Appearance
Risk identification and risk assessment
SDAIA's National AI Risk Management Framework (SDAIA-P145) is an advisory framework for government and private entities. For more information about the framework, see National AI Risk Management Framework. In SDAIA-P145, risk identification and risk assessment come after context and scope and before risk treatment (Figure 3, p. 13). The sections below give information about AI risks, the risk inventory, risk characterization, likelihood, impact, and the risk matrix.
AI risks
In SDAIA-P145, the risk «المخاطر» of an AI system is a mix of these two items (p. 10):
- The likelihood of unwanted harm from the use of the system.
- The severity of these possible effects.
In SDAIA-P145, the risk includes uncertainty about these items (p. 10):
- How models operate.
- The decisions that models make.
- How models operate with data and in the operating environment.
SDAIA-P145 gives these examples of possible sources of risk (p. 10):
- The quality of the training data and of the data that the system uses in operation.
- The design of the model and how the model operates.
- How the system connects to other systems.
- How users use the system.
- Missing controls and procedures to control the operation of the system and to monitor its performance.
For risk management in SDAIA-P145, see Internal AI risk policies and procedures.
SDAIA-P145 gives four problems in AI risk management (p. 11):
- Third parties — data, models, or software components from third parties make risk identification less accurate.
- Metrics — no metrics are available that are the same for all conditions of use, thus measured results are different.
- The lifecycle — risks change across development, deployment, and operation, thus the results of a risk assessment do not stay the same.
- Tests — tests in controlled conditions do not always show the risks that occur in operation. Thus risk identification continues after deployment, and it is necessary to monitor the system and to make regular changes.
SDAIA-P145 also gives four differences between AI systems and other software (p. 12):
- The quality of the data has a large effect on AI systems. It is possible that the training data does not show the actual context of use (p. 12).
- The performance of AI systems changes with time.
- AI systems have much complexity, and it is not easy to know before how they will operate.
- It is not easy to test AI systems and to get the same results again.
SDAIA-P145 tells entities that it is necessary to always do risk assessment in the actual context of use of the system (p. 12). For the records about the use of the system, its data, and its users, see Context and scope.
The risk inventory
In SDAIA-P145, the risk identification step «تحديد المخاطر» helps the entity to know, with a method, the possible risks of an AI system across its lifecycle (p. 18). The introduction to this step lists the work of the step (p. 18):
- Identify all the risks of the AI system, technical risks and non-technical risks.
- Examine the type of each risk.
- Identify the internal sources and the external sources of each risk.
SDAIA-P145 tells entities that this work gives them the same names and the same method to record and compare risks. The work also prepares the estimate of likelihood and impact (p. 18).
The risk inventory «حصر المخاطر» is the first task of the step. In this task, the entity makes a full record of the possible risks of the AI system. Then the entity puts each risk into a risk category of a unified risk taxonomy. This helps prevent missing types of risk (p. 18). AI risks frequently have many related parts. SDAIA-P145 tells entities that their risk inventory is not as easy as for traditional technologies, because of these properties (p. 18):
- A risk can have more than one cause.
- A risk can have an effect on more than one person or entity.
- A risk can occur before or after release.
To make the risk inventory complete, and to use the same method each time, SDAIA-P145 recommends «يُقترح» a unified risk taxonomy with primary areas (p. 18). This unified risk taxonomy helps the entity to make sure that the risk inventory includes all risks. It also helps the entity to keep clear records that it can compare (p. 18). SDAIA-P145 tells entities that they can use the seven risk categories below, to make sure that no important risk category is missing (p. 18). The risk inventory task gives no procedure to accept a different risk taxonomy.
