AI & Machine Learning Company in Riyadh

Three delivery shapes drive the range: a scoped AI proof of concept at Riyadh rates, a custom production ML model (SAMA-aligned fraud scoring, CMA market surveillance, Mada chargeback detection, Arabic document extraction), or full production AI systems with Arabic RAG on ALLaM or Jais, multiple models, fine-tuning, Absher or Tawakkalna integrations, and enterprise rollouts. Scope drivers include data audit, a baseline Arabic-capable model, and a hosted demo inside AWS me-central-2 Dammam or an approved KSA region. Riyadh rates carry a sovereignty premium because in-Kingdom GPU capacity, Arabic-fluent ML engineers, and NCA-cleared resources are scarcer than Dubai equivalents. We quote fixed fees in SAR with a milestone schedule, not open T and M.

Saudi Arabia's Personal Data Protection Law (PDPL) came into full implementation in September 2024 under NDMO and SDAIA enforcement. It governs consent, purpose limitation, data subject rights, breach notification within 72 hours, and Article 29 cross-border transfers, which broadly restrict moving Saudi personal data outside the Kingdom without an adequacy decision or contractual safeguards. For AI projects this means training datasets containing Saudi personal data should stay inside KSA regions (AWS me-central-2 Dammam, GCP me-central2 Dammam, or sovereign HUMAIN-aligned infrastructure), inference logs need configurable retention and erasure paths, and any model that produces decisions affecting individuals (credit, hiring, healthcare, insurance) requires a documented impact assessment. We run a PDPL gap analysis in discovery, classify data under CCRF tiers, and ship a controller-processor agreement plus a model card that NDMO and SDAIA assessors can read without supplementary clarifications.

Yes. We ship Arabic-first RAG systems, internal copilots, document extraction pipelines, and agent workflows on ALLaM (SDAIA's flagship Saudi Arabic model), Jais (G42-backed Arabic LLM), Falcon Arabic variants from TII, and Llama 3 or Qwen fine-tunes on Saudi-dialect corpora. For SAMA-regulated banks, CMA-regulated capital markets clients, and ministry workloads we stay inside KSA regions, apply NCA ECC controls, and produce the model risk documentation SAMA examiners and internal audit need under the SAMA Cyber Security Framework. Patterns include strict PII redaction with Arabic-aware tokenisation, prompt injection defences for Arabic and English dual-language attacks, human-in-the-loop review gates for high-impact decisions, and evaluation harnesses that test Modern Standard Arabic, Saudi dialect, and English performance before every production push. Output logs feed existing SIEM stacks and SAMA-aligned model risk platforms.

SDAIA's Cloud Computing Regulatory Framework defines four data classification tiers: Public, Internal, Confidential, and Top Secret. Each tier has different hosting, encryption, and cross-border rules. Our discovery phase runs a CCRF classification workshop with the client's data protection officer and NCA-aligned security lead, then maps every training dataset, inference input, and log stream to a tier. Public and Internal workloads can run in AWS me-central-2 Dammam, GCP me-central2, or an approved GCC region with documented controls. Confidential workloads stay in-Kingdom with KMS-backed encryption, network isolation, and access logging. Top Secret workloads run on sovereign HUMAIN-aligned or government-cleared infrastructure with no foreign vendor access to the data plane. The classification result is recorded in the model card and the architecture diagram, and we will refuse to deploy a workload to a region that breaches its tier.

When a project requires genuine Arabic NLP research, novel computer vision for Hajj or Aramco use cases, or reinforcement learning for energy and petrochemical optimisation, we scope collaborations with King Fahd University of Petroleum and Minerals (KFUPM) in Dhahran for energy AI, King Abdullah University of Science and Technology (KAUST) in Thuwal for foundational ML research, and SDAIA's National Centre for AI on Arabic language work. Our core team handles applied engineering, MLOps, and productionisation, which is where most Saudi AI initiatives actually stall. For standard work (Arabic RAG, fine-tuning ALLaM or Jais, classical ML, computer vision on known architectures) no academic partner is needed. We will tell you up front which bucket your problem fits into, and we have routed Riyadh clients to SDAIA's NEOM and HUMAIN programs when their roadmap and funding alignment fits.

AWS launched me-central-2 in Dammam in 2024, so Riyadh clients can now host training, inference, and storage in-Kingdom on AWS without falling back to Bahrain me-south-1. GCP me-central2 (Dammam, 2024) covers Google-stack accounts with the same in-Kingdom posture. Microsoft Azure Saudi Arabia is publicly planned, so Azure workloads run from UAE North today with a written migration commitment when the KSA region opens. HUMAIN is building sovereign GPU infrastructure under PIF backing, and we track its commercial availability for Confidential and Top Secret AI workloads. Hybrid architectures using AWS Outposts in client data centres, NEOM-hosted compute, and on-premises GPU clusters cover regulated cases where even AWS me-central-2 is not acceptable. Residency choices are documented in the model card, the PDPL controller-processor agreement, and the CCRF classification record.

A typical Riyadh fintech or SAMA-regulated bank model (Mada fraud scoring, Sharia-compliant credit decisioning, KYC document extraction with Arabic OCR, AML transaction monitoring against SAMA AML rules) takes sixteen to twenty-four weeks from kickoff to production, assuming clean historical data and SAMA Cyber Security Framework documentation as part of scope. Week 1 to 4 is data audit, PDPL impact assessment, and baseline modelling. Week 5 to 12 is iteration, challenger testing, and Sharia compliance review where applicable. Week 13 to 18 is MLOps, drift monitoring, shadow-mode deployment, NCA controls validation, and internal audit review. Week 19 onward is gradual rollout under SAMA notification rules. If you are pre-data or need Arabic-language labelling, add eight to ten weeks because Saudi-dialect annotation talent is scarcer than English. We have shipped to this cadence inside SAMA-regulated stacks from our Dubai office and Edmonton hub.

Saudi Arabia runs several AI funding and incentive programs. SDAIA's National Strategy for Data and AI (NSDAI) sponsors strategic projects, the Saudi Company for Artificial Intelligence (SCAI) operates as a PIF subsidiary funding sovereign AI, and HUMAIN deploys PIF capital into infrastructure and frontier model work. Vision 2030 sector roadmaps in tourism, mining, logistics, and entertainment carry separate procurement budgets where AI is a defined priority. The Ministry of Investment (MISA) offers Regional Headquarters incentives and tax holidays for multinationals anchoring AI capability in Riyadh, and MCIT runs grant programs for Saudi SMEs adopting AI. We deliver SDAIA-aligned project documentation, NSDAI strategic-pillar mapping, and ROI narratives suitable for PIF or sectoral grant submissions. Final eligibility and award sit with the funding authority and your government affairs counsel, but we have written the technical sections of multiple successful submissions.