Reference pillars, context and scope

SDAIA-P145, the National AI Risk Management Framework, is the advisory framework of SDAIA for AI risk management in government entities and private entities (p. 6). For more information about SDAIA-P145, see National AI Risk Management Framework. SDAIA-P145 has four reference pillars and five steps (Framework structure). The sections below give the four reference pillars, the first step (context and scope), and the applied example in SDAIA-P145.

The four reference pillars

In SDAIA-P145, AI risk management starts from the four reference pillars «الركائز المرجعية» (p. 14). With the reference pillars, all the steps of the framework start from one set of general principles, values, regulations, and approved policies (p. 14). The four reference pillars are these (Figure 3, p. 13, and p. 14):

1. General principles «المبادئ العامة»
2. AI regulations «تنظيمات الذكاء الاصطناعي»
3. Data regulations «تنظيمات البيانات»
4. Sector regulations «تنظيمات القطاعات»

SDAIA-P145 makes the reference pillars a governing reference for the design, development, and operation of AI systems (p. 14). The governing reference makes sure that AI systems agree with the related ethical, regulatory, and legal requirements (p. 14). SDAIA-P145 tells entities that it is necessary to think about the reference pillars when they make and use AI systems (p. 14). The reference pillars are for the safe and responsible use of AI (p. 14).

General principles and AI ethics

In SDAIA-P145, the general principles reference pillar gives the general principles and Islamic values for the development and use of AI systems (p. 14). Examples of these principles and values are justice, transparency, the protection of rights, the protection of human dignity, and no harm to others (p. 14). With these values, the design and use of AI systems agree with the human values and Islamic values of responsibility and fairness (p. 14). Decisions in all of the lifecycle of AI systems refer to these values (p. 14).

The AI ethics principles come from these general principles and Islamic values. SDAIA-P145 identifies the AI ethics principles as the most important principles that apply these values to AI systems (p. 14). SDAIA-P145 tells entities that it is necessary to think about the seven AI ethics principles through the full lifecycle of AI systems (p. 14). This applies to the design, development, use, and operation of AI systems (p. 14).

AI ethics principle	Information in SDAIA-P145
Integrity and fairness «النزاهة والإنصاف» (p. 14)	AI system developers apply the necessary measures in all of the design, development, and operation of the systems. These measures limit bias, discrimination, and stereotyping that come from data or algorithms, and they prevent harm to persons or groups. The principle includes fair, equitable, and objective systems that include all target groups without discrimination because of gender, race, religion, age, or other grounds.
Privacy and security «الخصوصية والأمن» (p. 14)	The development of AI systems agrees with the related privacy and cybersecurity requirements. The systems give protection to personal data, and they prevent unlawful access to data or systems and the harm that can come from this access. The design of the systems includes controls and mechanisms to control and monitor the systems through their lifecycle. Thus, compliance with the approved privacy and security requirements continues.
Humanity «الإنسانية» (p. 14)	The development of AI systems follows an ethical and fair method that comes from human rights and cultural values. The systems have a good effect on persons and society. The design of the systems does not include deception or manipulation. The design increases the human role in selections and decisions. It helps human capabilities and does not decrease them.
Social and environmental benefits «المنافع الاجتماعية والبيئية» (p. 14)	The good effect of AI systems on persons and society is as large as possible, and the systems help sustainability. The systems also have a good effect on technology, society, and the environment, with no harm or bad effects on persons. The principle also includes work on the problems that come from the use of the systems.
Reliability and safety «الموثوقية والسلامة» (p. 15)	AI systems agree with the approved specifications. They operate with reliability and predictability for their intended purpose, with accurate performance and results. The design of the systems prevents risk to persons or society. For this, the systems have risk management mechanisms that operate correctly. These mechanisms make it less possible that the systems do not operate correctly or show unexpected behavior. They also decrease possible harm and accidental harm to the minimum possible level.
Transparency and explainability «الشفافية وقابلية التفسير» (p. 15)	The principle increases trust in AI systems through a clear design and explainability. The design makes it possible to find and know how automatic decisions occur. This is very important when the decisions can have an effect on persons. The principle includes transparency of data, algorithms, purposes, and operations, in proportion to the context of use, purpose, and risk level of the system. Developers justify the decisions and behavior of the systems ethically and without harm.
Accountability and responsibility «المساءلة والمسؤولية» (p. 15)	Designers, developers, operators, and evaluators of AI systems have the responsibility for the effects of the decisions of these systems. Governance and human oversight apply through the lifecycle to decrease risks and misuse. The principle also includes clear roles, accountability, and measures before risks occur for risk assessment and mitigation. It also includes the fairness and sustainability of the systems, to keep the rights of persons and their right to select.

SDAIA-P145 gives its risk categories in a different section. For these risk categories, see The risk inventory.