| Risk category | Risks in the risk category (p. 18–20) |
|---|---|
| Bias, discrimination, and abuse | The system gives unfair treatment or unfair representation of persons or groups, frequently because of sensitive characteristics, for example race or gender. Users get harmful content or inappropriate content, for example hate speech, violence, or extremism, or instructions that can cause dangerous or unlawful behavior. The performance of the system is different for social or geographic groups, because of design decisions or biased training data. This can decrease the value of the system for some groups or make trust in the system weak. |
| Privacy and security | The system puts the privacy of persons or entities at risk. It collects, infers, or leaks their sensitive information when they do not know about this or do not give consent. The system makes data or information available when they do not think that it will, or when this is not permitted. This can help identity theft, or cause a loss of confidential information or intellectual property. Vulnerabilities in the system, its software supply chains, or its components can let persons get unauthorized access or change the system. They can also cause outputs that are not safe. |
| Misinformation | The system makes or sends incorrect information or misleading information without intent. Thus users think that incorrect information is correct, and they make decisions less correctly and less independently. This can cause material, psychological, or social harm. Over-personalized outputs make closed information environments. Closed information environments increase bias, and they make shared reality weak. They also have a bad effect on social cohesion, public processes, and societal decision-making. |
| Malicious use | Persons use AI systems with intent to cause harm. Examples are large disinformation campaigns, malicious surveillance, and systematic influence on public opinion and on individual or collective behavior. Persons also use AI for unlawful gain through fraud, deception, extortion, impersonation, or targeted manipulation. This risk category includes cyberattacks, the development or use of weapons, and an increase of the capabilities of weapons. |
| Human-machine interaction | The relation between a person and the system is not balanced. Examples are over-reliance, use that is not safe, and human properties that a person gives to the system. A person can also give the system a level of trust that is more than its actual capabilities. Malicious actors can use this trust to collect personal data or for manipulation. Human agency and autonomy can decrease when persons let AI systems make important decisions. This can also occur when system decisions decrease human control and how much persons can give instructions and select. These effects can make the cognitive skills of persons weak with time. |
| Social, economic, and environmental impacts | AI can increase inequality and the concentration of resources and power. Automation can decrease the quality of work or cause the loss of jobs. Competitive dynamics to make and deploy AI increase the likelihood of the release of systems that do not have sufficient maturity or are not safe. Governance failure can occur when regulation and control mechanisms do not change as fast as AI. Energy consumption, the carbon footprint, and materials cause environmental harm. |
| Safety and limitations | AI systems do not operate correctly in different conditions. Because of errors in design or development, the system does not do the work that its designers or users want. The system has dangerous capabilities that can increase the likelihood of wide harm. The reliability and robustness of the system are weak in critical applications. Weak transparency and explainability make it less possible to know how the system makes decisions, to apply accountability, or to correct its errors. When many systems operate together, this can cause complexity, conflicting incentives, cascading failures, or new vulnerabilities. |
Risk characterization
In SDAIA-P145, risk characterization «توصيف الخطر وتحديد مصدره» is the next task of risk identification after the risk inventory (p. 20). This task changes the general information about each risk into information that the entity can use to control the risk. For this, the entity identifies the cause, the intent, and the timing of each risk (p. 20):
| Item | Values (p. 20) |
|---|---|
| Cause | The AI system (a problem or an error in the system), or a human (misuse of the system) |
| Intent | Intentional, or unintentional |
| Timing | Before release, or after release |
The entity also identifies the conditions that can cause the risk to occur, and the vulnerabilities of the risk (p. 20). SDAIA-P145 tells entities that, during risk assessment and risk treatment, the entity can then connect each risk to the most applicable controls (p. 20). The internal sources and the external sources of a risk are a task of the full risk identification step (p. 18). They are not a different item of risk characterization.
Likelihood estimation
In SDAIA-P145, the risk assessment step «تقييم المخاطر» measures the level of each identified risk in the actual context of use of the system (p. 22). The risk assessment uses properties of the system and its operating environment, for example these (p. 22):
- The properties of the model and of the data.
- The level of maturity and the level of automation.
- The function of human intervention.
- The error scenarios that the entity knows, and the error scenarios that it does not know.
The risk assessment also uses the available results of tests and verification, and the available operational indicators (p. 22). Then the risk level is set with an approved risk matrix. This risk matrix makes it possible to compare risks and to put the most important risks first (p. 22). The step has these tasks: likelihood estimation, impact estimation, and risk-level determination (p. 22–25).
Likelihood estimation «تقدير الاحتمالية» estimates how possible it is that the risk scenario occurs in the adopted time frame (p. 22). The estimate uses the available indications, the related data, and practical experience of how the system and its operating environment operate (p. 22).
SDAIA-P145 gives four likelihood levels, from 1 (low) to 4 (high) (p. 22). Likelihood estimation does not initially «ابتداءً» use specified percentages (p. 23). SDAIA-P145 tells entities that it is not easy to set percentages for the risks of emerging technologies such as AI (p. 23). But SDAIA-P145 tells entities that the levels agree with the annual reference ranges that some risk management frameworks use (p. 23):
| Level | Information (p. 22) | Annual reference range (p. 23) |
|---|---|---|
| Rare (1) | The likelihood that the risk occurs is very low. | Less than 1% |
| Unlikely (2) | The risk can occur, but in usual conditions the entity does not think that it will occur. | From 1% to 10% |
| Likely (3) | The likelihood that the risk occurs is large, because of the type of the system and its operational context. | From 10% to 50% |
| Almost certain (4) | The entity is almost sure that the risk will occur, unless good controls limit it. | 50% or more |
SDAIA-P145 recommends that entities think about «يُراعى» one or more likelihood factors below, as applicable to the risk and system context (p. 22). It is not necessary to use all the likelihood factors each time (p. 22).
