Sovereign AI: deciding where your AI runs in Saudi Arabia and the UAE
Sovereign AI is a decision about where models run and where data travels. We compare managed APIs, in-country cloud and on-premises open-weight models under KSA and UAE rules.
Sovereign AI means running AI where your law, your data and your operating capacity allow: a managed API kept in-region, a sovereign or in-country cloud, or open-weight models on your own servers. For many organisations in Saudi Arabia and the UAE the answer is a mix, decided workload by workload, because each workflow touches different data and therefore different transfer rules. This guide sets out the three options, what the Saudi and UAE data protection texts say about moving personal data abroad, a decision matrix, the real operating burden of self-hosting and a pilot-first path.
What does sovereign AI mean in practice?
Sovereign AI comes down to three questions. Where does inference run, meaning where does the model actually process your prompts? Where are prompts, outputs, logs and embeddings stored? And who can reach the system: your staff, the provider's engineers, or authorities in another country?
Private AI usually describes control: a dedicated environment on your network or in your own cloud tenancy. Sovereign AI adds jurisdiction: processing, storage and operators sit inside the country and under its law. The three deployment options answer these questions differently.
- Managed API in-region: a cloud or model provider runs the model and you choose the region or geography where requests are processed. Fastest to start and the widest choice of models, with the least control over the stack.
- Sovereign or in-country cloud: models hosted in data centres inside the country, often on dedicated capacity, with contract terms on who operates and supports the service.
- On-premises open-weight models: you run published model weights on your own GPUs. Full control and full responsibility.
Read region settings carefully, and remember that a region is not a country: for a Saudi organisation, a cloud region in the UAE is still outside the Kingdom. In Microsoft Foundry, data at rest stays in the chosen Azure geography, but Global deployment types may process inference data in any Azure region. Standard and Regional Provisioned types keep prompts and responses within the customer-specified geography. On Amazon Bedrock, global cross-Region inference can route a request to any supported commercial AWS Region, and CloudTrail records which Region processed it. The deployment type you select, together with the region, decides where your data is processed.
How do Saudi and UAE data transfer rules shape the choice?
Saudi Arabia: PDPL Article 29 and the Transfer Regulation
The Personal Data Protection Law, issued by Royal Decree No. M/19 dated 9/2/1443 AH and since amended, lets a controller transfer personal data outside the Kingdom only for listed purposes. Article 29 adds conditions. The transfer must not prejudice national security or the Kingdom's vital interests. The destination must offer protection at least equivalent to the Saudi law, and only the minimum personal data needed may be sent.
SDAIA's Regulation on Personal Data Transfer Outside the Kingdom (version 2.0, August 2024) fills in the detail. SDAIA publishes a list of countries with an appropriate level of protection. Where a controller relies on one of the exemption cases instead, it must use one of three safeguards: standard contractual clauses, binding common rules or a certificate of accreditation. The controller must carry out a risk assessment before transfers made under those exemptions, and before transferring sensitive data abroad on a continuous or widespread basis.
For AI this is concrete. If a customer service assistant sends complaint text with names and account details to a model hosted outside the Kingdom, that is a transfer. It needs a permitted purpose, a basis and, in some cases, a risk assessment on file. Public entities have a further layer: the Data Classification Policy issued by the National Data Management Office (NDMO) at SDAIA sorts government data into Top Secret, Secret, Restricted and Public, and the level sets the protection the data needs.
UAE: Federal Decree-Law No. 45 of 2021
The UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, came into force on 2 January 2022. Article 22 allows transfers to countries the UAE Data Office approves as having adequate data protection legislation, or with which the UAE has a bilateral or multilateral data protection agreement. Article 23 covers everything else, and allows a transfer only in listed cases. Examples include a contract binding the recipient to the law's standards, the data subject's express consent, or performing a contract with the data subject. The detailed conditions are left to the Executive Regulations, so check with counsel whether they have been issued and what they require before relying on any of these routes.
Scope matters as much as the transfer rules. Article 2 excludes government data, health data and banking and credit data that have their own legislation, and companies in free zones that have their own data protection legislation, such as the Dubai International Financial Centre (DIFC Data Protection Law No. 5 of 2020). Companies in free zones without such a law generally fall under the federal law. A hospital, a bank and a federal ministry in the UAE may each start from a different rulebook.
Data protection law is not the only rulebook: sector regulators and national cybersecurity and cloud rules can add their own hosting requirements, especially for government entities, banks and health providers. This is general information, not legal advice. Your obligations depend on your sector, your data and where you operate, so confirm the position with counsel before you commit to an architecture.
