AI systems built for data residency, PDPL enforcement and sovereign cloud.
Gulf enterprises are investing in AI at national-strategy scale, and the regulators have kept pace. Saudi PDPL is in active enforcement, the UAE has moved to sovereign cloud for its most sensitive sectors, and residency now attaches to processing, not only storage. Architecture decides compliance here.
Riyadh
- Transformation and digital officesDelivering national and corporate AI programmes with a procurement process that asks for residency, controls and evidence before a contract is signed.
- Financial services and insurersOperating under SAMA and CBUAE expectations, where the sovereign financial cloud and vendor governance rules shape every architecture decision.
- Government-linked entities and their suppliersIn scope for NCA controls, including the third-party and cloud domain, which reaches the engineering partner directly.
- Groups and enterprises modernising operationsWorkflow automation, document processing and data platforms across several operating companies, often bilingual and multi-entity.
What we see holding AI programmes back in this market, from the engagements we run and the regulation now in force.
- 01
PDPL is in active enforcement
SDAIA has issued 48 formal enforcement decisions across 2025 and 2026, for processing without a lawful basis, unauthorised disclosure, missing safeguards and marketing without consent. Fines reach SAR 5 million and double for repeat violations.
- 02
Data stays in the Kingdom by default
Cross-border transfer is the exception, allowed only under equivalent-protection conditions. Cloud deployments need a residency assessment, processor agreements and a mapped list of any flows that leave Saudi Arabia.
- 03
Residency now attaches to processing, including model training
For enterprise AI in the UAE the question is no longer whether to comply with sovereignty rules but how to structure the whole deployment stack so sovereignty is a built-in property, including where models are trained and inferred.
- 04
Seventy-two hours to notify a breach, five years of processing records
PDPL implementing regulations require breach notification to SDAIA within 72 hours and an immutable record of processing activities kept for at least five years. Both are system properties, not policies.
- 05
NCA controls reach the vendor
ECC-2:2024 expands expectations for identity, access, cryptography and vendor governance, and its third-party and cloud domain requires due diligence and contractual security clauses for any engineering partner of an in-scope entity.
- 06
Sovereign cloud is becoming the norm for sensitive sectors
The Central Bank of the UAE launched a sovereign financial cloud in February 2026. Financial and government workloads increasingly have to run on approved in-country infrastructure operated under local law.
What each obligation means for the system itself. We build the controls; your counsel confirms the legal position.
Security review inside the build, not after it
Threat model, access control, secrets handling, dependency scanning and audit logging are designed with the architecture and documented as evidence your own auditor can read. Nothing is retrofitted for a questionnaire.
Controls written to the ECC domains your security office already audits against.
AI audit and evaluation you can hand to a regulator
Every AI feature ships with an evaluation set, grounding and hallucination measurements, regression runs per release and traced inputs and outputs. The result is an evidence pack, not a demo.
Evaluation evidence for Arabic and English behaviour, so an AI feature can be signed off in both.
Compliance mapped to the build
We map the system to the obligations that apply to it, control by control, so legal and security teams review a document rather than reverse-engineer the code. We are engineers, not your counsel, and we say so.
PDPL and NCA obligations mapped to residency, records, notification and processor terms in the build.
Data residency and model-provider exposure settled in architecture
Where data lives, which model providers see which fields, and what stays in-region are decisions made in the architecture phase with options costed, not discovered in procurement.
In-Kingdom and in-country hosting, sovereign cloud where required, and a documented list of anything that leaves, including model calls.
Human oversight for consequential decisions
Approval steps, confidence thresholds and human review queues are built into workflows that touch money, eligibility, health or employment, with logs that show who approved what.
Approval steps and review queues for decisions that touch customers, eligibility or funds, with the five-year record kept by design.
Portability and cost control by design
Model-portable interfaces, cost budgets per feature and monitoring from day one, so a provider change or a price change is a configuration decision rather than a rebuild.
Provider-portable design so a regional model or hosting change does not force a rebuild.
Only the services and AI solutions we run in production are listed. Anything outside this catalogue is not something we sell.
- Cloud & DevOpsWe make releases safer, infrastructure more observable, and product systems ready to scale.
- Custom Software DevelopmentWe design and build secure, scalable software around the way your business actually operates.
- Data EngineeringWe connect scattered business data into reliable pipelines, dashboards, and decision-ready intelligence.
- Technology ConsultingWe help leaders make practical product and architecture decisions before costly build, migration, or AI investments begin.
- Computer VisionUse visual data for inspection, classification, extraction, and operational decision support.
- Generative AIDesign assistants, content workflows, knowledge tools, and product features powered by generative models.
- MLOpsDeploy, monitor, evaluate, and improve AI models after launch.
- NLPExtract meaning from text, classify language, summarize information, and automate document-heavy work.
- RAG SystemsCreate retrieval-augmented search and answer systems over private documents and business knowledge.
Sectors we serve hereFinTech · Insurance · Logistics · Manufacturing · Real Estate
- Almost a full day of overlapNoida is 1.5 to 2.5 hours ahead of the Gulf, so stand-ups, reviews and incident response happen inside your working day. On-site presence for discovery and launches is arranged as needed.
- Residency settled before the estimateDiscovery maps every data flow, names what must stay in-country, and prices the hosting options, so the proposal is compliant rather than corrected later.
- Bilingual by designArabic and English interfaces, right-to-left layouts and evaluation of AI behaviour in both languages are part of scope, not a localisation pass at the end.
- Procurement-ready documentationArchitecture, controls, processing records and evaluation results are delivered as documents your compliance office and your regulator can review.
Yes. We design for the Saudi and UAE regions of the major clouds and for sovereign or private infrastructure where a sector requires it, and we document any model-provider call that would leave the country so it can be approved or replaced.
Building for Middle East? Let's take it to production.
Share your product, AI, workflow, or data challenge. We will help identify the right starting point, delivery risks, scope, timeline, and next step.
Book a Project CallOr email sales@ilytixservices.com