SASO Mandates Dual Cybersecurity Certification for Smart Pet Devices in Saudi Arabia

Saudi Arabia’s Standards, Metrology and Quality Organization (SASO) issued an urgent regulatory update on May 4, 2026, requiring all smart pet devices—including automated feeders and GPS-enabled collars—entering the Saudi market to comply with two cybersecurity standards effective June 1, 2026. This development directly impacts global manufacturers, exporters, and certification service providers engaged in the smart pet technology supply chain.

Event Overview

On May 4, 2026, SASO published Emergency Notice SASO/TECH/2026/089. It mandates that all Smart Pet Devices imported into Saudi Arabia must obtain both ISO/IEC 27001 information security management system certification and compliance verification against the SASO IoT Security Framework Version 2.3. The requirement takes effect on June 1, 2026. Chinese OEM manufacturers are given a 60-day transition window—until July 31, 2026—to complete the dual certification; failure to do so will result in denial of the SASO Certificate of Conformity (CoC).

Industries Affected

Direct Exporters & Trading Companies

These entities face immediate customs clearance risk: without valid SASO CoC backed by the dual certification, shipments will be rejected at Saudi ports. Impact manifests in delayed deliveries, rework costs, and potential contract penalties under Incoterms such as DAP or DDP.

OEM/ODM Manufacturing Firms (Especially China-based)

As primary certificate holders per SASO’s notice, Chinese OEMs bear full compliance responsibility—not just testing but documentation, internal ISMS implementation, and audit readiness. The 60-day deadline compresses timelines for gap assessment, remediation, and third-party audit scheduling, particularly where existing ISO/IEC 27001 scope excludes IoT device firmware or cloud backend components.

Certification & Testing Service Providers

Demand is rising for labs accredited to perform SASO IoT Security Framework V2.3 assessments—especially those with cross-recognition for ISO/IEC 27001. However, only SASO-authorized bodies may issue the final CoC. Non-accredited labs cannot substitute for official validation, creating a bottleneck for time-sensitive submissions.

Distribution & Brand Owners (Importers)

Brands relying on third-party OEMs must now verify certification status before purchase orders or inventory commitments. Lack of contractual clauses assigning certification ownership or cost allocation may expose importers to unplanned compliance liabilities—including product recalls or sales suspension if OEMs miss the deadline.

Key Actions for Stakeholders

Monitor Official SASO Communications for Interpretive Guidance

SASO has not yet published publicly accessible test protocols or acceptance criteria for the IoT Security Framework V2.3. Stakeholders should track SASO’s official portal and authorized notification channels for clarifications on firmware signing requirements, OTA update security, or data residency expectations—details critical for technical implementation.

Prioritize Devices with Cloud-Connected or Remote-Control Features

The notice explicitly names GPS collars and smart feeders—both typically cloud-dependent. Analysis shows devices involving remote command execution, biometric data handling, or persistent network connectivity are most likely within scope. Standalone Bluetooth-only devices may fall outside current enforcement focus—but this remains unconfirmed and subject to SASO’s discretion.

Distinguish Between Policy Signal and Operational Readiness

The May 4 notice is binding, but SASO’s capacity to process dual-certified CoC applications at scale remains untested. Observably, early applicants may encounter delays in CoC issuance even after passing audits—making it prudent to submit documentation no later than mid-June 2026 to avoid July bottlenecks.

Initiate Internal Alignment Across R&D, QA, and Regulatory Teams

ISO/IEC 27001 requires documented risk treatment plans, asset inventories, and incident response procedures—not just penetration testing. Current more suitable approach is to convene cross-functional teams now to map firmware update mechanisms, user authentication flows, and data encryption practices against both ISO/IEC 27001 Annex A controls and SASO V2.3 clauses.

Editorial Perspective / Industry Observation

This notice is less a standalone regulation and more a signal of SASO’s broader shift toward outcome-based IoT governance—where conformity hinges on demonstrable security outcomes, not just component-level testing. Analysis shows it aligns with Saudi Vision 2030’s digital trust agenda and mirrors tightening frameworks in UAE and Qatar, suggesting regional harmonization may follow. From industry perspective, it reflects growing regulatory expectation that consumer IoT vendors assume end-to-end accountability—from hardware design through cloud operations—even when outsourcing manufacturing. It is not yet a market-wide ban, but rather a hard deadline for formalized security governance—and one that treats certification as a prerequisite, not a post-market formality.

In summary, SASO’s May 4, 2026 notice establishes a concrete, near-term compliance threshold for smart pet device market access in Saudi Arabia. Its significance lies not in novelty—similar frameworks exist elsewhere—but in its enforceability timeline, explicit assignment of liability to OEMs, and integration of management system rigor (ISO/IEC 27001) with technical IoT controls. For stakeholders, it is best understood not as an isolated audit requirement, but as an indicator of accelerating regulatory convergence across Gulf Cooperation Council (GCC) markets—where cybersecurity compliance is increasingly non-negotiable, non-delegable, and non-deferrable.

Source: SASO Emergency Notice SASO/TECH/2026/089, issued May 4, 2026. Note: SASO IoT Security Framework V2.3 test methodology and authorized laboratory list remain pending public release; ongoing monitoring is advised.