Is the CST awareness guide binding on my company?

No. The guide states explicitly that it is advisory and non-binding, and does not replace or cancel any laws, regulations, or regulatory decisions issued by the Commission or other competent authorities. Your company remains responsible for complying with applicable laws such as the Personal Data Protection Law, but the guide is useful as a working framework even though it is not mandatory.

What are the five readiness dimensions the guide asks you to assess?

Context readiness, data readiness, infrastructure readiness, skills and expertise readiness, and organizational culture readiness. The purpose of the assessment is to identify suitable initiatives, the scope of expansion needed, the core gaps, and the priority order for closing them — before any budget is spent.

Where should I start applying AI in my company?

With internal operations. The guide describes them as the fastest and lowest-risk path to value, because mistakes never reach the customer. Customer-facing solutions allow greater differentiation but require higher maturity, and AI agents should start with restricted permissions and human oversight, expanding as performance reliability is proven.

What should I watch for specifically as a Saudi company?

Three things: data sovereignty — where data is stored and the rules for transferring it outside the Kingdom; the level of Arabic language support in any customer-facing use case; and inference cost, meaning the cost of running the model per operation, because it becomes a material operating line item at scale.

CST's AI Adoption Guide for Tech Companies: What It Means for Your Business

The Communications, Space and Technology Commission (CST) released the first edition of its Awareness Guide for AI Adoption in Technology Companies in July 2026. The guide is advisory and non-binding, and it does not replace any existing law or regulation. What it does provide is something the Saudi market was missing: an official, shared framework for how a company moves from scattered AI experiments to structured adoption that produces measurable value. It targets technology companies of every size, from startups to large enterprises, and it lands alongside the Council of Ministers designating 2026 as the Year of Artificial Intelligence.

The core idea: adoption is an organizational capability, not a toolset

The guide's first message is its clearest: treat AI as a core component of your business model's institutional architecture, not as a set of technical tools bolted on at the edges. That distinction is not semantic. A company that treats AI as a tool buys a subscription and waits for results. A company that treats it as a capability reorganizes its data, workflows, permissions, and skills around it.

The guide also records an observation worth pausing on: even as experimentation has spread widely, sustainable and scalable value remains largely confined to organizations that adopt structured operating models rather than stopping at pilot projects. In other words, the gap today is no longer access to models. It is the ability to run them inside the organization.

The five readiness dimensions: where to actually start

Adoption begins with an institutional readiness assessment across five interconnected dimensions, as the guide sets them out:

Context readiness: do you know where AI makes a real difference in your specific business, or are you copying use cases from companies that look nothing like you?
Data readiness: is your data present, clean, structured, and accessible, or spread across spreadsheets, files, and people's heads?
Infrastructure readiness: do you have a runtime, integration layer, and logging that allow deployment and monitoring, or is every experiment a separate project starting from zero?
Skills and expertise readiness: who is able to evaluate and correct the output, not merely operate it?
Organizational culture readiness: does the team trust the tool and use it in daily work, or treat it as a threat or a decoration?

The guide stresses that AI literacy is a key enabling factor at both leadership and operational levels. The practical benefit of this assessment is that it shifts the question from "which model do we use?" to "which gap do we close first?" — a cheaper and far more accurate question.

The AI-first principle: strategy before tools

The guide proposes an operating principle built on "AI first," whose essence is that defining strategy precedes selecting technical tools. In practice that means settling three things before signing any subscription: where AI delivers a measurable advantage, where your proprietary data creates a competitive edge that is hard for others to match, and what level of autonomy is acceptable in each use case.

Here is a point many miss: sustainable advantage rarely arises from mere access to models, because everyone has that access. It arises from the specific context a company owns, its embedded workflows, customer behaviour and feedback, and continuous feedback loops. The model is a commodity available to everyone. Your data and your operations are not.

Three application areas, each with a different maturity bar

The guide divides application into three areas, and orders them in a way that deserves respect:

Internal operations: usually the fastest and lowest-risk path to the intended value. A mistake here costs you internal time, not reputation.
Customer-facing solutions: greater opportunity for market differentiation, but they demand higher maturity because they are customer-visible, directly affect trust, and carry regulatory sensitivity.
AI agents: an advanced execution model. The guide advises starting gradually with restricted permissions and human oversight, expanding based on how reliable and safe performance proves to be.

That ordering matches what we recommend in practice when building any system: start where mistakes are cheap, and move to the customer-facing layer only after reliability is proven internally.

Build, partner, or acquire?

The guide presents a build-partner-acquire decision framework and ties it to a deeper issue: the risk of dependence on a narrow set of vendors. Its recommendation is to address that with a modular, flexible, decomposable technical architecture backed by contractual clarity, so you can replace one layer without dismantling the stack. It adds an element most feasibility studies omit: inference economics — the cost of running the model per operation — treated as a material driver of operating cost rather than a footnote.

It then recommends phased execution: readiness verification, then governed experiments, then enterprise integration, then continuous improvement.

Governance as a risk-based operating model

The section we hope gets read carefully is governance. The guide describes it as a risk-based operating model that begins with discipline in selecting use cases, not with controls imposed after deployment. Insufficiently governed AI systems can lead to legal, financial, and reputational risk.

Crucially, governance should be proportionate to risk level: expected impact, degree of autonomy, sensitivity of the data, and level of effect on customers. An internal assistant that summarizes meetings does not need what an agent issuing credit decisions needs.

The Saudi dimension: data, Arabic, and sovereignty

The guide warns that companies in the Kingdom should not rely on global indicators and trends alone when planning. They must align with local regulations, data governance requirements, and considerations around data sovereignty and cross-border transfer. It adds a very practical point: verify the level of Arabic language support in customer-facing use cases.

This is not a cosmetic detail. The difference between a model that understands Saudi dialect in a customer service conversation and one that translates literally is the difference between a served customer and an angry one. Likewise, "where is your data stored?" comes before "which model is smarter?" whenever the data is personal and subject to the Personal Data Protection Law.

Where to start this week

If we compressed the guide into steps you would actually execute: assess your readiness honestly across the five dimensions and score each one; pick a single internal use case with measurable impact and low risk; set a numeric target for it before you start rather than after; run it with human oversight and full logging of output; then expand once the numbers hold. The companies earning a return on AI in Saudi Arabia today are not the ones spending most — they are the ones most disciplined about which problem they picked.

Sources

Communications, Space and Technology Commission — Awareness Guide for AI Adoption in Technology Companies, First Edition, July 2026: cst.gov.sa/ai-adoption-guide-ar
Communications, Space and Technology Commission: cst.gov.sa
Saudi Data and AI Authority (SDAIA) — Personal Data Protection Law: sdaia.gov.sa

CST's AI Adoption Guide for Tech Companies: What It Means for Your Business