Shyam Sankar, CTO of Palantir Technologies, put the argument plainly at the Hill and Valley Forum in April 2025.
“The lie of globalization was that we will do the innovation, and they will do the production. But the reality is that innovation is a consequence of productivity. If you don’t make the thing, you cede your opportunity to innovate on the thing.”
Sankar was talking about physical manufacturing and the hollowing out of American industrial capacity. But the logic applies with equal precision to software. If you do not build the system, you do not accumulate the intelligence that comes from building it. The vendor does. And in an increasingly multipolar world, the question of who builds the software that powers a nation’s enterprises is not a procurement question. It is a sovereignty question.
For Saudi Arabia, that question has never been more urgent, or more consequential.
The Transformation Is Real. The Dependency Is Also Real.
Saudi Arabia is executing the most ambitious national transformation program in the world. Vision 2030 is not a digitization strategy applied to an existing economy. It is a structural reconstruction of the Kingdom’s economic foundation, moving from oil dependency toward a diversified, knowledge-based economy where technology is not a supporting function but a primary value driver. The numbers reflect the ambition. Saudi Arabia allocated more than $10 billion to ICT in 2024, an 18.75 percent increase from the prior year (Saudi Market Research Consulting, 2025). AI is projected to contribute up to $135 billion to Saudi Arabia’s GDP by 2030 (Oliver Wyman and SDAIA, 2024). The Kingdom has raised its target for the technology sector’s contribution to GDP from 1 percent to 5 percent by 2030 (IMARC, 2025). In 2024, Saudi Arabia ranked first in government strategy on Tortoise Media’s Global AI Index.
The transformation is real and the commitment behind it is genuine. But there is a structural problem embedded in how that transformation is being executed that Vision 2030’s architects are acutely aware of and have not yet fully resolved.
The software running Saudi Arabia’s enterprises, government entities, financial institutions, and industrial operators was overwhelmingly built outside the Kingdom. The SaaS platforms powering Saudi enterprise workflows, the cloud infrastructure hosting Saudi operational data, the AI tools being deployed across Saudi organizations: the vast majority of these systems are built, governed, and continuously improved by companies that answer to no Saudi authority. The Saudi SaaS market alone was valued at $2.86 billion in 2024 and is projected to reach $6.49 billion by 2030 (Research and Markets, 2025). That is $6.49 billion flowing annually toward software that Saudi enterprises do not own, cannot extend without vendor cooperation, and cannot govern independently.
Data sovereignty and regulatory compliance are now identified as the most pressing challenge in the Saudi SaaS market (Research and Markets, 2025). The PDPL, fully enforceable as of September 2024, imposes strict data localization requirements mandating that personal data must remain within the Kingdom unless specific conditions for cross-border transfer are met and approved, with fines of up to $1.3 million for non-compliance (InCountry, 2024). The National Cybersecurity Authority’s Essential Cybersecurity Controls impose mandatory requirements for how Saudi organizations govern data within their infrastructure. Sixty-six out of 99 Vision 2030 goals relate to data and AI, a figure that signals how central the information layer is to the transformation’s success (Clyde and Co, 2025).
The regulatory architecture is being built. The compliance requirements are hardening. But the fundamental problem is not addressed by compliance frameworks alone. The problem is not just that Saudi data is being processed outside Saudi borders. It is that the software Saudi organizations run on was built elsewhere, learns from Saudi operations toward platforms Saudi organizations do not control, and compounds intelligence toward vendors whose interests are not aligned with Saudi Arabia’s national transformation agenda.
What Sankar’s Argument Means for Saudi Software
The lie of globalization in manufacturing was that innovation could be retained at the strategy layer while production was offshored. Three decades of evidence showed that was false. The production learning, the engineering judgment, the institutional knowledge that accumulates from making things, went wherever the production went. America is now spending hundreds of billions of dollars trying to reverse that migration.
