AI in Saudi Arabia: implementation under Vision 2030

It means AI is national policy with an institution and published targets behind it, not a side experiment. Vision 2030, launched in 2016, rests on three pillars: a vibrant society, a thriving economy and an ambitious nation. Data and AI sit inside it through a dedicated strategy and a dedicated authority.

The National Strategy for Data and AI was approved by King Salman on July 17, 2020. Its published targets include ranking among the top 15 countries in AI, building a workforce of more than 20,000 data and AI specialists and experts, and attracting about 75 billion riyals of investment in data and AI.

The Saudi Data and Artificial Intelligence Authority (SDAIA) was established by royal order in the Hijri year 1440, reports directly to the Prime Minister, and houses the National Data Management Office, the National Center for AI and the National Information Center. For a private operator, the practical effect is that government counterparts increasingly expect data handled to national standards, and they ask about it in tenders.

It requires that any personal data your system touches is collected for a stated purpose, kept to the minimum, protected, and sent abroad only under defined conditions. The Personal Data Protection Law (PDPL), fully enforceable since September 14, 2024, is supervised by SDAIA.

Scope is wider than many teams assume. Article 2 of the law's published text covers processing that takes place in the Kingdom and also processing of data about people living in the Kingdom by a party outside it. A model provider in another country that sees your customers' names is inside that scope.

Article 29 allows transfers out of the Kingdom for defined purposes, provided they do not prejudice national security or the Kingdom's vital interests, the destination offers protection at least equivalent to the law's, and only the minimum data is sent; the implementing regulations set exceptions and safeguards. Article 36 sets a warning or a fine of up to five million riyals for breaches of the law or its regulations, which can be doubled for a repeat violation.

It depends on who you are and what the data is, so classify first and choose hosting second. SDAIA's Data Classification Policy applies to data held by public entities and sorts it into four levels: Top Secret, Secret, Restricted and Public. When a dataset mixes levels, the highest level applies to the whole.

That last rule matters for AI. An agent that merges a public tender notice with a restricted bill of quantities produces a restricted output, and the answer inherits the strictest label of anything it read.

Hosting rules bite hardest for regulated entities, and they have moved. The NCA (National Cybersecurity Authority) Essential Cybersecurity Controls apply to government organizations, their companies, and private operators of critical national infrastructure. Their 2018 edition required those entities to host and store their information inside the Kingdom; the 2024 edition deleted that control and handed data localization to the National Data Management Office within SDAIA, so hosting location for covered entities now follows that office's rules. A contractor working on government projects should expect the client to ask where every dataset will sit and why.

It should read from both and write to neither without a person in the loop. ZATCA rolled out e-invoicing in two phases: generation from December 4, 2021, and integration with ZATCA's systems from January 1, 2023, in waves of taxpayers. ZATCA also defines an e-invoice as one generated in a structured electronic format, so a scanned paper invoice does not qualify.

That structure is a gift for an operations dashboard. Billed and collected figures can come straight from the compliant invoicing solution instead of a finance team's spreadsheet, which is how we prefer to feed the money view in operational dashboards for Saudi contractors. The AI layer explains and forecasts; the compliant, ZATCA-integrated invoicing solution issues the tax invoice and value added tax (VAT) figures.

Etimad is the Ministry of Finance platform for government tenders, procurement, contracts and payments. Tender packages come out of it as stacks of booklets, drawings and forms, which is exactly the reading job an agent does well. We keep submission manual: the agent prepares, a person decides and uploads.

Because the documents themselves are bilingual, and meaning lives in the mix. A single tender package can carry Arabic conditions of contract, English technical specifications and tables that switch language mid-column. An agent that translates everything to English first loses the exact wording a bid committee will be held to.

We design for both languages end to end: extraction that handles right-to-left text and mixed tables, outputs in whichever language the reader chooses, and quotes kept in the original language with the clause reference. Dates need the same care, because official documents often carry Hijri dates beside or instead of Gregorian ones, and a missed submission deadline is a lost bid.

It also matters who reviews the output. A bilingual system has to be checked by someone who reads both languages fluently, against the source in both, because a fluent translation can still be wrong about the clause.

Start where documents and money already pile up, and keep the first phase narrow. For most groups that is the tender pipeline or the gap between contract value and cash collected, both of which have clear owners and measurable finish lines.

• Inventory the data a first use case touches and classify it before choosing any tool or cloud region.
• Decide which steps a person must approve, especially anything that submits, pays or commits the company.
• Settle where project and client data will be hosted against your classification and the national localization rules, and write the decision down.
• Connect to systems of record, such as the enterprise resource planning (ERP) system and the e-invoicing solution, rather than re-keying figures.
• Measure the first phase on time saved per tender or days to see a project's cash position, not on model accuracy alone.