AIChoosing a software, AI or app development company in Saudi Arabia: 10 questions to ask before you sign
Hiring an app development company in Saudi Arabia, the GCC or abroad? Send every candidate the same ten questions in writing, and score the answers before you compare prices.
Key takeaways
- Send every candidate the same one-page brief and the same ten questions in writing, and compare prices only for the same written scope.
- Tie each payment to a delivered, accepted milestone, and approve the screens before any code is written.
- Keep code, app-store accounts, domains and cloud accounts in your company's name; Apple and Google organisation accounts need a D-U-N-S number.
- Get a written list of subcontractors and services, including AI, with the country each runs in and whether any may train on your data; Saudi rules expect your prior acceptance of sub-processors.
- If a developer handles personal data for you, the PDPL requires the necessary guarantees and its Implementing Regulation an agreement on purpose, data, duration, breach notice and subcontractors.
On this page
- How to choose an app development company in Saudi Arabia or abroad
- The team: who actually does the work? (Questions 1–2)
- The paperwork: a written scope and a published timeline (Questions 3–4)
- Money and design: pay for accepted work, approve screens first (Questions 5–6)
- After launch: warranty, support and what you own (Questions 7–8)
- Your data: the PDPL questions you are accountable for (Questions 9–10)
- A scorecard to compare the answers
- Hiring a company or looking for a technical partner?
- Put the same questions to us
Before you hire an app development company in Saudi Arabia, elsewhere in the Gulf or abroad, get written answers to ten questions. They cover the team and its subcontractors, the scope and timeline, how payments follow delivery, when you approve the screens, support after launch, what you own at the end, and how personal data is protected and where it goes.
How to choose an app development company in Saudi Arabia or abroad
Quotes from software companies in Saudi Arabia, or anywhere else, can only be compared once they price the same written scope. Send two or three candidates the same one-page brief (what the system must do, for whom, in which languages, connected to what, by when) and the same ten questions, and ask for written replies.
Not sure whether to build at all, or need a template for that brief? Start with ready-made software or a system built for you.
Check who you are contracting with. A local address on a website does not show which legal entity will sign, or where the team works. In Saudi Arabia, the Ministry of Commerce's Commercial Registration Data e-service (in Arabic) lets anyone search a registration by company name or unified national number (the company's official ID number), free of charge [1]. Elsewhere, use that country's official company register. Note the country; it matters for questions 9 and 10 and for the governing law.
The team: who actually does the work? (Questions 1–2)
1. Who will do the work, and where?
The people who sell a project may not be the ones who build it, and each handover between teams loses context.
A good answer includes:
- named roles, ideally with names, from analysis to launch, plus your day-to-day contact;
- where the team works and how many working hours overlap with yours (a Sunday-to-Thursday week and a Monday-to-Friday week share four days);
- who can work in Arabic, if your users do;
- one or two recent projects like yours that you can see working, and a past client you may call (ask what went wrong and how it was handled);
- a call with the person who will lead the build.
2. Will any part be subcontracted, or run on someone else's service?
Most systems rely on outside services, such as cloud hosting, an AI model provider or email and SMS delivery, and each may touch your data. If the system processes personal data, the Implementing Regulation of Saudi Arabia's Personal Data Protection Law (PDPL) expects your agreement to identify "any subcontractors contracted by the Processor, or any other party to whom Personal Data will be disclosed" [2, Art. 17(1)(g)]. The developer also needs your "prior acceptance" before contracting a sub-processor [2, Art. 17(5)(c)].
A good answer includes:
- a written list of subcontractors and third-party services, with what each does and the country it runs in;
- a commitment to tell you before adding one, with an agreed period to object.
The paperwork: a written scope and a published timeline (Questions 3–4)
3. Is the scope written down, including what is out?
An argument about what was "included" is hard to settle without a document both sides signed.
A good answer includes:
- each feature with an acceptance test that says what "done" means;
- the interface languages, for example Arabic (right to left) and English;
- every integration named: payment gateway, accounting system, and any government or single sign-on services you use;
- an out-of-scope list, and how change requests are priced and approved.