AI regulations, data regulations, and sector regulations

In SDAIA-P145, the reference pillars 2, 3, and 4 are AI regulations, data regulations, and sector regulations (p. 16).

AI regulations «تنظيمات الذكاء الاصطناعي» (p. 16). In SDAIA-P145, this reference pillar includes the policies, legislation, and regulatory frameworks that control the development and operation of AI systems. These instruments are the regulatory reference that makes sure that AI systems agree with the requirements of Saudi Arabia. The purpose of these regulations is to set the obligations and responsibilities of the related entities. These obligations and responsibilities are for the safe and responsible use of AI and for less legal and regulatory risk. The regulations also help innovation in a framework of governance and compliance.

The AI regulations reference pillar also helps entities apply controls in the same manner each time (p. 16). It helps compliance to continue through the system lifecycle, with clear requirements, reviewability, and accountability (p. 16).

Data regulations «تنظيمات البيانات» (p. 16). In SDAIA-P145, this reference pillar includes all the controls and regulatory requirements for the collection, processing, storage, and use of data in AI systems. The reference pillar is a basic part of AI risk management because AI systems use data directly through their lifecycle. The purpose of these regulations is to keep the privacy of data, especially personal data and sensitive data. Their purpose is also to prevent misuse or unlawful processing of data. For this purpose, the regulations make it an obligation for entities to apply lawful and safe practices, for example:

• The identification of the purpose of the data use
• The control of access to the data
• The quality and integrity of the data

The data regulations reference pillar also helps compliance with the related national requirements and good data governance (p. 16). This data governance gives traceability of data sources, control of data retention, and work on bias risks, security risks, and output integrity risks (p. 16). The result is more reliability of AI systems and more sustainability in the use of these systems (p. 16).

Sector regulations «تنظيمات القطاعات» (p. 16). In SDAIA-P145, this reference pillar includes the regulatory requirements, policies, and guidelines of each sector. Examples are the health sector, the financial sector, and the education sector. These instruments control the design, development, and operation of AI systems in different contexts of use. The reference pillar starts from the principle that AI risks change with these items:

• The type of the sector
• The sensitivity of the data
• The possible impact scope
• The type of the decisions that the systems make or help persons to make

Because of these differences, SDAIA-P145 makes it necessary to apply special controls and procedures for the special conditions of each sector (p. 16). The purpose of the sector regulations is that AI systems agree with the approved standards of the sector for operation and security (p. 16). The purpose is also that AI systems agree with the related safety and compliance requirements (p. 16). This helps risk management that refers to the context of use (p. 16). It also increases the reliability of AI systems and their safe and responsible use in the different sectors (p. 16).

Context and scope

In SDAIA-P145, context and scope «تحديد السياق والنطاق» is the first of the five steps (Figure 3, p. 13). This step helps the entity to know fully and accurately the context of use of the AI systems that it uses or will use (p. 17). The step gives information about the system and its operational context, examines how the system is used, and identifies the related data (p. 17). The step has four primary tasks (p. 17):

1. System use
2. Data and value-chain parties
3. Automation and human intervention
4. Lifecycle and change management

System use

In SDAIA-P145, task 1 of context and scope is the system description and use boundaries «توصيف نظام الذكاء الاصطناعي وحدود استخدامه» (p. 17). The task gives clear information about these items of the AI system (p. 17):

• The type of the system
• The purpose of its use
• The functions or outputs that the system gives
• How the outputs are used in the operational context or in the institutional context

In this task, SDAIA-P145 recommends that entities think about a clear identification of the intended uses, as against unauthorized uses and out-of-scope uses (p. 17). This helps to limit the risk of misuse or of an increase in use without control (p. 17).

The task also identifies the groups that use the system directly. It also identifies the other groups on which the outputs of the system have an effect (p. 17). For the target group, the task identifies these items (p. 17):

• The limits of the target group
• How much the target group relies on the system
• How correctly the target group can read the results

This information helps to make and operate the system in proportion to the characteristics of these groups (p. 17).

Data and value-chain parties

In SDAIA-P145, task 2 of context and scope is the identification of data and of input points and output points «تحديد البيانات ونقاط الإدخال والإخراج» (p. 17). The task gives these items (p. 17):

• A full record of the training data and the operation data of the system
• The type, the sensitivity level, and the quality of this data
• The sources of the data and the mechanisms that collect the data
• A record of the data flows in the system
• The input points through which the system receives data, and the output points through which the system gives outputs

The task also identifies all the value-chain parties, with their roles and responsibilities (p. 17). These parties can be internal systems, other entities, external partners, or data providers (p. 17). This increases transparency and helps to know the risk points of the data and of the data that the parties send and receive (p. 17).

