Ahkam GRC vs Sahl (2026): Which Platform Fits Saudi Teams?
Quick Verdict
Choosing between Ahkam GRC and Sahl depends on how your organization wants to manage governance, risk, and compliance (GRC).
Ahkam, associated with Renad Al Majd Group for Information Technology (RMG), provides GRC management capabilities for policy lifecycle automation and compliance management. Sahl offers an AI-powered GRC platform tailored to the MENA regulatory environment, with Saudi framework support, an AI DPO assistant, and a built-in Dynamic Application Security Testing (DAST) scanner.
Organizations can evaluate Ahkam for its local vendor relationship and associated professional services, while Sahl offers AI-assisted compliance workflows, cross-framework evidence management, and integrated security testing for teams seeking these capabilities.
This comparison uses publicly described information and product details provided for Sahl. Features, packages, and pricing can change, so confirm the current scope directly with each vendor before making a decision.
The Two Platforms
What Is Ahkam GRC?
Ahkam is a GRC management system associated with Renad Al Majd Group for Information Technology (RMG), a Saudi technology company. RMG describes capabilities that include policy lifecycle automation and compliance management for cybersecurity frameworks such as NCA, SAMA, and ISO 27001.
Organizations evaluating Ahkam should confirm the current framework versions, available integrations, reporting features, implementation services, and any AI capabilities included in the proposed package.
What Is Sahl?
Sahl is an AI-powered GRC platform built for the MENA regulatory environment. Its framework coverage includes NCA ECC, SAMA CSF, PDPL, ISO 27001, and SOC 2.
Capabilities to evaluate include its AI DPO assistant, compliance dashboards, evidence management workflows, cross-framework mapping, Arabic-language support, and built-in DAST scanner.
For current product details, visit Sahl’s website.
1. Framework Coverage: NCA ECC, SAMA CSF, and PDPL
Saudi compliance teams should compare both platforms against the specific regulations and standards that apply to their organizations.
When comparing Ahkam and Sahl, ask:
- Does the platform support the required framework editions, including NCA ECC-2:2024 where applicable?
- Are controls mapped to individual requirements, or does the platform provide only general framework tracking?
- How are regulatory changes and new framework versions incorporated?
- Can evidence be reused across overlapping requirements?
- Can teams track control owners, gaps, remediation tasks, and supporting documentation?
Sahl offers pre-mapped Saudi framework support designed to help teams manage requirements across NCA ECC, SAMA CSF, and PDPL. Confirm the exact mapping scope and applicable framework versions during a demo.
For Ahkam, request a demonstration of the specific framework editions your organization needs.
2. AI and Compliance Automation
AI can help GRC teams reduce repetitive work, but the value depends on what the technology actually does.
A useful evaluation should distinguish between policy workflow automation, AI-assisted analysis, automated evidence collection, and continuous monitoring.
Sahl provides an AI DPO assistant for PDPL-related workflows and GRC capabilities that support compliance tracking and evidence management.
Ask RMG to demonstrate the AI capabilities available in Ahkam’s current product and clarify whether the proposed subscription includes them.
Evaluate both platforms using the same tasks:
- Draft or review a policy against a selected requirement.
- Map a control to the relevant framework.
- Identify gaps using sample evidence.
- Explain findings and provide supporting references.
- Track remediation and approval workflows.
The best platform is the one that produces useful, reviewable outputs and reduces manual effort without compromising accountability.
3. Security Testing and Vulnerability Management
Compliance management and technical security testing are related, but they are not the same thing.
A GRC platform may track vulnerability findings, while a security scanner performs technical tests to identify potential weaknesses in applications.
Sahl offers a built-in DAST scanner for web application security testing. This may be useful for teams that want to connect application security findings with their broader risk and compliance workflows.
When evaluating Ahkam, ask whether security scanning is included natively, available through an integration, or provided separately through a service.
For either platform, confirm:
- Which applications and environments can be tested.
- What scanning scope and limitations apply.
- How findings are prioritized and assigned.
- Whether findings can be linked to risks, controls, and remediation activities.
- Whether scanning is included in the quoted package.
Do not assume that a GRC platform provides vulnerability scanning simply because it supports cybersecurity compliance.
4. Delivery Model: Platform or Professional Services?
The implementation model affects cost, speed, and how independently your team can operate the platform.
Ahkam / RMG: RMG provides technology and professional services. Ask whether the proposed engagement combines software with assessment, consulting, or implementation support, and which activities are included in the contract.
Sahl: Sahl is positioned as an AI-powered GRC platform with onboarding support. Confirm the level of assistance provided during setup, framework configuration, integrations, and ongoing operations.
Neither model is automatically better. A team with limited internal GRC expertise may value hands-on services, while an experienced team may prioritize a platform it can manage directly.
5. Implementation Speed and Time to Value
A platform can have extensive features but still take time to configure. Evaluate how quickly each solution can deliver useful results for your organization.
Ask both vendors for a written implementation plan that covers:
- Initial configuration and user setup.
- Framework selection and control mapping.
- Importing existing policies and evidence.
- Integrations and data migration.
- Team training and approval workflows.
