NSDAI 2025 vendor onboarding: a practitioner diagnosis

What NSDAI is and why it matters to an annotation vendor

NSDAI was issued as a national strategy by SDAIA (the Saudi Data and AI Authority) within the Vision 2030 system. The strategy document sets national goals in concrete numbers: position the Kingdom among the top global nations in AI by 2030, train tens of thousands of specialists, attract billions of USD in investment, and build a sovereign data ecosystem that supports Arabic language models like ALLaM and sector-specific specialized models.[^1]

The question every regional AI vendor looking at the Kingdom today is asking: “How do I get in?” The answer does not come from reading the NSDAI document itself — that is a strategy document, not a procurement guide. The answer comes from understanding how SDAIA and the other sovereign buyers (HUMAIN, MCIT, NDMO, sector ministries) translate that strategy into actual procurement gates with measurable criteria. This post tries to unpack those gates from the outside, built on public documents and announcements.

I write this as a founder of an annotation house in Cairo studying the Saudi market in good faith. Annota8 is not a SDAIA vendor of record today. I am not inside the procurement committee. What I say here is correctable by anyone with inside knowledge, and I welcome corrections.

The first gate: regulatory before technical

The mistake most small foreign vendors make when looking at the Saudi market: they build a polished technical pitch before they build the regulatory file. The result: their pitch gets dropped in administrative review before it ever reaches technical evaluation. SDAIA and the other sovereign buyers apply four regulatory layers to any contract of meaningful size:

The MISA license is the foundation. A foreign company without MISA can sell limited-value services via a cross-border invoice, but enterprise contracting with SDAIA or HUMAIN requires a legal entity inside the Kingdom with a live MISA license. This is a real constraint on small vendors: cost, time, operational presence. But it is a constraint that is bypassable if the vendor is serious about the long-term market.

NDMO data classification is the second layer. The National Data Management Office classifies data into four categories (Top Secret, Secret, Restricted, Public).[^3] The top two tiers require in-Kingdom processing. Any annotation vendor that aspires to work on SDAIA data needs to internalize that its operating model must adapt: in-KSA processing for what is required, with an option for Cairo-based processing for less sensitive workloads.

See PDPL and NDMO data classification on the compliance page.

The second gate: IKTVA and ICV — economy before capability

The IKTVA program (In-Kingdom Total Value Add) was launched by Aramco in 2015 and then expanded as a preferential standard in other sectors.[^4] ICV (In-Country Value) is the broader frame. When you compete for a Saudi sovereign contract, IKTVA/ICV points enter the evaluation with non-trivial weight, though Aramco and LCGPA do not publish a uniform evaluation percentage and the weighting varies by procuring entity, sector, and tender.

What earns IKTVA points for an annotation vendor? Not hard to understand but it takes operational effort:

• Share of Saudi staff on the project team
• Spend with Saudi suppliers (offices, equipment, support services)
• Training and development of local talent inside the work plan
• Documented technology transfer and capability building — not rhetorical
• Partnerships with Saudi universities (KAUST, KFUPM, KSU) in research or training

A vendor that enters with a clear, measurable IKTVA plan earns points that separate it from a competitor who shows up with a better technical pitch but no local commitment. This is a hard balance for a small vendor: deep local commitment requires upfront capital, but without it you do not enter the bigger contract tier.

Read the KSA sovereign FM lab blueprint for the wider context.

The third gate: NDMO classification and in-Kingdom processing

NDMO (the National Data Management Office) issued its data classification framework starting in 2020, and it is now the reference for most government data.[^5] Per the SDAIA National Data Governance Interim Regulations, the four classification tiers are:[^3]

• Top Secret: Highest sensitivity; in-Kingdom processing only with strict security controls
• Secret: High sensitivity; in-Kingdom processing required
• Restricted: Controlled access; processing controls apply
• Public: Can be published without restriction

SDAIA’s model-training data — especially anything containing official government text, ministerial correspondence, or citizen data — usually falls in the Top Secret and Secret categories. Any annotation vendor that aspires to work on this data needs an operating posture that accommodates the geographic constraint:

• A secured physical or cyber workspace inside the Kingdom
• Security-cleared staff (clearances where required)
• An auditable logging and review system
• Clean separation between sensitive and ordinary data

The model Annota8 is building: a hybrid structure. A primary data-processing footprint in Cairo (where the PhD-level Arabic QA team sits), with a limited in-KSA processing capability for sovereign workloads via operational partnerships or the KSA entity. Top Secret data is never processed outside the Kingdom in any scenario. Secret-tier data is in-KSA by default. Restricted-tier data can run hybrid where controls allow. This division must be disclosed in the pitch and reflected in the processing contract.

