Running an Arabic LLM on your own infrastructure in Saudi Arabia
On-premise and air-gapped Arabic LLM deployment for the Kingdom — what offline actually means, how to size the model, which open weights are worth self-hosting, and how to adapt one to Gulf and Najdi dialect plus legal, financial and government vocabulary.
Plenty of organisations in the Kingdom cannot send customer conversations to someone else's cloud. Banks, government entities, defence-adjacent suppliers, healthcare providers, law firms holding privileged material — for them the question is not which API is best but whether the thing can run inside their own perimeter at all. It can. What follows is what that actually takes, without the marketing.
"Offline" means four different things
Vendors use the word loosely and buyers pay for the wrong tier. Pin down which one you actually need before anyone quotes you hardware.
| Tier | What it means | Typical driver |
|---|---|---|
| In-Kingdom cloud region | Managed service, but inference and storage stay in a Saudi region. | Data residency satisfied; you still depend on a third party's uptime and terms. |
| Your cloud tenancy | Deployed into infrastructure you own and control, in a region you choose. | Your keys, your logs, your network policy. The common enterprise answer. |
| On-premise | Running in your own data centre, reachable from your network only. | Regulated workloads and data that contractually cannot leave your estate. |
| Air-gapped | No outbound connectivity at all. Models and updates arrive physically. | Classified or critical-infrastructure environments. |
The cost curve between these is steep, and so is the operational burden. Air-gapped is a genuinely different discipline from on-premise — no telemetry, no automatic updates, no calling home for evaluation. Choose the highest tier your obligations genuinely require and not one above it.
Sizing the model to the job
The instinct is to run the largest model that fits. For most Arabic enterprise workloads that is the wrong optimisation — a smaller model that answers in 300ms beats a larger one that answers in three seconds, particularly on voice, and the accuracy gap narrows sharply once you fine-tune on your own domain.
| Class | Fits on | Suited to | Watch for |
|---|---|---|---|
| ~1–9B | A single workstation GPU, quantised | Classification, extraction, routing, tightly scoped voice turns. | Reasoning and long-context work degrade quickly. |
| ~27–35B | One or two datacentre GPUs | The practical sweet spot for most enterprise Arabic work, including voice. | Needs real evaluation on dialect; do not assume MSA results transfer. |
| ~70B | A multi-GPU node | Complex reasoning, document analysis, legal and financial review. | Latency and concurrency cost; often overkill behind a phone call. |
| ~120B and above | A dedicated multi-GPU cluster | Frontier-adjacent capability without leaving your estate. | Serious capital and operations. Justify it with measurements, not ambition. |
Quantisation moves these boundaries significantly — a well-quantised model in the 27B class runs on hardware that would not hold it at full precision, usually at a quality cost small enough that your own benchmark will struggle to detect it. Measure that yourself rather than trusting either the optimists or the purists.
Which open weights are worth self-hosting
The open-weight landscape moves every few months, so treat any specific recommendation as perishable and re-check before you commit hardware. As of now the serious candidates for Arabic on-premise work fall into three groups.
- General open-weight families released under permissive licences — the Qwen 3.5 generation, for example, ships Apache 2.0 weights across a range of sizes, which makes the licence conversation short.
- Open-weight releases from frontier labs, including the gpt-oss models, which brought genuinely capable weights into self-hostable territory.
- Arabic-first models, including the Kingdom's own ALLaM, whose published weights can be self-hosted — with the caveat that Llama-derived variants inherit the upstream community licence alongside their own terms.
Licence review matters more here than in a hosted deployment, because you are redistributing nothing but you are running the weights commercially inside your own estate. Get legal sign-off on the exact model file you intend to deploy, not on the family name.
Making it speak Saudi, not just Arabic
A general open model self-hosted in Riyadh is still a general model. Three adaptations separate it from something that reads a Saudi contract or a customer's WhatsApp message properly.
Dialect and register
Modern Standard Arabic is the easy case; models are trained on written text and written Arabic is standard. Gulf and Najdi dialect in conversational use is where general models fall down, and the gap is widest in exactly the informal channels customers actually use. Fine-tuning on dialect data from your own domain is the fix, and it is why the dataset matters more than the checkpoint.
Code-switching
Saudi business language moves between Arabic and English inside a single sentence — product names, job titles, technical terms, numbers. A model that handles both languages separately is not the same as a model that handles them interleaved. Build code-switched examples into both your training data and your evaluation set, because a model can score well on each language alone and still fail at the switch.
Domain vocabulary
Legal, financial and government Arabic each carry vocabulary, formulae and document conventions that a general corpus underweights — contract boilerplate, Sharia-compliant finance terminology, ministry forms and official correspondence registers. This is the most tractable of the three: a few thousand well-labelled in-domain examples move performance more than an order of magnitude more compute would.
What breaks when you go fully offline
- Evaluation. Without telemetry you cannot see quality drift, so evaluation has to be scheduled and run locally against a held-out set that lives inside the perimeter.
- Updates. New model versions arrive as a deliberate, tested event rather than a background improvement. Plan a release process.
- Guardrails. Hosted safety tooling is not available; filtering and policy enforcement have to be part of your own stack.
- Capacity. You are sizing for peak concurrency yourself, with no elastic burst behind you. Load-test at your worst hour, not your average one.
- Expertise. Somebody has to own GPU operations. If nobody does, on-premise becomes a stalled project rather than a sovereign one.
How Voho approaches it
We deploy the Arabic stack — speech to text, the language layer, text to speech — into the tier a customer's obligations genuinely require, including their own data centre. Models are adapted on the customer's own Saudi dialect and domain data, the resulting dataset and evaluation harness stay with the customer, and we are developing our own Arabic models tuned for these conditions. We publish no parameter counts or benchmark claims before they can be independently checked, and we would suggest treating any vendor's numbers the same way.
Frequently asked
- Can an Arabic LLM run fully offline on our own servers?
- Yes. Open-weight models can be deployed on-premise or fully air-gapped, with no outbound connectivity, and speech-to-text and text-to-speech can be deployed the same way. The practical questions are model sizing against your latency and concurrency needs, GPU capacity, licence compliance for the specific weights you deploy, and who inside your organisation will own GPU operations.
- What hardware do we need for an on-premise Arabic LLM?
- It depends entirely on model size and concurrency. Models in the 1–9B class run on a single workstation GPU when quantised; the 27–35B class, which is the practical sweet spot for most enterprise Arabic work, typically needs one or two datacentre GPUs; 70B and above needs a multi-GPU node or cluster. Size for your peak concurrent load rather than your average, and benchmark quantised variants before buying for full precision.
- Does running on-premise satisfy Saudi PDPL?
- On-premise deployment removes many of the hardest residency questions, but PDPL governs how personal data is handled overall, not only where it sits. You still need retention periods per data type, a documented deletion path, access controls and audit logs, and disclosure where people are interacting with an automated system. On-premise makes the review easier; it does not replace it.
- Which open-weight model is best for Arabic on-premise?
- It changes every few months, so the answer should come from your own benchmark rather than from a vendor's list. The serious candidates are permissively licensed general families such as the Qwen 3.5 generation, open-weight releases from frontier labs including the gpt-oss models, and Arabic-first models such as ALLaM. Weight dialect comprehension and code-switching heavily, since that is where general models lose the most ground.
Keep reading