شركة أمن البيانات

Request a consultation

Secure AI & Automation

AI Strategy & Readiness Assessment Find the AI use cases worth building, and what they need

We assess your data, systems, skills and constraints, score candidate use cases on value, feasibility, data readiness and risk, and set out the target architecture and roadmap for the ones worth pursuing, with proof-of-concept charters if you want them. Building is a separate step you decide on afterwards.

Request a proposal for this serviceTalk to sales on WhatsApp

Or call sales directly: +966 59 750 4669Sales hours: Sunday–Thursday 9:00–17:00

At a glance

Frameworks

  • SDAIA AI Ethics
  • NIST AI RMF
  • ISO/IEC 42001
  • PDPL

Deliverables

  • Readiness report: data, systems, skills and infrastructure
  • Prioritised use-case register with scores, reasoning and value assumptions
  • Target architecture, with the deployment option each use case needs
  • 12-month roadmap with budget considerations and cost drivers
  • Proof-of-concept charter with acceptance criteria (with a proof-of-concept plan)

When you need this service

  • Leadership has asked for an AI plan

    A board or executive instruction to adopt AI, with no agreed view yet of where it would pay off or what it would take.

  • Many ideas, no way to choose

    Departments and vendors bring many proposals, and you need one consistent way to compare them and to turn down those that do not justify the effort.

  • A pilot has stalled

    A pilot that looked good in a demonstration stopped at data access, classification, security review or the cost of running it.

  • AI needs a line in next year's budget

    You need a clear sequence and cost drivers you can explain before the budget cycle closes.

The challenge

Leadership wants results from AI, but nobody can yet say which use cases would pay off, what data each one needs, what risks it carries or what it would cost to run. Pilots then start from a product demonstration or one team's enthusiasm, and stall when they meet data that is incomplete, classified or out of reach, or when the running costs become clear.

The requirements that apply depend on who you are and what data you process, and they change which use cases are realistic. The Personal Data Protection Law (PDPL) applies wherever personal data is processed, and sending personal data to a model hosted outside the Kingdom is a transfer question under the Regulation on Personal Data Transfer outside the Kingdom. The Saudi Data and Artificial Intelligence Authority (SDAIA) Generative AI Guidelines for Government (2024) state that employees of government entities must not enter data classified Restricted or higher into generative AI tools, and government data is classified under the National Data Management Office (NDMO) standards. The National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC-2:2024) and Data Cybersecurity Controls (DCC) are mandatory for the organisations in their scope, which NCA defines as government entities and organisations that own, operate or host critical national infrastructure, and they shape how any new system at those organisations is hosted and protected. Financial institutions regulated by the Saudi Central Bank (SAMA) also work within its Cyber Security Framework (SAMA CSF).

So we make these constraints part of the scoring from the start, not a late surprise. We draw on the SDAIA AI Ethics Principles (2023) for the risk questions, and on international references that are not Saudi requirements: the NIST AI Risk Management Framework (AI RMF 1.0) and ISO/IEC 42001, the standard for AI management systems. The result is a short list your leadership can defend, with a written reason for every use case left out.

How we work

  1. 1

    Assess readiness and data

    We interview leadership, process owners and IT, and review your data sources, their classification and access rights, alongside your systems, skills and infrastructure. Data quality is judged on real samples, not on descriptions, and we record the regulatory, procurement and budget constraints you work within.

  2. 2

    Discover and score use cases

    In workshops with process owners we turn requests and ideas into candidate use cases. We then score them on criteria and weights you agree in advance, and write the expected value of each as assumptions, each with a named owner.

  3. 3

    Plan the path

    For the shortlisted use cases we set out target architecture options and the deployment option each one needs, a 12-month roadmap with its cost drivers and, if you want them, proof-of-concept charters with defined acceptance criteria. We then present the results to your leadership and hand over every document.

What is included

  • Data assessment

    Availability, quality, classification, ownership, location and access rights of the data each use case would rely on, checked on samples in Arabic and English, including scanned documents where relevant.

  • Systems, skills and infrastructure readiness

    The systems that would need integration, what your teams can build and run themselves, and whether your infrastructure, network and security controls can host what the use cases need.

  • Use-case discovery

    Structured workshops with process owners that turn requests and ideas, including proposals already on the table, into use cases described the same way: the task, the users, the current process, the data and the expected result.

  • Use-case scoring

    A scoring model covering value, feasibility, data readiness, risk and regulatory constraints, with weights you set and the reasoning behind each score recorded.

  • Business-value assumptions

    Expected benefits written as assumptions, each with an owner, a baseline to collect and a way to test it, so the business case can be checked rather than taken on trust.

  • Risk and regulatory screening

    A first view of the risks and requirements that may apply to each use case, which depend on who you are and what data you process, including personal data transfers outside the Kingdom and data classification. The roadmap also takes account of the Draft AI Cybersecurity Guidelines (AICG-1:2026) that NCA put out for public consultation; as a draft, they show direction and create no obligation. Policies, system inventory and evidence belong to AI Governance & Regulatory Readiness.

  • Target architecture options

    Architecture patterns for each shortlisted use case, such as an assistant that answers from your documents through retrieval-augmented generation (RAG), document extraction or an agent that takes actions, with the deployment option it needs: private hosting, Saudi data residency, sovereign or air-gapped. We describe the options generically and do not select products.

  • Roadmap and budget considerations

    A 12-month sequence that respects dependencies such as data clean-up, integration and security review, with the cost drivers for each use case: compute, model usage, data preparation, integration, security testing, operation and skills. It contains no prices; those come from proposals for the work itself.

