Use Saudi AI Risk Management in Modulos

Recommended AI System structure

SDAIA-P145 is an advisory framework of SDAIA for government and private entities. For more information about the framework and its sources, see National AI Risk Management Framework. In SDAIA-P145, an entity is a government entity or one of the private entities. An entity is not the same as the Modulos Organization.

Modulos has two Frameworks for SDAIA-P145. Each Framework has the name "Saudi AI Risk Management":

• OFF-23 at the Organization level. Add it to the organization AI System.
• MFF-23 at the AI System level. Add it to the AI System of each AI system or use case to which you apply SDAIA-P145. For the systems that SDAIA-P145 is for, see Entities.

For SDAIA-P145, Modulos recommends this structure. SDAIA-P145 does not set a structure in Modulos.

Organization AI Systems

Frameworks at the Organization level, for example OFF-23, attach to the organization AI System of your organization. You cannot make a new organization AI System. If your organization does not have one, contact Modulos before you add OFF-23.

Requirements and source provisions

For the Saudi AI Risk Management Frameworks OFF-23 and MFF-23, use the Requirements below. Each row gives the SDAIA-P145 sections for a Requirement and the related information.

Framework	Requirement	Source provisions in SDAIA-P145	Information
OFF-23	ORF-448 Internal AI Risk Management Policies and Procedures	The Purpose and Scope sections, p. 7–8	Internal AI risk policies and procedures
OFF-23	ORF-449 General Principles and AI Ethics Principles	The General Principles reference pillar, p. 14–15	General principles and AI ethics
OFF-23	ORF-450 Alignment with AI Regulations	The AI Regulations reference pillar, p. 16	AI regulations, data regulations, and sector regulations
OFF-23	ORF-451 Alignment with Data Regulations	The Data Regulations reference pillar, p. 16	AI regulations, data regulations, and sector regulations
OFF-23	ORF-452 Alignment with Sector Regulations	The Sector Regulations reference pillar, p. 16	AI regulations, data regulations, and sector regulations
OFF-23	ORF-453 AI Risk Governance, Decision Rights, and Risk Tolerance	The Purpose, Scope, and Risk Treatment sections, p. 7–8 and p. 26–27	Risk governance, decision rights, and risk tolerance
OFF-23	ORF-454 AI Risk Documentation Standards	The Scope, Risk Identification, and Monitoring and Review sections, p. 8, p. 18, and p. 28–29	AI risk records
OFF-23	ORF-455 AI Risk Awareness and Capability Development	The Purpose section, p. 7, and examples in the Appendix, p. 42–44	Prepare personnel
MFF-23	MRF-414 Reference-Pillar Alignment for the AI System	The Reference Pillars section, p. 14–16, and the first step of the Appendix, p. 32	The four reference pillars
MFF-23	MRF-415 AI System Description and Use Boundaries	The Context and Scope section, p. 17	Context and scope
MFF-23	MRF-416 Data, Input/Output Points, and Value-Chain Parties	The Context and Scope section, p. 17	Context and scope
MFF-23	MRF-417 Automation Level and the Human Role in Decisions	The Context and Scope section, p. 17	Context and scope
MFF-23	MRF-418 Lifecycle Stage and Change Plan	The Context and Scope section, p. 17	Context and scope
MFF-23	MRF-419 Comprehensive Risk Inventory	The Risk Identification section, Risk Inventory, p. 18–20	The risk inventory
MFF-23	MRF-420 Risk Characterization by Source, Intent, and Timing	The Risk Identification section, Risk Characterization, p. 20	Risk characterization
MFF-23	MRF-421 Likelihood Estimation	The Risk Assessment section, Likelihood Estimation, p. 22–23	Likelihood estimation
MFF-23	MRF-422 Impact Estimation	The Risk Assessment section, Impact Estimation, p. 23–24	Impact estimation
MFF-23	MRF-423 Risk-Level Determination via the Risk Matrix	The Risk Assessment section, Risk Level, p. 24–25	Risk level and risk matrix
MFF-23	MRF-424 Treatment Strategy Selection	The Risk Treatment section, Treatment Strategy, p. 26	Treatment strategy selection
MFF-23	MRF-425 Control Design and Implementation	The Risk Treatment section, Control Design and Implementation, p. 26	Risk treatment controls
MFF-23	MRF-426 Residual-Risk Reassessment	The Risk Treatment section, Residual-Risk Reassessment, p. 27	Residual-risk reassessment
MFF-23	MRF-427 Acceptance or Escalation Decision	The Risk Treatment section, Acceptance or Escalation Decision, p. 27	Acceptance or escalation decision
MFF-23	MRF-428 Continuous Performance Monitoring	The Monitoring and Review section, Continuous Performance Monitoring, p. 28	Performance and risk checks
MFF-23	MRF-429 Periodic Reviews and Risk Register Updates	The Monitoring and Review section, Periodic Reviews, p. 28	Risk register checks
MFF-23	MRF-430 Incident Monitoring and Response Management	The Monitoring and Review section, Incident Monitoring and Response, p. 29	Incident response