Saudi Arabia is at the beginning of the equivalent decision in software. Every Saudi organization that deploys AI on a vendor-managed platform is feeding Saudi institutional intelligence into a system that answers to a foreign company’s governance. Every Saudi financial institution running credit decisioning on a vendor model is training that model on Saudi portfolio patterns that the vendor retains at contract end. Every Saudi government entity running citizen services on a foreign SaaS platform is accumulating operational intelligence inside a system that no Saudi authority controls.
The question Sankar poses for manufacturing is the same question Saudi enterprises need to ask about their software: who accumulates the learning that comes from operating these systems? If the answer is the vendor, Saudi Arabia is in the early stages of building a digital dependency that will be as expensive to reverse as America’s industrial dependency, and far faster to deepen because software compounds at the speed of data rather than the speed of physical production.
The Sectors Where This Matters Most
The dependency is not abstract. It concentrates in the sectors that matter most to Vision 2030’s success.
Financial Services
Saudi Arabia’s financial sector operates under SAMA’s comprehensive regulatory framework, one of the most rigorous in the Gulf region. Financial institutions are deploying AI for credit decisioning, AML monitoring, fraud detection, and compliance reporting at a pace that reflects the sector’s ambition. The compliance posture is strong. The ownership posture is weaker. A Saudi bank whose credit decisioning model runs on a vendor-managed endpoint is training that model on Saudi portfolio performance, Saudi customer behavioral patterns, and Saudi risk signatures that it cannot independently validate, retrain, or govern after the vendor relationship ends. SAMA requires the bank to demonstrate control over every model used in consequential decisions. The deployment architecture frequently makes that demonstration difficult. The model that would satisfy SAMA’s model risk requirements most cleanly is the one the bank owns.
Government and Public Sector
Over 86 percent of Saudi government services became digitally accessible in 2024, up from 60 percent in 2020 (Research and Markets, 2025). The e-Government transformation is one of Vision 2030’s most visible achievements and one of its most significant sovereignty exposures simultaneously. The platforms powering Saudi government service delivery were built by companies operating under foreign law, governed by foreign data policies, and updated according to foreign product roadmaps. A Saudi government entity whose citizen services run on a foreign SaaS platform has transferred operational intelligence about how Saudi citizens interact with government, what services they use, and how they behave across digital channels, to a platform it does not govern. That intelligence is Saudi Arabia’s institutional knowledge. It should compound inside Saudi institutions.
Energy and Industrial Infrastructure
Saudi Arabia’s energy sector, anchored by Aramco’s supply chain and the Kingdom’s expanding industrial base, is one of the most data-rich operational environments in the world. Equipment telemetry, supply chain signals, maintenance records, operational exceptions, and production patterns generate intelligence continuously across thousands of facilities and millions of operational cycles. The AI systems being deployed to reason over that intelligence are increasingly vendor-managed. The operational knowledge those systems accumulate about how Saudi energy infrastructure actually behaves is among the most strategically sensitive data the Kingdom generates. It should not be compounding toward a foreign platform’s training datasets.
Retail, Logistics, and the New Economy
Vision 2030’s economic diversification agenda is creating a new Saudi economy in retail, tourism, entertainment, and logistics that did not exist at the same scale a decade ago. The digital infrastructure powering that economy is being built now, in real time. The decisions being made today about which platforms power Saudi retail operations, which systems govern Saudi logistics networks, and which AI tools optimize Saudi supply chains will determine whether the intelligence generated by that economy compounds inside Saudi organizations or outside them. The new economy is the highest-leverage moment for getting this right because the dependency has not yet accumulated.
AI Is the Breakthrough Moment
Vision 2030 identifies AI as the primary driver of Saudi Arabia’s next phase of economic development. AI is projected to contribute up to $135 billion to Saudi Arabia’s GDP by 2030 (Oliver Wyman and SDAIA, 2024). The Kingdom has invested in AI infrastructure, AI talent development, and AI regulatory frameworks at a pace that reflects that conviction.
