Internal Management Center

• AI - Artificial Intelligence: Technology that performs tasks requiring human-like reasoning, prediction, generation, or decision support.
• Cortex: NABDs.AI's governed AI platform layer for agents, workflows, knowledge, controls, and enterprise AI operations.
• PDPL - Personal Data Protection Law: Saudi Arabia's personal data protection law governing how personal information is collected, used, stored, shared, and protected.
• SDAIA - Saudi Data & Artificial Intelligence Authority: Saudi national authority responsible for data and AI strategy, policy, and enablement.
• NCA - National Cybersecurity Authority: Saudi authority responsible for national cybersecurity governance and controls.
• DLP - Data Loss Prevention: Controls that prevent sensitive information from being leaked, shared, copied, or uploaded improperly.
• LLM - Large Language Model: An AI model trained to understand and generate language, such as chat, summaries, analysis, or code.
• RAG - Retrieval Augmented Generation: A method where AI answers are grounded in approved documents or databases retrieved at runtime.
• SME - Subject Matter Expert: A qualified person who can validate content in a specific domain such as healthcare, law, finance, cybersecurity, or architecture.
• RBAC - Role-Based Access Control: Access permissions based on a user's role, such as administrator, reviewer, developer, or business user.
• MFA - Multi-Factor Authentication: Login protection requiring more than one proof of identity.
• PII - Personally Identifiable Information: Information that can identify a person, such as name, phone, national ID, or address.
• PHI - Protected Health Information: Health-related information tied to a patient or individual.
• API - Application Programming Interface: A controlled method for systems to exchange data or trigger actions.
• KPI - Key Performance Indicator: A measurable indicator used to track business or operational performance.
• GTM - Go To Market: The plan for launching, selling, and scaling a product or service.
• RACI - Responsible, Accountable, Consulted, Informed: A responsibility model clarifying who does the work, owns the outcome, provides input, and receives updates.

Purpose

Establishes how NABDs.AI creates, stores, protects, retains, archives, and disposes of AI-related records, including prompts, outputs, approvals, agent logs, model records, incidents, and audit evidence.

Scope

This policy applies to all NABDs.AI employees, contractors, partners, Cortex administrators, AI product teams, customer delivery teams, and any system that creates or stores AI-related records.

Mandatory Requirements

• Every AI system must define record categories before production use.
• Prompts, outputs, agent actions, approvals, and model changes must be retained based on business, legal, contractual, and regulatory requirements.
• Restricted or regulated records must not be stored indefinitely without approved retention justification.
• Deletion must be controlled, logged, and approved when records are subject to legal, healthcare, government, or customer obligations.
• Audit evidence must remain tamper-resistant and traceable to user, model, agent, data source, and approval workflow.

Cortex Platform Controls

Cortex should include retention labels, legal hold capability, immutable audit logs, approval history, exportable evidence packages, and automated deletion workflows based on classification.

Saudi Market Alignment

Supports Saudi Personal Data Protection Law expectations around data lifecycle management and accountability, and helps demonstrate evidence readiness for ministries, healthcare organizations, and regulated enterprises.

Non-Compliance

Violations may result in access suspension, governance escalation, remediation requirements, disciplinary action, contract remedies, or regulatory notification where required.

Purpose

Defines how Cortex is governed as a controlled enterprise AI platform, including ownership, tenancy, access, releases, configuration, integrations, and operational responsibilities.

Scope

Applies to all Cortex environments, including internal NABDs.AI use, customer deployments, healthcare deployments, government deployments, pilots, sandboxes, and production tenants.

Mandatory Requirements

• Every Cortex environment must have a business owner, technical owner, security owner, and governance owner.
• Production tenants must be isolated from demo, sandbox, and development tenants.
• Platform changes must follow release management and change approval processes.
• Only approved administrators may configure models, agents, knowledge bases, connectors, and governance rules.
• Tenant access, privileged access, and administrative actions must be logged and reviewed.

Cortex Platform Controls

Cortex should provide tenant isolation, admin role separation, configuration baselines, environment promotion controls, release logs, privileged access review, and customer-specific governance dashboards.

