A full 30-question diagnostic of your organisation's readiness against PDPL, SDAIA AI Ethics, NCA ECC-2:2024, and ISO/IEC 42001:2023. This sample reflects a fictional Saudi mid-market retail group.
A score below 40 means the foundations of an AI Management System are not in place. Controls exist informally, none are documented, and there is no Data Protection Officer to respond if SDAIA or a customer files a request. The five dimensions below show where the work concentrates. Three pages of detail follow for each.
The Profectus scorecard runs 30 questions across five dimensions. Each question is mapped to a specific clause in PDPL, SDAIA AI Ethics v2.0, NCA ECC-2:2024, or ISO/IEC 42001:2023. There are no generic best-practice questions. Every answer affects one or more framework coverage scores.
Tests whether an AI policy, AI Management System, AI register, and risk classification process are in place. Governance is the structural layer that lets every other dimension be sustained. Without it, controls exist informally and fail the documentation test.
Clause 5.2 requires a documented AI policy signed by top management. No such document exists. The CEO has stated principles verbally; nothing is written, nothing is communicated to staff.
Annex A.6.2.6 requires an inventory of AI systems with a defined set of metadata per entry. There is no such inventory. The four production AI systems are tracked informally in different team folders.
Principle 3.2 requires controllers to tier AI systems by impact on individuals. Candidate screening is a high-impact use case under SDAIA's working definition and should sit at the top of the tier. It is currently treated as routine IT.
The candidate-screening tool went live in 2025 without an impact assessment. The demand-forecasting model is in its second year of operation; no scheduled review.
Tests whether personal data flows have a documented legal basis, a Data Protection Officer, a Record of Processing Activities, and the disclosures PDPL requires from a controller. PDPL has been actively enforced since Q3 2024 and is the dimension with the most public enforcement decisions to date.
Article 32 requires controllers that process sensitive data or systematically monitor data subjects to appoint a DPO. Customer purchase profiling across 14 stores crosses both thresholds. Without a DPO, the 30-day data subject response SLA cannot be met.
Article 6 enumerates the six lawful bases for processing personal data. Phone numbers, national IDs (warranty), and purchase history are collected at all stores. Loyalty program enrolments rely on assumed consent at checkout. None of these flows are tied to a documented Article 6 basis.
Article 31 requires controllers to maintain a Record of Processing Activities. The current spreadsheet covers HR but not retail customer data, e-commerce, or the chatbot. A stale RoPA fails the documentation test under both PDPL and ISO 42001 Cl. 7.5.
PDPL Art. 12 requires controllers to inform data subjects how their data is processed. SDAIA Principle 3.3 extends that to automated decisions. The chatbot does identify itself; the candidate-screening tool does not appear in the careers-page privacy notice; the loyalty profiling is not disclosed at signup.
Tests whether AI-specific risks (model drift, prompt injection, vendor model change, automated decision error) are named, tracked, and mitigated in a register, plus the discipline applied to AI vendor risk and security review.
The enterprise risk register lists "AI" as a top-level entry with no children. No system-level risk entries. No mitigation owners. No review cadence.
The four AI vendor contracts have no clauses on model change notification, training data provenance, or fallback behaviour on vendor service termination.
The four AI vendor contracts were signed without an ECC-2 assessment. The candidate-screening vendor is hosted outside KSA and the contract does not name a Saudi data residency requirement.
Clauses 9.1 and 10.2 expect controllers to monitor AI system performance and trigger corrective action when it degrades. The demand-forecasting model has no drift metric; the candidate tool has no precision tracking; the chatbot has no satisfaction or escalation rate review.
Tests whether meaningful human review is built into AI decisions, fairness testing is performed, transparency obligations to data subjects are met, and AI decisions are logged for audit. The candidate-screening tool and customer chatbot are the highest-risk surfaces here.
Principle 3.4 requires meaningful human oversight of AI decisions affecting individuals. Chatbot handoff to a human agent is set up. The candidate-screening tool has no documented review step before shortlist sign-off; the demand-forecasting model auto-orders without a buyer review threshold.
The vendor's marketing materials state the tool is "bias-free." No internal test, no demographic disaggregation, no rejection-rate analysis by nationality, gender, or age has been run.
Principle 3.3 requires data subjects to be informed when an automated system makes or substantially supports a decision affecting them. Three surfaces fail this test: the careers-page privacy notice, the loyalty signup, and the chatbot's escalation notice when handing off to a human.
Clause 8.4 requires controllers to retain evidence of AI system operation sufficient to demonstrate conformance. The candidate-screening tool overwrites past shortlists; the chatbot stores only the last 30 days; the demand forecaster does not retain inputs.
Tests the documented breach response procedure for PDPL events (72-hour SDAIA notification), the AI-specific incident playbook (prompt injection, model drift, automated decision error), and the access control and logging that make detection possible in the first place.
Article 20 sets a 72-hour SDAIA notification window for personal data breaches. The IT team has an informal escalation chain but no written procedure, no rehearsal, no roster.
Sub-control 2-13-3 requires documented incident response. The plan covers ransomware and phishing but has no playbook for AI-specific incidents like model drift, prompt injection on the chatbot, or candidate-tool decision error.
Sub-control 2-12 requires centralised logging of security-relevant events. The chatbot, candidate tool, and demand forecaster log locally only. No 90-day retention is configured. No alerting on anomalous activity.
Sub-control 1-3-3 requires individual accountability for privileged access. Three buyers share one admin login on the forecasting platform. There is no audit trail back to a specific person for parameter overrides.
Sequenced by regulatory exposure and dependency. Items 1 and 2 unblock everything else: without a DPO and a lawful-basis register, every PDPL response timeline starts with "we'll find someone." Item 3 gives the AI work a structural frame. Items 4 and 5 are the highest-impact ECC-2 fixes.
| # | Gap | Reference | Owner | Effort |
|---|---|---|---|---|
| 01 | No documented lawful basis for personal data processingMap every data flow into a lawful-basis register. Default to consent for marketing, contract for warranty, legitimate interest for fraud. | PDPL Art. 6 | DPO (interim) | 3–4 weeks |
| 02 | No Data Protection Officer appointedAppoint interim DPO from existing legal or compliance staff, then run 90-day brief to retain or contract a fractional DPO. | PDPL Art. 32 | CEO & Head of Legal | 2 weeks |
| 03 | No AI Management System or model inventoryStand up a 12-field AI register before any further AI procurement. Draft and sign a 1-page AI policy at the next board meeting. | ISO 42001 Cl. 4–10 | Head of IT | 4 weeks (register) |
| 04 | Shared admin credentials on AI platformsIssue individual admin accounts for forecasting, candidate, and chatbot platforms; rotate the shared credentials immediately. | NCA ECC-2 1-3-3 | Head of IT | 2 weeks |
| 05 | No fairness testing on candidate-screening toolRequest vendor fairness test results in writing; if none, run an internal disparate-impact check on the last 90 days of decisions. | SDAIA AI Ethics 3.1 | Head of HR & DPO | 3 weeks |
We work with KSA mid-market private companies, 100–1,000 staff, where AI is in production but governance is not. We do not serve enterprises, government entities, or international clients. We do not write generic frameworks with a Saudi cover sheet. Every artifact we produce is tied to a specific PDPL, SDAIA, NCA, or ISO 42001 clause.
Najm Retail Group is a fictional Saudi mid-market retail and logistics company built for this sample. Any resemblance to a real entity is unintentional. The scores, gaps, and recommendations reflect a plausible KSA mid-market reality circa 2026. The regulatory citations are real and current.