
NIST AI RMFMAP 2 · MAP 3 (data provenance and validity)
Map function, data provenance and validity inputs for AI risk decisions.
Cleaning without a contract
The same defects return next quarter because nothing upstream changed.
A lake with no owners
Storage grows, trust does not, and every number needs a human to defend it.
Certifying once
A one-off audit ages badly; readiness has to be re-tested on a schedule.
Built on
- 1
DAMA-DMBOK and EDM Council DCAM
Data management knowledge areas and capability assessment.
- 2
NDMO data management and personal data protection standards
National Data Management Office specifications and domains.
- 3
Personal Data Protection Law (PDPL) and its implementing regulations
Lawful basis, subject rights, transfer and retention.
- 4
NIST AI Risk Management Framework 1.0 and Generative AI Profile
National Institute of Standards and Technology, Govern, Map, Measure, Manage.
Citations describe the parts of each standard the framework answers. Bilytica is not an accreditation or certification body.
In Saudi Arabia
What this family has to satisfy before a release in Saudi Arabia
The AI operating system frameworks carry a workload from a readiness score to a governed release. These are the Saudi checks each stage is built against.
AuthorityWhat it requiresWhat we buildWhat you keep
SDAIA, PDPL
Purpose, lawful basis and disclosure recorded before the first personal-data field is used.
Diagnosis and assurance stages block a build that has no recorded basis.
Processing register entry attached to the release record.
NCA ECC
Authorisation and containment for anything the system can do on its own.
Agent operations defines action classes, dual control and a tested rollback path.
Containment test result and an authority matrix signed by the business owner.
NDMO data management controls
No workload builds on an uncertified data domain.
The data foundation gate certifies ownership, lineage and quality thresholds first.
Signed domain certificate referenced by the release.
Where it runs
Training, evaluation and serving run inside Saudi Arabia on your infrastructure, with any hosted component documented as a boundary.
Arabic, as it is spoken here
Arabic quality is a release condition: evaluation sets include Saudi Arabic content, not translated English.
FAQ
Frequently Asked Questions
Do we have to fix all our data first?
No. DFF is run per domain and per use case. You certify the slice a workload depends on, then extend.
What makes a domain AI-ready?
It passes freshness, completeness, accuracy, lineage and access tests repeatedly, and every metric it exposes has one definition.
How does this connect to compliance?
Capture and Curate produce the evidence NDMO and PDPL reviewers ask for, so assurance reuses the same artefacts.
What are the five stages of the Data Foundation Framework?
Capture, Contract, Consolidate, Curate and Certify. Each stage has an exit gate and named artefacts, so a domain only moves forward when the evidence exists.
Which standards does it map to?
DAMA-DMBOK for data management practice, NDMO for national data controls, PDPL for personal data handling, and NIST AI RMF for the data quality expectations AI systems inherit.
What does a certified data domain actually give us?
A documented contract per source, one definition per metric, lineage a reviewer can follow, and repeatable quality tests. That package is what makes downstream AI answers defensible.
Can we run it while an AI project is already live?
Yes. The usual pattern is to certify the specific domain the live workload reads from first, then widen coverage domain by domain without pausing delivery.
Where this sits on the spine
Where this connects
Rest of the library
AIRMAI Readiness ModelVALUEAI Value FrameworkTRUSTAI Assurance FrameworkDELIVERAI Delivery FrameworkAGENTAgent Operations FrameworkSOVEREIGNSovereign AI FrameworkDMMData Management Maturity ModelDPAData Platform Architecture FrameworkDQFData Quality & Observability FrameworkDECIDEAnalytics & Decision FrameworkDGOVData Governance Operating ModelSDCFSaudi Data Compliance FrameworkAQSArabic Quality StandardKSA-READYIn-country Deployment Framework
Topic cluster
Explore the topic cluster
Curated links across our Saudi hubs, sector pages and long-form blog research.