SASO Mandates Dual Cybersecurity Certification for Smart Pet Devices in Saudi Arabia

Saudi Arabia’s Standards, Metrology and Quality Organization (SASO) updated its regulatory requirements for smart pet devices on May 4, 2026 — mandating dual cybersecurity certification for all in-market products including smart feeders, GPS collars, and health-monitoring wearables. This development directly impacts exporters, OEM/ODM manufacturers, and supply chain service providers serving the Gulf pet tech market.

Event Overview

On May 4, 2026, SASO issued an urgent update to its technical requirements for smart pet devices. Effective immediately, all such devices placed on the Saudi market must concurrently comply with ISO/IEC 27001 (Information Security Management Systems) and SASO’s adopted IoT Security Framework — which is aligned with ETSI EN 303 645. Non-compliant products will be removed from shelves and denied customs clearance. Chinese contract manufacturers are explicitly required to upgrade both secure development lifecycle practices and third-party testing protocols.

Industries Affected

Direct Exporters & Brand Owners

Exporters placing branded smart pet devices into Saudi Arabia face immediate compliance risk. The dual-certification requirement adds new layers of documentation, audit scope, and time-to-market delay — especially for products previously certified only to general CE or FCC standards. Market access now hinges on verifiable evidence of both ISMS implementation and IoT-specific security controls.

OEM/ODM Manufacturers (especially China-based)

Contract manufacturers supplying smart pet hardware must adapt their design, firmware development, and QA processes to meet ISO/IEC 27001’s organizational controls and ETSI EN 303 645’s technical safeguards (e.g., secure boot, default password management, vulnerability disclosure policies). This affects firmware architecture, cloud API security, and even packaging instructions — not just test reports.

Supply Chain & Certification Service Providers

Testing labs, certification bodies, and compliance consultants supporting the pet tech sector must now offer integrated assessment pathways covering both ISO/IEC 27001 and IoT Security Framework criteria. Gaps exist: few labs currently hold SASO-recognized accreditation for the full dual-scope evaluation, increasing reliance on multi-stage audits and extended lead times.

What Stakeholders Should Focus On — And How to Respond

Monitor SASO’s official guidance updates closely

SASO has not yet published a formal transition timeline, enforcement schedule, or list of accredited conformity assessment bodies for the dual-certification scheme. Stakeholders should track SASO’s e-Services portal and official notifications for clarifications on grandfathering, phased rollout, or exemptions for legacy models.

Prioritize high-volume SKUs and Saudi-bound shipments

Given limited testing capacity and evolving interpretation of the IoT Security Framework, companies should identify top-selling smart pet devices destined for Saudi Arabia and initiate gap assessments first — focusing on firmware update mechanisms, data encryption in transit/at rest, and remote management interfaces.

Distinguish between policy signal and operational readiness

This mandate signals SASO’s broader shift toward outcome-based cybersecurity governance for consumer IoT — not just a one-off product rule. However, actual enforcement rigor (e.g., random post-market surveillance, penalties for non-compliance) remains unconfirmed. Treat current requirements as binding but verify verification methods before committing to full-scale re-certification.

Align internal development workflows with ISO/IEC 27001 Annex A controls

Manufacturers should map existing secure development practices (e.g., threat modeling, code signing, patch management) against ISO/IEC 27001’s control objectives — particularly A.8.23 (Secure Development Lifecycle), A.8.27 (Secure Configuration), and A.5.15 (Information Security in Supplier Relationships). This prepares teams for both certification audits and future regional requirements.

Editorial Perspective / Industry Observation

Observably, this update reflects SASO’s accelerating alignment with global IoT security baselines — notably the UK’s PSTI regime and EU’s Cyber Resilience Act — rather than introducing novel technical demands. Analysis shows it functions primarily as a regulatory signal: it confirms Saudi Arabia’s intent to treat consumer IoT as critical infrastructure requiring documented, auditable security governance — not merely functional safety. From an industry perspective, it is less a sudden compliance cliff and more a formalization of emerging best practices already adopted by leading pet tech brands. Still, the lack of transitional provisions means early-mover advantage lies with firms that treat certification as an embedded engineering process — not a final gate.

Conclusion
This SASO update marks a structural tightening of market access conditions for smart pet devices in Saudi Arabia — shifting emphasis from device functionality to verifiable, organization-wide cybersecurity maturity. It does not introduce unprecedented technical hurdles, but it does raise the evidentiary bar for compliance. Current understanding better fits a coordinated regulatory maturation phase than a reactive enforcement surge — meaning proactive alignment with ISO/IEC 27001 and ETSI EN 303 645 offers strategic resilience across multiple export markets.

Information Sources
Main source: Official SASO announcement dated May 4, 2026, accessible via SASO e-Services platform (reference ID: SASO/SPD/2026/001).
Note: Transitional arrangements, accredited bodies list, and detailed scope exclusions remain pending confirmation and are under active observation.