Scope before assurance
NCA Compliance for AI Systems
Assess an AI deployment against the right NCA scope, current ECC and CCC versions, shared responsibilities and service-specific control evidence.
“Is this AI system NCA compliant?” is incomplete until the buyer identifies the entity, deployment, applicable controls and evidence. A model is only one component of a service that may also include identity systems, document stores, orchestration, external APIs, support access and operational procedures. Assessing a product brochure cannot settle the compliance of that whole arrangement.
This guide is for Saudi cybersecurity, architecture and procurement teams preparing an AI deployment for a scoped review. It uses the NCA's current ECC 2:2024 and CCC 2:2024 publications, checked on 22 October 2026. The proposed evidence worksheet is a way to organise the assessment; it is not an official NCA control set or certification.
Confirm entity scope before building a control matrix
ECC 2:2024 covers Saudi government agencies and affiliated entities, including affiliations outside the Kingdom, and private entities owning, operating or hosting critical national infrastructure. Other entities are encouraged to use the controls. Applicable controls also depend on the entity's activities and technologies.
Record the legal entity, relevant business activity and basis for the scope decision. Check whether a sector requirement, customer contract or group policy creates additional obligations. “We are a private company” and “our customer is governmental” are both insufficient as standalone conclusions. Ask the responsible compliance owner to document the relationship and the requirements flowing through it.
CCC 2:2024 applies to in-scope government and critical-infrastructure cloud tenants and providers serving them. It distinguishes provider and tenant responsibilities. A company should determine its role and service boundary before choosing the assessment evidence.
Keep the result within the wider AI governance process. A security applicability decision does not itself answer whether the business purpose is acceptable, whether personal-data processing is appropriate or who may authorise an agent's actions.
Do not copy an obsolete localisation statement
CCC 2:2024 Annex D removes the earlier localisation subcontrols 2-3-p-1-10 and 2-3-p-1-11 and directs entities to NDMO on localisation. Therefore, an old CCC checklist is not a sufficient basis for a current location decision; use the current NCA publication and applicable data requirements.
Create a location map covering more than primary storage. Identify where prompts, retrieved documents, outputs, logs, backups and support access are handled. Record the evidence source and unresolved locations. A locally hosted application can still call an external model or send diagnostic information to another service. Equally, the presence of a foreign supplier does not by itself establish where every processing activity occurs.
Have the relevant data and legal owners decide which location and transfer rules apply to the actual information and entity. Include contractual commitments in that review. A regional label in a sales document should lead to a precise service configuration and contract description, not an assumption that every requirement has been satisfied.
Draw the assessed system boundary
Place the user, authentication service, application, knowledge stores, model service, action tools and monitoring arrangements on one architecture view. Mark each organisation that operates a component. Show data flows and administrative access separately; people maintaining a service can create a different exposure from normal user requests.
Then identify actions with consequences. Reading a policy document, preparing an ERP change and committing that change require different evidence. Ask which identity the action uses, where its authority is limited, how a reviewer sees the proposed change and how an unexpected action is contained. Do not infer these controls from a model's ability to follow instructions.
Give the boundary a version and date. A favourable assessment of a drafting assistant should not quietly become an assessment of the same assistant after transaction authority is added. Changes in retrieval sources, vendors, support arrangements or connected systems may also require a new applicability or evidence review.
Build an evidence worksheet that exposes responsibility gaps
| Assessment question | Evidence to examine | Responsibility to resolve |
|---|---|---|
| Who can use and administer the service? | Role assignments, access approvals and removal tests | Tenant identity owner and provider administrator |
| What can an agent change? | Tool permissions, transaction boundaries and rejected-action tests | Application owner and target-system owner |
| Where does information travel? | Data-flow diagram, service configuration and subprocessors | Data owner, supplier and contract owner |
| Can the organisation investigate an event? | Representative records with timing, actor and outcome | Operations and security monitoring teams |
| Can service be contained and restored? | Exercise results, recovery dependencies and fallback capacity | Service owner and continuity lead |
| What changes invalidate existing evidence? | Release history, change notices and reassessment rules | Supplier manager and release authority |
Add the actual control reference, applicability rationale, evidence date, test result, gap owner and due date alongside each relevant row. The official control text remains authoritative for the assessment. This worksheet helps the team find evidence; it does not replace a full mapping or introduce new NCA requirements.
