Classify residency
Decide per data class where it may be processed and by what.
Done when: No workload starts before its data classes have a residency rule.
Sovereign AI Framework (SOVEREIGN)
Sovereign AI Framework
Residency, key custody, model routing and Arabic quality treated as architecture, not policy text.
The business problem
Sensitive data cannot leave. Useful AI still has to arrive.
Public AI services are easy to try but hard to approve when data residency, classification and Arabic quality all matter.
What you hear inside the organisation
Where does our data go when we ask the model?
Security rejected the public AI tool.
The Arabic answers sound translated.
Do we really need the largest model?
Who it serves and what changes
Your teams, before and after the Sovereign AI Framework
Client teams and what they need
CISO and security
Data that stays inside approved boundaries
IT infrastructure
A platform they can run on premises or in local cloud
Data and AI
Right-sized models for each task
Business users
Natural, accurate Arabic
The outcome you get
- An architecture where data residency is designed in
- A model portfolio routed by task, cost and sensitivity
- Arabic quality tested on your own content
- Controls mapped to NCA and PDPL requirements
A worked example
A healthcare provider wanting an AI assistant
The problem we saw
Security blocked public AI tools because patient data would leave the country, and Arabic answers sounded translated.
How the framework solved it
We classified data, kept sensitive work on in-country models, routed simpler tasks to smaller models, and tested Arabic on real content.
The business result
Security approved the assistant, staff get natural Arabic answers, and running cost fits the budget.
Illustrative example based on common client situations.
In short
What is the Sovereign AI Framework?
Sovereign AI Framework (SOVEREIGN): Residency, key custody, model routing and Arabic quality treated as architecture, not policy text.
Sovereignty claims are only as good as the architecture behind them.
- How it moves
- Each step closes with a check before the next begins
- Owned by
- Owned by the CISO and the data protection officer, with architecture accountable for the design.
- You keep
- Residency matrix, Reference architecture, Model routing policy
How it works
How the Sovereign AI Framework works
Sovereignty fails most often in the side channels: logs, telemetry, embeddings and support access. Those get classified first.
Place the stack
Choose in-country, private cloud or on-premises per class, including the vector store and logs.
Done when: Logs, embeddings and caches follow the same residency rule as the source data.
Custody keys
Define who holds encryption keys, how they rotate and who can be compelled.
Done when: Key custody is documented and separable from the platform provider.
Route models
Match each task to the smallest model that passes evaluation within its residency class.
Done when: Sensitive classes never route to a model outside their residency boundary.
Assure Arabic
Test Arabic terminology, register and answer equivalence as a release condition.
Done when: Arabic performance is measured, not assumed from an English benchmark.
Plan the exit
Document how models, indexes and data are exported and what remains portable.
Done when: An exit can be executed without the incumbent vendor's cooperation.
Is it right for you?
Is the Sovereign AI Framework right for you?
A strong fit if
- You handle classified or personal data
- Security has blocked public AI tools
- Arabic quality matters to your users
Probably not yet if
- Your data is public and low sensitivity
- A standard cloud AI service meets your policies
Free assessment
Discuss the Sovereign AI Framework with our team
A working session with our senior team. We review what fits your situation, what does not, and where to start.
A focused conversation
We listen to your situation and goals.
Fit review
Which parts of this framework apply to you, and which do not.
A written view
Clear next steps, whether or not you work with us.
Go deeper
Applying the Sovereign AI Framework in practice
Open only the part you need: how it starts, what your team keeps, maturity levels, sector rules and the evidence a reviewer will ask for.
Sovereignty claims are only as good as the architecture behind them. This framework fixes where data sits, who holds the keys, which model may see which class of data, and how you leave.
Version
v1.5
Last reviewed
August 2026
Family
AI Operating System
How this was developed: Built from delivery practice on Saudi and international engagements, then reconciled clause by clause against the published standards below. Revised when a standard is updated or a gate proves unworkable in the field.