Saudi Market Alignment

Supports sovereign AI expectations in Saudi Arabia by demonstrating controlled platform administration, separation of customer environments, and governance traceability.

Non-Compliance

Violations may result in access suspension, governance escalation, remediation requirements, disciplinary action, contract remedies, or regulatory notification where required.

Purpose

Controls the selection, approval, use, monitoring, versioning, and retirement of AI models used by NABDs.AI and Cortex.

Scope

Applies to commercial models, open-source models, fine-tuned models, embedded models, classification models, generative models, and any model used in production or customer-facing workflows.

Mandatory Requirements

• All production models must be registered in an approved model registry.
• The registry must document model provider, version, owner, purpose, risk level, allowed data classifications, and approval status.
• Model upgrades must be tested before production use.
• High-risk models require bias, security, privacy, performance, and explainability review.
• Models must be retired when unsupported, unsafe, inaccurate, non-compliant, or replaced.

Cortex Platform Controls

Cortex should include a model registry, model risk scoring, approved model list, version controls, rollback capability, performance monitoring, and model retirement workflows.

Saudi Market Alignment

Supports Saudi market trust by showing customers that NABDs.AI does not use uncontrolled or unknown models for regulated, healthcare, or government workloads.

Non-Compliance

Violations may result in access suspension, governance escalation, remediation requirements, disciplinary action, contract remedies, or regulatory notification where required.

Purpose

Defines how enterprise knowledge, documents, data sources, vector stores, and Retrieval Augmented Generation workflows are governed.

Scope

Applies to all Cortex knowledge bases, document uploads, indexed repositories, embeddings, vector databases, search connectors, and context sources used by AI systems.

Mandatory Requirements

• Every knowledge source must have an owner, classification, source of truth, review cycle, and access rule.
• Restricted data must not be indexed into shared knowledge repositories.
• Users may only retrieve knowledge they are authorized to access.
• Outdated or unverified knowledge must be removed or clearly marked.
• AI outputs based on retrieved knowledge should include source references where feasible.

Cortex Platform Controls

Cortex should enforce access-aware retrieval, source attribution, document lineage, vector-store isolation, content freshness checks, approval workflows, and knowledge quality scoring.

Saudi Market Alignment

Supports Saudi regulated-sector deployments where customers expect data sovereignty, source control, reliable retrieval, and no cross-customer data exposure.

Non-Compliance

Violations may result in access suspension, governance escalation, remediation requirements, disciplinary action, contract remedies, or regulatory notification where required.

Purpose

Ensures that AI vendors, model providers, data providers, software platforms, cloud services, and external tools are evaluated before purchase or use.

Scope

Applies to procurement, contracting, pilots, subscriptions, open-source adoption, vendor integrations, and partner-provided AI capabilities.

Mandatory Requirements

• No AI vendor may be used for business or customer data without approval.
• Vendor assessments must include security, privacy, compliance, data residency, model usage, intellectual property, and incident response.
• Contracts must define data ownership, data retention, confidentiality, audit rights, breach notification, and subcontractor controls.
• High-risk vendors require legal, security, and governance review.
• Unapproved personal AI subscriptions may not be used for NABDs.AI business work.

Cortex Platform Controls

Cortex should maintain an approved vendor registry, vendor risk status, permitted use cases, contract restrictions, and automated blocking of unapproved AI services where possible.

Saudi Market Alignment

Supports procurement confidence for Saudi ministries and enterprises by showing structured third-party governance, not ad hoc tool adoption.

Non-Compliance

Violations may result in access suspension, governance escalation, remediation requirements, disciplinary action, contract remedies, or regulatory notification where required.

Purpose

Defines how risks from third-party AI providers, APIs, plugins, connectors, agents, datasets, and infrastructure services are identified, assessed, monitored, and remediated.

Scope

Applies to any external dependency that supports NABDs.AI AI systems or Cortex workloads.