- The point at which the platform will be ready for operational use.
Sahl’s pre-mapped framework approach is designed to help accelerate setup. However, actual implementation time depends on your organization’s requirements, integrations, data quality, and customization needs.
Request a realistic timeline based on your own control set rather than relying solely on general onboarding estimates.
6. Arabic-Language Support and Local Requirements
Language support can matter when policies, evidence, workflows, and reports are used by teams across Saudi Arabia.
Sahl offers Arabic-language support. Confirm which parts of the platform are available in Arabic, including the user interface, reports, documentation, and AI-assisted workflows.
Ask Ahkam and RMG to clarify the same details, along with support hours, escalation arrangements, and any local implementation services.
Also verify data residency, data processing, access controls, and contractual requirements against your organization’s policies and applicable obligations. A local vendor does not automatically meet every data-handling requirement.
7. Pricing and Total Cost of Ownership
Comparing headline subscription prices alone can be misleading. The total cost may include software licensing, onboarding, integrations, advisory services, training, and optional features.
Ask both vendors for a written quotation covering:
- Subscription fees and renewal terms.
- Implementation and onboarding charges.
- AI features and usage limits.
- Frameworks and modules included.
- Security scanning and integration costs.
- Support and training.
- Additional charges for users, storage, or services.
Sahl’s commercial packaging should be confirmed with the sales team, and Ahkam’s complete software and services costs should be requested from RMG.
Compare the total cost over the same contract period and for the same scope of work.
Ahkam GRC vs Sahl: Comparison Table
| Criteria | Ahkam GRC (RMG) | Sahl |
|---|---|---|
| Vendor background | Saudi technology company | GRC platform focused on the MENA market |
| NCA and SAMA support | Described by RMG; confirm versions | NCA ECC and SAMA CSF support |
| PDPL workflows | Confirm current scope | AI DPO assistant and PDPL-related workflows |
| ISO 27001 | Described by RMG | Supported |
| SOC 2 | Confirm current scope | Supported |
| AI capabilities | Confirm current product features | AI DPO assistant; evaluate additional workflows |
| Evidence management | Request a live demonstration | Evidence workflows and compliance dashboards |
| Cross-framework mapping | Confirm current scope | Cross-framework mapping capabilities |
| Built-in DAST scanner | Confirm whether included | Available; verify package and scope |
| Arabic-language support | Confirm current scope | Available; verify supported areas |
| Delivery model | Software and potentially related services | Platform with onboarding support |
| Pricing | Request a written quotation | Request a written quotation |
Note: “Confirm” means the capability should be verified with the vendor. It does not mean the feature is unavailable. The table is a starting point for evaluation, not a substitute for a live product comparison.
Which Platform Should You Choose?
Choose Ahkam if:
- You prefer working with a local Saudi technology provider.
- You want to evaluate a GRC platform alongside professional services.
- Its current framework coverage and implementation model fit your requirements.
- The vendor can demonstrate the controls, reports, and workflows your team needs.
Choose Sahl if:
- You want to evaluate AI-assisted compliance and PDPL-related workflows.
- You need support for Saudi frameworks alongside international standards.
- Cross-framework evidence management is important to your team.
- Built-in DAST scanning is relevant to your security and compliance workflows.
- You prefer a platform-led approach with onboarding support.
Before deciding, run a short proof of concept with both vendors. Use the same controls, sample evidence, and reporting requirements to compare actual results.
Frequently Asked Questions
It depends on your requirements. Sahl is worth evaluating for AI-assisted compliance workflows, cross-framework mapping, and built-in DAST scanning. Ahkam may appeal to organizations seeking a local GRC vendor relationship with professional services. Compare current capabilities against your specific needs.
RMG’s product descriptions refer to compliance management for NCA, SAMA, and ISO 27001. Confirm the exact framework versions, mapping depth, and update process directly with RMG.
Sahl provides NCA ECC framework support. Confirm the exact coverage and alignment with NCA ECC-2:2024 during your product demonstration.
Migration may be possible, depending on data access, export options, and the structure of your existing records. Start by identifying which policies, controls, evidence files, risk registers, and remediation records can be exported. Ask Sahl to assess the data and prepare a migration plan before committing to a timeline.
Sahl offers a built-in Dynamic Application Security Testing (DAST) scanner. Confirm its scope, supported targets, limitations, and package availability with the Sahl team.
Request written quotations covering licensing, onboarding, integrations, training, support, optional modules, and renewal terms. Compare the total cost over the same period and for equivalent requirements.
Final Thoughts
The choice between Ahkam GRC and Sahl comes down to your compliance priorities, internal resources, and preferred delivery model.
Ahkam is worth considering if its local vendor relationship and services align with your implementation needs. Sahl is worth evaluating if you want an AI-powered GRC platform with Saudi framework support, evidence management, cross-framework mapping, and built-in DAST capabilities.
The most reliable way to choose is to test both platforms against the same requirements, confirm current feature availability, and compare written commercial proposals.
Want to evaluate Sahl against your current compliance workflows? Visit Sahl to discuss your framework requirements, evidence management, and GRC automation needs.