One-pager
Download the SOVEREIGN one-pager
Stages, exit gates, artefacts, standards crosswalk and FAQs for Sovereign AI Framework on one printable page, share it with the committee.
- Week 1
Classify the data the workload touches and fix the residency rule per class.
- Week 2
Draw the in-country boundary and design the model routing that respects it.
- Week 3
Settle key custody, access and logging so control is provable, not asserted.
- Week 4
Set the Arabic quality threshold as a release condition and write the exit plan.
- End of the first thirty days
Residency matrix
Every data class with its processing boundary and transfer basis.
Reference architecture
Deployment topology including vector store, logs and support access paths.
Model routing policy
Task-to-model rules with residency and evaluation thresholds.
L1
Assumed
Residency is believed rather than verified.
L2
Contracted
Vendor terms cover it; architecture does not.
L3
Architected
Routing, keys and logs enforce the boundary.
L4
Portable
You can change provider without losing the system.
Banking & finance
Customer data and transaction detail stay in-country, with key custody held by the bank.
- Who reviews it
- SAMA, plus PDPL and NCA controls
- Systems in scope
- Core banking, cards, KYC and AML systems, credit bureau feeds, the general ledger
- Where it lands first
- KYC and AML review, credit decisioning support, complaint and dispute handling
1
Classify residency
- Residency matrix
- Transfer register
2
Place the stack
- Deployment topology
- Data-flow diagram
3
Custody keys
- Key custody model
- Rotation policy
4
Route models
- Model routing policy
- Model portfolio register
5
Assure Arabic
- Arabic evaluation set
- Terminology glossary
6
Plan the exit
- Exit plan
- Portability test
Sovereignty fails most often in the side channels: logs, telemetry, embeddings and support access. Those get classified first.
Stage
Exit gate
Artefacts
1
Classify residency
Decide per data class where it may be processed and by what.
- Signed off by
- Legal and compliance
- Typical duration
- Scoped with you
Exit gate
No workload starts before its data classes have a residency rule.
Evidence: Data class map with residency and transfer conditions
Artefacts
- Residency matrix
- Transfer register
2
Place the stack
Choose in-country, private cloud or on-premises per class, including the vector store and logs.
- Signed off by
- Architecture board
- Typical duration
- Scoped with you
Exit gate
Logs, embeddings and caches follow the same residency rule as the source data.
Evidence: Hosting and routing design with the in-country boundary drawn
Artefacts
- Deployment topology
- Data-flow diagram
3
Custody keys
Define who holds encryption keys, how they rotate and who can be compelled.
- Signed off by
- Security lead
- Typical duration
- Scoped with you
Exit gate
Key custody is documented and separable from the platform provider.
Evidence: Key custody and access model signed off
Artefacts
- Key custody model
- Rotation policy
4
Route models
Match each task to the smallest model that passes evaluation within its residency class.
- Signed off by
- Architecture board with the AI platform owner
- Typical duration
- Scoped with you
Exit gate
Sensitive classes never route to a model outside their residency boundary.
Evidence: Model routing policy stating which class of data reaches which model
Artefacts
- Model routing policy
- Model portfolio register
5
Assure Arabic
Test Arabic terminology, register and answer equivalence as a release condition.
- Signed off by
- Arabic quality owner
- Typical duration
- Scoped with you
Exit gate
Arabic performance is measured, not assumed from an English benchmark.
Evidence: Arabic evaluation results against the release threshold
Artefacts
- Arabic evaluation set
- Terminology glossary
6
Plan the exit
Document how models, indexes and data are exported and what remains portable.
- Signed off by
- Executive sponsor
- Typical duration
- Scoped with you
Exit gate
An exit can be executed without the incumbent vendor's cooperation.
Evidence: Exit plan naming what leaves with you and how
Artefacts
- Exit plan
- Portability test
Standard
What this framework satisfies
PDPLArt. 29 cross-border transfer · Art. 19 processor obligations
Cross-border transfer conditions and processor obligations per data class.
NDMONational data classification · data sharing controls
National data classification and sharing controls applied to AI pipelines.
