An AI readiness assessment is a short review that answers one question: can your company run a specific use case safely and measure the result? It checks the goal, data, access, risk level and decision owner. In Saudi Arabia it maps onto SDAIA's AI Adoption Framework and AI Ethics Principles, and ends with a first pilot and a roadmap.
Many teams start with the tool: a subscription to a public assistant, or a vendor demo. SDAIA's AI Adoption Framework warns that without a clear AI strategy, experiments may lack strategic value and adoption becomes less likely to succeed. A readiness assessment starts from the other end: the workflow and the problem it has to solve.
It measures the gap between a use case you want and what your company has today to run it. It does not count the tools you have bought, and it does not give the whole company a single score.
Ask five questions of every candidate use case:
- Goal: what is the operational problem, who feels it, and how do you measure it today?
- Data: where does the data live, who owns it, and can you reach it with clear permissions?
- Systems: can a tool reach your current systems without manual copying?
- Risk: what happens when the output is wrong, and which risk level does the use case fall into?
- People: who owns the decision, who reviews the output, and who needs training for the new way of working?
Run the assessment on one use case or a short list, not on the whole company at once. The data for summarising meeting minutes may be ready today, while forecasting inventory demand may need years of clean sales history.
The AI Adoption Framework from the Saudi Data & AI Authority (SDAIA) organises adoption into three pillars: Directions, Enablers and Outcomes. Version 2, published in May 2025, targets government and private entities regardless of their specialty or digital maturity (as of October 2026).
The framework names the need for a tool that lets entities measure their enterprise AI maturity, identify strengths and areas for improvement, and set a realistic roadmap. A readiness assessment does that at the level of a single use case:
| SDAIA pillar | Its elements | Practical assessment question |
|---|---|---|
| Directions | Strategy, Governance | Is the use case tied to a written goal and a KPI, and who approves and reviews it? |
| Enablers | Data, Infrastructure, Human capacity | Is the data available and reliable, can the tool run and connect, and who has the skills? |
| Outcomes | Applications, Impact | How will you monitor the use case after launch, and what impact will you measure against the baseline? |
The framework deliberately avoids detailed technical standards. Its scope says it offers guiding principles and enablers so each entity can make decisions that fit its own context. Use it as the structure for your questions, and answer them from your real systems and teams.
The three pillars and seven elements of SDAIA's AI Adoption Framework (version 2, May 2025), used here as the structure for assessment questions. The diagram shows the framework's grouping only, not a score or maturity level.
Three questions reveal data readiness: can you reach the data, can you trust it, and are you allowed to use it for this purpose? A fourth covers systems: can the tool reach them without temporary manual workarounds?
Use this checklist in the assessment workshop:
- Owner: every data source has a person responsible for updating and correcting it. A source without an owner is a gap to record before the pilot.
- Permissions: SDAIA's framework recommends role-based access control (RBAC) that defines who can access, modify or share data. Confirm the tool will respect those permissions instead of bypassing them through one over-privileged account.
- Quality and freshness: decide how old the data may be and who notices when it is wrong. A month-old price list may be fine for an internal summary but not for a reply sent to a customer.
- Source and licence: the framework asks entities to verify dataset licences and intellectual property rights before use, by reviewing contracts and terms of use with the compliance team.
- Personal data: SDAIA's framework states that entities are obliged to implement the Personal Data Protection Law (PDPL) and its Implementing Regulations. Identify whether the use case processes personal or sensitive data and where the tool stores what is entered, then check the PDPL rules for personal data in cloud tools.
- Integration: if customer data is split across the CRM, sales spreadsheets and email, record that as a gap with a plan, and do not rely on manual copying during the pilot.
Include the public tools your staff already use. SDAIA's Generative AI Guidelines for the public make verifying AI-generated content the user's responsibility. Write that into your use policy, together with the list of data that must never be entered.
Classify every use case against the four risk levels in SDAIA's AI Ethics Principles before you choose it for a pilot. The principles apply to all AI stakeholders designing, developing, deploying, using or affected by AI systems within the Kingdom, including private entities.
| SDAIA risk level | What the principles say | What it means for your assessment |
|---|---|---|
| Little or no risk | No restrictions, though ethical compliance is recommended; spam filters are the example | Record the reason and move on to ranking |
| Limited risk | Subject to the AI ethics principles in the document | Apply the principles and record who reviews the output, and when |
| High risk | Pre- and post-conformity assessments, plus the relevant statutory requirements | Do not make it your first pilot without a legal adviser and an assessment plan |
| Unacceptable risk | Not allowed, such as social profiling, exploitation of children or distortion of behaviour | Remove it from the list |
The seven principles in the 2025 edition on SDAIA's website are Fairness; Privacy & Security; Humanity; Social & Environmental Benefits; Reliability & Safety; Transparency & Explainability; and Accountability & Responsibility (as of October 2026).