Decision matrix: managed API, sovereign cloud or on-premises
Classify each workload by the data it touches, then read across the table.
| Criterion | Managed API in-region | Sovereign or in-country cloud | On-premises open-weight models |
|---|---|---|---|
| Where inference runs | Provider's region or geography, depending on deployment type | Data centres inside the country | Your own data centre |
| Model choice | Widest; newest models, but availability varies by region | Models the provider hosts locally | Open-weight models you select, host and update |
| Time to first use | Fastest | Moderate | Slowest: hardware, setup and hardening |
| Cross-border transfer exposure | Low if processing and storage stay in-country, but check abuse-monitoring, logging and support access, which can involve staff abroad; a transfer if processing leaves the country | Low; check operator and support access terms | Lowest, provided you also control vendor support access, telemetry and model downloads |
| Operating burden on your team | Low | Medium | High |
| Cost profile | Pay per use | Reserved capacity or subscription | Capital spend plus staff time |
| Typical fit | Public and internal data; personal data with a documented transfer basis | Personal and confidential data that must be processed in-country | Highly classified data, isolated networks, steady high volume |
Many organisations will use more than one column. A regional bank might draft marketing copy through a managed API, summarise customer complaints on an in-country deployment and keep analysis of restricted internal reports on its own hardware. The matrix places each workload; it does not force one platform on all of them.
What does running your own models really take?
On-premises and dedicated sovereign deployments move work from the provider to you. Count that work before you write the business case.
GPU capacity
Size for peak concurrent users and the longest documents you expect, not the average day. Larger models and longer context windows need more GPU memory per request, and you need headroom for evaluation runs, failover and the next model version. Hardware lead times can set your go-live date.
Patching and updates
A private stack has many parts: GPU drivers, the model-serving layer, the chat interface, the vector database, identity integration and the operating system. Each receives security fixes on its own schedule. Open-weight models also release new versions, and every swap needs a full re-test.
Evaluation in Arabic
Public leaderboards rarely tell you how a model handles your documents. Build a test set from your own material in Modern Standard Arabic, the dialects your customers write in, Arabizi and mixed Arabic-English text. Score answer accuracy, faithfulness to the source and correct refusals, and rerun the same set after every model or prompt change.
People and monitoring
Someone must own uptime, access reviews, log retention and incident response. If no team can carry that load, a dedicated in-country cloud deployment is usually a safer choice than hardware nobody maintains.
A pilot-first path to sovereign AI
- List the three to five workloads you want first and the data classes each one touches.
- Map each workload to the transfer rules, sector rules and internal classification that apply, and record the result.
- For each workload, choose the lightest option in the matrix that meets those rules.
- Build the Arabic evaluation set before you shortlist models, so the test is fixed before the vendors are.
- Run a controlled pilot with real users and approved or synthetic data. Measure answer quality, response time and cost per task.
- Record a decision: proceed, extend the pilot, pause or stop. Size production capacity from the load you measured, not from vendor estimates.
- Plan operations before go-live: patching, monitoring, access reviews and how you will migrate to the next model.
How to start
Our Private & Sovereign AI Feasibility service covers steps one to three: the workload and data-boundary assessment, the SaaS, private cloud or on-premises decision, and a cost model. Private AI Pilot & Deployment then runs the controlled pilot and the on-premises or in-region cloud build. Both sit in our Transformation Lab, and the private AI use-case page shows how they connect.
If you are not yet sure which workloads need this level of control, start with the free AI Exposure Scan, a 45-minute conversation that ends in a written next step.
Frequently asked questions
What is the difference between private AI and sovereign AI?
Private AI describes control: the model runs in an environment dedicated to your organisation, on your network or in your own cloud tenancy. Sovereign AI adds jurisdiction: processing, storage and the people who operate the system stay inside the country and under its law. A private deployment hosted abroad is private but not sovereign. Many organisations need sovereignty only for workloads that touch personal or classified data.
Does using an AI API hosted outside Saudi Arabia count as a personal data transfer?
If the prompts contain personal data and the model processes them outside the Kingdom, the Personal Data Protection Law treats that as a transfer. Article 29 and SDAIA's Regulation on Personal Data Transfer Outside the Kingdom then require a permitted purpose, adequate protection or an approved safeguard, and in several cases a documented risk assessment. Confirm the position for your sector with counsel.
Can we use Microsoft Foundry or Amazon Bedrock and keep processing in our region?
Often, but it depends on the deployment type and on model availability. In Microsoft Foundry, Global deployment types may process inference in any Azure region, while Standard and Regional Provisioned keep prompts and responses in the chosen geography. In Amazon Bedrock, global cross-Region inference can route requests to any supported commercial AWS Region. Check the type you deploy, not only the region you select.
Do we need our own GPUs for sovereign AI?
Not always. An in-country cloud deployment can meet many residency needs without buying hardware. Own GPUs make sense for highly classified data, isolated networks, or steady high volumes where your cost model shows owned hardware beating reserved cloud capacity. If you go on-premises, plan for peak load, failover, patching and a team that can run the stack around the clock.
How do we test whether a model is good enough in Arabic?
Build a test set from your own documents and real, redacted queries in Modern Standard Arabic, the dialects your users write in, Arabizi and mixed Arabic-English. Score answer accuracy, faithfulness to sources and correct refusals. Fix the test before you shortlist models, and rerun it after every model, prompt or configuration change so you can see regressions before users do.
Get new insights by email
One email when we publish something useful. No spam; leave any time.
Services in this article
Related lab: Transformation Lab ↗