If the system includes AI. Whether you hire an AI development company in Saudi Arabia or add one AI feature to an existing system, agree an acceptance test on a sample of your own past cases whose correct answers you already know, and name who checks the output. A demo on the vendor's examples proves little.
The Saudi Data & AI Authority (SDAIA) warns that generative models can "over-confidently generate 'facts' that are complete fiction", and makes verifying output the user's responsibility [3, §5.3]. Still choosing the task? See how AI can help your business, starting with one task.
4. Is there a published timeline with milestones?
A single end date hides where delays start, and what the project needs from you.
A good answer includes:
- milestones with dates, and what each one delivers;
- what you must supply and by when (content, access to existing systems, approvals), since your delays move the dates too;
- how public holidays and your approval time are planned in, and what happens when a date slips on either side.
Money and design: pay for accepted work, approve screens first (Questions 5–6)
5. How do payments follow delivery?
Money should follow working software that you have tested and accepted. Payments due on calendar dates keep flowing while the work stalls.
A good answer includes:
- each payment linked to a named milestone and its acceptance test from question 3;
- what "accepted" means, and how many days you have to test;
- the final payment released after launch and a successful handover test (question 8).
If a payment is due before work starts, ask which deliverable it covers, such as the analysis and the written scope.
6. When do we see and approve the screens?
Changing a screen on paper takes minutes; changing it in code takes longer and costs more.
A good answer includes:
- designs or a clickable prototype of the main journeys in every launch language, with Arabic laid out right to left from the start;
- a written sign-off on each part before its development begins;
- later changes handled through the change-request process from question 3.
After launch: warranty, support and what you own (Questions 7–8)
7. What warranty, support and maintenance come after launch?
Launch is when users find the bugs testing missed, and phones, browsers and app-store rules keep changing after it.
A good answer includes:
- a written warranty period covering defects in the agreed scope (new features are separate);
- support channels, hours and response times by severity;
- who applies security patches, how fast, and who handles new iOS, Android and store-policy changes;
- maintenance as a separate, optional agreement;
- a written estimate of monthly running costs after launch (hosting, AI usage, SMS and email, store fees) and who pays each (what to budget for).
For security, a US buyers' guide from the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI suggests building "product security requirements into contract language" [4]. Its questions work anywhere: is multi-factor authentication on by default at no extra cost, and does the system keep security logs of sign-ins, configuration changes and data access?
AI features. If the underlying model or AI provider changes, will you be told in advance, and will your acceptance cases from question 3 be run again?
8. What do we own at the end: code, accounts and data?
You can change developer, or bring the work in-house, only if everything needed to run the system is yours. Agree this handover list before you sign:
| Item | What to agree |
|---|---|
| Source code | In a repository your company owns; the developer is a member you can remove |
| iOS and Android apps | Under your company's own Apple and Google Play developer accounts |
| Domains, cloud, email-sending and AI-provider accounts, API keys | In your company's name, or transferred on request |
| Admin credentials, design files, documentation | Handed over and kept current |
| Your data | Exportable in a usable format whenever you ask |
| Early exit | If either side ends the contract before launch: the code, designs and documents to date, with payment up to the last accepted milestone |
Before the final payment, test the handover: ask an independent developer to set up the system from the repository and documents alone. Whatever they cannot do is still missing. Code ownership itself is set by your contract and its governing law, so have your lawyer review the handover terms.
Apple displays an organisation's name "as the seller name of your apps on the App Store", and organisation enrolment requires a D-U-N-S Number, a nine-digit business identifier from Dun & Bradstreet [5], free in most jurisdictions [6]. Google Play also requires one for an organisation account [7].
If the app sits in the developer's account, your customers see the developer as the seller. Moving an app later is possible on both platforms, but each has its own steps and conditions [8][9], so whichever mobile app development company you hire, have it publish under your company's account from day one.
Your data: the PDPL questions you are accountable for (Questions 9–10)
This is general information, not legal advice. Check the current text of the law and its regulations.