Automation and human intervention

In SDAIA-P145, task 3 of context and scope is the automation level and the human role in decisions «تحديد مستوى الأتمتة ودور الإنسان في القرار» (p. 17). The task identifies the automation level of the system, which is one of these (p. 17):

• The system only recommends, and a person makes the decision.
• The system makes decisions.
• The system does tasks automatically.

The task also identifies the human role in the decision cycle, with the points of approval, human review, objection, or stop (p. 17). It identifies when human intervention is mandatory (p. 17).

The task also identifies clearly the responsibilities of the related parties, for example developers, operators, and decision owners (p. 17). It also identifies the formal approval paths and the escalation mechanisms for when risks or unexpected results are found (p. 17).

Lifecycle and change management

In SDAIA-P145, task 4 of context and scope is the lifecycle and change plan «تحديد دورة الحياة وخطة التغيير» (p. 17). The task identifies the part of the lifecycle in which the AI system is: development, test, operation, or update (p. 17). The task also identifies the change management mechanism, with these items (p. 17):

• The type of the expected updates
• The interval of the updates
• The party that is responsible for the implementation of the updates
• The authority that gives approval for the updates

SDAIA-P145 also recommends that entities think about these two items (p. 17):

• The requirements for a new risk assessment when material changes are made
• The mechanisms that tell users or affected groups about changes that can have an effect on the performance or the risk level of the system

Example: internal reports

In the SDAIA-P145 example section, a government entity uses a large language model (LLM) to help its personnel prepare and write internal reports (p. 32). The competent employee keeps the authority for the last decision, the human review, and the approval (p. 32). The measures in this section apply only to this example.

In the example, the four reference pillars are a binding reference for the use of the LLM by this government entity (p. 32). The government entity starts from the general principles and values, AI regulations, data regulations, and the related regulations of the government sector (p. 32). In the sections before the example section, the reference pillars are a governing reference (p. 14).

The context and scope record of the example has these items (p. 32–33):

• System description and use boundaries (p. 32). The LLM only writes first drafts, makes the language of content more clear, or decreases the length of content that the user gives. The LLM has no authority to give approval for content, to release content, or to make a decision for the entity. The intended use does not include binding legal analysis, official regulatory interpretation, final administrative decisions, external correspondence, or classified documents. In the example, it is not permitted to use the system for other purposes, for example for the entry of very sensitive confidential information.
• Users and affected groups (p. 32). The users of the system are personnel who have the authority to prepare reports. These personnel can examine the content and how correct it is before they use it. The outputs also have an effect on internal units and decision makers. These groups can read the reports after a person gives approval for them.
• Data and input and output points (p. 32–33). The LLM operates in the government entity's infrastructure or in an approved government cloud, with full supervision by the government entity that owns it. The inputs are only content that personnel give manually, with low to medium sensitivity. In the example, the entry of sensitive personal data or of security-classified information is not permitted. The outputs show directly to the user, with no automatic storage or transfer to other systems.
• Automation level and the human role (p. 33). The automation level is low and the LLM helps persons. The LLM does not make decisions or do actions. It gives no outputs that are binding on the entity. No output is approved until the competent employee examines it and gives approval. Human intervention is mandatory in all use cases of the example.
• Lifecycle and change plan (p. 33). The system is in monitored operation, with model changes at intervals, as necessary for the entity. All material changes, for example to the data sources or the scope of use, go through approved change management procedures. These procedures include a risk assessment and a formal approval before the change. The example identifies the party for changes, a test procedure before release, and a rollback plan for unexpected effects.
• Changes and risk assessment (p. 33). A new risk assessment is a condition for each change that has an effect on the scope of use or the automation level. Users get information about all changes that can have an effect on the operation of the system or on its risk level. For the two items that SDAIA-P145 recommends that entities think about, see Lifecycle and change management.

For the risks of the example, see Example: risk assessment. For risk treatment in the example, see Example: risk treatment.

Related information

The next step of SDAIA-P145 is risk identification. For this step, see Risk identification and risk assessment. For the Requirements of OFF-23 and MFF-23 in Modulos, see Requirements and source provisions. See the Saudi AI Risk Management FAQ. For other frameworks, see Comparison.

Source

• SDAIA-P145 — Saudi Data and Artificial Intelligence Authority (SDAIA), «الإطار الوطني لإدارة مخاطر الذكاء الاصطناعي» (National AI Risk Management Framework). SDAIA-P145, version 1, April 2026. «المقدمة» (p. 6), Figure 3 (p. 13), reference pillars (p. 14–16), context and scope (p. 17), and appendix, parts 1 and 2 (p. 32–33). PDF.

For information about the Arabic framework and the English executive summary, see National AI Risk Management Framework.

Disclaimer

This page gives general information. It is not legal advice.