Why in the Kingdom

The Personal Data Protection Law, supervised by the Saudi Data and AI Authority (SDAIA), makes sending personal data outside the Kingdom a restricted, documented decision. Government entities and regulated sectors often require data and models to stay in-country. When the model runs inside your premises, nothing calls an outside service, so cross-border questions do not arise in the first place. SDAIA’s October 2026 draft amendments go further and add an express requirement to store personal data in the Kingdom: what the draft means for AI.

The Kingdom's dialects, not only formal Arabic

General models read formal Arabic well and stumble on how people actually write. Orchestra is trained on Arabic with a tokenizer designed for it, and understands Najdi and Hijazi within Gulf Arabic, alongside Modern Standard, Egyptian and Levantine.

The rules at a glance

  • Personal Data Protection Law: fully enforceable since 14 September 2024. Sending personal data outside the Kingdom, including prompts sent to a cloud API abroad, is a restricted, documented decision.
  • Draft amendments, Article 23(2): an express requirement to store personal data in the Kingdom. A draft, open for comment on Istitlaa until 5 November 2026.
  • Draft, Article 25: a mandatory impact assessment where processing results in automated decisions affecting individuals, which can apply to AI agents that take actions.
  • Draft, Article 24: breach notification within 72 hours in every case, which needs full logs of what the system saw and did.

A summary of public sources, not legal advice. Check the official texts and your legal counsel before acting. Details and sources: Saudi AI and data rules in 2026, and what SDAIA's draft means for AI.

What we deploy

NoorAI deploys a complete stack that you own: Orchestra, our 14-billion-parameter Arabic-native language model trained in-house, a low-code agent platform wired into your systems, and the engineers who deploy and run it with you. We work in the Kingdom through partners in Riyadh, with our engineers in Cairo.

By sector: banking, government, healthcare and telecom.

Where it runs

  • Inside your data centre, air-gapped when you need it.
  • In a private cloud you own or rent in-country.
  • In a dedicated VPC with an in-country provider.

How we start

We start with a short Discover phase: the use case, the data and the regulatory requirements, with pass criteria agreed before anything is bought. Then Deploy with a parallel run, then Operate with monthly support.

Frequently asked questions

Does any data leave the Kingdom?

No. The model, retrieval and logs run inside your environment in the Kingdom, and can run fully air-gapped.

Does it understand Najdi and Hijazi?

Yes. Orchestra is trained on Gulf dialects, Najdi and Hijazi included, both for understanding and for replying.

Do you have a presence in the Kingdom?

We work in the Kingdom through partners in Riyadh, with our headquarters and engineering team in Cairo. Our engineers work on site during deployment.