Vision 2030 + AI procurement: a reality check

The narrative versus the mechanics

Vision 2030 — the strategic framework launched by the Crown Prince in 2016¹ — set a clear goal: transform the Kingdom from an oil-based economy into a diversified knowledge economy in which artificial intelligence and data play a central role. The official narrative talks about placing the Kingdom among the top 15 countries globally in AI by 2030², investments in the billions of USD, the creation of tens of thousands of jobs, and the building of a sovereign technological capability.

The narrative is honest. But it is a narrative. The actual procurement mechanics differ. When Vision 2030 says “X billion USD of AI spend by 2030,” that number splits across multiple sovereign and quasi-sovereign entities, each with an independent procurement cycle. The vendor who looks at the aggregate number and assumes a single entry gate fails at operational planning. The vendor who maps the entities and picks 1–2 to know deeply succeeds.

I write this as a founder of an annotation house in Cairo who has been studying the Saudi market seriously for 18 months. I am not inside any of the entities mentioned. What I say here is correctable by anyone with deeper knowledge.

The actual map: at least 12 entities

This is not a complete list. Other entities buy AI at smaller volume: STC Solutions, Mobily, Zain KSA as B2B buyers; Tahakom in road safety; Solutions by STC as an integrator; Elm as a government platform. Each of them opens procurement cycles periodically.

Read government sovereign AI solutions for the wider frame.

Why dispersion is a feature, not a bug

The new-to-market foreign vendor looks at this map and complains about the dispersion. That is an analytical mistake. Dispersion is a feature for a small vendor, for three reasons:

First, dispersion opens multiple doors with different requirements. SDAIA asks for MISA + IKTVA + NDMO. KAUST asks for an academic track record and research capability. NEOM asks for operational capability in a specific location. The Diriyah Gate Authority asks for understanding of heritage and cultural context. The small vendor with a specific strength finds at least one entity that values it.

Second, dispersion lowers the probability of market isolation. If there were a single centralized procurement authority, a single decision would knock you out of the market entirely. With 12 entities, the vendor who fails with SDAIA can try with MoH. The one who fails with NEOM can try with MoE. This is structural risk reduction.

Third, dispersion creates specialization opportunities. An Arabic annotation vendor with PhD-level QA can choose: specialize in ALLaM data (SDAIA + HUMAIN)? Medical data (MoH + KAUST)? Educational data (MoE + MISK)? Mobility data (NEOM + RCRC)? Each choice builds different depth.

Read the MENA FM lab training data lead persona and the KSA smart city, AV and mobility AI lead persona for buyer-persona detail.

Typical procurement cycles: what differs between entities

Each of these entities runs a different procurement cycle, in shape and in timing. The operational differences:

HUMAIN: Launched May 2025 under PIF³; procurement cycle taking shape through 2026. What can be said from public announcements: HUMAIN is leading with strategic partnerships with major technical suppliers (Nvidia, AMD, Qualcomm, Groq, Cisco, AWS)⁷, then expanding to smaller suppliers for data and services.

SDAIA: The most mature entity in AI procurement. RFI then formal RFP, with the General Department of Contracts and Procurement publishing tenders through standard KSA government channels. Full cycle is typically 6–12 months.

MCIT: Traditional government procurement via the Etimad platform⁸. Pre-registration is required, then qualification, then competition. Etimad routes tenders by value thresholds defined in the Government Tenders and Procurement Law.

MoD: Classified. I do not claim to know its mechanics. What can be said: long cycles, strict security qualification, preference for Saudi suppliers or those nearest to strategic allies. A small annotation vendor does not enter this entity directly.

MoH: The procurement triangle in KSA health is real. MoH regulates; the Health Holding Company (HHC), established by Royal Decree in 2022 under the Health Sector Transformation Program, delivers services and runs operating-cluster procurement⁹; NUPCO (National Unified Procurement Company) handles centralized procurement of pharmaceuticals, devices and medical supplies¹⁰; the National Health Insurance Center is the emerging payer. For an Arabic medical NLP or imaging-diagnostic data vendor, the buying entity is more likely an HHC cluster, NUPCO (for bundled software-with-device deals), or an individual academic-medical centre — not “MoH” as a single gate.

