Every Saudi organisation deploying AI agents should train in two tiers: literacy for all staff who work beside agents, and certified competence for the people who release held actions. SAMA's expectations for financial firms and the Personal Data Protection Law, overseen with SDAIA, shape what that training must cover. Arabic-first review and seasonal peaks shape how it is delivered.
What does every employee near an agent need?
Literacy here means being able to read an agent's work, not knowing how models are built. Every employee should know:
- Depth: 1 read, 2 draft for a person to send, 3 routine work within bounds, 4 money or hard-to-undo actions, 5 coordinating other agents. Each action needs its own depth.
- Verdicts: allowed, held for a named person, refused as outside the agent's bounds, or withheld at the platform floor for every agent.
- Provenance: a sealed fact from the billing system outranks a customer's declared claim, and an external email cannot authorise a payment.
- Expiry: an agent's certificate lapses after 90 days, and a run that clears no depth drops it to depth 1 the same day.
What changes for the people who approve?
An approver is the last control before an action reaches a customer. They need to read why an action was held, which of the five bounds decided it, and whether the evidence behind it is strong enough. They also need to release or reject with a recorded reason, because the append-only record will show their name against the decision.
That is a skill, and it should be tested on real decisions rather than assumed from seniority. A supervisor who has run a contact team for years may still approve an agent's refund on the strength of a customer's screenshot unless they have been trained to look for the source.
How do SAMA, SDAIA and the Personal Data Protection Law shape it?
The Saudi Central Bank (SAMA) supervises banks, insurers and finance companies and expects them to manage operational and technology risk with accountable people. SDAIA, the national data and AI authority, works alongside the Personal Data Protection Law, which sets duties on how personal data is collected, used, disclosed and kept secure. The SAMA expectations guide for staff who oversee AI agents covers the financial side in more detail.
For training, the point is that anyone who configures or reviews an agent must understand which personal data it reads and why, and that oversight in regulated firms must be done by people who can show their competence. Saudi firms serving EU customers may also need to consider GDPR and the EU AI Act.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What may the agent do in a utility collections team?
Take a utility using an agent for overdue bills. The agent reads the billing record, drafts reminders in Arabic and English, and proposes instalment plans within the utility's own limits.
| Step | Agent | Stays with a person |
|---|---|---|
| Checking the balance and payment history | Reads at depth 1 | Disputes about the bill itself |
| Sending a standard reminder | Executes within approved templates at depth 3 | Approving the templates and timing |
| Proposing an instalment plan | Drafts at depth 2 | Agreeing the plan |
| Disconnection or referral | Never acts alone | The decision and its reasons |
The collections brief for utilities in Saudi Arabia explores the role, and the customer support brief for e-commerce in Saudi Arabia covers a faster-moving one.
How should training handle Arabic and peak seasons?
Test reviewers on cases in the language they will review in. A draft that reads well in English may carry a different tone in Arabic, and the reviewer must judge what the customer will actually read.
Plan for peaks. Customer volumes in retail, utilities and telecoms rise sharply around Ramadan and the major sales periods. Certify approvers before the peak, not during it, and check that no approver's credential expires in the middle of one. The broader method is in AI literacy and certification for people who work with agents, and the US guide shows the contrast with a market of many regulators.
Where the Academy fits
Pryme Intelligence Academy's admin view shows each team member's progress, results, certificates and expiry dates, so a manager can see before a peak season whose credential needs renewal. Module tests are set in the learner's own industry and role, and certificates are issued through VerifyDoc.ai for checking at source.
Questions people ask
Does SAMA require a named AI certification?
SAMA does not set a specific AI credential among the expectations covered here. It expects accountable oversight, and certified approvers are a practical way to show it.
Should agents send customer messages in Arabic without review?
Only within approved templates and bounds, at depth 3. Anything outside a template should be drafted at depth 2 for a person to approve.
How quickly should a Saudi team be trained?
Certify the approvers for the first agent before it goes live, then extend literacy across the team over the following weeks.