In this article
If your company uses AI to answer customers, draft proposals or sort requests, there is now a national reference for how to manage the risk. On 14 July 2026 SDAIA launched the National AI Risk Management Framework for government and private entities, with a 4-phase method, 7 principles and 7 main risk types. On 14 October 2026 SDAIA said it has adopted 23 national AI-related standards. The framework is guidance, not a new fine, but it sets out the questions your company will be asked. Your first step: a list of every AI tool your team uses.
What exactly did SDAIA launch?
According to the Saudi Press Agency, the framework provides a unified national methodology for identifying, assessing, treating and monitoring AI risks, so that public and private entities can adopt AI safely and responsibly. SDAIA explains why ordinary IT risk management is not enough: AI risks may emerge unexpectedly during operation, a system's performance can change over time, and its behaviour can be hard to explain or reproduce.
The framework includes a worked scenario of a government entity using a model to prepare internal reports, taken through every phase, and it can be read through SDAIA's official link. For the wider picture of SDAIA's data governance rules, see our article Data Governance and Responsible AI Under SDAIA Rules.
The four phases, applied to a private company
The method is a lifecycle of 4 connected phases. Here is how it looks in a mid-sized business that uses an AI assistant to answer customers on WhatsApp:
- 1. Define context and scope: What is the tool? What exactly does it do? Who uses it? What data goes in, and does it include customers' personal data?
- 2. Identify and assess risks: What if the assistant quotes a wrong price, promises something you do not offer, or shows one customer's data to another? Each risk is scored on a matrix linking its likelihood to the size of its impact.
- 3. Treat the risks: One decision per risk: reduce it (human review before prices are sent), avoid it (block the tool from certain data), or accept it if the impact is small.
- 4. Monitor and review continuously: Because performance can drift, review a sample of replies regularly, log the mistakes, and reassess whenever you change the tool or the vendor.
7 principles your company will be asked about
The framework rests on 7 principles: integrity and fairness, privacy and security, humanity, reliability and safety, transparency and explainability, accountability and responsibility, and social and environmental benefits. It sorts AI risks into 7 main types so that no essential category is missed. In practice, ask of every tool: does it treat customers fairly? Do we know where the data goes? Can we explain its decision to a customer who complains? And who, by name, is accountable when it gets something wrong?
23 national standards: from what to how
At the 10th Standards Forum, held by the Saudi Standards, Metrology and Quality Organization in Riyadh on 14 October 2026, SDAIA explained that policies and frameworks define what AI systems should achieve, while standards define how those requirements are implemented, measured and proven. It said it has issued more than 10 AI regulatory frameworks and tools and adopted 23 national AI-related standards covering governance and management systems, training data quality, safety, robustness, security and privacy, plus reference frameworks and big data, as reported by Al-Madina. What it means for you: if you supply technology to government entities or large companies, expect these standards to show up in tender requirements.
The Origami view
We read the framework as a signal of direction rather than an immediate obligation. It is guidance today, but large organisations build their policies on it and then pass its requirements down to their suppliers. A business that already keeps a written register of its AI tools and their risks will answer those questions in a day; one that does not will start from zero under a delivery deadline.
None of this needs a full risk department. For a small or mid-sized business, one table with five columns (tool, use, data, top risk, decision owner) covers most of what phases 1 and 2 ask for. And when your systems are designed to log every automated reply and allow human review before sensitive decisions, phase 4 becomes automatic instead of a burden. That is what we build as part of our services.
Start this week
- List every AI tool your team uses, including personal subscriptions employees use for work.
- For each tool, note the data that goes in and flag anything containing customers' or employees' personal data.
- Score the top 3 risks of each tool for likelihood and impact, and start with the highest.
- Name one accountable person per tool and set a review every 3 months.
- Read the worked scenario in SDAIA's document and use it as a template.
Sources
- Saudi Press Agency — SDAIA Introduces National Framework for Managing AI Risks (14 July 2026): spa.gov.sa
- Saudi Press Agency — Arabic announcement with the link to the framework: spa.gov.sa
- SDAIA — National AI Risk Management Framework document: sdaia.gov.sa
- Saudi Standards, Metrology and Quality Organization — 10th Standards Forum 2026: saso.gov.sa
- Al-Madina — SDAIA on the role of standards in enabling AI applications: al-madina.com
- Al-Jazirah Online — same coverage (14 October 2026): al-jazirahonline.com
Frequently asked questions
Is SDAIA's National AI Risk Management Framework mandatory for private companies?
SDAIA described it at launch on 14 July 2026 as a guidance reference for government and private entities, and announced no fines tied to it. It does, however, set the method large organisations will use to assess their suppliers, so applying it early is sensible.
What are the four phases of the national AI risk management framework?
Defining context and scope, identifying and assessing risks, treating risks, and continuous monitoring and review. Each risk level is scored on a matrix that links its likelihood to the size of its impact.
What are the 23 national AI standards SDAIA has adopted?
On 14 October 2026 SDAIA said it has adopted 23 national AI-related standards covering governance and management systems, training data quality, safety, robustness, security and privacy, reference frameworks and big data. The announcement did not publish a detailed list.
Where should a small business using ChatGPT or similar tools start?
List every AI tool the team uses and the data that goes into it, score the top 3 risks of each tool, name an accountable person per tool, and review them every 3 months.
Follow Origami in Google
Pin Origami as a preferred source and our articles will surface first for you in Google Search and Top Stories.
