SDAIA AI Adoption Framework: is your company ready for AI?

The SDAIA AI Adoption Framework is guidance, not a law. It groups AI readiness into three pillars: Directions (strategy, governance), Enablers (data, infrastructure, people) and Outcomes (applications, impact). It was written with large entities in mind, but a smaller company can use it as a checklist for one AI use case [1, pp. 5–9; 2].

SDAIA is the Saudi Data & AI Authority, the national authority for data and AI [1, p. 4]. Through its National Data Management Office it also regulates personal data protection and publishes Saudi Arabia's Personal Data Protection Law (PDPL) and the Implementing Regulation that holds its detailed rules [2]. This guide is for companies in Saudi Arabia, and for companies elsewhere in the Gulf Cooperation Council (GCC) and beyond that sell to Saudi customers or operate there.

This article is general information, not legal advice. Check your company's obligations against the current text of the law and its implementing regulations.

What is the SDAIA AI Adoption Framework, and which version are you reading?

It is a guidance document built as three pillars, seven dimensions and 23 sub-dimensions [1, p. 9]. It "targets all government and private entities" and offers "guiding principles and enablers" rather than detailed technical standards [1, p. 6].

Its stated audience is government entities and policymakers [1, p. 5], and none of its examples is sized for a 20-person firm.

Version 1 (2024) or Version 2 (2025)? Check before you quote

SDAIA unveiled the first edition in September 2024; the Saudi Press Agency's summary describes four maturity levels: Emerging, Developed, Proficient and Advanced [3]. The PDF now at the same address is Version 2 (May 2025, SDAIA-P121), built on the three pillars without those levels [1, p. 48]. Many online summaries still describe 2024, so check the "Version Number" on the last page of SDAIA's PDF before quoting one.

The framework on one page (structure from [1, p. 9]; right-hand column is our reading):

Is it mandatory? What binds your company and what only guides it

Short answer: no. The Adoption Framework is guidance, and in our reading so are SDAIA's other AI documents, though the ethics principles are firmer in places. What binds a company is law, above all the PDPL, and its sector regulator's rules.

The Adoption Framework itself points to the law: entities "are also obligated to implement the 'Personal Data Protection Law' and its Implementing Regulations" [1, p. 20].

One item to watch: SDAIA put a draft Responsible AI Policy to public comment on 2 April 2026 [11]; check whether it has been finalised.

What a smaller company can borrow, and what it can leave to large entities

Habits worth keeping at any size:

• Start from "actual user needs or existing operational challenges" [1, p. 16].
• Assess risks "across all use cases before adopting any AI system" [1, p. 22].

A 12-question AI readiness assessment, built on the three pillars

This AI readiness assessment scores one use case at a time: 12 questions, four per pillar, 0 to 2 points each, 24 in total. Answer it with the person who does the task today: 0 = no, 1 = partly, 2 = yes, and you can show it.

An AI feasibility study asks two questions: are we ready, and is it worth it? For the second, SDAIA's executive guide lists "estimating required commitments, determining expected return" [12, p. 14], and our one-task guide has a worksheet and a two-week pilot. The table below, your readiness questionnaire, answers the first.

Records stuck in scanned Arabic PDFs? Fix question 5 first with a checked OCR workflow.

Reading the score (our rule of thumb, not SDAIA's):

• 18–24, and no question at 0: run a limited pilot, with a person approving every output.
• 11–17, or 18 or more with any 0: fix the 0 and 1 answers first, then re-score.
• 0–10: not ready. Fix the process or data first, or pick another task. Some tasks only need simple automation without AI.

Score the risks with SDAIA's AI risk management framework: a worked example

The National AI Risk Management Framework scores the risks of one AI system at a time on a 4×4 likelihood × impact matrix [5]. It is published in full in Arabic, with a six-page English summary [7]; the English labels below are our translations.

1. Set the context: what the system may and may not do, its data inputs and outputs, its level of automation and the person's role, and its change plan [5, p. 17].
2. Identify risks under seven types: bias, discrimination and abuse; privacy and security; misinformation; malicious use; human–machine interaction; social, economic and environmental impacts; safety and limitations [5, pp. 18–20].
3. Rate likelihood 1–4 from exposure, controls, ease of occurrence and past incidents. The scale is not built on percentages, though SDAIA says its levels match annual bands some frameworks use: under 1%, 1–10%, 10–50%, 50% or more [5, pp. 22–23].
4. Rate impact 1–4: low, medium, high, catastrophic [5, p. 23].
5. Multiply: 1–2 low, 3–6 medium, 8–12 high, 16 catastrophic [5, pp. 24–25].
6. Treat: avoid, mitigate, transfer or accept. Transferring risk through contracts, insurance or supplier obligations "does not cancel the entity's responsibility for governance and compliance" (our translation) [5, p. 26].

The matrix behind step 5 [5, p. 25]:

SDAIA's own appendix scores eight risks of a large language model that drafts a government entity's internal reports. All eight come out medium and are accepted, most with continued monitoring; two, including leaks of internal information, only with immediate escalation if an incident is suspected [5, pp. 32–44].

