AI Governance
Governance for generative AI, agentic AI and private/cloud LLM deployments — before production, not after.
Saudi organizations adopting generative AI, private LLMs or cloud AI platforms need a governance and security baseline before production use — not after an incident or an SDAIA/NCA review raises it. This engagement inventories AI use cases, assesses risk and security, and produces a governance roadmap aligned with ISO/IEC 42001 and applicable Saudi AI guidance.
Is this your situation?
Generative AI pilots are spreading through departments faster than any inventory or policy can follow.
An SDAIA, NCA or internal audit question about AI governance has arrived and there is no documented baseline to point to.
How I Solve It
Saudi organizations adopting generative AI, private LLMs or cloud AI platforms need a governance and security baseline before production use — not after an incident or an SDAIA/NCA review raises it.
An AI inventory, risk classification and governance roadmap aligned with ISO/IEC 42001 and applicable Saudi AI guidance — a baseline you can show, not just describe.
Selected Experience
Supported a major Saudi government organization's migration from a local cloud provider to Google Cloud under Saudi data-residency and cybersecurity requirements. Scope included Windows/Linux workloads, DNS, networking, security architecture, migration, administration and operational support.
Led/supported ISO/IEC 27001 implementation and certification-readiness for a major government organization, including ISMS, risk, controls, remediation and audit preparation.
Architecture and migration work across smaller organizations and large enterprises, including AWS architecture, IAM, networking, Windows/Linux workloads, cloud security and operational planning.
25+ years across Europe, international environments and Saudi Arabia, including experience associated with CERN, the Swedish Defence Research Agency (FOI), Saudi government and regulated/research environments.
Not sure this is the right engagement yet?
Bring the one decision that is pending. Thirty minutes, an independent senior view, and a short written note with the key risks and a recommended next step — whether or not that step involves an engagement.
AI governance works best connected to the security and infrastructure decisions around it:
How an Engagement Works
Every engagement starts with your situation, not a methodology deck. Four steps, each with a clear output — and a no-obligation free 30-minute review if you want to test the fit first.
A short conversation about the decision in front of you: the environment, the constraints, the objective and who has to sign off.
We agree what is being solved, what information and access are needed, what you receive at the end and where the engagement stops. NDA and confidentiality requirements are accommodated where required.
Architecture and documentation review, stakeholder discussions, technical assessment and/or workshops — whichever the agreed scope needs.
You receive clear executive findings plus technically actionable recommendations. Implementation or ongoing advisory can be scoped separately if you want it.
FAQ
Engagements can range from independent architecture review through migration/security implementation advisory and operational support. Scope depends on the problem.
No. Advice is vendor-neutral. Experience includes AWS, Google Cloud, OCI, stc cloud, Zain Cloud, private cloud and hybrid environments.
Yes. Independent architecture review can complement internal teams, cloud partners, system integrators and vendors.
Yes. Government, regulated and enterprise technology work often involves sensitive information. NDA and confidentiality requirements can be incorporated into the engagement.
Saudi Arabia, GCC and international remote advisory are supported. Onsite requirements can be discussed by engagement.
No. Shah.sa provides assessment, architecture, implementation and readiness support. Certification, accreditation and regulatory decisions remain with the applicable authorized body.
Engagements are scoped around the problem, required work and expected deliverables. Fixed-scope assessments and recurring advisory arrangements are available.
Tell me what is being decided and what is at stake. I will first say honestly whether my experience fits — then we talk about scope, not before.
Or connect on LinkedIn first.