AI Agent Development Company in Riyadh

The number follows what you actually build: a scoped agent proof of concept at Riyadh rates, a production banking, government, or PIF mega-project agent, or full agent platforms with multi-agent orchestration, ALLaM fine-tuning, and Sharia-screening hooks. Scope drivers include tool-use design, an ALLaM or Claude baseline agent, and Arabic-first prompt scaffolding. Riyadh rates sit above Cairo and Amman because of the HUMAIN and SDAIA talent premium and in-Kingdom-residency operational cost.

Saudi Arabia\'s Personal Data Protection Law took full effect on 14 September 2024 under SDAIA enforcement. It mirrors GDPR in many respects (lawful basis, consent, data subject rights, breach notification within 72 hours) but adds Saudi-specific provisions on cross-border transfer, with SDAIA approval required for outbound personal data flows. Our discovery phase runs a PDPL classification, identifies sensitive categories (health, biometric, genetic, religious belief), maps every cross-border hop, and produces a Transfer Impact Assessment for any non-KSA inference call. Citizen agents and SAMA-regulated banking agents are kept fully in-Kingdom on AWS me-central-2 or local Google Cloud Dammam. We document Article 18 data-subject-rights handling so SDAIA inspections have a clear answer.

Yes. HUMAIN, launched by the Public Investment Fund in 2025, provides the sovereign AI infrastructure layer for Saudi enterprise, and ALLaM is SDAIA\'s production Arabic LLM with Najdi, Hijazi, and MSA coverage. We integrate against HUMAIN\'s LLM endpoints for PIF-affiliated clients (NEOM, Red Sea Global, Diriyah Gateway, Qiddiya, ROSHN) and route Arabic-first agent workflows through ALLaM for MOH, MCI, and other Vision 2030 ministries. We have patterned deployments against published HUMAIN reference architecture, including ECC Level 3 controls, NCA-aligned key management, and a PDPL data-flow audit. When ALLaM coverage is incomplete (rare-domain jargon, code-mixed Arabic-English), we fine-tune in a HUMAIN-hosted environment and keep weights inside KSA.

Riyadh users overwhelmingly type and speak in Najdi dialect, with code-mixed English for tech vocabulary. Modern Standard Arabic-only agents fail conversational tests inside the first two turns. We prompt-engineer ALLaM, Claude, and GPT-4o with Najdi vocabulary primers, run conversational evaluation sets sourced from Saudi user transcripts, and add code-switching detection so the agent does not lecture users for mixing English. UX is right-to-left with proper Arabic typography (correct kashida, no Latin-numeral substitution unless the user types Latin numerals), Hijri-calendar awareness for Ramadan and Eid timing, and prayer-time pauses for synchronous voice agents during the five daily prayers. We test with KSA-native reviewers, not Levantine or North African Arabic speakers, because dialect mismatches alone tank user trust.

SAMA\'s Cyber Security Framework applies to all SAMA-regulated banks, insurers, and finance companies and is reviewed annually against a four-tier maturity model. Our banking-agent engagements produce SAMA CSF control mappings (governance, asset management, identity and access, cryptography, application security, third-party security, business continuity, incident management), challenger-model testing for any agent that touches credit, AML, or fraud, and full logging to the bank\'s SIEM. We coordinate with the bank\'s internal SAMA-compliance team on agent design before code is written and stay inside AWS me-central-2 Dammam for inference. Agents touching customer money or instructions always have a human-in-the-loop gate, not autonomous execution.

We default to AWS me-central-2 (Dammam, launched 2024, three availability zones) for storage, inference, and orchestration, and Google Cloud\'s Dammam region for clients on GCP. NCA\'s Cloud Computing Regulatory Framework classifies workloads into four tiers — we keep Level 3 (regulated and sensitive government and financial data) inside KSA without exception, and Level 2 inside KSA by default unless a documented business need and SDAIA-cleared TIA say otherwise. For ALLaM and HUMAIN endpoints, inference is already in-Kingdom. Cross-border calls to Anthropic, OpenAI, or Cohere are only used when PDPL Transfer Impact Assessment signs off, typically for non-sensitive internal tooling. The data processing agreement documents every region in Arabic and English.

A typical Riyadh production agent (SAMA-regulated banking flow, Vision 2030 citizen service, NEOM construction-coordination) takes sixteen to twenty-four weeks from kickoff, assuming clean historical data and SAMA CSF or ECC documentation in scope. Week 1 to 4 is PDPL classification, NCA control mapping, and Arabic-first prompt scaffolding. Week 5 to 12 is agent design, tool-use, evaluation harness, and Najdi-dialect tuning. Week 13 to 18 is integration (Nafath, Absher, core banking, ERP), Sharia-screening hooks, and red-team testing. Week 19 onward is shadow-mode pilot then gradual rollout. If you need Hajj-season readiness, we shift the timeline so production hand-off lands four weeks before Ramadan.

Yes. We have patterned integrations against the published National Information Centre and Ministry of Interior interfaces for Absher, the NIC\'s Tawakkalna SDK for health and government services, MOH\'s Sehhaty APIs for healthcare-citizen flows, and the Ministry of Hajj and Umrah\'s Nusuk platform for pilgrim-permit workflows. Identity flows through Nafath single sign-on with biometric step-up where required. Citizen agents are kept inside AWS me-central-2 Dammam, log every inference to a SDAIA-inspectable audit store in Arabic and English, and route any decision that affects a citizen right (permit grant, health-record access, immigration status) through a human reviewer. Hajj-season agents are stress-tested for the Dhul Hijjah pilgrimage spike.