Saudi Arabia's SDAIA has launched a national AI risk framework. Seven principles, seven risk categories, and a four stage cycle that ends in continuous monitoring and review.

The reasoning is the interesting part. SDAIA says AI risks can emerge unexpectedly during operation, performance can change over time, and behaviour can be hard to interpret or reproduce.

That's the quiet death of the point in time risk assessment. If nobody is watching after go live, you're governing a snapshot, not a system.