Who this is for
- Founders and scale-ups in Riyadh, Jeddah and the Eastern Province who need senior technical leadership.
- Enterprises and family groups modernising core systems and setting an AI strategy.
- Regional companies expanding between Saudi Arabia, the UAE and the wider GCC.
- Investors backing Saudi technology companies.
What shapes technology decisions in Saudi Arabia
The Personal Data Protection Law has been enforceable since September 2024, administered by the Saudi Data and AI Authority13. Transfers of personal data outside the Kingdom need an appropriate basis and safeguards, such as standard contractual clauses, with risk assessments required in some cases2. For AI systems that often call hosted models abroad, the design question is what data leaves the country, and whether it needs to.
| Rule or standard | Who it touches | What it means for architecture |
|---|---|---|
| PDPL | Organisations processing personal data in the Kingdom | Data mapping, lawful basis, retention and data subject rights designed into platforms |
| Transfer regulations | Anyone sending personal data abroad, including to AI APIs | In-country processing for sensitive data, minimisation and documented transfer safeguards |
| Arabic-first users | Customer-facing products | Bilingual retrieval, Arabic normalisation and per-language evaluation |
Related reading: Saudi PDPL and cross-border AI, a bilingual Arabic and English assistant and private LLMs on-prem.
Typical first projects
- An AI strategy and architecture review grounded in PDPL and transfer rules.
- Arabic and English knowledge assistants with citations and in-country hosting.
- Platform modernisation with cloud, data and security foundations.
- Technical due diligence for investors.
Time zones
Riyadh is one hour behind the UAE, so Saudi teams share my full working day, including the Sunday to Thursday week where needed.
How engagements work
- Architecture and AI readiness review (2 to 4 weeks): a clear picture of the current platform, risks and a prioritised roadmap.
- Fractional CTO (ongoing, part-time): technical strategy, architecture governance, hiring and board-level communication.
- Build and hand-off: hands-on delivery of a platform or AI capability, documented so your team can run it.
- Technical due diligence: an independent view of a target's technology for investors and acquirers.
Every engagement starts with a free 30-minute call. See how I work for the full process.
- 1
- 2A close-up on Saudi Arabia's personal data transfer regulationsAl Tamimi & Company
- 3