Mandatory Requirements

• Third-party AI risks must be assessed before integration and monitored during operation.
• Critical providers must have documented exit plans and fallback options.
• Third-party APIs must use least-privilege access and secure credential handling.
• External tools must not receive restricted data unless explicitly approved.
• Vendor incidents must be reviewed for customer and regulatory impact.

Cortex Platform Controls

Cortex should include provider health monitoring, connector permission governance, third-party risk dashboards, integration logs, and emergency disable controls.

Saudi Market Alignment

Supports Saudi sovereign and regulated AI expectations by reducing dependency risk and proving external providers are actively governed.

Non-Compliance

Violations may result in access suspension, governance escalation, remediation requirements, disciplinary action, contract remedies, or regulatory notification where required.

Purpose

Establishes mandatory AI literacy, responsible AI training, security awareness, and role-based certification for users of AI systems.

Scope

Applies to employees, contractors, consultants, partners, administrators, developers, data scientists, product teams, sales teams, and executives.

Mandatory Requirements

• All personnel must complete baseline AI usage training before using approved AI tools for work.
• Users handling Confidential or Restricted data must complete enhanced data-handling training.
• Developers and administrators must complete secure AI development and Cortex governance training.
• Healthcare and government project teams must receive sector-specific AI governance training.
• Training completion must be recorded and refreshed periodically.

Cortex Platform Controls

Cortex should include training assignments, acknowledgement tracking, policy quizzes, role-based learning paths, certification status, and access gating based on completion.

Saudi Market Alignment

Supports Saudi workforce enablement and Vision 2030 capability-building by making responsible AI adoption part of the operating model.

Non-Compliance

Violations may result in access suspension, governance escalation, remediation requirements, disciplinary action, contract remedies, or regulatory notification where required.

Purpose

Defines patient safety, clinical oversight, validation, privacy, accountability, and explainability requirements for AI used in healthcare contexts.

Scope

Applies to healthcare command centers, clinical decision support, population health analytics, hospital operations, patient communications, medical summarization, and healthcare AI agents.

Mandatory Requirements

• AI must assist healthcare professionals; it must not independently diagnose, prescribe, or override clinical judgment.
• Healthcare AI outputs that may affect patient care require qualified clinical review.
• Patient data must be processed only in approved, secure, and authorized environments.
• Clinical AI systems must be validated for safety, accuracy, fairness, and intended use.
• Healthcare AI incidents must be escalated through governance and clinical safety channels.

Cortex Platform Controls

Cortex should provide clinical review workflows, patient-data controls, role-based access, source traceability, explainability, clinical risk scoring, and human approval gates.

Saudi Market Alignment

Supports Saudi healthcare transformation while respecting patient safety, privacy, and clinical accountability expectations.

Non-Compliance

Violations may result in access suspension, governance escalation, remediation requirements, disciplinary action, contract remedies, or regulatory notification where required.

Purpose

Defines governance for AI systems used with ministries, municipalities, public services, smart cities, government data, and citizen-facing workflows.

Scope

Applies to all public sector engagements, government pilots, sovereign AI deployments, citizen services, public dashboards, and ministry-facing Cortex tenants.

Mandatory Requirements

• Government data must be classified and handled according to customer, contractual, and regulatory requirements.
• Citizen-impacting AI outputs require transparency, auditability, and human accountability.
• Public-sector AI systems must maintain clear ownership and approval pathways.
• Sovereign or restricted data must remain in approved environments.
• AI must not make final legal, eligibility, enforcement, or citizen-rights decisions without authorized human oversight.

Cortex Platform Controls

Cortex should support sovereign deployment options, ministry-specific tenant controls, citizen-data protections, public-sector audit logs, and approval workflows.

Saudi Market Alignment

Aligns NABDs.AI with Saudi public-sector expectations for sovereignty, citizen trust, transparency, and accountability.

Non-Compliance

Violations may result in access suspension, governance escalation, remediation requirements, disciplinary action, contract remedies, or regulatory notification where required.

Purpose

Establishes a structured process for identifying, assessing, treating, accepting, monitoring, and reporting AI risks across NABDs.AI and Cortex.