The fourth gate: rigorous TQM — PhD-level Arabic QA

The first three gates are regulatory. The fourth gate is technical, and it is where vendors who clear the regulatory layer separate from each other. SDAIA and HUMAIN need Arabic data at a QA level that most global annotation vendors — trained on English data — do not have:

• Real dialect coverage: Not just MSA, but Egyptian, Levantine, Gulf dialects across their spectrum, Maghrebi, Yemeni, Sudanese
• Academic-level linguistic review: SFT and RLHF samples need researchers with backgrounds in linguistics or Arabic language, not annotators with everyday Arabic fluency
• Cultural and religious awareness: Handling religious, shariah, and historical texts requires genuine context awareness, not surface rules
• Auditable methodological documentation: Annotation guidelines written, inter-annotator agreement measured, arbitration process documented

Here is where Cairo adds depth that complements Riyadh-based operations. Egypt holds one of the largest concentrations of academic Arabic-language scholarship in the region — Cairo University, Al-Azhar, Ain Shams, Alexandria, and Assiut produce hundreds of researchers in linguistics, Arabic literature, and Islamic studies every year. Assembling a QA panel of researchers at this academic level is operationally easier in Cairo because the scholarly community is concentrated there. Riyadh’s research community is growing fast on the back of King Saud University and SDAIA’s hiring; the practical model is hybrid (Riyadh + Cairo), not a single-city play and not a cheap-versus-expensive framing.

See workforce architecture and the glossary: SFT and RLHF.

What a small vendor actually enters with

Building a complete SDAIA qualification file — MISA + KSA entity + IKTVA plan + hybrid processing footprint — is a serious capital and operational lift, not counting founder time. This is a real barrier for a small vendor. Reality: you do not enter through a big RFP gate in year one. You enter through smaller gates:

First, RFI (request for information) before RFP. Every big procurement cycle is preceded by an RFI cycle in which the buyer opens to the market to gather information about available suppliers. Responding to an RFI does not require complete MISA or IKTVA. It requires a strong technical brief. This is an opportunity to build the relationship and put your existence on the buyer’s radar.

Second, subcontracting with a local integrator. The big Saudi firms (Elm, Solutions by STC, Mozn, Lean) win big RFPs and need a data layer they do not own.[^6] Entering as a second-tier subcontractor lets you build an in-KSA execution track record without carrying the weight of direct contracting.

Third, research projects with Saudi universities. KAUST in particular funds Arabic NLP research,[^7] and a KAUST-accepted project gives you an academic track record. Research partnerships can contribute to local-content / supplier-development categories used in IKTVA-style scoring, depending on the procuring entity. KFUPM, KSU, and PNU likewise.

Fourth, a strategic partnership with a local KSA vendor. The 91/9 (or later 70/30) model many foreign companies follow: a Saudi partner holds the front-end, the foreign vendor holds the technical operations. This is Annota8 AI LLC’s Saudi model.

A realistic sequence

The typical sequence small foreign vendors describe when entering the Saudi market via SDAIA/HUMAIN:

• Phase 1: MISA registration, KSA entity formation, building initial IKTVA file
• Phase 2: Responding to RFIs, attending events (the Global AI Summit in Riyadh, LEAP),[^8] building relationships with prospects
• Phase 3: First small contract (PoC or pilot), usually with an intermediary entity rather than SDAIA directly
• Phase 4: First mid-size contract, starting to build an execution track record
• Phase 5: Qualification for a direct RFP with SDAIA or HUMAIN

There is no honest shortcut. A vendor who claims they can put you inside a SDAIA contract in weeks is selling an illusion. The vendors who actually entered built the file well before the first dollar.

What Annota8 is doing now

Full honesty about where we are today: Annota8 LLC is a Delaware office; Annota8 AI LLC is a Saudi entity held 91/9 between the two partners; the operating team in Cairo has a linguistic depth that a global annotation house could not build in Riyadh; and we have no direct contract with SDAIA or HUMAIN yet. ALLaM, originally developed by SDAIA, is now stewarded by HUMAIN, the PIF AI company formed in May 2025[^9] — making HUMAIN the primary commercial counterparty for ALLaM-related work. We are in the regulatory-file-building layer and the early relationship phase. Our plan for the next 12 months:

• Finish the MISA license and get the KSA entity registered as a supplier in the Saudi system
• Build an initial IKTVA file via at least one university partnership
• Participate in SDAIA and HUMAIN RFIs as they open
• Expand the Cairo Arabic QA team from 10 to 30 researchers at academic level
• Build the hybrid processing capability to handle NDMO category-three data

Read government sovereign AI solutions and the MENA FM lab training data lead persona.

The honest takeaway

NSDAI is not an obstacle, it is a frame. The gates SDAIA and the other sovereign buyers create are not designed to disqualify — they are a standard. The small vendor who internalizes that qualification is a multi-stage process, who builds the file with patience, enters through small gates before big ones, and who is honest about what it can and cannot deliver — enters. The vendor who is looking for a shortcut without regulation and without local commitment fails.

To repeat: Annota8 is not a SDAIA vendor of record as of publication. This is an outside-in analysis built on the published NSDAI documents, the NDMO framework, and experiences relayed from other vendors. Any correction from a reader with inside knowledge is welcome.