Saudi Arabia has built one of the most structured national AI programmes anywhere. The Saudi Data and AI Authority, SDAIA, was established in 2019 as the central authority for data and artificial intelligence, the National Strategy for Data and AI set the direction in line with Vision 2030, the Personal Data Protection Law brought data handling under formal regulation, and SDAIA has published AI ethics principles and guidance on generative AI for entities to follow. For a government or semi-government entity, the direction is clear. The question that remains is internal: is the organisation ready to deliver against it?

This checklist puts the national programme into seven questions an entity can answer honestly about itself.

1. Ownership and alignment with national direction

Who in the entity is accountable for AI, for its outcomes and risks as well as its technology? Readiness starts with a named owner, a governance forum that meets, and an AI policy that reflects SDAIA guidance rather than sitting apart from it. If AI decisions are made informally inside projects, the entity is adopting AI without governing it.

2. A clear view of current AI use

Can the entity list where AI is already in use, including capabilities embedded inside vendor platforms and national shared services? Most entities underestimate this. An inventory of AI systems, each with an owner and a purpose, is the foundation for everything else and usually the fastest gap to close.

3. Data foundations and the PDPL

AI performs at the level of the data beneath it, and in Saudi Arabia that data now sits under formal obligations. Readiness means knowing where critical data lives, who owns it, how it is classified against national data management standards, and how personal data is handled in line with the Personal Data Protection Law. Entities with mature data governance move quickly on AI. Entities without it accumulate pilots that never reach production.

4. Use cases tied to the mandate

A ready entity selects AI use cases from its mandate and its contribution to Vision 2030 programmes, not from what a vendor demonstrated last month. Each candidate use case should name the service it improves, the measure it moves and the risk it carries. A short, prioritised pipeline beats a long aspirational list.

5. People and capability

The national programme depends on people who can specify, challenge and operate AI, and on building that capability in national talent. That means literacy at leadership level, practitioner skills in the teams that deliver, and role clarity on who reviews AI decisions. Training plans count as readiness only when they are matched to named roles.

6. Ethics, risk and standards alignment

SDAIA’s AI ethics principles set risk based expectations for how AI treats the people it affects, and public entities carry those obligations most directly. A ready entity assesses the impact of each significant AI system, keeps humans accountable for consequential decisions, and aligns its practices with recognised standards. ISO/IEC 42001, the international standard for AI management systems, gives entities an auditable structure for exactly this, and it sits comfortably alongside SDAIA direction and the requirements entities already meet under their existing management systems.

7. Measurement and honest reporting

Finally, readiness shows in how the entity measures itself. Adoption counts, service improvements, incidents and model performance should reach the governance forum on a regular rhythm. An entity that can report honestly on its AI is an entity that can improve it.

Where to start

Few entities score well on all seven questions, and that is not the point. The point is knowing which gaps matter most for your mandate, so effort goes where it changes the outcome.