AI Governance & Regulatory Readiness Policies, inventory and evidence for the AI you already use

It depends on who you are and what data your AI processes. If it processes personal data, PDPL applies as law, and a model running outside the Kingdom raises a transfer question. If you are in NCA's scope, as a government entity or an organisation with critical national infrastructure, ECC-2:2024 and DCC are mandatory, with CCC for cloud services; if you are a financial institution SAMA regulates, the SAMA Cyber Security Framework is a sector requirement for you. SDAIA's AI Ethics Principles set principles for anyone who develops or uses AI, its Generative AI Guidelines for Government are addressed to government entities and their staff, its guidelines for the public are advisory, and NCA's AI guidelines are still a draft. We set this out in an applicability statement that names each requirement, its status and why it applies, for your legal counsel to confirm.

No. The AI Cybersecurity Guidelines (AICG-1:2026) are a draft NCA put out for public consultation in July–August 2026, and a draft under consultation creates no obligation. The final text, scope and status are for NCA to decide. We treat the draft as direction: we show where your current controls already point the same way and which gaps would matter if the final text keeps that direction. Your current NCA obligations, if you are in their scope, remain ECC, DCC and, for cloud services, CCC.

No. DataSec does not certify, attest or declare that an organisation is compliant, and we do not give legal opinions. We give you a requirement map that links each applicable requirement to the evidence you hold, the gaps and the owner of each gap. Your management, legal counsel and auditors reach their own conclusion from it. Where a formal attestation or certificate is needed, it comes from your auditors, the regulator or an accredited body.

Usually not; you extend what you have. AI systems belong in your existing asset register, risk register, third-party risk process, change management and internal audit plan. What is new is the AI-specific content: risk criteria for model behaviour, human oversight, vendor questions about training and model changes, and the AI policies. We add these to your current framework and committees, and propose a separate AI committee or role only where your size or exposure justifies it. If the wider governance framework needs building first, that is our GRC Advisory service.

By combining several sources, because none of them sees everything on its own. We review procurement and licence records, interview business and IT owners, check the AI features vendors have added to software you already license, and identify what development teams have built or connected to models through an API. Staff use of public AI tools is found through network and endpoint discovery, which is part of our Generative AI Data Protection service; if you use it, its findings feed the register. The register then stays current through your procurement and change approvals rather than being a one-off list.

It means named people can check, correct and stop an AI system at the points where its output matters. For each system the procedure states which outputs a person reviews before use, which actions need approval, what the reviewer must see to judge the output, how to override or switch the system off, and how decisions are recorded. The depth depends on risk: an assistant that drafts correspondence needs less than a system that affects people's rights or triggers actions in other systems. Oversight reduces the effect of errors but does not prevent them, so the procedure also sets how errors are reported and corrected.

Clear written answers on how your data is handled, and contract terms that hold them to those answers. Ask whether prompts, files and outputs are stored and for how long, whether they may be used for training, where they are processed and by which subprocessors, how personal data leaving the Kingdom is handled, what security testing the product has had, and how incidents, model changes and exit are handled. For software that adds AI features, ask whether each feature can be switched off and whether it changes the data terms you agreed. We provide the due diligence questionnaire and contract checklist; your legal counsel finalises the terms.

Yes, we prepare you for it; the certificate itself is issued by an accredited body after its own audit, not by DataSec. ISO/IEC 42001 is an international standard for AI management systems, not a Saudi requirement. We assess your current state against it, build the missing elements such as the management system scope, AI policy, risk and impact assessment processes and internal audit, and can carry out a pre-audit review.