NDMO (National Data Management Office)

The NDMO standards organise data management into a set of domains, including data governance, data catalogue and metadata, data quality, data classification, data sharing, open data, freedom of information, and personal data protection. Each domain has controls and specifications that an entity must implement and can be assessed against. Data classification is the part most people meet first: information is graded into levels from Top Secret down to Public, and the level determines who may access it, how it must be stored and whether it can leave the country. The standards were written for government bodies, but any company that builds systems for them or handles their data inherits the requirements through the contract.

For AI vendors working with Saudi government, semi-government or large regulated entities, NDMO alignment decides whether a project can go live. A chatbot on a ministry's WhatsApp line or an internal assistant over agency documents must show which classification level each data source carries, that classified data never reaches a model or hosting region it is not allowed to, that a data catalogue exists for what the agent reads, and that personal data is handled under the PDPL. These requirements sit alongside the National Cybersecurity Authority's controls, which govern the security side.

Nano AI approaches government and regulated work by starting with a data inventory: which sources the agent will read, their classification, where they may be processed, and which model and hosting options are therefore permitted, before any prompt is written. If a vendor proposes an AI project for a Saudi public entity, ask them to name the NDMO domains their design addresses, show how classification is enforced at the retrieval layer rather than in the prompt, and confirm the hosting region for every component that touches the data.