AI TRUST & GOVERNANCE
You already owe the PDPL. Then AI arrived.
AI is arriving faster than the proof that it can be trusted.
We examine the evidence behind the AI you use or build, and give your leadership a clear position it can act on and show — in the Kingdom, and in Europe under the AI Act and the GDPR.
Can you show what personal data your systems touch, where it travels, and on what basis?
Do you know what your AI decides, and about whom?
If a regulator, a buyer or an investor asked you to prove either of those, could you?
Every organisation processing personal data in the Kingdom falls under the same law. See what the PDPL requires
For organisations
For organisations that use or build AI, agents included. Know what your AI does, and show it.
The AI Evidence Review · 6 to 8 weeks, six weekly sessions.
Discover the AI Evidence ReviewFor startups
Before the pilot, the tender or the round. A short, fixed-scope assessment of your AI product.
The Pre-Launch Review · Two weeks, about 6 hours of your team's time.
Discover the Pre-Launch ReviewHOW IT WORKS
Start from what you say you have. Then check the evidence.
Map
All your AI, including agents and AI inside tools you own.
Accountability
Owners, registers, contracts, risk files.
Personal data under the PDPL
Lawful basis, consent, requests from individuals, and where the data travels.
The model and its supplier
What it was trained on, on what right, and tested for what; what the supplier shows.
Control in daily use
Who supervises, with what authority; what an agent does alone.
Security and sector rules
Cloud, incidents, the rules of your sector.
153 checks, each with a written criterion for enough evidence.
Binding obligations and voluntary guidance are scored apart.
Each system is scored against the regimes it actually falls under. A good score on good practice never hides a gap in what the law requires. Every finding cites the text it rests on and the evidence behind it.
Binding obligations — Saudi regime shown
78 / 100
- Lawful basis and data principles
- Rights of individuals
- Transfers outside the Kingdom
- Records, data protection officer and impact assessments
- Contracts with processors and subcontractors
- Security and breach notification
- Sector and hosting rules, where they apply
Voluntary guidance
Reported on its own. Never added to the score.
- Fairness and bias measurement
- Explainability
- Robustness and drift monitoring
- Human oversight
- Transparency to users and for generated content
- Agent permissions and traceability
- AI risk management
Some of these points become binding depending on the system which is assessed (for example a high-risk system under the EU AI Act, or a medical device under SFDA rules in Saudi Arabia)
Illustrative, and not a client result. Both lists are extracts: they name the areas covered, not the full set of scored controls.
WHY OXON X
Legal rigour and technical depth, in one team.
| Aspect | Big 4 · large law firms | At Oxon X |
|---|---|---|
| Who does the work | A pyramid: you meet the seniors, juniors do the work | The experts you met, from first call to debrief |
| Law and technology | Separate teams or firms, with hand-offs between them | Both disciplines in one team, one conversation, no hand-offs |
| Proof | Interviews, questionnaires, a maturity score | Each answer checked against evidence; legal duties scored apart from good practice |
| Focus | AI as one practice among many | AI only: models, data flows, agents |
| Time and price | Open-ended scope, months to deliver | Fixed scope and price, weeks to deliver |
- An assessment, not a certification
- Documents, technical records and live demonstrations examined
- Sensitive evidence never leaves your environment
- Fixed scope and price
INSIGHTS
All insightsStart with a conversation.
Tell us about your AI. We reply with a scope and next steps within two business days.
Request an assessment