A third of establishments in the Kingdom already use artificial intelligence, and two thirds are deciding now. The 2025 ICT access and use statistics for establishments published by the General Authority for Statistics show that 33.1% of establishments used AI technologies in conducting their activities. The figure hides a wide gap between sectors: 61.1% in information and communication against 30.2% in wholesale and retail trade and 26.7% in other services. The question facing the owner of a mid-sized enterprise is not “whether” but “where, when and at what cost”, and this article answers all three.
| Sector | Share of establishments |
|---|---|
| Information and communication | 61.1% |
| Financial and insurance activities | 52.9% |
| Education | 51.0% |
| Transportation and storage | 44.4% |
| Professional activities | 43.9% |
| Health and social work | 35.6% |
| Construction | 33.8% |
| Manufacturing | 30.7% |
| Wholesale and retail trade | 30.2% |
| Other services | 26.7% |
The right reading of the GASTAT table is that the gap follows the type of data, not the size of the enterprise. Sectors whose work produces ready digital data, such as telecoms and finance, went first; sectors whose data still sits in paper invoices and scattered spreadsheets came later. The AI decision in a mid-sized enterprise therefore starts with the data question before the tool question, and whoever starts with the tool buys a system that finds nothing to feed on.
Where the remaining two thirds should start
The right starting point for AI differs by sector because the costly decision differs. In retail the costly decision is purchase quantity and stock location; in contracting it is the scheduling of crews and equipment across sites; in professional services it is bid pricing and collection forecasting; in manufacturing it is maintenance before the stoppage rather than after. The common denominator is that the decision repeats daily, has at least three years of historical data, and its error can be measured in riyals. An enterprise that starts from a decision with those three properties reaches a presentable result in one quarter; one that starts from “a smart assistant for staff” gets a pleasant experience the board cannot price.
Four steps to a decision that is not cancelled after six months
- Pick one operating decision that repeats daily and costs money when it is wrong: ordering, pricing, scheduling or collection.
- Measure the current cost of error in riyals for a full quarter before any trial; that is the baseline the project will be judged against.
- Check the legality of the data before collecting it: whose it is, for what purpose, whether consent is needed, and where it is processed.
- Trial in one unit for ninety days with one metric, then decide to scale or stop on numbers, not impressions.
IAD Business Services Group observes that AI projects cancelled in their sixth month almost all skipped the second step. Without a measured baseline nobody can prove the system saved anything, so the board discussion moves from numbers to tastes, and tastes lose at the first budget squeeze.
The statutory limit that precedes the tool
The Personal Data Protection Law defines what an enterprise may feed into any AI model. Article 5 of the Personal Data Protection Law, issued by Royal Decree M/19 dated 9/2/1443H and amended by Royal Decree M/148, provides that personal data may not be processed “or the purpose of its processing changed” except with the consent of the data subject, save in the cases the law specifies. Changing the purpose is exactly what happens when customer data collected for invoicing is used to train a recommendation or pricing model.
Article 10 of the Personal Data Protection Law adds two constraints: personal data is collected directly from the data subject and processed for the purpose for which it was collected. Article 29 restricts the transfer of personal data outside the Kingdom to conditions set by the regulations, which directly touches any cloud AI tool that processes data on servers abroad. Article 20 requires the enterprise to notify the competent authority as soon as it learns of a data leak or unlawful access, and to notify the data subject immediately where the leak could cause serious harm. Four articles are enough to turn “let's try a tool” into a decision with a named owner and a compliance budget calculated before the licence budget, not after it. The question IAD Business Services Group asks in the first meeting is not “which tool?” but “which data, under which permission, and processed in which country?”, because the answer rules out half the tools on offer before their prices are compared.
- Is the data personal or operational? Aggregated sales data without customer identity sits outside most of the constraints.
- Is the new purpose covered by the original consent? If not, Article 5 requires new consent.
- Where is the data processed? Inside or outside the Kingdom; the answer decides whether Article 29 applies.
- Who notifies the authority, and when, if a leak occurs? A person's name, not a department's.
A worked example: a retail chain, figures disguised
A Saudi retail chain with forty branches, revenue of SAR 200 million, average inventory of SAR 30 million, and 8% of inventory marked down or written off each year, a measured annual loss of SAR 2.4 million. The chosen operating decision: demand forecasting at branch and item level to reduce over-purchasing. The investment: SAR 1.8 million in the first year, covering three years of data cleaning, the system licence and training for the purchasing team, then SAR 400 thousand a year.
| Item | Before | After a 90-day trial in 8 branches | Scaled to 40 branches |
|---|---|---|---|
| Dead stock | 8% of inventory | 5.5% | 5.5% target |
| Measured annual loss | SAR 2.4 million | SAR 1.65 million (annualised) | SAR 1.65 million |
| Annual saving | None | SAR 750 thousand (annualised) | SAR 750 thousand, plus SAR 750 thousand of working capital released once |
| Investment | Not applicable | SAR 300 thousand | SAR 1.8 million, then SAR 400 thousand a year |
The arithmetic settles the decision for this retail chain. An annual saving of SAR 750 thousand from write-offs alone gives a payback of about 2.4 years on SAR 1.8 million, a period many boards reject. Adding the effect of a 2.5% reduction in average inventory, SAR 750 thousand of working capital released once, brings payback down to about 1.4 years. The difference between the two figures is the difference between a project that is approved and one that is postponed, and it is visible only to those who measured the baseline. The data used here is operational, not personal, so the statutory constraints stay limited; but the same chain, if it wanted to personalise offers to named customers, would fall directly under Article 5.
What AI does not do
An AI model does not repair bad data and does not take a decision nobody owns. In the mandates IAD Business Services Group has worked on, more than half of the first project's effort went to cleaning data and unifying item and branch names, not to the model itself; that is not a flaw in the project, it is the project. An enterprise that expects the tool to leap over that stage pays for it twice.
- It does not replace an absent decision owner: the model proposes the order quantity; the purchasing manager signs, and if unconvinced, quietly disables the system.
- It is useless without a baseline: a 30% improvement on a number nobody measured is zero in the boardroom.
- It does not scale from one successful branch without retesting: the branch where the trial worked differs in location, season and team from the other forty.
IAD Business Services Group works, within its technology and digital transformation practice, on the decision before the tool: selecting the operating decision, measuring the baseline, statutory verification, and designing the ninety-day trial, leaving the choice of technology vendor until after that. The order is not a methodological preference; it is what makes the number at the end of the trial defensible.
Conclusion
The AI decision in a mid-sized enterprise is an operating and statutory decision before it is a technical one. The General Authority for Statistics says 33.1% of establishments have started; the Personal Data Protection Law says what may go into the model; and simple arithmetic says which project deserves it. An enterprise that starts from one measured decision, permitted data and a ninety-day trial reaches the leading third at a cost its board knew in advance.
An enterprise does not need artificial intelligence. It needs one operating decision that fails at a known cost, and then a tool that lowers that cost.
Sources
- ICT access and use by establishments, 2025, General Authority for Statistics (33.1% and the sector breakdown).
- Personal Data Protection Law, Royal Decree M/19 (1443H) as amended, official text on the Bureau of Experts platform.