Ting Guides · For the CEO
What should an AI readiness checklist cover for a Saudi company?
The short answer
Six things, each backed by evidence rather than a yes: a named owner and goal for the first use case, a process that runs the same way every time, access to the data it needs, systems that can be connected, people who will use and maintain it, and the legal and risk constraints that apply.
Reviewed by Badr Al-RashedUpdated
What it depends on
Whether you have a use case yet
Readiness is always readiness for something. Without a candidate use case, the checklist turns into a general IT maturity survey. Pick one or two real candidates and check against them.
How much of the work lives in email and chat
If the process runs on email, WhatsApp and spreadsheets, the first gap is usually capture, not AI: the data a system would need doesn't yet exist in a form it can read.
Who controls your systems
Data in a vendor-hosted ERP or CRM counts as ready only if your contract lets you get it out, through an API or an export. Check that before anything else.
The risk of the use
An internal drafting assistant needs less proof than a system that answers customers or touches money. The checklist gets stricter as the risk rises.
Read against SDAIA's AI Adoption Framework
General information, not legal advice. Each regulatory point summarises the official source cited beside it, as checked on the date shown under Sources; confirm how it applies to your company with your legal adviser.
Three pillars
SDAIA's AI Adoption Framework (2025), written for both government and private entities, organizes adoption into three pillars: Directions (strategy and governance), Enablers (data, infrastructure and human capacity) and Outcomes (applications and impact). The six checks above sit under the first two; outcomes are what you measure once a system is live.[1]
Pilot to production as a signal
The framework names tracking the transition of projects from pilot to production as an indicator of maturity. If none of your past pilots reached production, find out why before you start the next one.[1]
Risk category and personal data
SDAIA's AI Ethics Principles classify uses from little or no risk to unacceptable, with conformity assessments for high-risk systems. If the use involves personal data, the Personal Data Protection Law applies as well (Article 2), including its conditions for transfer outside the Kingdom (Article 29). Record both before anything is built.[2][3]
One use case, checked line by line: proof-of-delivery intake
ExhibitWorked example
Rasikh Logistics, the transport arm of the fictional Rasikh Holding, wants an assistant that reads drivers' proof of delivery and closes the shipment in its transport system. Each line is marked by the evidence found, not by anyone's opinion.
2 In place3 Partial2 Missing
Directions
1 In place0 Partial1 Missing
- A named owner and a measurable goalIn placeA signed one-page brief from the operations director
- Risk category of the use agreedMissingNot yet discussed
Enablers
1 In place3 Partial0 Missing
- The process runs the same way each timePartialDrivers send proof three ways: the delivery app, WhatsApp photos and signed paper notes
- Access to past deliveries and their proofPartialExport approved; API access pending with the transport-system vendor
- The transport system can be connectedIn placeA documented shipment-update API exists
- People to review and maintain itPartialTwo dispatch reviewers named; nobody assigned to maintain it
Outcomes
0 In place0 Partial1 Missing
- A baseline measured before the buildMissingTime from delivery to closed shipment not recorded
The decisionNot ready to build yet. First: one way to send proof of delivery, API access, an owner for maintenance and a measured baseline.
What Ting does and doesn't do here
What we do
- We check direction, process ownership, data access, system interfaces, team skills and adoption barriers against evidence, for the use cases you actually have in mind.
- We tell you what is in place, what is missing and what to fix first, in the order a build would need it.
- Your team can act on the findings whether or not Ting builds anything later.
Where Ting helps: AI Readiness Assessment
What we don't do
- We are not an SDAIA body. Our assessment is not an SDAIA assessment, badge or certification.
- We don't sell a generic maturity score. Readiness is measured against real candidate use cases.
- We don't require you to commission a build or a Blueprint afterwards.
Sources
Primary sources only, each read in full on the date shown.
