For this article, we talked to Dr. Shaista Hussain from Saudi Arabia, Founder & CEO of SAIF CHECK, our partner company Q has recently started collaborating with in the field of AI risk assessment, compliance and model evaluations. With Dr. Shaista’s expertise in AI cybersecurity, agentic AI evaluations, API, and quantum AI security, rich experience, and daily work with her organisation facing these challenges, we got a practical insight into what is often lost in theoretical discussions: how this topic looks like in a real business environment.
Dr. Shai’s answers served as an excellent foundation for this blog post. Through this interview, our goal was to open up space for concrete answers, real-world problem solutions and decisions that companies have to make today.
1. Why AI compliance is becoming a strategic business challenge in Saudi Arabia right now
This year, 2026, has been declared as the Year of AI in Saudi Arabia, and that means that AI services are recognised as integral parts of working systems and evolving rapidly, but with governance and licensing requirements.
Adopting new technologies during this digitisation era comes with technical and legal challenges that must be overcome with knowledge acquisition and upskilling.
To guide this process, SDAIA (Saudi Data and AI Authority) as a regulatory agency, is enforcing the PDPL (Personal Data Protection Law) and is layering it with other data management and ethical practices that establish a foundation for data, model accountability, transparency, human-in-the-loop decision making and risk management. This adds another challenge of requiring companies to shift towards high-level enterprise-grade systems to process big data, meet the goals of Vision 2030 and subscribe to all regulatory requirements.
This is all happening so quickly, that the digitisation efforts are happening in tandem with rapidly growing AI technologies being adopted by the stronger competitors in the market, e.g. those embracing agentic systems over legacy AI are likely seeing increased workflow efficiency but also occult and unknown festering risks.
SAIF CHECK’s work with enterprise companies in the GCC has consistently shown that most AI users and product owners are largely unaware of neither the risks nor the compliance requirements, despite a reported 98% of Saudi public sector workers having adopted AI tools into daily use.
At the organisational level, there remains a gap in the knowledge and implementation of essential new practices like audit logs and trails, how to accurately classify data, incident response management and risk aversion pre- and post- deployment.
For AI companies supplying services to government entities, AI governance controls are requirements and this changes the traditional approach of software integration into work systems. So to win contracts, avoid penalties and fines, compliance with governance frameworks have been rapidly initiated into the corporate system.
2. Biggest misconceptions about Generative AI compliance
In my experience, the commonest, most worrisome misconception is that having a draft or template policy churned out by a GPT makes a company compliant and safe. It doesn’t. Policies and protocols are instruction booklets that should be custom designed for each company and be part of ongoing staff training to be implemented in daily operations.
Another huge misconception is that relying on brand-name products indemnifies people and organisations from safety and security practices; ie. “We use Microsoft Co-Pilot,” or “We built all our customer facing apps on ChatGPT, so we are protected and anything that goes wrong is their fault not ours.”
But in reality, corporate accountability includes selecting 3rd party models, and determining the safe flow of data, particularly PII (personal identifying information) and sensitive information. And off-the-shelf models are not vetted for regional and often even industrial compliance standards.
Without a SAIF CHECK risk assessment, enterprises often miss how these tools interact with their unique datasets, and falsely cover staggering gaps in security, leading to ‘Shadow AI’ complications, where employees use unauthorised tools that leak proprietary data into the public domain.
Other areas of lack of knowledge that lead to misconceptions include the inevitable drift of AI models, the changing nature of integrations and APIs, and the frequency of compliance requirements per model iterations.
When we describe our services, many people wonder why we have integrated compliance with AI cybersecurity and data/model evals and the reason is simple – they are all connected to oversight, accountability and responsibility, particularly in the data realm.
3. Saudi regulations, frameworks, and authorities enterprise leaders should be paying attention to
The most important and mandatory authority frameworks are:
1. SDAIA: for PDPL, AI Adoption Framework and the upcoming Responsible AI policy
2. NCA (National Cybersecurity Authority): for Essential Cybersecurity Controls (ECC) and Critical Systems
3. NDMO (National Data Management Office): for proper data classification, lifecycle and sovereignty
SAIF CHECK monitors all these frameworks and the ISO42001 and NIST RMF which are becoming the de facto compliance markers in the region.
4. How AI governance in Saudi Arabia differs from Europe or the US
Around the world, different regions are rolling out governance in different ways, and the approach in Saudi Arabia is, in my opinion, the most logical and practical approach. In Europe, the AI Act has set the stage for regional governance through laws and penalties, while the Americans have both state-specific legislation as well as a changing landscape from the Federal mandates that largely consider corporate giants. Saudi Arabia is more focused on integrating digital governance into the commercial practice, while considering cultural values.
Another differentiator for the Kingdom is the ambition and pace of roll-out. The authorities are both adopting and regulating AI, setting the benchmark for other companies to follow. This also means that the government system actually understands how regulations impact AI operations, because they are actively using the technology.
SAIF CHECK’s selection of frameworks is principle-based and flexible to adapt as Saudi regulations evolve.
5. Biggest compliance risks when deploying LLMs or Generative AI tools internally
The architectural nature of Language Models and Generative AI is different from other AI systems, and therefore the knowledge base retrieval process and the data output processes inherently carry their own set of unique risks, particularly in data compliance.
The biggest risk is in adversarial attacks through prompt injections which can give bad actors access to databases that often host personal information like names, financial information, business strategies, confidential contracts and the prompts can not only access this but also manipulate it to affect hosted data and the data output from the models. SAIF CHECK’ Top 8 Attack Vectors publication identifies the specific ways AI systems are targeted: prompt injection, data poisoning, model inversion, and adversarial inputs.