NCA CCC / ECCCCC cloud controls · ECC 2-8 cryptography and key custody
Cloud cybersecurity and key management expectations for hosted AI.
SDAIANational AI ethics principles · Arabic language expectations
National AI ethics principles and Arabic language expectations.
Sovereign in the slide only
In-country compute with logs and embeddings leaving the boundary is not sovereign.
Frontier model for everything
Routing every task to the largest model raises cost and shrinks the residency options.
Translated Arabic
Machine-translated interfaces read as foreign to enterprise users and fail on terminology.
Built on
- 1
SDAIA AI Ethics Principles
Saudi Data & AI Authority, national principles for AI.
- 2
NCA Essential and Cloud Cybersecurity Controls
National Cybersecurity Authority control catalogues.
- 3
Personal Data Protection Law (PDPL) and its implementing regulations
Lawful basis, subject rights, transfer and retention.
- 4
NDMO data management and personal data protection standards
National Data Management Office specifications and domains.
- 5
ISO/IEC 42001: AI management systems
International Organization for Standardization, management system requirements for AI.
Citations describe the parts of each standard the framework answers. Bilytica is not an accreditation or certification body.
In Saudi Arabia
What this family has to satisfy before a release in Saudi Arabia
The AI operating system frameworks carry a workload from a readiness score to a governed release. These are the Saudi checks each stage is built against.
AuthorityWhat it requiresWhat we buildWhat you keep
SDAIA, PDPL
Purpose, lawful basis and disclosure recorded before the first personal-data field is used.
Diagnosis and assurance stages block a build that has no recorded basis.
Processing register entry attached to the release record.
NCA ECC
Authorisation and containment for anything the system can do on its own.
Agent operations defines action classes, dual control and a tested rollback path.
Containment test result and an authority matrix signed by the business owner.
NDMO data management controls
No workload builds on an uncertified data domain.
The data foundation gate certifies ownership, lineage and quality thresholds first.
Signed domain certificate referenced by the release.
Where it runs
Training, evaluation and serving run inside Saudi Arabia on your infrastructure, with any hosted component documented as a boundary.
Arabic, as it is spoken here
Arabic quality is a release condition: evaluation sets include Saudi Arabic content, not translated English.
FAQ
Frequently Asked Questions
Does sovereign mean on-premises?
No. It means the processing boundary, key custody and exit path are known and enforced, that can be in-country cloud, private cloud or on-premises.
How do you keep cost down under residency limits?
Through model routing: small local models handle most traffic, and only tasks that need more capability escalate within the same boundary.
What does sovereign AI mean in practice?
Data residency classified per workload, the stack placed accordingly, keys held by you, model routing that respects the classification, and a documented exit path, not a label on a slide.
Does sovereignty force one model for everything?
No. Routing sizes the model to the task and the data class, so in-country or on-premise models serve sensitive workloads while others use larger models where the classification allows.
How is Arabic quality assured?
The Assure Arabic stage tests enterprise Arabic on your own terminology and documents, including dialect handling and RTL rendering, rather than accepting translated output.
Which Saudi requirements does it address?
PDPL for personal data, NDMO for national data management, NCA CCC and ECC for cloud and essential cybersecurity controls, and SDAIA guidance for responsible AI.
Where this sits on the spine
Where this connects
Rest of the library
DFFData Foundation FrameworkAIRMAI Readiness ModelVALUEAI Value FrameworkTRUSTAI Assurance FrameworkDELIVERAI Delivery FrameworkAGENTAgent Operations FrameworkDMMData Management Maturity ModelDPAData Platform Architecture FrameworkDQFData Quality & Observability FrameworkDECIDEAnalytics & Decision FrameworkDGOVData Governance Operating ModelSDCFSaudi Data Compliance FrameworkAQSArabic Quality StandardKSA-READYIn-country Deployment Framework
Topic cluster
Explore the topic cluster
Curated links across our Saudi hubs, sector pages and long-form blog research.