How to implement AI in your company in Saudi Arabia: a plan an owner can run

To implement AI in your company in Saudi Arabia, run it as a sequence, not a purchase: check where the company stands, pick one department and one job with a number on it, settle the data and PDPL questions, build the first workflow with the people who own it, measure it for eight weeks, then write the plan for everyone else. That is the whole method. This article walks through each step so an owner or general manager can run it, alone or with a partner like Octopus Mena. It is written for a company that has already decided AI matters and now wants to know what Monday looks like.

Most Saudi companies are not short of AI. They are short of a plan. The General Authority for Statistics puts AI use among establishments at about a third (33.1 percent in 2025, up around a fifth on the year before). Globally, McKinsey's 2025 State of AI survey found close to nine in ten organizations using AI somewhere, and only around four in ten seeing any effect on profit, most of it under 5 percent. Read the two together and the picture is plain: plenty of companies have AI, few have made it do work that shows up in the accounts. The difference is the plan.

The usual first move is to buy: licenses for everyone, one workshop, and hope. Usage spikes for two weeks and fades. Our executive playbook for AI adoption covers why that pattern fails, so here is only the fix. Run adoption as a fixed order of steps, each small enough to finish, each producing something the next step needs.

• Step one: an AI readiness assessment.
• Step two: one department, one job, one number.
• Step three: data and PDPL rules, settled before the first file moves.
• Step four: build the first workflow and train the people who own it.
• Step five: measure for eight weeks, then decide.
• Step six: write the AI adoption strategy for the rest of the company.

Six steps, roughly twelve weeks to a working system, and the order matters more than the tools. Skip step one and you build the wrong thing. Skip step three and your most careful departments will refuse to take part, and they will be right.

Step one: an AI readiness assessment, before any tool

An AI readiness assessment is a plain look at four things. Where your data lives and who can reach it (shared drives, an ERP, WhatsApp threads, someone's laptop). Which pieces of work repeat every week and pile up in a queue. What your people already do with AI, which is usually more than the management team thinks. And what your policies say about any of it, which is usually nothing.

The output is one page: a ranked list of where AI would pay back first, with a rough size next to each item. It takes a week or two. It needs someone senior enough to open doors and honest enough to write down what they find. It is also the first stage of the AI adoption program Octopus runs for Saudi companies, because nothing later in the sequence works without it. If you do it yourself, do it as a set of thirty-minute conversations, one per department head, and write while they talk.

Step two: one department, one job, one number

Pick one department. Then pick one job inside it that meets three tests: it repeats every week, it has a queue (people wait for it), and it already has a number attached. Days to close the month. Hours per weekly report. Time from a customer's message to a reply. Proposals sent per week.

Ask the team a single question: if an assistant joined tomorrow and could handle exactly one job, which one? The answer is rarely what the vendor deck predicted, and it is almost always the right place to start.

Then write the number down before anything changes. An illustrative example, not a client: a distribution company in Riyadh whose sales desk takes an average of six hours to turn a customer request into a priced quote. Six hours is the number. Everything in step five compares against it. Companies that skip this step end up arguing about whether AI "helped", with nothing to point at.

Step three: settle data and PDPL before the first file moves

Saudi Arabia's Personal Data Protection Law (PDPL) has been fully enforceable since 14 September 2024, with fines that can reach SAR 5 million and double for a repeat. So before any file goes into any tool, answer three questions in writing.

What may reach a cloud model? Public material, templates, and internal documents with no personal data are usually fine. What stays inside the company? Anything with customer names, national IDs, phone numbers, salaries, or contract terms belongs on the careful side until you have a tool and a contract that keep it in the Kingdom or under your control. What gets removed before a model sees it? Often the answer is "the identifying columns", and a five-minute redaction step solves most of the problem.

Write the answers as a one-page AI use policy. Give the assistant a scope, not your logins: a tool that reads the sales folder does not need the HR folder. This is the step that turns nervous department heads into willing ones. Once they can see the rules, they stop guessing at the risk.

