Governance and AI risk records

SDAIA's National AI Risk Management Framework (SDAIA-P145) helps entities prepare their governance, risk records, and personnel (p. 7–8). See National AI Risk Management Framework for its use and effect.

In Modulos, the Organization-level Framework OFF-23 holds the Requirements for this work. For the Requirements, see Requirements and source provisions. For the work sequence, see Work sequence.

Internal AI risk policies and procedures

SDAIA's National AI Risk Management Framework helps government and private entities to write their internal policies and procedures for AI risk management. In the section Scope «نطاق الإطار» (p. 8), the framework helps entities with methods and tools for this work. With these methods and tools, an entity writes internal policies and procedures for risk identification, risk assessment, risk treatment, or acceptance. These policies and procedures fit the conditions of the entity and help the safe and responsible use of AI (p. 8). The framework does not set detailed technical standards for model performance (p. 8).

In SDAIA-P145, risk management is a set of operations and procedures that give direction to an organization and control it in relation to risks (p. 10). With a method, risk management identifies risks, examines them, does a risk assessment of them, gives risk treatment to them, and monitors them during all of the system lifecycle (p. 10). For AI systems, risk management continues through the development, operation, and use of the systems (p. 10).

The framework helps entities prepare institutional, organizational, and technical conditions in which they can know AI risks and do work on them before the risks occur (p. 7). Clear governance and specified controls and work standards help to decrease the likelihood and severity of harm (p. 7).

The framework is for all government and private entities in all sectors and levels of digital maturity (p. 8). For the flexible use of the framework and for the systems with high impact, see Entities. The framework has four reference pillars and five steps: context and scope, risk identification, risk assessment, risk treatment, and monitoring and review (Figure 3, p. 13). See Framework structure.

System developers, system operators, and policy makers

SDAIA's National AI Risk Management Framework names three primary groups in the section Target Audience «الجمهور المستفيد» (p. 7). The framework helps each group (p. 7):

• System developers — The framework helps system developers to include risk management in the design of models, in model training, and in the tests of models. It also helps them to use controls and standards, with a method, for safety and technical governance. These measures help to decrease risks before the systems go into use.
• System operators — The framework helps system operators to use clear policies and procedures to operate and monitor AI systems. It also helps them with risk assessment and with the identification of who does follow-up and incident response. This work helps to keep business continuity and the protection of beneficiaries.
• Policy makers — The framework helps policy makers to examine if the available regulatory frameworks are prepared for AI risks. It also helps them to identify where AI risk governance is not sufficient, and to make policies and legislation with different levels. These policies and legislation help responsible innovation and give protection to persons and to society. This work uses a clear risk classification method and sets the necessary levels of controls with that method.

The functions of policy makers apply to regulatory frameworks and legislation. The framework does not give these functions to the persons who write the internal policies of an entity (p. 7).

Context and scope identifies who does the work, formal approval paths, and escalation mechanisms for risks or unexpected results (p. 17). See Context and scope.

Risk governance, decision rights, and risk tolerance

In the section Scope of SDAIA's National AI Risk Management Framework (p. 8), the framework helps entities with these tasks:

• to prepare a governance environment that suits the entity
• to record risk scenarios
• to set the acceptable risk level and its controls
• to set mechanisms for monitoring and response.

These parts of risk treatment use an approved risk tolerance (p. 26–27):

• Acceptance — Acceptance is available only with residual risk in the approved risk tolerance and other conditions (p. 26). See Treatment strategy selection.
• Residual-risk reassessment — Residual-risk reassessment compares residual risk with the approved risk tolerance to identify if more measures or escalation are necessary (p. 27). See Residual-risk reassessment.
• Acceptance or escalation decision — This decision compares residual-risk reassessment results with the approved risk tolerance (p. 27). See Acceptance or escalation decision.

SDAIA-P145 recommends that entities think about two items (p. 27). These items are a decision level that agrees with the risk level of the system, and clear records of approvals and escalation paths. See Acceptance or escalation decision.

For incidents, the framework recommends escalation paths that agree with the severity and the scope of impact (p. 29). See Incident response.