| Likelihood factor | Information (p. 22–23) | Effect on likelihood |
|---|---|---|
| Exposure | How much persons use the system, the number of users or requests, and how wide the operation of the system is. | More exposure, or more time of exposure to the source of the risk, increases the likelihood. |
| Preventive controls | If preventive controls are available before the risk occurs, and how good these controls are. | Strong controls decrease the likelihood. Weak or missing controls increase it. |
| Ease of occurrence | How easily errors occur or persons can use vulnerabilities, for example because of system complexity, weak configurations, or human oversight that is not sufficient. | More ease of occurrence increases the likelihood. |
| Precedents | Equivalent incidents that occurred before, in the entity or in the sector. | More precedents increase the likelihood that the risk occurs again. |
Impact estimation
In SDAIA-P145, impact estimation «تقدير الأثر» estimates the severity of the possible harm if the risk occurs (p. 23). The estimate examines these properties of the impact on the affected parties (p. 23):
- The type of the impact.
- How wide the impact is.
- How long the impact continues.
- If recovery is possible.
The estimate includes these types of impact (p. 23):
- Fundamental rights.
- Human safety.
- Privacy and data protection.
- Continuity of services.
- Public trust.
- Regulatory compliance.
The estimate also includes how sensitive the sector is, and the type of decision that the system helps with or makes (p. 23). Each risk gets one impact level (p. 23). SDAIA-P145 tells entities that the impact levels make the risk assessment method the same for all risks, and let the entity compare risks (p. 23). The impact levels also prepare the step to calculate the risk level with the risk matrix (p. 23).
SDAIA-P145 gives four impact levels, from 1 (low) to 4 (catastrophic) (p. 23):
| Level | Information (p. 23) |
|---|---|
| Low (1) | The possible harm is small and local. It is possible to limit it and correct it quickly. |
| Medium (2) | The possible harm is clear, but not wide. It is possible to limit it and correct it in a reasonable period, without severe effects or effects that continue for a long time. |
| High (3) | The possible harm is large and has clear effects. Usually it is possible to limit it, but the harm has important results and clear effects, for which a clear institutional response is necessary. |
| Catastrophic (4) | Only for extreme cases: very severe and very dangerous harm, with wide and deep effects. The harm can be irreversible, or a long recovery can be necessary, with permanent or almost permanent effects. |
In SDAIA-P145, catastrophic impact usually «عادةً» occurs with the properties below (p. 23–24). Because of «عادةً», these properties are typical. They are not the only conditions. SDAIA-P145 does not tell entities if one property is sufficient or if all the properties are necessary.
- The risk has an effect directly on public security or societal stability, or it causes threats of national dimensions.
- The risk has an effect directly on human safety, or it puts the life, the physical health, or the psychological health of persons at severe risk.
- The risk causes harm to religion, offense to sacred things, religious incitement, or religious misinformation, with possible social effects that are severe and sensitive.
- The risk causes actual deprivation of fundamental rights or vital services that cannot be compensated for easily or in a short period.
- The risk includes a breach or the control of critical systems, or unauthorized access to very sensitive basic components for operation.
- The risk includes a wide leak of very sensitive data, for example health data, financial data, data of minors, identity data, or security data.
SDAIA-P145 recommends that entities think about «يُراعى» one or more impact factors below, as applicable to the risk and system context (p. 24). It is not necessary to use all the impact factors each time (p. 24).
| Impact factor | Information (p. 24) | Effect on impact |
|---|---|---|
| Severity of harm | The severity of the harm, from small effects that it is possible to limit, to severe harm that can be catastrophic. | More severity increases the impact. |
| Size of impact | How wide the harm is: the number of persons, systems, or services that it has an effect on, and the quantity of its losses. | If the harm has an effect on more persons, systems, or services, the impact increases. |
| Sensitivity of decisions or data | How sensitive the system context is, for example critical data or critical decisions. | If the system context is more sensitive, a problem has more impact. |
| Speed of recovery | How quickly the entity can repair the service or correct the error, and go back to usual operation after the incident. | Fast recovery decreases the impact. Slow recovery increases it. |
Risk level and risk matrix
In SDAIA-P145, risk-level determination «تحديد مستوى الخطر» changes the results of likelihood estimation and impact estimation into one risk level, as a number, for each risk (p. 24). The risk level shows how dangerous each risk is. It helps the entity to compare risks, and to put the risks in a sequence for risk treatment (p. 24).
The AI risk matrix gives likelihood levels (1 to 4) in its rows and impact levels (1 to 4) across its top (p. 24–25). In SDAIA-P145, the risk level is the likelihood level multiplied by the impact level (p. 24–25):
Risk level = likelihood × impact, from 1 to 16.