MoE: Separate approved-vendor list, distributed between Tatweer and the private sector for general education, and the universities for higher ed. Universities have independent procurement autonomy up to a threshold.

NEOM Authority: A unique cycle different from the other government bodies because NEOM is an independent entity. Every big project takes its own cycle, typically with a written RFP under NEOM’s criteria, with preference for vendors able to maintain operational presence inside the region.

RCRC: The Royal Commission for Riyadh City buys autonomous mobility and urban AI⁵, with active tenders around the Riyadh Metro (fully automated driverless trains) and the Expo 2030 Metro Station integrating smart-mobility solutions.

Diriyah Gate Authority: AI projects for tourism and heritage, smaller volume but specialization opportunities for vendors with the ability to handle historical and heritage text.

MISK: The Mohammed bin Salman Foundation funds educational projects and research grants. Entering as a training-data supplier for an educational LLM is possible, but at smaller volume than SDAIA/HUMAIN.

Read the KSA sovereign FM lab SFT/RLHF data program blueprint for operating context.

Where the small-to-mid annotation vendor enters

Based on the map above, the entities best matched to an Arabic annotation vendor with PhD-level QA (like us) in 2026–2027:

First priority: SDAIA + HUMAIN. These are the two entities that consume the largest volume of Arabic training data and have the largest demand for academic-level linguistic QA. This is where regulatory qualification effort should concentrate.

Second priority: KAUST. The university funds Arabic NLP research, and a partnership opens academic track record + an indirect entry to HUMAIN and SDAIA via tripartite research partnerships. Local-content credit at SDAIA / HUMAIN flows through ICV (In-Country Value) and GAMI frameworks, not Aramco’s IKTVA — keep those streams separate.

Third priority: MoH ecosystem (HHC clusters / NUPCO / academic-medical centres). Arabic health data is a large segment, and the ability to do Arabic medical QA at academic level is a rare niche. Entering here requires a layer of medical experts on the team, which is available in Cairo at cost efficiency, plus the right buyer mapping across HHC, NUPCO and the academic-medical centres.

Fourth priority: MoE / MISK / educational institutions. Arabic educational data, automated assessment, educational LLMs. Smaller segment but it builds a track record.

Not a priority: MoD. A small annotation vendor does not enter this entity directly. Working with MoD requires security clearance layers that are not available to a small foreign vendor. The only honest path: subcontracting with a qualified Saudi partner, if one exists.

Not a priority right now: NEOM, RCRC, Diriyah Gate Authority, Aramco Digital. Not because they are closed, but because building relationships with four entities simultaneously is beyond a small vendor’s capacity. These are entities to target in 2027–2028 after building a track record with the higher priorities.

Read the PDPL compliance page and the workforce architecture.

What unites all the entities

Despite the dispersion, there is a common thread across all Saudi sovereign buyers when it comes to AI vendors:

• Localization is a requirement, not a preference. In-Kingdom processing, Saudi staff within the required ratios, local spend. Localization is now a red line, not a tie-breaker.
• PDPL is enforced. The Saudi Personal Data Protection Law became fully enforceable on 14 September 2024 and is enforced by SDAIA, with fines of up to SAR 5 million per violation¹¹. Most KSA government RFPs now require PDPL compliance as a mandatory qualification gate ahead of technical evaluation.
• Transparency is required. Vendors are expected to provide auditable methodological documentation — work rules, inter-annotator agreement, quality process. Transparency has been an asset for Annota8 in our conversations.
• Long-horizon dealing. Sovereign entities do not reward the one-shot vendor. They reward the vendor that invests in a relationship for years.

The honest takeaway

Vision 2030 is a real narrative, but AI procurement happens in the details of each entity’s procurement cycle. The small vendor who picks 1–2 entities to know deeply, builds a clean regulatory file, follows each entity’s cycle with patience, and is transparent about what it can and cannot deliver — enters. The vendor who hopes for a “centralized Vision 2030 gate” does not find one, because it does not exist.

Annota8 targets SDAIA + HUMAIN + KAUST as a priority in 2026–2027. This is a choice, not a claim of outcome. We are not an approved vendor of record with any of them as of publication. We built the map to direct our own operational effort, and we publish it so that other vendors facing the same question can use it. Any correction from a reader with inside knowledge is welcome.

References