Docs

Appearance

Saudi AI Risk Management ​

Saudi AI Risk Management illustration

National AI Risk Management Framework ​

The National AI Risk Management Framework of the Saudi Data and Artificial Intelligence Authority (SDAIA) is an advisory framework:

  • In the Introduction, SDAIA gives an advisory framework for AI risk management in government and private-sector entities (p. 6).
  • The English executive summary writes that SDAIA "issues this advisory framework for AI risk management in government and private-sector entities in its capacity as the national authority for data and AI".

SDAIA-P145 gives its legal basis in the Introduction (p. 6). The English executive summary gives the same legal basis:

  • "The framework is grounded in the regulatory arrangements of the Authority issued by Council of Ministers Resolution No. (292), dated 1441/4/27 AH".
  • These regulatory arrangements "stipulate that the Authority is the national reference for all matters related to data" and AI "in terms of regulation, development, supervision, and integration".

In Saudi Data & AI Authority's Laws and Regulations, the entry SDAIA Regulatory Arrangements adds that the regulatory arrangements "were amended by Council of Ministers Resolution No. (195) dated 15/3/1444 AH".

SDAIA gives this information about the use of the framework:

  • The English executive summary writes: "The framework aims to provide entities with a practical methodology for identifying, assessing, treating, and monitoring AI risks". The first item in the Purpose section is one method for this work for all of Saudi Arabia (p. 7).
  • The English executive summary also writes: "This framework supports the National Strategy for Data and AI". SDAIA-P145 connects the framework to Saudi Vision 2030 (p. 6).
  • In the Scope section, SDAIA-P145 recommends methods and tools. These methods and tools help entities write internal policies and procedures for risk identification, risk assessment, and risk treatment or acceptance. The policies and procedures fit the conditions of each entity (p. 8).
  • SDAIA-P145 does not set detailed technical standards for model performance (p. 8).
  • In its reference pillars, SDAIA-P145 tells entities that AI regulations set obligations and responsibilities for the related entities, and that data regulations put an obligation on entities to apply lawful and safe practices (p. 16).

SDAIA gives the full National AI Risk Management Framework only in Arabic. In English, SDAIA gives only an executive summary:

  • SDAIA-P145: the full framework in Arabic, version 1, April 2026. If the English summary and the Arabic framework are different, use the Arabic framework. At the end of the PDF, SDAIA-P145 gives Reports and Studies as its type, and labels it General.
  • SDAIA-P145EN: the English executive summary of SDAIA-P145, version 1.0, April 2026. It is not the full framework.

In SDAIA Publications, SDAIA shows the National AI Risk Management Framework with the date "1/4/2026" and the two PDFs. In the Arabic entry, the framework is in the group «أدلة إرشادية» (guidelines). This date is not a date from which the framework applies. SDAIA-P145 gives no such date.

Entities ​

SDAIA-P145 is for all government and private-sector entities, in all sectors and at all levels of digital maturity (p. 8). SDAIA-P145 adapts to different usage patterns and to the magnitude of risks. Thus, the framework is flexible for entities, on the condition that they keep the principles of systematic risk management (p. 8).

In its Scope section, SDAIA-P145 focuses on AI systems and applications with high impact on persons, assets, and operations (p. 8). Examples are predictive models, natural language processing, image and video analysis, intelligent automation, and general-purpose models.

In the Target Audience section, SDAIA-P145 gives three groups: system developers, system operators, and policy makers (p. 7). For the functions of each group, see the three groups.

Framework structure ​

In Figure 3, SDAIA-P145 shows two parts: four reference pillars and five steps (p. 13).

The four reference pillars are general principles, AI regulations, data regulations, and sector regulations. The reference pillars are a governing reference for the design, development, and operation of AI systems (p. 14). See The four reference pillars.

The five steps of SDAIA-P145 are, in this sequence:

  • Context and scope (p. 17): the system and its use, data and value-chain parties, automation level and human intervention, and the lifecycle and change management. See Context and scope.
  • Risk identification (p. 18–20): the risk inventory, with a proposed risk taxonomy of seven risk categories, and the risk characterization. See The risk inventory.
  • Risk assessment (p. 22–25): the likelihood and the impact of each risk, each with four levels, and the risk level from the risk matrix. See Risk level and risk matrix.
  • Risk treatment (p. 26–27): the treatment strategy for each risk, the controls, the residual-risk reassessment, and the acceptance or escalation decision. See Treatment strategy selection.
  • Monitoring and review (p. 28–29): the monitoring and review of performance and risks during operation, and the incident response. See Performance and risk checks.

The Scope section of SDAIA-P145 also includes the governance of the entity (p. 8). An example is the risk level that the entity accepts, with the controls for it. See Governance and AI risk records.

Use Modulos ​

Modulos has two Saudi AI Risk Management Frameworks: OFF-23 at Organization level and MFF-23 at AI System level (Recommended AI System structure).

For the work that the Modulos risk functions do not do, see Modulos limits.

For other AI risk and AI governance frameworks, see NIST AI RMF, ISO/IEC 42001, EU AI Act, UAE AI Ethics, and the Comparison section.

FAQ ​

The FAQ answers questions about the status, scope, risk method, and use of SDAIA-P145 in Modulos.

Source ​

Disclaimer

This page gives general information. It is not legal advice.