But AI is also the moment where the software dependency question becomes structurally critical. An AI system that runs on a vendor-managed platform, trained on Saudi operational data that stays with the vendor at contract end, does not compound Saudi intelligence inside Saudi organizations. It compounds toward the vendor’s platform. The Saudi organization gets the output. The vendor gets smarter about Saudi operations.
An AI system built on owned infrastructure, fine-tuned on Saudi institutional data, with model weights and training datasets that transfer permanently to the Saudi organization at engagement close, compounds in the opposite direction. The intelligence generated by every Saudi operational cycle stays inside Saudi Arabia. It improves with every cycle because it is being trained on this organization’s specific operational reality. And it belongs to the Kingdom permanently.
The difference between those two AI deployment architectures is not a compliance decision. It is a sovereignty decision. And it is the same decision at the application layer as the one Vision 2030 is making at the economic layer: Saudi Arabia must own the infrastructure of its own future.
Building the Application Layer Saudi Arabia Needs to Own
The resolution to the software dependency problem is not for every Saudi organization to build its own application infrastructure from scratch with internal engineering teams. That is not a realistic response to the scale and speed at which digital transformation is currently executing across the Kingdom.
The resolution is that the software being built for Saudi organizations must be structured so that what gets built stays with the Saudi organization that commissioned it. The model weights and training datasets transfer permanently. The application infrastructure runs within the organization’s own environment. The engineers building it work within the organization’s governance, absorbing institutional context that stays inside the Saudi organization when the engagement concludes. The intelligence that accumulates through every operational cycle compounds inside Saudi Arabia, not toward a foreign vendor’s platform.
CodeNinja was built around this problem. Operating delivery centers in Riyadh, Dallas, Santiago, and Lahore, the company has worked inside enough AI deployments across Saudi financial institutions, government entities, and industrial operators to understand the structural difference between building AI for a client and building AI that stays with a client. The engineering approach is different, the governance model is different, and the outcome for the organization is categorically different. Every CodeNinja engagement in Saudi Arabia is structured so that the models trained on Saudi operational data transfer permanently to the Saudi organization at engagement close, Saudi engineers work within Saudi governance structures throughout delivery, and the capability to govern, retrain, and extend the system independently stays inside the Kingdom when CodeNinja exits.
This is the architectural decision that Vision 2030 demands at the application layer. Not just data localization, which addresses where data is stored. Capability localization, which addresses who owns the intelligence that data generates when AI systems reason over it.
Hyper is the application layer expression of that delivery conviction. It generates MCP-ready application infrastructure that Saudi organizations own permanently, designed from the first line of code for both the humans and the AI agents that will operate them. The systems built on Hyper run inside the organization’s own environment, governed by the organization’s own policies, with no capability that resets when an engagement ends. For Saudi enterprises executing Vision 2030’s sovereignty agenda at the application layer, Hyper is not a development tool. It is the mechanism by which Saudi institutional intelligence stops compounding toward foreign platforms and starts compounding inside Saudi Arabia permanently.
To discuss building application infrastructure your Saudi organization owns permanently
Start the conversation at codeninja.sa/hyper
References
Clyde and Co. Ten Legal Updates in Saudi Arabia’s Technology and Data Space in 2024. Clyde and Co, 2025.
IMARC Group. Saudi Arabia ICT Market Report. IMARC Group, 2025.
InCountry. Saudi Arabia Data Sovereignty Policies and Requirements. InCountry, 2024.
Oliver Wyman and SDAIA. Innovation Oasis: How KSA Is Using Generative AI to Transform Its Economy. Oliver Wyman, 2024.
Research and Markets. Saudi Arabia Software as a Service Market Report 2025. Research and Markets, 2025.
Saudi Market Research Consulting. Digital Transformation in Saudi Arabia: Emerging Opportunities in the Services Sector. Saudi Market Research Consulting, 2025.
Tortoise Media. Global AI Index 2024: Government Strategy Rankings. Tortoise Media, 2024.