01
Exposure Mapping
Which obligations reach you, and in which role.
Before anything is assessed, one question has to be answered: which regimes actually apply to this organisation, to this system, and on what timeline. It sounds like a preliminary. It is not — the answer determines which obligations you carry, which ones fall on your vendor, and which deadlines are real for you. Organisations routinely assess themselves against the wrong perimeter, and the work is wasted.
What we establish
Regime — whether the EU AI Act reaches you, whether the Saudi stack reaches you, or both. Selling into the Union, being the local arm of a European group, or processing the personal data of Saudi residents each trigger a different answer.
Role — provider or deployer under the AI Act; controller or processor under the PDPL. These are not the same distinction and an organisation can be a deployer in Europe and a controller in the Kingdom simultaneously. Role determines who carries which obligation.
Role shift — branding, substantial modification and change of intended purpose can turn a deployer into a provider without anyone deciding to. We test for it explicitly.
Sector overlay — where SAMA, the SFDA or NCA controls reach the entity, and how they combine with PDPL and SDAIA rather than sitting beside them.
Timeline — what applies now, what applies from a dated deadline, and what is guidance that becomes binding only through a contract.
What you receive
A written scoping note, dated, naming the entity and the system, stating the regime, the role and the reasoning behind each.
A list of the obligations that reach you, with their legal force — binding, or guidance carried into effect by procurement — and their dates.
A clear statement of what does not apply to you, and why. This is as useful as the rest: it is what stops you paying to comply with something that was never yours.
Who it's for
Organisations deploying or building AI who have not yet established where they stand — and organisations that have been told they need to comply with something, without being told on what basis. Also the right starting point before a procurement questionnaire, a due-diligence process, or a larger assessment.
How it works
- 01
Intake — a short conversation and a list of the systems in scope.
- 02
Analysis — qualification against each regime, sector overlay, and role determination.
- 03
Written note & debrief — delivered with a walkthrough, so the reasoning can be argued with.
Related services