THE AI EVIDENCE REVIEW · FOR ORGANISATIONS
Know what your AI does, and show it.
For organisations that use or build AI, agents included. Start from what you say you have, then check the evidence.
- 6 to 8 weeks
- six weekly sessions
- about 14.5 hours of your team's time
Who it is for
Banks and financial institutions under SAMA supervision, healthcare providers and hospital groups, and companies building AI on clinical data, insurers, public entities and government-adjacent bodies, large data processors, AI vendors that sell to them, and the Saudi arm of an international group.
What usually goes wrong
Nobody owns the model. Procurement bought it, IT hosts it, a business unit uses it, and no one approves changes to it.
The vendor's assurances are not verifiable. Accuracy figures with no definition, fairness claims with no measurement, and contract terms that leave the exposure with you.
Security is mistaken for governance. Infrastructure controls are in place, so the organisation believes the AI question is handled. It is a different question.
AI is running where nobody calls it AI. Scoring, triage and eligibility tools that pre-date the term, and that no inventory lists.
Nobody can show where the data came from. The AI was built on public, licensed and customer data, and no one holds a record of what each source allows.
The six sessions
Map.
Every AI system in use or planned, including agents and AI inside tools you already own.
Which rules reach you, and in what role.
Accountability (on paper).
Who answers for each system: owners, registers, contracts, risk files, documentation.
Data.
What personal data goes in, on what basis, who can ask for it back, where it travels.
The model and its supplier.
What it was trained on, on what right, and tested for what; how it can be unfair or fail; what the supplier shows; what happens when it changes.
Control in daily use (in practice).
Who supervises each system, with what authority; what an agent may do alone; what users are told.
Security and sector rules.
Cloud and access, incidents, and the rules of your sector.
You receive
An evidence position, control by control
A register of who answers for each AI decision
A prioritised plan, one owner per action
A summary for a board, a buyer or a regulator
Buying AI, not building it
If you deploy third-party systems, the obligations still land on you. We assess what your suppliers can evidence against the rules that bind your organisation, and turn the result into terms you can hold them to.
FAQ
No. It is an assessment of the evidence behind your AI. It is not a certification or an accreditation, and it binds no authority.
We examine the documents, technical records and live demonstrations you provide. Where a check has to run on your data, we define it and it runs in your environment, either by your team with us watching or by us in a session you attend. We assess the outputs. Sensitive evidence never leaves your environment.
Sensitive evidence is shown on screen and never leaves your environment.
Saudi Arabia and the European Union. Our control library covers the Saudi regime — PDPL, SDAIA and NCA, with sector rules where they apply — and the EU AI Act. Where a system falls under both, each obligation is scored against its own text rather than merged into a single rating. Other jurisdictions are added with local partners.
Each obligation is read from the text by a Paris Bar–qualified specialist in technology and data law, who then judges the evidence against it. The assessment is not a formal legal opinion and does not replace one: for an opinion under Saudi law, we work alongside locally licensed counsel, so you keep a single point of contact.
A list of the documents and demonstrations expected is sent a week before each session. Pieces are due 48 hours before the session.
No. SDAIA's AI ethics badges are voluntary and are awarded by SDAIA alone, on your own application. We can help you prepare for the self-assessment that comes with it; that is a separate service, on quotation. An assessment from us is not a certification.
Start with a conversation.
Tell us about your AI. We reply with a scope and next steps within two business days.
Request an assessment