Illustrative example (not a client case): a spare-parts distributor in Dammam, in eastern Saudi Arabia, with customers across Saudi Arabia and the Gulf, wants AI to draft email replies to "where is my order?" and "is this part in stock?" from its order system, with a staff member approving every reply. Scores are judgments, with the listed controls in place.

All four are medium with controls, so the distributor can pilot, accept what remains and watch SDAIA's monitoring signals: complaints, repeated objections to decisions, and more requests for human review [5, p. 28].

SDAIA AI ethics principles and PDPL checks before go-live

The seven principles and four risk categories

The seven principles: fairness; privacy and security; humanity; social and environmental benefits; reliability and safety; transparency and explainability; accountability and responsibility [4, pp. 12–26].

The same document has four risk categories: little or no risk, such as spam filters (no restrictions); limited risk (the principles apply); high risk to basic rights (pre- and post-conformity assessments plus statutory requirements); and unacceptable risk, such as social profiling (not allowed) [4, p. 9]. SDAIA's generative AI guideline asks users to place their tools in these categories [8, §4.5]. Most drafting and data-entry uses look like "limited" candidates; someone in your company should decide, using the ethics checklist.

Three PDPL checks that AI adds

1. Solely automated decisions. Consent is the PDPL's default basis [9, Art. 5]; where you rely on it, it must be explicit for decisions made solely by automated processing [10, Art. 11(2)(c)]. The law lists cases where consent is not needed [9, Art. 6], so check which basis applies before AI decides anything about a person on its own. Processing with new technologies or automated decisions, on a large scale or repeatedly, also means telling people whether decisions are solely automated [10, Art. 4(5)(c)].
2. A written impact assessment is required in listed cases, among them when you process sensitive data, link personal datasets from different sources, or, on a large scale or repeatedly, process data with newly adopted technologies or for automated decisions [10, Art. 25(1)]. For Articles 4 and 25 we follow the official Arabic ("or repeatedly") [13, Arts. 4(5), 25(1)]; SDAIA's English translation of Article 25 says "large scale and repetitive".
3. Your AI supplier is usually a processor. Choose one that provides "sufficient guarantees", with an agreement covering purpose, data categories, duration, breach notification, exposure to other countries' laws, and subcontractors [10, Art. 17(1)].

If customers will deal with the AI. This one comes from SDAIA's guidance, not the PDPL: its generative AI guideline says to "clearly communicate when GenAI is used in interactions with the public" and offer "alternative, non-automated communication channels" [8, §4.3]. Planning a WhatsApp assistant? Build both in from day one.

Questions for your AI supplier, taken from SDAIA's checklist

When a third party builds the system, SDAIA's ethics principles ask its owner for "an AI Ethics due diligence" before procurement or sign-off [4, p. 25]. Their checklist (Annexure C) marks items Yes or No under "Binding for Third-party" [4, pp. 41–47]. The column is undefined, so treat the Yes items as questions, not a legal duty on the supplier. Checklist stages: PD plan and design, PID prepare input data, DM deploy and monitor.

1. Where can our staff review, edit or stop an output before it reaches a customer? (PD.1, PD.2)
2. What does the contract say about liability and about protecting the people whose data we process? (PD.5)
3. How do you test and monitor for unfair bias before and after launch, including with Gulf and other Arabic dialects and non-Arabic names? (PD.10, DM.9; the example is ours)
4. How do you flag and control personal data, including consent and its withdrawal? Is our data used to train models? (PID.1, PID.4; the training question is ours)
5. How is data kept confidential, and has the system been tested against attacks and leaks? (PID.5, DM.2)
6. Will users know they are dealing with AI? (DM.1)
7. How do we report errors, and how does that feedback reach the system? (DM.8)

Add the Article 17 contract items above and our ten questions to ask before you sign.

If your company is outside Saudi Arabia

The PDPL covers personal data about people residing in Saudi Arabia, including processing "by any means from any party outside the Kingdom" [9, Art. 2]; the ethics principles address AI stakeholders "within KSA" [4, p. 9]. So if you serve customers in Saudi Arabia from Dubai, Cairo or London, the three PDPL checks above can apply to you, and SDAIA's frameworks are useful guidance. For transfers and registration, see what the PDPL asks of companies outside Saudi Arabia.

SDAIA's ethics document cites NIST's AI RMF and ISO 23894 as references [4, p. 34].

Four steps for this week

1. Pick one AI use case and write down what it costs today.
2. Answer the 12 questions with the person who does the task.
3. Score three to five risks and the controls you would use.
4. Send the supplier questions before you sign, and ask for written answers.

This is how O AI, a Saudi AI and software company in Al Khobar, works:

A good first step is one slow, repetitive task: documents, customer replies, reports or data spread across systems. O AI studies that task, checks whether AI is worth it, then connects AI to the systems you already use or builds a new one. The first consultation and proposal come with no commitment.

Tell us which task you want to test and book a free consultation; we reply within one business day.