What an NCA checklist doesn't cover

Ask a Saudi organisation how it handles AI compliance and the answer is usually the same: we have a checklist for the NCA, and our data stays inside the environment. Both are true, both matter, and neither says anything about the model.

The National Cybersecurity Authority's frameworks, the Essential Cybersecurity Controls and their extensions for cloud, critical systems and data, govern the environment a system runs in. Access control, segmentation, encryption, logging infrastructure, incident response. For an air-gapped deployment handling sensitive data, that work is the difference between a system that can be operated and one that cannot. The NCA has also published a baseline for private-sector entities that are not critical infrastructure (NCNICC-1:2025). It applies to the entities the NCA notifies, so more organisations may now be in scope, and doing this work, than before.

What NCA controls do, and what they don't ask

What those controls do not ask is whether the model works, for whom, and whether anyone could show it.

Five questions sit outside the perimeter.

Five questions outside the perimeter

Is the output explainable? A clinician, a credit officer or an HR manager acting on a model's recommendation needs to know what drove it. A perfectly secured system can still be a black box to the person held responsible for the decision.

Does it perform equally across the population it serves? A model trained predominantly on one group and deployed across another will underperform for the second, quietly. No security control detects this. It surfaces as a complaint, a regulator's question, or a harmed individual.

Is there real human oversight? Not a signature field, but a person with the information, the authority and the time to overrule the system. Oversight that cannot be exercised is oversight on paper.

Can the decision be reconstructed? Security logging records access. It does not record which model version, which prompt and which data produced a given output six months ago, which is what an investigation actually needs.

Is anyone watching for drift? Models degrade as the world moves. Nothing in a cybersecurity framework asks when performance was last measured in production.

Where the risk actually sits

These are not gaps in the NCA's frameworks. They are outside their subject: the NCA governs cybersecurity, and SDAIA's ethics and governance expectations, the PDPL, and the sector regulators cover the rest. The risk is organisational: a company that has done its security work well can reasonably believe it has done its AI work, because no one has asked it a question it could not answer.

That changes the moment a hospital, a bank or a ministry sends a procurement questionnaire with a section on model validation. Or when an investor asks how bias was tested. Or when a system produces an output someone contests.

The bottom line

Infrastructure controls tell you the environment is sound. They do not tell you the system inside it is defensible. Those are separate pieces of work, and only one of them is usually done.

Oxon X maps the frameworks (NCA, SDAIA, PDPL and sector regulators) that actually reach your AI systems, so security work and model work are done together, not in silos.