  • Proof-of-concept charters

    A charter for each proof of concept that sets its scope, data, evaluation set, acceptance criteria agreed in advance, roles, and the conditions for stopping or moving to production, written so that your team or any provider you choose can run it.

How to work with us

Frameworks and regulations

We align the service with the frameworks your organisation is subject to.

  • SDAIA AI Ethics
  • NIST AI RMF
  • ISO/IEC 42001
  • PDPL

Frequently asked questions

How do you decide which AI use cases are worth building?

We score each candidate against criteria you agree before scoring starts: business value, feasibility, data readiness, risk and regulatory constraints. You set the weights, so the ranking reflects your priorities. A use case with high value but unusable data, or with data that may not go where the model would run, moves down the list or gets a precondition, such as cleaning a data source first. Use cases that tend to rank well have a named owner, a task that recurs, data you are allowed to use for that purpose, and errors a person can catch before they have an effect.

What do you need from us?

A senior sponsor, time from process owners, representative data samples, access to system owners and architecture documents, and your known constraints. The sponsor settles priorities when departments disagree, and process owners join the workshops and answer follow-up questions. Samples, or supervised access to them, let us judge data quality on real records. The constraints we need to know include data classification, procurement rules and the budget cycle. Where samples contain personal or classified data, we agree before we receive them where they are reviewed, who sees them and when they are deleted.

How does this assessment differ from a proof of concept, a production build or managed operation?

This assessment produces decisions and plans, not working software. It tells you which use cases to pursue, what each one needs and how to test it. A proof of concept then tests one use case on your data against acceptance criteria agreed in advance; a production build delivers it on the chosen deployment option, with security testing before go-live; and managed operation runs it afterwards, with scope and support hours set in the contract. Any step can be the last. The build and run steps are covered by services such as Private & Sovereign AI Platforms, Enterprise Knowledge AI & Document Intelligence and Managed AI Platforms & LLMOps.

What determines the cost and duration of the assessment?

It depends mainly on the number of business units and use cases in scope, and on how quickly people and data become available. Other factors are the number of data sources to sample, whether Arabic and English content must both be assessed, the depth of the architecture work, whether you want proof-of-concept charters, and how many stakeholder groups review the results. We set scope and duration in a proposal after a first meeting, and do not publish generic figures.

What does success look like, and how is it measured?

For the assessment, success is a decision your leadership can take and defend: a short list of use cases, the reasoning behind it, and the measures each use case will be tested on. Those measures are defined before anything is built, such as answer accuracy on a test set drawn from your own material, the time a task takes before and after, the errors a reviewer finds, use by the intended staff, and running cost per use. Each measure gets a baseline and an owner, and a proof-of-concept charter sets the threshold it must reach. We do not promise business outcomes; the assumptions behind any expected value are written down so you can test them.

Do we need our own GPUs before we start?

No, not to start and not for the assessment. Whether a use case needs dedicated graphics processing units (GPUs) depends on the data it handles and the deployment option it requires. Where your data classification and the PDPL rules on transfers outside the Kingdom allow it, a proof of concept can use a commercial model through its enterprise application programming interface (API), with no new hardware. Data that must stay in a sovereign or air-gapped environment needs models that run inside it, usually open-weight models you run locally on hardware you own or host with a provider you choose. The architecture options state the compute each use case needs, so any purchase follows a tested need rather than preceding it.

How do you judge a model's Arabic and English capability?

On your own tasks, not on public rankings. For each use case you plan to test in a proof of concept, we prepare a small evaluation set from your material, such as real questions, documents and expected answers in Arabic, English and the mix your staff actually write, and agree with your reviewers how answers are scored. This tests what matters to you: your terminology, colloquial phrasing in user questions, scanned documents and text that mixes right-to-left and left-to-right writing. The assessment also records where language capability decides the architecture; the candidate approaches are compared on the evaluation set in the proof of concept itself.

Who owns the deliverables?

The contract sets this: your data stays yours, and the deliverables are handed over to you as it specifies, including the readiness report, use-case register, architecture options, roadmap and any proof-of-concept charters. They are written so that your own teams, or any provider you choose for the next step, can use them, and the register includes the scoring model and its weights so you can score new proposals the same way.

  • Secure AI & Automation

    AI Governance & Regulatory Readiness

    AI policies, a system inventory, risk classification, human oversight and evidence mapped to the Saudi requirements that apply to you.

  • Secure AI & Automation

    Private & Sovereign AI Platforms

    AI platforms on infrastructure you control: locally deployed models, isolation and integration, with every external dependency documented.

  • Secure AI & Automation

    Enterprise Knowledge AI & Document Intelligence

    Arabic and English assistants that answer from your own documents with their sources and existing permissions, plus document extraction.

  • Govern & Comply

    GRC Advisory

    Policies, procedures and risk management built on NCA, SAMA and ISO 27001 controls.

Sales

Talk to our sales team

Tell us what you need and we will prepare a proposal for this service, or reach sales directly by call or WhatsApp.

  • Unified number

    9200 33782

    For general enquiries about our services and for existing clients. Reachable from within Saudi Arabia.

  • Mobile (calls and WhatsApp)

    +966 59 750 4669

    The direct sales line, by call or WhatsApp: a quick quote or a question about this service, and for existing clients.

  • Address

    3173 Al Abbas Ibn Abdulmutalib, At Taawun, Riyadh 12475

    Open the map ↗
  • Looking for a job at DataSec? Open roles