Pre-Deployment Review Guide Inspired by SDAIA's AI Ethics Principles

SDAIA's AI Ethics Principles, published in September 2023, set a principle-based framework for responsible AI in Saudi Arabia built around seven principles: Fairness, Privacy & Security, Humanity, Social & Environmental Benefits, Reliability & Safety, Transparency & Explainability, and Accountability & Responsibility.

The framework is tied to the Kingdom's stated commitment to human rights, cultural values, and alignment with international standards, and it is intended to help entities adopt ethics when building, developing, deploying, and monitoring AI-based solutions.

The scope covers public, private, and non-profit AI stakeholders in the Kingdom, including developers, designers, users, deployers, and people affected by AI systems; this guide treats the principles as controls to operationalize before an AI system is released.

SDAIA describes the AI System Lifecycle as a cyclical process for designing, building, and producing a robust and safe system, while summaries of the framework describe coverage from conception, design, development, testing, deployment, monitoring, maintenance, and retirement.

The pre-deployment review must first classify the system using SDAIA's four-tier model: little or no risk, limited risk, high risk, and unacceptable risk, because the tier determines whether compliance is recommended, required with applicable controls, or prohibited.

Systems of little or no risk are recommended rather than required to comply; limited-risk and high-risk systems must comply with the principles and additional applicable controls; unacceptable-risk systems cannot be developed or deployed.

The review output should record the risk tier, the rationale for that tier, the principles and controls triggered by that tier, and any conditions that must be met before release or before the system moves into monitoring.

1. Define the system, intended purpose, users, affected groups, sector context, and lifecycle stage, then assign the SDAIA risk tier and list the principles and controls triggered by that tier.

2. Run an ethics impact assessment across the seven principles: bias and discrimination checks for Fairness; dignity, rights, and human oversight for Humanity; net social and environmental effect for Social & Environmental Benefits; and ownership, incident paths, and remediation for Accountability & Responsibility.

3. For Privacy & Security, confirm the data and security posture against the Personal Data Protection Law for privacy matters and National Cybersecurity Authority best practices for model security and incident response, applying them only as applicable to the system's data and operations.

4. For Reliability & Safety and Transparency & Explainability, complete testing and validation for expected operating conditions, resilience, and robustness, and document datasets, model design, and decision logic to the extent feasible and appropriate.

5. Close the review with a release decision: approve, approve with conditions, require remediation and reassessment, or stop when the risk is unacceptable; record the decision, evidence, responsible owners, and the monitoring handoff.

The checklist operationalizes SDAIA's seven principles as pre-deployment controls rather than general values, with one evidence line for each principle and a gate that reflects the assigned risk tier.

It prompts reviewers to test fairness through bias detection and mitigation, privacy and security through applicable PDPL and NCA-aligned controls, humanity through rights and oversight safeguards, and social and environmental benefit through explicit impact consideration.

It also requires reliability and safety validation, transparency documentation for data, model design, and decision logic where feasible, and accountability measures that name owners, escalation routes, incident reporting, and remediation channels.

Entities use the completed checklist to verify compliance status, document decisions and exceptions, identify conditions for release, and prepare the evidence and metrics needed for post-deployment monitoring.

SDAIA's framework includes annexed AI ethics tools, lifecycle mapping, and an AI Ethics Checklist, and external summaries describe self-assessment tools for mapping AI risks against the principles; these should be used to structure the review rather than replace judgment.

Compliance evidence should be organized as an auditable pack: impact assessment, risk-tier rationale, model card or equivalent model documentation where used, test and validation results, incident logs when relevant, and governance records showing who approved what and why.

For limited-risk and high-risk systems, documentation and logging expectations are stronger, and third-party or external assurance may be used for high-risk systems where independent confidence is needed before release.

After deployment, SDAIA monitoring can include periodic assessments, audits, self-reporting, and targeted investigations, so the pre-deployment file must hand off clear owners, indicators, incident routes, and review dates for continued compliance.