Generative AI that works on your own documents and your own rules

Most failed pilots skip the unglamorous part. The model is rarely the problem. What matters is the pipeline around it: which documents are ingested, how they are split, how the right passages are found for each question, and how the answer is checked before a person sees it. This pattern is called retrieval-augmented generation, or RAG, and it is how we keep answers tied to your content instead of the model's memory.

We start with one narrow use case, such as answering HR policy questions or drafting replies to supplier queries. We collect fifty to a hundred real questions from the people who will use it, and that list becomes the test set. Every change we make is measured against it. If a new prompt or a new model makes answers worse, we see it before you do.

There are three realistic options. You can call a hosted model through a cloud API, which is fastest to start and cheapest at low volume. You can run the model in a private cloud tenancy, which keeps prompts inside an environment you control. Or you can run an open model on infrastructure inside the Kingdom, which gives the strongest answer to data residency questions but needs more engineering and a capable GPU budget.

The right choice depends on what the prompts contain. Public marketing copy can go to an API. Employee records, patient data or customer contracts usually should not. We put the comparison in writing at the end of the first stage, including cost drivers: token volume, document size, concurrency and how often the index is rebuilt. You decide with the numbers in front of you.

If prompts or documents contain personal data, the Personal Data Protection Law applies to how that data is collected, stored, transferred and deleted. SDAIA publishes the law and its implementing regulations, and its AI ethics principles are a useful checklist for transparency and human oversight. We design logging and deletion so a data-subject request can actually be carried out, and we avoid sending personal data outside the Kingdom unless the legal basis for the transfer is clear.

For regulated sectors and government-linked buyers, cloud and cybersecurity requirements from the National Cybersecurity Authority and the communications regulator may also apply to the hosting choice. We build to those requirements where they apply and flag early when a use case should stay on infrastructure inside the Kingdom. A pilot usually takes six to ten weeks. A production rollout with integrations and access control takes a further four to eight.