Cloud and AI adoption is changing the basic assumption about enterprise data: that organisations understand where their information is and who can access it – it was quite straightforward in a traditional IT environment. 

With cloud services, that environment is much more distributed. Add AI, global support teams and third-party subprocessors, and a single business application involves data storage, processing, multi jurisdictional access. 

For organisations operating in the GCC (Gulf Cooperation Council), this creates governance challenges that cannot be addressed by the cloud provider. It necessitates the need to demonstrate control throughout the data lifecycle.

Take Saudi Arabia, for example. The Kingdom’s Personal Data Protection Law and Regulation on Personal Data Transfer Outside the Kingdom establish regulations to transfer or disclose personal data outside the country. 

In specific cases, controllers must conduct a risk assessment that considers the purpose and legal basis for the transfer, the nature and geographical scope of processing, safeguards, data minimisation and the potential impact on data subjects.

The National Cybersecurity Authority’s Cloud Cybersecurity Controls add another layer. The current CCC-2:2024 controls address cloud cybersecurity from the perspectives of both cloud service providers and cloud service tenants and have been updated to reflect changes related to data localisation.

The data flow is bigger than the contract

When businesses evaluate a cloud or AI service, the assessment often begins with the vendor and its contract. While critical, the complete data flow lacks visibility. 

For example, Saudi organisations using HR platforms hosted by a global cloud provider collects employee information in the country, while the application may be hosted across multiple regions. This necessitates a meaningful governance assessment that follows the data.

Organisations should understand what information is collected, where it is stored, where processing occurs, which countries can access it, which subprocessors are involved, and what happens to the information when the service is no longer required. 

For AI-enabled services, it also needs to establish if information is sent to an external model, how it is retained, and whether it can be used for purposes such as model improvement.

Privacy compliance is only one part of the decision

Another common mistake is to treat cross-border data transfers, cybersecurity and contractual controls as separate compliance activities.

The privacy team may assess whether a transfer is permissible. Cybersecurity may evaluate the provider’s technical safeguards. Legal may negotiate data-processing terms, while procurement assesses the vendor and commercial relationship. While necessary, these assessments should be connected.

For example, a contract may require data to remain within certain boundaries, while allowing administrator access from another country. A vendor may provide strong security controls but rely on an unauthorised subprocessor. An AI capability may be introduced into an existing platform after the initial vendor review.

When compliance is managed using isolated checklists, these issues may not be visible. Governance model brings them together.

Saudi Arabia’s transfer regulation reflects this risk-based approach. Where a transfer risk assessment is required, it takes purpose, processing activities, geographical scope, safeguards, data minimisation and potential impact into consideration.

What should leadership know before approving a cloud or AI service?

For legal leaders or procurement executives, the question should be about adequate evidence to make an informed risk decision.

Before approving a service that processes personal or regulated data, leadership should have visibility into the data involved, its classification and purpose, the jurisdictions in which it will be stored or processed, and the people and organisations that may access it.

They should also understand the applicable transfer mechanism, the security controls protecting the information, the provider’s subprocessors, contractual obligations, AI-specific processing practices and the organisation’s ability to retrieve and securely delete its data post usage.

This evidence should not be scattered across procurement documents, spreadsheets, contracts and email threads. It should be connected to the organisation’s broader risk and compliance framework to enable decision-makers to see the risks, controls, owners, exceptions and remediation actions.

Post implementation

Vendor approval is not the end of the process. It is the point at which ongoing governance begins.

As cloud environments introduce new subprocessors, modify infrastructure, expand AI capabilities and change how services are delivered. A data flow that was initially acceptable may look very different a year later.

Recognising this, Saudi Arabia’s NCA controls address data transfer security, cloud data protection,  and exit strategies (secure disposal and transfer of data and virtual infrastructure).

This means organisations need mechanisms to identify material changes, reassess risk, track control performance and maintain evidence of compliance.

With increasing AI integration across enterprise applications, it can change the way data is processed without changing the application or vendor relationship. Governance teams need to understand how their underlying capabilities are evolving.

From data localisation to data accountability

The GCC’s cloud and AI governance challenge is often framed around data localisation – though the real challenge is accountability across a distributed technology environment.

The leadership question should evolve from “Where is our data stored?” to something much more useful: “Can we demonstrate how our data is being handled from collection through deletion, including every material third party and jurisdiction involved?”

That shift in thinking will become increasingly important as organisations across the GCC accelerate cloud adoption and incorporate AI into business processes.

The organisations that approach this as a governance problem, rather than simply a hosting or compliance problem, will be better positioned to adopt new technology without losing visibility or control over the data that enables their business.