A developer that hosts or supports your system, or moves or tests your existing data, handles personal data for you. Your company is then usually the controller under the PDPL, which decides the purpose and manner of processing, and the developer is the processor, which processes data "for the benefit and on behalf of the Controller" [10, Art. 1(18)–(19)]. The controller "shall only select Processors providing the necessary guarantees" and must monitor their compliance [10, Art. 8].
The law covers processing in the Kingdom, and also processing of personal data of "individuals residing in the Kingdom by any means from any party outside the Kingdom" [10, Art. 2(1)]. So a developer or company working abroad is still inside it when the people in the data live in Saudi Arabia. If your system has neither link to the Kingdom, use the two questions below next to your own data protection law.
9. What guarantees and processing agreement do you offer for personal data?
A good answer is a written data-processing agreement with the seven items the Implementing Regulation requires [2, Art. 17(1)]:
| Art. 17(1) | The agreement states | Ask for |
|---|---|---|
| (a) | Purpose of the processing | What the system does with the data, in plain words |
| (b) | Categories of personal data | A list: names, phone numbers, ID numbers, health data if any |
| (c) | Duration of the processing | How long they keep the data; deletion at the end |
| (d) | Breach notice to you "without undue delay" | Who tells whom, and how fast |
| (e) | Whether the processor is subject to other countries' regulations, and the effect | Which countries' rules apply to them |
| (f) | Disclosures required by Saudi law may proceed without your prior approval, if the processor notifies you | Notice when it happens |
| (g) | Subcontractors and other recipients of the data | The list from question 2 |
You must also give the processor clear instructions and periodically assess its compliance, directly or through an independent third party [2, Art. 17(2)–(3)]. Ask how the developer will let you check: a yearly review, access to logs, or a written security summary.
PDPL Article 19 requires the controller to implement "all the necessary organizational, administrative and technical measures to protect Personal Data" [10, Art. 19]. Ask which ones the developer runs for you, such as access by role, encryption and tested backups.
10. Where will data be hosted and processed, including by AI services?
A good answer is a data-flow list:
- where the main system (servers, database and files) runs, and in which country;
- each supporting service (AI processing, email, SMS, analytics, backups), the data it receives, and where it runs;
- whether any AI provider may use your data to train its models, and where that is written (the provider's terms or your contract).
On the last point, SDAIA warns that generative AI services "use the information received through prompts as training data for further development of the model", which "can then be exposed to third parties", and says providers should give users "options to give – or refuse – consent to use their data for AI model training purposes" [3, §5.4]. Ask for that choice in writing.
Hosting, cloud and services outside the Kingdom
If personal data leaves Saudi Arabia, PDPL Article 29 sets the purposes and conditions, including an adequate level of protection abroad and limiting the transfer "to the minimum amount of Personal Data needed" [10, Art. 29].
Where a transfer relies on an exemption from those conditions, SDAIA's Transfer Regulation requires case-specific safeguards (standard contractual clauses, binding common rules or a certificate of accreditation) and a prior risk assessment [11, Art. 4, 7(1)], and it also covers "subsequent transfers" [11, Art. 5].
If your organisation must follow the Cloud Cybersecurity Controls (CCC-2:2024) of Saudi Arabia's National Cybersecurity Authority (NCA), minimum requirements for cloud providers and the organisations that use them, updated in 2024 to reflect changes in data localisation requirements [12], ask how the developer's hosting meets them.
A scorecard to compare the answers
Score each answer 2 (in writing, with evidence), 1 (verbal or partial) or 0 (no answer, or a red flag), out of a maximum of 20. Copy the table and add one score column per company.
