Sebastian Thomas

Chief Information & AI Officer (CAIO), Detasad · Riyadh

Leading the transformation of a long-established Saudi technology company into an AI-first enterprise, built on governed agents, trusted data and sovereign infrastructure.

The mandate

At Detasad, a Saudi technology company in the Deutsche Telekom Group, my mandate is to lead and transform the business into an AI company. Since 2022 we have moved from applied machine learning to generative and agentic AI running in production across the enterprise: in leadership decision-making, sales, HR, presales, operations and support.

What we have built

Agentic AI platform

A governed, on-premises agent framework

Modular agent architecture with Model Context Protocol (MCP) tool access, agent-to-agent coordination and human-in-the-loop approval. Agents never touch core systems directly: every action runs through governed tools with role-based access, policy controls, session context and a full audit trail.

Data and knowledge

A decision-grade data lakehouse and enterprise knowledge layer

Structured data from ERP, CRM, ITSM and infrastructure platforms unified with unstructured content into one governed system of insight. On top sits an enterprise retrieval-augmented generation (RAG) layer over SharePoint, OneDrive and Teams, with ingestion, embedding, retrieval and reranking, access-control synchronisation and PII safeguards, so agents answer only from what a user is allowed to see.

Model orchestration

Hybrid, model-agnostic routing

Frontier models handle reasoning-heavy executive workflows; open-weight models on in-house GPU infrastructure handle high-volume, cost-sensitive and data-sovereign work such as summarisation, drafting, classification and document navigation. The model can change; the enterprise control plane does not.

Executive AI

Natural-language access to enterprise systems

The CEO and leadership team query SAP S/4HANA, Microsoft Dynamics 365, ServiceNow and Teams conversations through AI assistants connected via MCP, with the same permissions and auditability as the systems themselves.

AI in the business

Agents across core workflows

Agentic recruitment orchestration, proposal generation with verified knowledge retrieval and pricing, bid go/no-go assessment, workforce and field-force productivity, and an enterprise growth assistant. Some agents answer, some draft, some act, and some prepare actions for human approval.

AIOps

From reactive to predictive IT operations

Infrastructure observability feeding a service-aware CMDB for impact-based incident routing and change risk analysis; predictive log and network analysis for root-cause diagnosis; GenAI-assisted incident resolution and agentic remediation into ITSM and ERP, cutting mean time to resolve.

Adoption

AI for every employee, safely

A two-lane operating model: centrally governed architecture for enterprise-grade use cases, plus guided experimentation for everyone through AI literacy, prompt training and a low-code automation platform where business teams build their own workflows on approved agents and APIs.

Sovereign by design

In-Kingdom hosting and compliance

AI products and platforms hosted in Saudi Arabia and aligned with PDPL, NCA and DGA requirements, starting with our first deep-learning platform for telecom network capacity optimisation.

Self-improving agents, under control

Our enterprise assistant is built for governed self-improvement: it detects its own capability gaps, proposes new skills and workflows, and adds them once a human approves. Three loops keep that self-improvement safe:

Workuser intent → context retrieval → tool use → answer or action
Self-improveincomplete outcome → capability gap detected → new skill proposed
Governhuman approval → safe deployment → rollback if needed → audit trail

Autonomy alone is not the goal. Controlled adaptability, with self-improvement under human governance, is.

Principles

  • Systems of record stay authoritative. AI works above SAP, CRM and ITSM, never as a shadow copy of them.
  • Governance lives in the "can", not the "should". What an agent may do is set by architecture, not by its prompt.
  • Route intent, not prompts. The right request, to the right model, with the right context and permissions, into the right system, with an audit trail.
  • The strategic layer sits above the GPUs. Orchestration, governance and cost control are where lasting advantage is built, for enterprises and for nations.

Attention is all you need — but in the enterprise, attention must be grounded, permissioned and auditable.

The journey

I started as a programmer and have since worked across telecoms, IT services and enterprise technology, building teams, practices and a couple of companies along the way. Before Detasad, I led business operations at Wipro in the Netherlands, and earlier spent close to a decade at HCL Technologies, helping build its Europe region and its CRM and Oracle practices. My career began in Chennai and Riyadh, took me to Europe for many years, and has brought me back to Riyadh to work on what I find the most interesting problem in technology today.

India→Saudi Arabia→Europe→Saudi Arabia

Connect

I write about leading AI in the enterprise on LinkedIn.