In July SDAIA launched the National Artificial Intelligence Risk Management Framework. The full text is a 48-page Arabic document (SDAIA-P145, dated April 2026). The English edition is a one-page summary, so the method itself is only in the Arabic. We read it.
Short answer: treat the framework as a project artefact, not a policy to file. Every AI system gets a context sheet and a risk register, scored before build, decided by a named person, and reviewed whenever the data, the model or the scope changes. If you already design to SDAIA's AI ethics principles, the controls will look familiar. What is new is a shared way to score and record them.
What the framework asks for
It is advisory. SDAIA describes it as guidance, methods and tools that government and private entities can build their own internal policies on, and it does not set detailed technical standards for model performance. It focuses on high-impact systems: predictive models, natural language processing, image and video analysis, intelligent automation and general-purpose models.
- Four reference pillars. General principles and AI ethics, AI regulations, data regulations, and sector regulations.
- Five steps. Context and scope, risk identification, risk assessment, risk treatment, and monitoring and review.
- Seven risk categories. Bias, discrimination and abuse; privacy and security; misinformation; malicious use; human–machine interaction; social, economic and environmental impacts; safety and limitations.
Each risk is also tagged by source (the system or a person), intent (deliberate or not) and timing (before or after launch).
Start with context, not the matrix
Before any scoring, the framework asks four questions we would put on page one of any project:
- What is it for, and what is out of bounds? Intended uses, written next to the uses that are not allowed.
- What goes in and comes out, and through whom? Every input and output point, and every party in the chain: internal systems, other entities, vendors and data providers.
- Does it recommend, decide or act? And where a person approves, reviews, objects or stops it.
- How does it change? Who approves updates, and which changes trigger a fresh assessment.
The third question moves every score that follows. It is also where an agent differs from a chat window.
Scoring one workflow
Likelihood runs from 1 (rare) to 4 (almost certain), judged on exposure, existing controls, ease of occurrence and precedent. Impact runs from 1 (low) to 4 (catastrophic). The risk level is likelihood multiplied by impact: low 1–2, medium 3–6, high 8–12, catastrophic 16.
Two details are easy to miss:
- The gaps between the bands are arithmetic. No product of two numbers from 1 to 4 gives 5, 7, 10, 11 or 13–15, so no score falls between bands.
- Read the impact column, not just the score. A rare but catastrophic risk scores 4, the same band as an almost-certain, low-impact one. The framework reserves catastrophic for extreme cases, including a direct threat to public security or human safety, denial of fundamental rights or vital services, or a large leak of highly sensitive data such as health, financial or minors' records.
SDAIA's appendix works through an example: a government entity using a large language model, hosted in its own environment or an approved government cloud, to draft internal reports. The model only suggests text and a person approves everything. The appendix lists eight risks and rates every one medium. Inaccurate content, for instance, is likely (3) with medium impact (2): a 6.
Now let the same model send supplier emails on the organisation's behalf, with nobody reading them first. The answer to "recommend, decide or act" changes, and in our reading the scores change with it. The same inaccurate text now leaves the building, so impact can reasonably move to high, and with no reviewer in the loop likelihood does not fall either. Likely times high is 9, and the risk is no longer medium. That is where the framework expects an explicit decision, not a default.
Treatment is a decision with a name on it
For each risk there are four responses: avoid (change the design, restrict or switch off the function), mitigate (technical, organisational and operational controls), transfer (contracts, insurance, vendor commitments) and accept. The framework is explicit that transferring a risk does not transfer your responsibility for governance and compliance. Acceptance requires the residual risk to sit inside an approved tolerance, with the reasons, limits and review plan written down.
Every control gets an owner, a timeline and a measurable indicator. Once the controls are in, the residual risk is scored again with the same matrix. Then someone decides: accept, or escalate to a conditional launch, restricted use, or a temporary or permanent stop.
Monitoring closes the loop. Drift, error rates, complaints and requests for human review each get an alert threshold. Reviews run on a schedule and on events: new data, a model update, wider use, new regulation. Incidents get a root-cause analysis that feeds back into the register.
What we would put in the register
One row per risk, kept with the system rather than in a policy folder:
- The risk, its category, and its source, intent and timing.
- Likelihood, impact and level, with the reason for each.
- Response and controls, each control with an owner and an indicator.
- Residual level and decision, with the name of the person who made it.
- Review triggers, so the next model update reopens the row.
Most of the evidence already exists if the system was built properly. An evaluation set is how you defend a likelihood score. The audit log is how you investigate an incident. The system owner from our working guide to the ethics principles is the person who signs the decision.
What this is not
This is our reading as builders, not legal advice. The framework is advisory; the laws it points to, such as the PDPL and sector rules, apply on their own terms. The Arabic text is the full document, so check the current edition, and your own counsel, before relying on any of this.
If you want to score one workflow together, start with one workflow.