Work sequence

For the Saudi AI Risk Management Frameworks, Modulos recommends the sequence of work below. Items 3 to 8 of this sequence include the five steps of SDAIA-P145 (Figure 3, p. 13). These steps are context and scope, risk identification, risk assessment, risk treatment, and monitoring and review. Items 6 and 7 are for risk treatment.

1. Prepare the governance at the Organization level (OFF-23).
   • Record the internal AI risk policies and procedures of your entity. See Internal AI risk policies and procedures.
   • Record the approved risk tolerance and the decision rights. See Risk governance, decision rights, and risk tolerance.
   • Record how your entity keeps its AI risk records. See AI risk records.
   • If your entity has an approved risk tolerance or approved procedures for risk records, refer to them.
2. Use the four reference pillars at Organization and AI System levels. In SDAIA-P145, the reference pillars are the governing reference to make and operate AI systems (p. 14). See The four reference pillars.
3. Record the context and scope of each AI system (MFF-23). Record the use, the data and value-chain parties, the automation and human intervention, and the lifecycle and change management. See Context and scope.
4. Identify the risks. Prepare the risk inventory. Then record the risk characterization of each risk. See The risk inventory and Risk characterization.
5. Make an estimate of each risk. Make an estimate of the likelihood and the impact of each risk. Then calculate the risk level with the risk matrix. See Likelihood estimation, Impact estimation, and Risk level and risk matrix.
6. Apply risk treatment.
   • First, examine each risk and the results of its risk assessment. Then set the result that you want from the risk treatment.
   • Then select one of the four treatment options.
   • Then select the controls that fit the type and the source of each risk. SDAIA-P145 gives three types: technical controls, organizational controls, and operational controls (p. 26). Modulos Controls are different items in Modulos. For each risk treatment control, set a control owner, a schedule, and a measure of its effect.
   • Apply the selected risk treatment controls.
   • See Treatment strategy selection and Risk treatment controls.
7. Make an estimate of the residual risk again. Then make the decision.
   • After you apply the risk treatment controls, make an estimate of the residual risk again. Use the same approved risk assessment method in SDAIA-P145 (p. 27).
   • Then make the decision: acceptance or escalation.
   • See Residual-risk reassessment and Acceptance or escalation decision.
8. Monitor and examine the AI system during operation. Monitor the performance of the AI system. Examine the risk register again. Do the incident response procedures. See Performance and risk checks, Risk register checks, and Incident response.
9. Review each Requirement in Modulos. See Requirement decisions.

Requirement decisions

For each Requirement of OFF-23 and MFF-23, the Requirement Owner examines the completed Controls. Then the Requirement Owner can mark the Requirement as Fulfilled.

Controls do not make a Requirement Fulfilled without this Review. For the Review of a Requirement, see Requirements and Reviews & Statuses.

Modulos limits

The Saudi AI Risk Management Frameworks in Modulos help you record and examine your work on SDAIA-P145. A Fulfilled Requirement does not show that all the work in SDAIA-P145 is complete.

You cannot record risk treatment decisions with the risk functions of Modulos. They do not record the acceptance of residual risk. Keep these decisions in your entity's own records. For the risk functions, see Risk Operating Model.

Related information

For more information about SDAIA-P145 and about Modulos, see:

Saudi AI Risk Management overview

SDAIA-P145, the entities that it is for, and its structure

Governance and AI risk records

Internal policies, risk governance, risk records, and personnel

Reference pillars, context and scope

The four reference pillars and the context and scope of an AI system

Risk identification and risk assessment

The risk inventory, the likelihood and impact levels, and the risk matrix

Risk treatment, monitoring and review, and incident response

Treatment options, residual risk, decisions, and monitoring and review

Saudi AI Risk Management questions

Short information about SDAIA-P145 and the Frameworks in Modulos

Governance operating model

Requirements, Controls, Evidence, and Reviews in Modulos

Control overlap

The Controls that two or more Frameworks use

Source

• National Artificial Intelligence Risk Management Framework — SDAIA, SDAIA-P145, version 1, April 2026, in Arabic. See p. 7–8, p. 13–20, p. 22–29, p. 32, and p. 42–44. PDF.

Disclaimer

This page gives general information. It is not legal advice.