How to Choose a SAMA-Compliant AI Platform in 2026

A practical checklist for banks and financial institutions in Saudi Arabia evaluating AI vendors against SAMA, NDMO and PDPL requirements.

For a bank or financial institution operating in the Kingdom, an AI platform is not just a customer-experience decision, it is a regulatory one. Before any procurement, decision makers run the same searches: which vendors actually meet SAMA, NDMO and PDPL requirements? This checklist is designed to cut through vendor marketing.

1. Start with data residency

The first question is physical: where does customer data live, and where is it processed? Generic AI platforms route data through servers in countries that do not respect Gulf data-residency laws. A SAMA-aligned posture means every byte stays inside national infrastructure, with no silent transfer to third-party model providers abroad.

2. Confirm compliance is architectural, not a label

Ask whether compliance was designed in from day one or added after the fact. The practical markers are concrete: DMZ isolation, PII scrubbing before any model sees the data, zero-log configuration options, and full audit trails on every automated action. If a vendor cannot describe these in technical detail, the 'compliant' claim is marketing.

• SAMA: cybersecurity and outsourcing requirements for banks and financial institutions.
• NDMO: data classification, residency and lifecycle management policies.
• PDPL (Law 45): consent, transparency and right-to-erasure for personal data.
• UAE NESA: critical-information-infrastructure protection for UAE entities.

3. Demand auditability of the action layer

In banking, what the AI does matters as much as what it says. Every action, such as a balance inquiry, a KYC step or a record update, must be logged, attributable and reviewable. Ask to see the audit interface, not a slide describing it.

4. Test the deployment model

Regulated institutions often need private, isolated or even on-premise / air-gapped deployment. Confirm the vendor supports the model your risk function requires, and ask for a realistic timeline. A mature platform moves a regulated client from contract to live deployment in roughly 4 to 8 weeks, with sandbox testing before anything touches production.

Compliance is your strongest moat. Treat the vendor's compliance posture as a feature you can verify, not a checkbox you accept.

5. Verify Arabic and channel coverage

Finally, the platform must serve customers the way they actually reach you: Arabic-first across WhatsApp Business, voice and web, with seamless code-switching. A compliant platform that cannot hold a natural Khaleeji conversation will still fail your customers.