Saudi Cloud-First Policy

Saudi Arabia’s Cloud-First Policy represents a foundational element of the Kingdom’s digital transformation strategy, mandating that government entities prioritise cloud-based solutions over traditional on-premises infrastructure when procuring or upgrading information-technology systems. The policy, driven by the Communications, Space and Technology Commission (CST) and the Digital Government Authority (DGA), reflects a strategic determination that cloud computing is essential to achieving the agility, scalability, and cost efficiency required to deliver Vision 2030’s ambitious digital-government and smart-city objectives. The policy has also served as a powerful market signal that has attracted billions of dollars in hyperscaler investment into Saudi data-centre infrastructure.

Policy Framework

The Cloud-First Policy establishes a presumption in favour of cloud adoption across the Saudi government sector. Under the policy, government entities undertaking new IT projects or refreshing existing systems are required to evaluate cloud-based options as the default architecture, with on-premises deployment permitted only where specific security, regulatory, or technical requirements cannot be met through cloud services. The policy does not mandate exclusive use of public cloud; it encompasses a spectrum of deployment models including public cloud, private cloud, hybrid cloud, and community cloud configurations, enabling agencies to select the model best suited to their data-classification and operational requirements.

The DGA has published cloud-adoption guidelines that provide government entities with frameworks for assessing cloud readiness, conducting cloud-migration planning, evaluating cloud-service providers, and managing cloud operations. These guidelines address common barriers to government cloud adoption, including data-sovereignty concerns, security requirements, legacy-system integration challenges, and workforce skills gaps.

Regulatory Environment

The Cloud-First Policy operates within a regulatory environment shaped by multiple authorities. The CST regulates telecommunications and technology infrastructure, including data-centre licensing and cloud-service provider registration. The National Cybersecurity Authority (NCA) establishes cybersecurity standards and controls that cloud-service providers must satisfy to serve government clients. SDAIA’s data governance framework, including the Personal Data Protection Law, establishes requirements for data handling, localisation, and cross-border transfers that directly affect cloud-architecture decisions.

The convergence of these regulatory domains has produced a layered compliance framework for cloud services in Saudi Arabia. Cloud-service providers seeking to serve government clients must satisfy CST registration requirements, NCA cybersecurity controls, SDAIA data-governance standards, and agency-specific requirements that may apply to particularly sensitive workloads. This multi-layered approach is designed to ensure that cloud adoption does not compromise security or sovereignty while preserving the flexibility and innovation benefits that motivate cloud migration.

The Cloud Service Provider (CSP) classification framework, administered by the CST, categorises cloud providers based on their capabilities, security posture, and compliance with Saudi regulatory requirements. This classification system enables government procurement officials to identify pre-qualified providers and streamlines the procurement process by reducing the due-diligence burden on individual agencies.

Hyperscaler Investments

The Cloud-First Policy has been a decisive catalyst for investment by global hyperscale cloud providers in Saudi data-centre infrastructure. The policy’s clear market signal, combined with the Kingdom’s large government-sector IT budget and growing private-sector digital economy, has attracted commitments from the world’s leading cloud platforms to establish dedicated cloud regions within Saudi Arabia.

Oracle, Google Cloud, Microsoft Azure, and Amazon Web Services have all announced or operationalised cloud regions in the Kingdom, investing billions of dollars collectively in data-centre construction, networking infrastructure, and local operational capabilities. These investments provide Saudi government entities and private-sector organisations with access to world-class cloud platforms hosted on Saudi soil, satisfying data-localisation requirements while delivering the full range of cloud services including compute, storage, database, artificial intelligence, machine learning, and analytics.

The hyperscaler investments extend beyond data-centre infrastructure to encompass workforce development, startup ecosystem support, and digital-skills training. Each major cloud provider has committed to training thousands of Saudi nationals in cloud technologies, creating a pipeline of skilled professionals capable of designing, deploying, and managing cloud-based systems. These training commitments align with Saudisation objectives and address the skills gap that would otherwise constrain cloud-adoption velocity.

Government Cloud Adoption

Government adoption of cloud services has progressed across multiple sectors. The DGA has overseen the migration of numerous government applications and workloads to cloud platforms, with early adopters including entities in the health, education, municipal services, and financial sectors. The government’s Absher platform for citizen services, the Tawakkalna health application deployed during the COVID-19 pandemic, and various e-government portals have leveraged cloud infrastructure to achieve rapid scaling and high availability.

The National Information Centre and the Yesser e-Government Programme have historically provided shared IT services to government entities, and these capabilities are being progressively augmented or replaced by cloud-based alternatives. The transition reflects a broader shift from government-owned-and-operated IT infrastructure toward a model in which the government consumes IT as a service from commercial providers, enabling greater flexibility and reducing the capital and operational burden on individual agencies.

Private-Sector Cloud Adoption

The Cloud-First Policy’s influence extends beyond the government sector. Private-sector organisations, particularly in financial services, retail, telecommunications, and technology, have accelerated their own cloud-adoption programmes, motivated by competitive pressures, digital-transformation imperatives, and the availability of locally hosted cloud platforms that satisfy regulatory requirements. The Saudi banking sector, regulated by the Saudi Central Bank (SAMA), has been a significant adopter of cloud services following SAMA’s issuance of cloud-computing guidelines that established a regulatory framework for bank use of cloud infrastructure.

The startup ecosystem has been a particularly enthusiastic adopter of cloud services, with Saudi technology companies building cloud-native applications from inception rather than migrating legacy systems. This pattern is expected to accelerate as the Kingdom’s startup ecosystem matures and as cloud-first becomes the default architecture for new technology ventures.

Strategic Significance

The Cloud-First Policy serves multiple strategic objectives simultaneously. From a fiscal perspective, cloud adoption enables the government to shift IT spending from capital expenditure to operational expenditure, improving budget flexibility and enabling pay-as-you-go consumption models. From a capability perspective, cloud platforms provide access to cutting-edge technologies, including AI and machine learning services, that would be prohibitively expensive for individual agencies to develop independently. From a resilience perspective, cloud infrastructure offers built-in redundancy, disaster recovery, and geographic distribution that enhance the continuity of government services.

The policy also positions Saudi Arabia as a regional digital-infrastructure hub. The concentration of hyperscaler data centres in the Kingdom, combined with favourable regulatory conditions and a skilled workforce, creates conditions for Saudi Arabia to serve as a cloud-hosting centre for organisations operating across the Middle East, North Africa, and Central Asia.