Step four: build the first workflow and train the people who own it

Build small. Connect the tool to the real files for that one job, write the steps out in plain words, and run it beside the old way for two weeks. If the job needs more than an off-the-shelf tool can do, this is the point where a custom workflow or AI agent earns its place, not before. The person who owns the number in step two runs the tool. If they are not the one running it, it will not survive contact with a busy month.

Train on the real work, not on AI in general. A session on "prompting" is entertainment. A session where the sales desk turns three of last week's real requests into quotes with the new tool changes behavior the same afternoon. Two roles need names by the end of this step: an owner inside the department, and someone who keeps the thing running when it breaks (an internal person or a partner). A workflow with no second name is a workflow that ends when the first person goes on leave.

If that second name is going to be an outside partner, pick it the way you picked the job: on answers about your company, not on credentials. How to choose an AI adoption partner in Saudi Arabia gives you the ten questions to put to every firm on the shortlist, and what a good answer sounds like.

This is also where the first pieces of a company memory appear: the templates, the rules, the corrections the team makes in week one. Keep them. They are the start of what we call an AI operating system, and they are the reason the second workflow is faster to build than the first.

Step five: measure for eight weeks, then decide

After eight weeks, compare the number with the one you wrote down in step two. Six hours to a quote became ninety minutes, or it did not. Then decide one of three things: scale it to the next department, fix what is wrong and run another four weeks, or stop and pick the next job on the readiness list. All three are good outcomes. The bad outcome is a pilot nobody measured that keeps running out of politeness.

Step six: write the AI adoption strategy for the rest of the company

Only now write the company-wide AI adoption strategy. Written earlier, it is a wish list. Written now, it rests on one thing that works inside your own company, and it reads differently. Keep it short: the order of departments and the job in each, the data rules from step three, who owns adoption at the leadership level, a budget as a range rather than a figure, and review dates. The Kingdom's push under Vision 2030 means clients, tender committees, and banks increasingly ask a Saudi company what its AI plan is. A two-page document with a measured result behind it answers better than a forty-page one without.

AI adoption for SMEs: the same plan, smaller steps

Most Saudi companies are small. Monsha'at's SME Monitor counts around 1.7 million commercial registrations in the Kingdom, and the large majority are small and medium businesses without an IT department. The plan does not change for them. The size of each step does.

The readiness assessment is a week, done by the founder with the two or three people who run operations. The first job is whichever one the founder personally dreads on Sunday morning: invoices, follow-ups, quotes, the weekly report to the partners. Off-the-shelf tools do most of the work at this stage, with a connector to the files rather than a custom build. The PDPL step still happens, because a small company with customer phone numbers in a spreadsheet is a data controller under the law like any other.

The one danger specific to SMEs is that the founder runs the whole thing alone. It works for six weeks and dies the first time a big order lands. Name the second person on day one.

Where the SDAIA AI Adoption Framework fits

The Saudi Data and AI Authority (SDAIA) publishes an AI Adoption Framework, the state's own reference for how an organization moves from trying AI to using it properly. It is free, it is voluntary for private companies, and its logic is the same as the six steps above: direction and ownership first, then data and governance, then people, then measured use. We have written a plain-language walkthrough in SDAIA's AI Adoption Framework, explained for executives.

Use it as the checklist for the strategy you write in step six. If a government client or a large Saudi group asks how your company approaches AI, answering in the framework's terms, with your own measured workflow as the evidence, is the strongest position a private company can hold right now.

What to do this week

Book the readiness conversations. One department head at a time, thirty minutes each, and write down what repeats, what queues, and what already has a number. By Thursday you will have the ranked list, and the rest of the sequence follows from it.

If you would rather run that first step with people who do it every week, start with the two-minute AI readiness check. It is how every Octopus engagement begins, and the score tells you where AI pays back first before anyone talks about tools.

Related reading

AI Adoption

SDAIA's AI Adoption Framework, explained for executives

13 September 2026 · 8 min read

AI Adoption

The Saudi executive's playbook for AI adoption

15 July 2026 · 4 min read

AI Adoption

What is an AI operating system, and why your company needs one first

15 July 2026 · 4 min read