Scope

Applies to all AI initiatives, models, agents, products, pilots, customer deployments, and internal AI use cases.

Mandatory Requirements

• Every AI initiative must complete risk classification before production.
• Risk assessments must consider security, privacy, ethics, legal, clinical, operational, reputational, and financial impact.
• High and critical risks require documented mitigation and formal acceptance.
• Risk status must be reviewed periodically and after major changes.
• AI risk reporting must be available to governance leadership.

Cortex Platform Controls

Cortex should include risk scoring, risk registers, control mapping, mitigation tracking, exception management, and executive risk dashboards.

Saudi Market Alignment

Supports enterprise and government buyer confidence by showing mature AI risk governance aligned with international and Saudi expectations.

Non-Compliance

Violations may result in access suspension, governance escalation, remediation requirements, disciplinary action, contract remedies, or regulatory notification where required.

Purpose

Defines how NABDs.AI identifies, reports, triages, investigates, remediates, and learns from AI-related incidents.

Scope

Applies to incidents involving AI outputs, model behavior, privacy, hallucinations, bias, unsafe recommendations, agent misuse, data leakage, or compliance failures.

Mandatory Requirements

• All AI incidents must be reported through approved channels.
• Incidents must be classified by severity, impact, affected users, affected customers, and regulatory implications.
• High-severity incidents require containment, investigation, customer impact assessment, and governance review.
• Corrective actions must be tracked to closure.
• Lessons learned must update policies, prompts, models, controls, or training where needed.

Cortex Platform Controls

Cortex should include incident intake, severity scoring, prompt/output preservation, agent suspension, evidence export, remediation workflow, and incident dashboards.

Saudi Market Alignment

Supports trust with Saudi healthcare, government, and enterprise customers by proving NABDs.AI can detect and respond to AI failures responsibly.

Non-Compliance

Violations may result in access suspension, governance escalation, remediation requirements, disciplinary action, contract remedies, or regulatory notification where required.

Purpose

Establishes audit, assurance, evidence collection, control testing, and reporting requirements for NABDs.AI AI governance.

Scope

Applies to AI policies, Cortex controls, model governance, agent governance, data handling, security, privacy, output validation, and customer commitments.

Mandatory Requirements

• AI controls must be auditable and evidence must be retained.
• Internal audits must test policy compliance, access controls, model approvals, agent permissions, and output validation.
• High-risk deployments may require independent review or customer audit support.
• Audit findings must have owners, due dates, and remediation tracking.
• Evidence must be reliable, complete, and protected from unauthorized modification.

Cortex Platform Controls

Cortex should provide audit evidence packs, control dashboards, approval records, immutable logs, compliance mappings, and exportable reports.

Saudi Market Alignment

Helps NABDs.AI compete in Saudi regulated sectors where ministries, hospitals, and enterprises require auditability before adopting AI platforms.

Non-Compliance

Violations may result in access suspension, governance escalation, remediation requirements, disciplinary action, contract remedies, or regulatory notification where required.

Purpose

Defines how NABDs.AI maintains AI service continuity during model outages, provider failures, cyber incidents, data unavailability, infrastructure disruption, or agent malfunction.

Scope

Applies to Cortex, customer AI deployments, internal AI tools, critical agents, model providers, knowledge repositories, and integrations.

Mandatory Requirements

• Critical AI services must have continuity and recovery plans.
• Provider dependency risks must be documented with fallback options where feasible.
• Critical agents must support safe pause, rollback, or manual override.
• Recovery procedures must be tested periodically.
• Customer-facing services must define communication and escalation procedures for major disruptions.

Cortex Platform Controls

Cortex should include failover models, backup knowledge stores, degraded-mode operation, agent kill switches, disaster recovery logs, and service health dashboards.

Saudi Market Alignment

Supports Saudi enterprise and government readiness by proving AI capabilities can remain reliable, controlled, and recoverable during disruptions.

Non-Compliance

Violations may result in access suspension, governance escalation, remediation requirements, disciplinary action, contract remedies, or regulatory notification where required.