| # | Question | Red flag | Ask to see |
|---|---|---|---|
| 1 | Who does the work? | "Our team", with no names or roles; nothing you can see running | The named team; a call with the lead; a live project and a reference |
| 2 | Subcontractors and services? | "Nobody", yet the proposal names cloud or AI services | The written list, with countries |
| 3 | Written scope? | A one-page feature list; "we'll work it out later" | Draft scope with acceptance tests |
| 4 | Timeline? | One end date, nothing asked of you | Milestone plan with your inputs |
| 5 | Payments tied to delivery? | Payments on dates, whatever was accepted | Schedule mapped to milestones |
| 6 | Screens before code? | Coding before you see screens; Arabic "later" | A sample prototype; the sign-off step |
| 7 | Warranty and support? | "We'll support you", nothing written | Warranty and support terms; running-cost estimate |
| 8 | What you own? | App in their account; code "on request" | Handover clause; account list |
| 9 | Processing agreement? | "We're compliant", nothing on paper | Draft agreement with the Art. 17 items |
| 10 | Hosting and processing? | "It's in the cloud"; nobody knows where the AI runs | Data-flow list; transfer safeguards |
The deal-breaker rule. A 0 on question 3, 8, 9 or 10 means you do not sign until it is fixed, whatever the total. A system with user accounts holds personal data such as names and email addresses [10, Art. 1(4)]; if the developer will host it, support it or work with your live data, assume 9 and 10 apply. Compare totals only between companies with no deal-breakers.
Before you sign: the paperwork pack
Have every document from the "Ask to see" column in hand, final and in writing, plus:
- the out-of-scope list and change-request process;
- the approved designs or prototype;
- the contracting company's registration details and governing law, for your lawyer.
Hiring a company or looking for a technical partner?
"Technical partner" means either a long-term supplier, which is hiring a company (the ten questions apply as they are), or a co-founder who builds the product for a share of the company. The second differs:
| Hire a company | Bring in a technical partner | |
|---|---|---|
| Payment | Fees for agreed work | A share of the company (equity), often with little or no fee |
| Decisions | You direct the roadmap | Technical decisions are shared |
| You need | A clear scope and a budget | Someone you trust, and a written founders' agreement |
| Suits | A defined system for a running business | A product that is the business |
The ten questions still apply to a co-founder; questions 2 and 8 (who else touches the work, who owns it) weigh more when the builder is also an owner.
Put the same questions to us
These questions apply to O AI, a Saudi AI and software company, too. Our published way of working answers several:
- One team handles analysis, design, development and launch (question 1).
- A written scope of work, a published timeline, and payments tied to delivery milestones (questions 3 to 5).
- Every stage is approved before the next one begins; interfaces are approved before code is written (question 6).
- After launch: a warranty period, technical support and optional maintenance packages (question 7).
For question 1, you can see our own product, Rushd, live on the web and the iPhone App Store; much of our other work is confidential at our clients' request.
On question 10: core hosting (compute, database and files) is on Saudi-based cloud infrastructure inside the Kingdom. A small number of supporting services, such as AI processing and email delivery, can run outside the Kingdom; the privacy policies describe each flow.
Our published material does not yet answer questions 2, 8 and 9, so ask us for written answers and score us with the same table. More on our way of working.
Include us among the two or three companies you send these questions to: book a free consultation. The first consultation and proposal come with no commitment, and we reply within one business day.
This article is general information, not legal advice; have your lawyer review the contract before you sign.
Frequently asked questions
How do I choose an app development company in Saudi Arabia?
Send the same one-page brief and the same ten questions, in writing, to two or three companies. Score each answer 2, 1 or 0, and treat a missing answer on scope, ownership, data protection or hosting as a deal-breaker. Check the contracting company's commercial registration through the Ministry of Commerce's free Commercial Registration Data e-service. Compare prices only between companies that priced the same written scope. The same method works for a mobile app, a web system or an AI project.
What should I ask an AI development company in particular?
Three things on top of the ten questions. First, an acceptance test on a sample of your own past cases whose correct answers you already know, and a named person who checks the output (question 3). Second, advance notice when the model or AI provider changes, and a re-run of those tests (question 7). Third, where the AI processing runs and whether the provider may use your data to train its models (question 10); SDAIA's Generative AI Guidelines for Public (§5.4) warn that information in prompts can become training data and be exposed to third parties.
Is a software company better than a freelancer?
Neither is better by default, so put the same ten questions to both. With a freelancer, three need extra care: who covers the work if they are ill or busy (question 1), what support you get after launch (question 7), and whether the code, app-store accounts and cloud accounts are in your company's name (question 8). The PDPL's definition of a processor includes a natural person (PDPL Article 1(19)), so the data questions (9 and 10) apply to a freelancer who handles personal data for you as well.