Treat this classification as an internal record with its reasons, not a legal opinion. If the use case affects decisions about people, such as hiring or credit, ask your legal adviser before it goes into the first pilot.
If your risk team already works with international standards, the NIST AI Risk Management Framework, released on 26 January 2023 for voluntary use, helps connect the classification to your risk register. Our guide to an AI register with named owners explains how to build one.
SDAIA's four AI risk levels and what each requires, summarised from its AI Ethics Principles (2025 edition). Classifying a use case is an internal record with its reasons, not a legal opinion.
Rank opportunities on four criteria agreed in advance: business value, feasibility, data readiness and risk. For the first pilot, choose a use case whose data is ready and whose errors are cheap to catch, even if it is not the highest-value idea.
The table compares three hypothetical opportunities on those criteria. It is an illustration, not a client project or a measured result:
| Opportunity (illustrative) | Value | Data readiness | Cost of an error | First-pilot decision |
|---|---|---|---|---|
| Draft replies to customer emails | High for a team with heavy inbound mail | Message history and reply policies are available | Medium; staff review before sending | Strong candidate |
| Summarise meeting minutes | Medium | Minutes are scattered across tools | Low | Possible once the source is unified |
| Forecast inventory demand | High | Needs years of clean sales data | High if purchasing depends on it | A longer data project, not a first pilot |
Before ranking, put each opportunity through the four tests for a candidate workflow: maintained sources, enforceable permissions, the cost of an error and a person who reviews the output. If the opportunity is an automation that acts on its own, look at SME workflows with a human approval step before deciding its permissions.
The roadmap names the chosen pilots, the owner of each, its success measure, its review date and the decision expected at each gate: continue, change or stop.
SDAIA's framework recommends linking every initiative to measurable outputs, such as work hours saved, beneficiary satisfaction and model accuracy, and reviewing initiatives every quarter. It also recommends a timeline that covers planning, launch, expansion and evaluation, with responsibilities and resources for each phase. It treats the move from pilot to production as an indicator of enterprise maturity.
Write at least five items into the roadmap:
- Baseline: measure the current process before anyone builds the pilot. Our guide to judging a pilot against its baseline explains how to measure accepted outputs and total cost.
- Owner and reviewer: one owner per pilot, and a named person who reviews its results.
- Pilot boundaries: who uses it, on which data, and for how long.
- Decision gate: a fixed decision date and a list of what scaling would need, such as integration, training and a use policy.
- Later phases: the remaining ranked opportunities, with indicative timing that is not a commitment to deliver.
TecnoStack runs an opportunity assessment in two weeks, starting from SAR 4,000 before VAT. The final price depends on the number of interviews, workflow reviews and workshops.
| Plan | Duration | From (excl. VAT) | Main inclusions |
|---|---|---|---|
| Opportunity assessment | 2 weeks | SAR 4,000 | One discovery workshop and up to 3 interviews, review of up to 3 workflows, a readiness checklist for data, systems and access, a report ranking at least 3 opportunities, and a recommended first pilot |
| AI adoption roadmap | 4 weeks | SAR 12,000 | Up to 5 interviews and 5 workflow reviews, a 90-day roadmap with owners, success measures and decision gates, and a draft staff AI use policy |
| Pilot enablement | 6 weeks | SAR 25,000 | Six weekly working sessions, up to 2 pilot briefs with baselines, and a review of each pilot with a continue, change or stop recommendation |
If you move from the opportunity assessment to the AI adoption roadmap within 60 days, we credit the assessment fee in full. All three plans are advisory engagements: engineering, tool subscriptions and legal or compliance assessments are priced separately, and a written proposal confirms the final scope and price. The details of our AI readiness assessment and adoption roadmap are on the service page.
The assessment has done its job when you leave with written decisions, not a general presentation:
- A short list of use cases ranked by value, readiness and risk, with the reason for each ranking.
- The data and permission gaps for each use case, each with an owner.
- A recorded risk level for each use case on SDAIA's scale, plus the points to confirm with your legal adviser.
- A first pilot with an owner, a baseline, a success measure and a decision date.
- A roadmap you review every quarter.
If you want to start from the workflows you already run, tell us about your teams, tools and current pilots, and we will suggest an assessment scope that fits them.
