Do you bid on Etimad tenders directly?

We participate as a registered Saudi entity and also support other bidders as the technical partner on data and AI scopes. Which route fits depends on the tender conditions.

What disqualifies a technically strong AI bid?

Usually an administrative gap: an expired registration, a missing signed form, or a residency answer that contradicts the architecture attached to the same submission.

How is local content treated in an AI scope?

It is read as where the work happens and who ends up able to run the system. In-country delivery with a documented enablement plan reads far stronger than an offshore team with a local invoice.

Can a government entity use a model hosted abroad?

It depends on the data class reaching the model and the entity's own classification decision. The workable pattern is in-country processing for restricted classes, with redaction and routing rules for anything else.

Do you guarantee an award?

No. The evaluation belongs to the entity. What we can do is make sure the technical response answers what the tender asked, with evidence attached instead of assurances.

Government procurement

Etimad in practice: what a government AI and data tender expects from a bidder

Public sector buying in Saudi Arabia runs through Etimad, and most technical disqualifications happen on evidence, not on price. This page sets out the artefacts a data and AI bid actually has to carry.

Book the Data Foundation Assessment AI governance practice

A bid rarely loses on the model. It loses on the appendix nobody prepared.

EtimadPDPLNDMONCA ECC

The short answer

Etimad is the Ministry of Finance platform used by Saudi government entities to publish tenders, receive bids and manage contracts under the Government Tenders and Procurement Law. For a data or AI scope, a competitive bid carries a valid commercial registration and VAT registration, a local content position, a residency statement per data class, and technical evidence mapped to PDPL, NDMO and NCA ECC expectations.

Key takeaways

What you need to know, in a minute

Evidence is scored, intent is not

Technical evaluation reads what is attached. A statement that data stays in Saudi Arabia scores differently from an architecture diagram that shows where each data class runs.

Residency is answered per data class

A single sentence about hosting invites questions. A table listing each data class, where it is stored, where it is processed and which model may see it closes them.

Local content is a structural answer

Saudi staffing, in-country delivery and knowledge transfer to the entity's own team are described as a plan with owners, not as a paragraph of intent.

Handover decides the second contract

Public entities reward scopes that leave documentation, runbooks and trained staff behind, because the next evaluation asks what happened after the first one.

From the text to what gets built

Each line is a published expectation and what we implement against it. None of this is legal advice or a compliance verdict.

Area	What it asks for	What we build
Eligibility and registration	A valid commercial registration, VAT registration and an active Etimad supplier profile.	A maintained registration pack kept current, so an expiry date never removes a bid from evaluation.
Technical response	A method statement covering architecture, delivery phases and acceptance criteria.	An architecture and phasing pack written against the entity's stated outcomes, with acceptance tests defined before the work starts.
Data protection evidence	Show how personal data is classified, protected and kept auditable.	Classification records, access controls and retention rules produced from the platform rather than described in prose.
Cybersecurity controls	Map the solution to the essential cybersecurity controls the entity operates under.	A control mapping per component, with the gaps named and a remediation owner beside each one.
Local content and Saudisation	State the in-country share of delivery and the transfer of capability to national staff.	A staffing and enablement plan with named roles, training milestones and the point at which the entity runs the platform itself.
Contract execution	Report progress, milestones and invoicing through the platform.	Delivery milestones defined so each one produces a verifiable artefact, which keeps reporting factual instead of narrative.

Bid technical pack

Architecture, data flows, residency table and control mapping assembled as the technical annex an evaluator can score line by line.

Residency and model routing statement

Which data class may reach which model, in which region, and what is redacted before any call leaves Saudi Arabia.

Proof of concept scoped to the tender

A working slice on the entity's own data class, sized to be demonstrated inside the evaluation window rather than promised after award.

Handover and enablement plan

Runbooks, documentation and training that leave the entity able to operate without the vendor in the room.

Use cases

Where this applies in practice

Questions we get on Etimad

Related guides

PDPL

Most gaps we find are not legal gaps. They are missing lineage, missing classification and copies nobody owns.

Open the guide

NDMO controls

An assessment score moves when the catalogue is populated by the pipeline, not by a spreadsheet campaign.

Open the guide

SDAIA alignment

The ethics principles are not decoration. They decide which decisions a model is allowed to make alone.

Open the guide

NCA Essential Cybersecurity Controls

Most audit findings on a data platform are access findings. Shared accounts and forgotten service credentials, not exotic attacks.

Open the guide

SAMA expectations

The question is rarely whether the model works. It is whether you can reconstruct one decision from eighteen months ago.

Open the guide

In-country hosting

The failure is almost never the main database. It is a notebook, a support tunnel or a model API nobody classified.

Open the guide

Let's put your AI ambition on the table

Sixty minutes with a senior Bilytica partner. We stress-test your plans against what actually works in your sector, agree which moves are worth funding first, and you leave with a written 90-day plan and honest numbers, whether you work with us or not.

Start the conversation