Who should own the source code and the app-store accounts?
If you want to be free to change developer later, your company should hold them: the code in a repository your company owns, and the apps under your own organisation accounts. Apple and Google both require a D-U-N-S number for an organisation developer account, according to their developer help pages, so request one early. Ownership itself is set by your contract and the law that governs it, so get the handover terms in writing and have your lawyer check the clause.
How do I compare quotes from different software companies?
Only once they price the same written scope: the same features, languages, integrations, security and support after launch, with the same acceptance tests. Ask each company to break its price down by milestone, and read what each quote leaves out. A lower quote that excludes the Arabic interface, testing or the warranty may not be lower once those items are added back.
Can we hire a software company outside Saudi Arabia?
Yes, and the ten questions matter even more. If the system handles personal data of people living in the Kingdom, the PDPL applies even when the processing happens abroad (PDPL Article 2(1)). The processing agreement should say whether the developer is subject to other countries' regulations (Implementing Regulation Article 17(1)(e)), and transfers of personal data outside the Kingdom must meet PDPL Article 29 and SDAIA's Regulation on Personal Data Transfer Outside the Kingdom. Check the company in its home country's official register.
We are based outside Saudi Arabia and building an app for Saudi users. What changes?
Three things. The PDPL applies to processing of personal data of people living in the Kingdom even when it happens abroad (PDPL Article 2(1)), so questions 9 and 10 apply to you and your developer, and if personal data leaves the Kingdom, PDPL Article 29 and SDAIA's Regulation on Personal Data Transfer Outside the Kingdom apply. If the app has an Arabic interface, have it designed right to left from the start (question 6). And publish the app under your own organisation's Apple and Google developer accounts, which need a D-U-N-S number. This is general information, not legal advice.
What should a software or app development contract include?
At least: a written scope with acceptance tests and an out-of-scope list; a milestone plan; payments tied to accepted milestones; design approval before coding; warranty and support terms; an ownership and handover clause with a list of accounts; a data-processing agreement; a list of subcontractors and where data flows; and the governing law. This is general information, not legal advice or a contract template, so have your lawyer review the final contract.
How this article was made: Researched from the official sources listed below (Saudi Ministry of Commerce, SDAIA, NCA, CISA, Apple, Google), opened on 29 September 2026. Drafted with AI assistance, then checked against those sources. Images are AI-generated illustrations.
Sources
- Commercial Registration Data (e-service) (opens in a new tab)Saudi Ministry of Commerce · mc.gov.sa
- Implementing Regulation of the Personal Data Protection Law (opens in a new tab)Saudi Data & AI Authority (SDAIA) · sdaia.gov.sa
- Generative Artificial Intelligence Guidelines for Public (May 2025) (opens in a new tab)Saudi Data & AI Authority (SDAIA) · sdaia.gov.sa
- Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem (August 2024) (opens in a new tab)Cybersecurity and Infrastructure Security Agency (CISA) and FBI · cisa.gov
- Become a member (Apple Developer Program) (opens in a new tab)Apple Developer · developer.apple.com
- Enrollment (Membership, Account Help) (opens in a new tab)Apple Developer · developer.apple.com
- Choose a developer account type (Play Console Help) (opens in a new tab)Google · support.google.com
- Overview of app transfer (App Store Connect Help) (opens in a new tab)Apple Developer · developer.apple.com
- Transfer apps to a different developer account (Play Console Help) (opens in a new tab)Google · support.google.com
- Personal Data Protection Law (English translation, as amended by Royal Decree M/148; the Arabic text on laws.boe.gov.sa is the official version) (opens in a new tab)Saudi Data & AI Authority (SDAIA) · sdaia.gov.sa
- Regulation on Personal Data Transfer Outside the Kingdom (Version 2.0, August 2024) (opens in a new tab)Saudi Data & AI Authority (SDAIA) · sdaia.gov.sa
- Cloud Cybersecurity Controls (CCC-2:2024) (opens in a new tab)National Cybersecurity Authority (NCA) · nca.gov.sa
About the author