SDAIA-P145 tells entities that this method makes risk assessment the same for all entities (p. 25). The risk matrix in Figure 5 of SDAIA-P145 gives these values (p. 25):
| Likelihood \ Impact | Low (1) | Medium (2) | High (3) | Catastrophic (4) |
|---|---|---|---|---|
| Almost certain (4) | 4 | 8 | 12 | 16 |
| Likely (3) | 3 | 6 | 9 | 12 |
| Unlikely (2) | 2 | 4 | 6 | 8 |
| Rare (1) | 1 | 2 | 3 | 4 |
The risk level puts each risk in one of four risk groups. Each risk group has a color that helps decisions (Figures 4 and 5, p. 25):
| Risk group | Risk level | Color |
|---|---|---|
| Low risk | 1–2 | Green |
| Medium risk | 3–6 | Yellow |
| High risk | 8–12 | Orange |
| Catastrophic risk | 16 | Red |
SDAIA-P145 uses the risk groups to make risk assessment the same each time, and transparent (p. 25). The risk groups help the decisions about acceptance, risk treatment, or escalation of a risk (p. 25). The risk groups also connect the risk level to controls and measures that are proportionate to its severity and the context of use (p. 25). For these decisions, see Treatment strategy selection.
The Purpose section of SDAIA-P145 also includes system classification of types of AI systems by risk level, based on likelihood, impact, and context (p. 7). For periodic reviews that examine the system classification again (p. 28), see Risk register checks. These provisions (p. 7, 24–25, and 28) give no method to calculate one system classification from the risk levels of the risks.
Example: risk assessment
The SDAIA-P145 example section gives a risk assessment for a government entity that uses a large language model to prepare internal reports (p. 32).
In the example section, the risk inventory has eight risks from all seven risk categories. The risk category of social, economic, and environmental impacts has two of the eight risks (p. 34–36). For each risk, the risk inventory of the example gives this information (p. 34–36):
- The risk category and the risk description.
- The cause, the intent, and the timing.
- The vulnerabilities and the affected groups.
- The type of the effect.
Risk 7 is about a decrease in human competence (p. 36). Its source is human, its intent is unintentional, and it occurs after release. Its vulnerabilities are that no parallel training programs are available, and use without control (p. 36).
For each risk, the risk assessment tables give a likelihood level with a justification, an impact level, and a risk level (p. 38–40). These are two of the eight risks:
| Item | Incorrect or misleading information | Entry or leak of sensitive internal information |
|---|---|---|
| Risk category (p. 34) | Misinformation | Privacy and security |
| Cause, intent, timing (p. 34) | AI system, unintentional, after release | Human, unintentional, after release |
| Likelihood (p. 38) | Likely (3) | Unlikely (2) |
| Justification of likelihood (p. 38) | Exposure is high, because many personnel use the system frequently. Ease of occurrence is moderately high, because of the type and the limits of each large language model. Controls are available only in part (human review), and they operate correctly only if the user is careful. Precedents are frequent in equivalent systems. | Exposure is medium, because users write the data into the system manually. Ease of occurrence is medium, because a human error can cause the risk. Controls include clear instructions and an internal operating environment. The instructions tell users that entry of sensitive data is not permitted. There are not many precedents where governance controls are available. |
| Impact (p. 38) | Medium (2) | High (3) |
| Risk level (p. 38) | Medium (3 × 2 = 6) | Medium (2 × 3 = 6) |
The tables give a justification for each likelihood estimate. They give no justification by impact factor for each impact level (p. 38–40). No risk in the example has catastrophic impact, and the tables give a medium risk level for all eight risks (p. 38–40). For the risk treatment of these risks, see Example: risk treatment.
Related information
In Modulos, the AI System Framework MFF-23 (Saudi AI Risk Management) has the Requirements for risk identification and risk assessment. For the Requirements and their source provisions, see Requirements and source provisions. For the step before risk identification, see Context and scope. For the steps after risk assessment, see Risk treatment, monitoring and review, and incident response. For short information about the risk categories, likelihood, impact, and the risk matrix, see Saudi AI Risk Management FAQ. For other AI risk frameworks, see NIST AI RMF, ISO/IEC 42001, and Comparison.
Source
- National Artificial Intelligence Risk Management Framework — SDAIA, الإطار الوطني لإدارة مخاطر الذكاء الاصطناعي, SDAIA-P145, version 1, April 2026 (Arabic). Provisions used: p. 7, 10–13, 18–25, and 28, and the example section, p. 32, 34–36, and 38–40. PDF.
For the Arabic version of SDAIA-P145 and the English executive summary, see National AI Risk Management Framework.
Disclaimer
This page gives general information. It is not legal advice.