AI risk records

SDAIA's National AI Risk Management Framework helps entities with risk records through these provisions:

• In the section Scope, the framework includes the task to record risk scenarios (p. 8).
• The risk identification step helps entities use the same names and methods to record and compare risks (p. 18).
• In the risk inventory, SDAIA recommends a unified risk taxonomy. The unified risk taxonomy helps entities to record risks clearly and to compare the records (p. 18).

These provisions do not set one location for all risk records. They do not set a different layer of standards across the entity.

In SDAIA-P145, risk records have different relations to the risk register (p. 26–29). See the record provisions for:

• Treatment strategy selection
• Residual-risk reassessment
• Performance and risk checks
• Risk register checks
• Incident response

The example section gives records for risk identification, risk assessment, risk treatment, and monitoring and review (p. 34–44). See Example: risk assessment and Example: risk treatment.

Prepare personnel

In its Purpose section, SDAIA's National AI Risk Management Framework uses clear governance, specified controls, and work standards to help entities (p. 7):

• be better prepared
• increase human capacity
• increase risk awareness
• give protection to rights, data, and privacy.

The framework does not give one training plan or one interval for user training for all entities.

In the risk inventory, the human-machine interaction risk category includes a possible decrease of the cognitive skills of persons with time (p. 19). See The risk inventory.

Example: human competence

SDAIA's National AI Risk Management Framework gives an example in its last section. In this example, a government entity uses a large language model to prepare internal reports (p. 32). The measures below are measures of that example only.

In the example, the last decision, the human review, and the approval stay with the competent employee (p. 32). For the human review in the example, see Example: internal reports. The example gives these measures to prepare users (p. 42):

• For incorrect or misleading information (risk 1), the entity gives user training on the limits of the model capabilities.
• For the entry or leak of sensitive internal information (risk 2), the entity gives mandatory user training on data classification and privacy requirements.
• For over-reliance on the system (risk 3), the entity gives awareness programs to users on the limits of the system capabilities.

For over-reliance, the example also uses double human review for reports that are sensitive or that have an effect on administration (p. 42). See Example: risk treatment.

Risk 7 of the example is a decrease in the level of human competence (p. 36). When personnel rely on the system all the time, their writing skills and analysis skills can decrease with time (p. 36). For its risk characterization and vulnerabilities, see Example: risk assessment.

For risk 7, the example selects mitigation with these measures (p. 44):

• continuous training programs to increase writing skills and analysis skills
• tasks in which the use of the system is not permitted, to keep human competence
• performance assessments that do not use the system outputs
• professional development plans connected to competence indicators.

For the monitoring and review of risk 7, the entity monitors professional competence indicators with time (p. 44). The entity also does periodic reviews of the effect of system use on writing skills and analysis skills, and changes the training from the results. For the decision, expected residual risk, and risk register check each year, see Example: risk treatment.

Related information

For the reference pillars and the context and scope step, see Reference Pillars and Context Scoping. For risk treatment, decisions, and monitoring and review, see Risk Treatment, Monitoring, and Incidents. For the Frameworks in Modulos, the Requirements, and the steps that Modulos recommends, see Operationalizing Saudi AI Risk Management in Modulos. For the relation between AI Systems, Requirements, Controls, and Evidence in Modulos, see Governance Operating Model. For other frameworks, see Comparison. For the FAQ, see Saudi AI Risk Management FAQ.

Source

• National Artificial Intelligence Risk Management Framework — SDAIA-P145, April 2026, version 1 (Arabic), SDAIA. PDF. Sections used:
  • the sections Purpose «الغرض من الإطار» (p. 7), Target Audience «الجمهور المستفيد» (p. 7), and Scope «نطاق الإطار» (p. 8)
  • AI Risks (p. 10) and Framework Structure (Figure 3, p. 13)
  • Context and Scope (p. 17) and Risk Identification (p. 18–19)
  • Risk Treatment (p. 26–27) and Monitoring and Review (p. 28–29)
  • The example section (p. 32–36, 38–40, and 42–44).

For the English executive summary, see National AI Risk Management Framework.

Disclaimer

This information is general. It is not legal advice.