In this same field, hallucination outputs that sound articulate but carry false-information create a data risk. This is why SAIF CHECK’s Data Quality and Security as well as the LLM-specific evals are crucial, as the enterprises using the AI systems are accountable, not vendors or 3rd party suppliers.
Other risks are revealed as models degrade, algorithms carry developmental biases, and data leakage or shadow AI threatens data security and compliance. Finally, there is the AI agent risk dimension. As organisations have started using chatbots and now autonomous AI agents that take actions, the compliance and liability surface has expanded. AI security posture is a different species from traditional IT security which is simply not adequate to cover the scope of safety and security in AI systems.
6. What responsible AI actually means in practice for enterprise organisations
Responsible AI is an umbrella term that covers human-centric, data-centric, explainability, transparency, accountability, end-user fairness and safety and product security.
It involves having clear, operationalised policies associated with tool inventory and clearly defined roles and responsibilities. From a data-centric perspective it heavily focuses on “Bias in-Bias out” management, and from a human-centric perspective it includes reinforcement learning, human oversight and humans-in-the loop.
Transparency means that end-users are clearly informed about the extent of the capabilities of an AI tool, and explainability is the process of revealing black box logic to end-users of the tools.
Management responsibilities include risk-tiering the AI systems, and ensuring comprehensive documentation of activities, features, operations and 3rd party / API contracts.
For engineers, the responsibility should also include evaluations of drift and malicious interference, and having a service provider to support incident responses, such as SAIF CHECK’s War Room that assists users through the remediation of adversarial mitigation and SAIF CHECK’s Responsible AI (tech due diligence) assessment.
7. What enterprises should assess before allowing employees to use public AI tools
This is a topic of heavy importance, especially as AI adoption is becoming mainstream. There should be organised assessments occurring at scheduled intervals to keep companies safe from these off-the-shelf tools, namely, continuous monitoring.
Firstly, before adopting these tools into a workspace, a designated and accountable individual should be examining the data pipeline of the tools and make an executive decision about if company data can afford to be pushed through these tunnels or not; if PII is collected, then the answer is rather clear and 3rd party tools should not be used, and data packets should be classified into role-based-access categories.
If vendors are to be used, then finely worded contracts and guardrails should be implemented to ensure PDPL compliance.
Secondly, there should be some explainability of models with a final acceptance step from the human-end user to verify model outputs. These processes will require staff training and this should be occurring internally, frequently.
Thirdly, activities should be logged and recorded for audit trails, such that if an incident occurs, there are breadcrumbs to trace back to source; which is closely linked to the fourth recommendation which is to ensure a process of incident response.
8. Industries in Saudi Arabia under the most pressure to establish AI governance
Infrastructure critical domain workspaces are under the most pressure, particularly because compliance is multi-lateral.
For example, in healthcare there are now tech regulations as well as legacy HIPAA and other such governance models; in finance there are SAMA and international governance models that now intersect with the tech requirements; in retail there are specific NCA, GDPR, SOC2, transaction and now tech based regulations.
9. Most common gaps in enterprise AI readiness today
In our experience, there are three commonly occurring gaps.
Firstly, typically there is no responsible individual monitoring or taking inventory of AI tools being used and by whom.
Secondly, there are few organisations that have appropriate policies and fewer that actually implement the policies.
Thirdly, and this is so important for us, there are almost no companies opting to do responsible assessments for bias or fairness. It is remarkable to think that product owners are just ignoring such a crucial part of their customer-facing tools.
Another huge mistake that happens so often is that IT and legal teams are managing AI safety and governance, where neither have training in managing AI systems and ultimately there is no continuous monitoring of these specific systems. Finally, there is a skills and capability gap, where training seems to focus on how to use AI rather than how to use it safely and responsibly.
10. Balancing innovation speed with regulatory and security requirements
Organisations should include responsible AI into the ideation phase and continue threading it throughout the MLOPs development process. This prevents having to backstep to correct previous model iterations.
Beta testing with a select group of controlled users or in sandboxes is another way to build and stay in the know regarding compliance. Most companies are in a rush to start the races, to deploy without understanding what they are publishing and without knowing about the regulatory and other consequences of unvetted models. And since every model has a unique set of risks, tiering the risk levels of each model is super important.
The partnership between SAIF CHECK and Q agency, announced May 2026, directly addresses this balance. Combining SAIF CHECK’s governance and compliance expertise with Q’s end-to-end AI delivery capability can help clients to build fast and build right simultaneously.
11. What a strong enterprise AI governance model looks like in practice
- Filing Cabinet: catalogued inventory of all AI tools and all AI activities
- Rule Books: enforceable policies and protocols that are directly mapped to roles with clearly defined responsibilities, accountability and regulatory compliance
- Documentation: audit logs and trails, incident response integrations, user level access to classified data systems
- Structure: having appointed individuals to manage human oversight and end-user interaction with AI systems, including training and incident response protocols
- Monitoring: security monitoring, pen testing, vendor risk assessments at scheduled intervals
12. Advice for CEOs and CIOs planning their first large-scale Generative AI initiatives in the Gulf
Pace yourself and know the playing field. Don’t rush to deploy systems that you don’t understand and for which you cannot act as commander. Educate yourself on these systems and their risks. Employ service providers to guide you through safe and responsible development. Have accountability infrastructure established before jumping into product development. Nominate someone and study regulatory requirements like PDPL, and invest in people – train staff regularly on safe use and practices with AI systems.
Before choosing a solution, define the problem and the data available, then think about what solution is best. Enable continuous monitoring, the adversarial landscape is evolving rapidly and in unseen blind spots that can tear down walls with one access point.
Give Kudos by sharing the post!
ABOUT AUTHOR
Shaista Hussain
Founder & CEO of SAIF CHECK