Distinguish “documented”, “implemented” and “tested”. A policy may require access removal, but an observed removal test shows whether the configuration behaves as intended. A supplier may operate a control while the tenant must configure its use. Record both responsibilities instead of marking the row complete because one party supplied a statement.
Evaluate cloud and SaaS evidence in the correct scope
Request assurance materials for the exact service, region, operating entity and period under consideration. Read exclusions and customer responsibilities. A report about the supplier's infrastructure may leave application permissions, prompts, knowledge access and business approval rules entirely with your organisation.
If evidence cannot be shared openly, agree a controlled review route appropriate to the information. Ask whether a summary, supervised review or independent report can answer the question. Record any remaining limitation and its decision consequence. Confidentiality is a reason to manage evidence access; it is not evidence that a control works.
The AI vendor due diligence guide provides a claim-to-evidence method. Keep commercial deadlines separate from security conclusions. A procurement team may negotiate staged commitments while the relevant owner resolves an assessment gap, but a signature should not silently convert missing evidence into acceptance.
Worked example: a knowledge assistant with an ERP action
Consider a fictional in-scope organisation using a cloud assistant to answer maintenance procurement questions. The first release retrieves approved manuals. A later proposal adds the ability to draft purchase requisitions and submit them to an ERP system.
The assessment now needs more than a repeat of the document-access review. Establish whether the ERP tool uses the requesting person's authority or a shared service identity, whether suppliers and amounts are bounded, and whether a rejected requisition can still be submitted. Confirm which team investigates an attempted unauthorised action and who can disable the tool while preserving the read-only service.
An acceptable initial decision might permit draft creation only, conditional on verified access and information handling. Submission remains unavailable until its separate control evidence is complete. This is a specific operating boundary, not a general claim that the model has passed NCA compliance.
Manage gaps and preserve the assessment's useful life
Describe each gap as an unresolved requirement or failed control with a consequence. Avoid entries such as “improve AI security” that have no completion evidence. Route material residual decisions through the AI risk register and the organisation's authorised process. Some gaps require stopping a proposed use; others may support a narrower scope while treatment proceeds.
Before release, have an appropriately independent reviewer inspect the evidence relevant to their remit. Define the limits of that review through AI audit and assurance. After release, retain the approved configuration and reassess material changes as part of the pilot-to-production handover.
Open for AI's agentic AI consulting can help map system boundaries, workflow authority and evaluation needs. Bring a redacted architecture, the current applicability decision and a supplier responsibility matrix to discuss the evidence your AI deployment needs. Specialist compliance interpretation and acceptance responsibilities should be explicit in the engagement.
FAQ
Your questions, answered.
Does every Saudi SME have identical NCA obligations?
No. Establish the entity's applicable scope, activity and relevant contractual or sector requirements before choosing the control set. A company may also adopt controls as internal practice. Record why each requirement applies and who owns that interpretation instead of treating company size or the presence of AI as a complete answer.
Can a supplier's certificate establish compliance for our AI deployment?
Evaluate the document's actual scope, issuer, validity and exclusions. Supplier evidence may address only part of the service. Your organisation still needs evidence for its configuration, information use, access and business actions. Avoid converting a narrow certificate or report into a claim about the entire deployment.
Is Saudi hosting enough to complete the assessment?
Hosting location is one input. Map all processing, logs, backups, external services and support access, then assess the applicable information requirements. The deployment also needs evidence about identity, permissions, monitoring, recovery and responsibility. A location label cannot answer those questions or establish the suitability of an agent's action authority.
What should a SaaS buyer request from the provider?
Request service-specific assurance, data-flow and location details, customer responsibilities, administrative access arrangements, incident cooperation and change notices. Check whether the evidence covers the purchased configuration. Where documents are restricted, agree a controlled inspection or other credible evidence route and record the questions that remain unanswered.
When should an AI security assessment be revisited?
Revisit it when a change affects the assessed boundary or assumptions: new action permissions, knowledge sources, suppliers, processing locations, administrative access or operating arrangements. A model update can also require targeted retesting. Define triggers and the responsible owner in the original release decision so reassessment is not left to informal judgment.
How can an assessment proceed when a supplier will not share detailed evidence?
Clarify exactly which question the missing material must answer. Consider supervised review, a suitably scoped independent report or a demonstration in an agreed environment. If uncertainty remains, document it and assess a narrower deployment or another supplier. Commercial urgency does not make an unsupported control claim reliable.