Data sovereignty and security guide Saudi organisations' decisions on deploying AI

Saudi organisations have moved from experimenting with AI to its actual deployment and monitoring of its agents, and the question they ask today has shifted: it is no longer how to test the technology, but how to monitor AI agents, how to define their permissions, where these systems should operate, and which data should remain inside the Kingdom. This shift, now one of the clearest features of the Saudi market, is being tracked by Petra Jenner, senior vice-president and general manager for Splunk in Europe, the Middle East and Africa, in an exclusive interview with Al-Sharq Al-Awsat on the sidelines of Splunk.conf26 in Denver.

Jenner describes AI agents as part of the “new workforce”, meaning that an organisation needs to monitor them, control them and understand what they do, just as it would with any other component that plays a role within the work environment. The debate over agentic AI has become very broad in the Kingdom, and client requests are increasingly focused on how to monitor agents, discover the risks associated with them, and try to mitigate those risks before they turn into an operational or security issue.

The cloud is not a one-size-fits-all decision

Saudi organisations do not view the decision to move to the cloud as a single step that can be applied to all systems in the same way. Splunk’s goal was to give customers the freedom to choose where to run each workload, whether in the cloud or on the organisation’s own infrastructure. Several companies requested that the cloud service be made available inside the Kingdom because they needed greater scalability and different operating economics, which led the company to invest in Splunk Cloud locally. This does not mean that the market is moving entirely toward the cloud. When Jenner was asked about the factors that determine an organisation’s decision, she ordered the priorities clearly: “security first”, then economies of scale, then cost and the nature of the application. Many companies end up in hybrid environments that combine the two models.

Geopolitics restores the value of “choice”

Jenner added another factor, the geopolitical context, noting that an increasing number of customers simply want to retain multiple options regarding where systems run and where data resides. Making products available in the cloud or on-premises does not change the essence of the technology as much as it gives the organisation greater freedom to decide in line with security, regulatory and market requirements. This flexibility gains particular importance in Saudi Arabia, where large investments in AI and cloud computing coincide with growing concern about where data is located and how it can be controlled.

Can data remain inside the Kingdom?

When asked whether the workflow and data could remain entirely within a Saudi-controlled architecture, Jenner said that this is possible, but the answer depends on the nature of the organisation. A company that operates only inside the Kingdom can keep data locally, whereas a global Saudi organisation may need to handle data distributed in other markets and link it together for analysis. This does not necessarily require moving all data back and forth to the Kingdom; data can stay where it is while analysis and linking are performed in a way that allows the organisation to obtain a unified view. Solution design aims to give the customer the “best possible freedom of choice”.

Agent monitoring: the next growth area

Among all the technologies Splunk showcased in Denver, Jenner sees “agent monitoring” as one of the most important areas for the Saudi market in the coming phase. The reason lies in the scale of AI development within Saudi organisations and the growing use of agentic systems that do more than provide a recommendation or answer; they can execute steps inside systems. Everything related to agentic AI, monitoring those agents, ensuring their security and confirming that they operate as required, represents, in her view, one of the areas that will see the greatest growth in the Kingdom. This aligns with Splunk’s direction at the.conf26 conference, where the company focused on tools that monitor agent behaviour and evaluate their actions during operation, not just application and infrastructure performance.

Data was the foundation before AI

Although AI dominates today’s discussion, Jenner says that demand for Splunk’s technologies in Saudi Arabia preceded this wave by years. The company’s products were used in the Kingdom before Splunk established a direct local presence, especially because of the need to analyse system data to detect security threats. Splunk’s view of itself as a platform that collects and analyses machine data “resonated in the Kingdom faster than in many other markets”, which she considers one of the reasons that gave the company a foundation to build on as AI rose. This comparison is important: the Saudi market did not start its relationship with Splunk on the basis of AI alone, but on the broader need to manage operational and security data, a need that is now expanding to include agents and models.

What this means for the practitioner in the region

What stands out is not only the size of the investment, but the shift in the type of questions Saudi organisations are asking. Instead of merely asking how to trial AI, organisations are now probing where to run it, where data should remain, how to monitor agents, and what should stay on-premises versus move to the cloud. For the technical practitioner and decision-maker in the Gulf, the message is clear: sovereign infrastructure, the ability to monitor agents, and flexibility in choosing the operating environment are no longer optional extras but essential requirements for any AI project that aims to persist and scale in the Saudi market.