We publish the methods we work by
A framework library spanning AI, data and analytics, and Saudi standards, each method versioned, dated and reconciled against the standards a regulator already recognises.
15
published frameworks
3
framework families
13
standards tracked
The rules every framework obeys
Evidence over adjectives
Every stage ends in an artefact a reviewer could ask to see. If a stage cannot produce one, it does not belong in the framework.
Reconciled to standards
Nothing is invented where a recognised standard already answers the question. Each framework states which clause or function it satisfies.
Versioned and dated
Frameworks carry a version and a last-review date. A method with no review date is a slide, not a method.
Arabic-first where it matters
Saudi standards and the Arabic quality rubric are drafted in Arabic and mirrored to English, not translated at the end.
Three families, one spine
AI Operating System
The methods that carry an AI programme from a readiness score to a governed release a regulator can inspect, trusted data, evidenced decisions, measurable business outcomes.
Data & Analytics Operating System
The frameworks for the layer AI programmes keep failing on: maturity, platform architecture, quality, decisions and governance.
Saudi Data & AI Standards
Drafted for Saudi Arabia: the unified Saudi control set, the Arabic quality standard, and the in-country deployment ruling.
What was reviewed most recently
The standards the library is reconciled against
NIST AI Risk Management Framework 1.0 and Generative AI Profile
National Institute of Standards and Technology, Govern, Map, Measure, Manage.
ISO/IEC 42001: AI management systems
International Organization for Standardization, management system requirements for AI.
ISO/IEC 23894: AI risk management
Guidance on managing risk across the AI lifecycle.
EU AI Act
Risk tiering, documentation and transparency obligations.
SDAIA AI Ethics Principles
Saudi Data & AI Authority, national principles for AI.
NDMO data management and personal data protection standards
National Data Management Office specifications and domains.
Personal Data Protection Law (PDPL) and its implementing regulations
Lawful basis, subject rights, transfer and retention.
NCA Essential and Cloud Cybersecurity Controls
National Cybersecurity Authority control catalogues.
SAMA frameworks for cybersecurity and outsourcing
Supervisory expectations for financial institutions.
DAMA-DMBOK and EDM Council DCAM
Data management knowledge areas and capability assessment.
OWASP Top 10 for LLM Applications and MITRE ATLAS
The AI attack surface and adversarial technique catalogue.
MLOps and LLMOps maturity practice
Published maturity levels for automation of the model lifecycle.
FinOps for AI
Unit economics and cost accountability for AI workloads.
Frequently Asked Questions
What does Bilytica publish?
A maintained framework library across AI, data and analytics, and Saudi standards, each with versions, review dates, stage gates, evidence artefacts and a crosswalk to the standards it answers.
How is a framework revised?
When a referenced standard changes, or when a gate proves unworkable in delivery. Each revision carries a version number and a review date shown on the framework page.
Are these certifications?
No. Bilytica is not an accreditation or certification body. The frameworks organise work and evidence so recognised standards and Saudi regulations can be answered with artefacts.
Can we use a framework ourselves?
Yes. The stages, gates, artefact lists and self-assessment sheets are published, and the one-pagers are downloadable in both languages.
Explore the topic cluster
Curated links across our Saudi hubs, sector pages and long-form blog research.