Can we run credit decisions on a large language model?

Not as the decision maker. Language models are useful for gathering, summarising and drafting around the decision, while the decision itself stays on a model you can document, validate and reproduce.

Does customer data have to stay in Saudi Arabia?

Treat it as the default position and justify anything else. We route by data class so restricted customer data stays on in-country infrastructure while non-sensitive workloads have more freedom.

What does internal audit usually ask for first?

A single decision, end to end. Show the inputs, the version, the threshold and the approver for one case and most other questions answer themselves.

Banking and insurance

What a SAMA supervised institution needs before AI reaches a customer decision

Banks and insurers in Saudi Arabia are not short of models. They are short of the model risk evidence, data lineage and outsourcing position that a supervisor asks about.

Book the Data Foundation Assessment AI governance practice

The question is rarely whether the model works. It is whether you can reconstruct one decision from eighteen months ago.

SAMANCA ECCPDPL

The short answer

The Saudi Central Bank supervises banks, insurers and finance companies, with frameworks covering cybersecurity, business continuity, outsourcing and IT governance. Before AI touches a credit, fraud or claims decision, an institution needs model documentation, traceable data lineage into the decision, human accountability, an outsourcing position for any external service, and monitoring after go live.

Key takeaways

What you need to know, in a minute

Reconstruction is the real test

You need the inputs, the model version and the policy in force at the time of the decision, held together.

Outsourcing is a data question

Any external model service handling customer data is an outsourcing arrangement with a residency and continuity position attached.

Drift is a supervisory issue

A model that silently degrades in production becomes a conduct problem, not only a performance one.

Arabic correspondence is in scope

Customer facing generation in Arabic carries the same conduct expectations as a letter drafted by staff.

From the text to what gets built

Each line is a published expectation and what we implement against it. None of this is legal advice or a compliance verdict.

Area	What it asks for	What we build
Model documentation	Describe purpose, data, limits and validation.	A registry entry per model with training data provenance, evaluation results and known failure modes.
Data lineage into decisions	Trace a decision back to its inputs.	Decision level capture of features, model version and thresholds, retained for the supervisory period.
Human accountability	Keep a responsible officer over automated outcomes.	Approval thresholds where the model recommends and a person decides, with both recorded.
Outsourcing	Assess and control reliance on external providers.	Provider inventory with data class, hosting location, exit path and what happens when the service is unavailable.
Continuity	Keep critical processes running through disruption.	A defined fallback for every automated decision path, tested rather than documented.
Monitoring	Watch performance and outcomes after deployment.	Drift, override rate and outcome distribution tracked per segment, with an owner who acts on them.

Decision record layer

Every automated or assisted decision stored with its inputs, model version and the person who approved it.

Model risk pack

Documentation, validation results and monitoring design assembled in the form internal audit and the supervisor expect.

Fraud and AML data foundation

Entity resolution across products and channels so alerts describe a customer rather than an account.

Arabic customer communication controls

Templates, review gates and logging on any generated Arabic that reaches a customer.

Use cases

Where this applies in practice

Questions we get on SAMA expectations

Related guides

PDPL

Most gaps we find are not legal gaps. They are missing lineage, missing classification and copies nobody owns.

Open the guide

NDMO controls

An assessment score moves when the catalogue is populated by the pipeline, not by a spreadsheet campaign.

Open the guide

SDAIA alignment

The ethics principles are not decoration. They decide which decisions a model is allowed to make alone.

Open the guide

NCA Essential Cybersecurity Controls

Most audit findings on a data platform are access findings. Shared accounts and forgotten service credentials, not exotic attacks.

Open the guide

In-country hosting

The failure is almost never the main database. It is a notebook, a support tunnel or a model API nobody classified.

Open the guide

Etimad

A bid rarely loses on the model. It loses on the appendix nobody prepared.

Open the guide

Let's put your AI ambition on the table

Sixty minutes with a senior Bilytica partner. We stress-test your plans against what actually works in your sector, agree which moves are worth funding first, and you leave with a written 90-day plan and honest numbers, whether you work with us or not.

Start the conversation