Arab News | Saudi Arabia strengthens AI governance with unified risk framework

RIYADH: Saudi Arabia has introduced a national framework to help government agencies and companies identify and manage risks from artificial intelligence as adoption of the technology accelerates. 

The National AI Risk Management Framework, developed by the Saudi Data and AI Authority, provides a unified methodology for identifying, assessing, treating and monitoring AI-related risks, the Saudi Press Agency reported. 

The framework recognizes that AI risks can emerge unexpectedly, change over time and be more difficult to explain or reproduce than problems involving conventional technologies. 

The initiative comes as commercial registrations for AI activities increase in Saudi Arabia. The number reached 24,552, up from 19,042 at the end of 2025 and 14,163 a year earlier, according to Ministry of Commerce data. 

Saudi Arabia has designated 2026 as the Kingdom’s Year of AI, with SDAIA leading related programs under the National Strategy for Data and AI as part of Vision 2030. 

For businesses, the framework comes as companies expand their use of autonomous AI systems, raising questions about data access, decision-making and human oversight.  

Mohammed El-Shaari, an enterprise AI specialist and chief technology officer at HotDesk, said companies should examine their operations before selecting an autonomous system.  

“A structured AI consultation, discovery and risk-analysis phase should be a core requirement for any company planning to adopt autonomous solutions,” he told Arab News. 

Businesses should map the workflows they intend to automate, the data systems will access, decisions they may make and potential failure scenarios before deployment, El-Shaari added. 

Higher-risk systems should undergo accuracy, security and bias testing, while companies should restrict access to sensitive information, record AI-generated actions and require human approval for consequential decisions, the specialist said.  

“A customer-service chatbot should not be governed in the same way as an autonomous agent that can access financial information, approve transactions or act on behalf of the company,” he added.  

The framework is structured around four phases: defining the context and scope of an AI system; identifying and assessing risks; treating those risks; and continuously monitoring and reviewing the system. 

Bindesh Vijayan, co-founder and chief technology officer of Myndlab, said Saudi Arabia’s approach focuses on managing AI risks according to their potential impact rather than treating all applications equally. 

“The biggest shift for companies will be treating AI risk as an engineering responsibility, not a compliance check at the end,” Vijayan said. 

National governance system  

The framework uses a matrix combining the likelihood and potential impact of a risk, helping organizations determine its severity and prioritize their response. It covers seven principal risk categories and seven core principles, including integrity, privacy, transparency and accountability.  

SDAIA launched the framework in July and subsequently introduced its methodology to more than 150 specialists representing 45 public- and private-sector organizations at a forum in Riyadh.