SASO Updates SABER: Firmware Hash & OTA Logs Required for Beauty Devices from May 10, 2026

Saudi Standards, Metrology and Quality Organization (SASO) has enforced new SABER platform requirements for beauty devices (HS code 8543.70) effective May 10, 2026. The update mandates submission of firmware binary SHA-256 hash values and six-month OTA upgrade logs—including version numbers, trigger conditions, and user authorization records—alongside existing EMC/EMF test reports. Non-compliant applications are automatically rejected, with a 90-day re-submission ban. This development is particularly relevant to manufacturers and exporters of electronic beauty equipment, software-integrated personal care devices, and suppliers engaged in Saudi market access.

Event Overview

Effective 00:00 on May 10, 2026, SASO requires all new SABER registration applications for beauty devices classified under HS 8543.70 to include: (1) SHA-256 hash value of the device’s firmware binary file; and (2) OTA remote upgrade logs covering the past six months, specifying firmware version number, activation trigger condition, and evidence of user consent or authorization. Applications omitting either item will be system-rejected without manual review. Re-submission is prohibited for 90 days following rejection.

Which Subsectors Are Affected

Direct Exporters & Trade Enterprises

Exporters submitting beauty devices to Saudi Arabia via SABER must now validate firmware integrity and trace OTA behavior—not just electrical safety. Impact manifests as delayed market entry, increased pre-submission validation effort, and higher risk of registration failure due to unverifiable or incomplete log documentation.

Electronics Manufacturing & OEM/ODM Firms

Manufacturers—especially those producing smart beauty tools with wireless connectivity or upgradable firmware—are directly impacted. Many lack standardized firmware version control, automated OTA logging, or audit-ready user consent mechanisms. This creates immediate compliance gaps in product release workflows and quality documentation systems.

Supply Chain & Certification Service Providers

Certification consultants, testing labs, and SABER agents supporting beauty device registrations must now verify firmware and OTA data authenticity—not only test reports. Their service scope expands to include firmware hash verification, log format validation, and cross-checking of version consistency between submitted binaries and logs.

What Relevant Enterprises or Practitioners Should Focus On — and How to Respond Now

Monitor official SASO guidance for log format specifications and hash submission protocols

As of current public information, SASO has not published detailed technical templates for OTA log structure or firmware hash upload interface requirements. Enterprises should track SASO’s official announcements and SABER portal updates for mandatory field definitions, acceptable timestamp formats, and required metadata fields before May 10, 2026.

Identify and isolate affected SKUs by firmware architecture and OTA capability

Not all beauty devices under HS 8543.70 have OTA functionality. Companies should audit their product portfolio to distinguish models with upgradable firmware from static-firmware units. Only OTA-capable devices require full log submission; however, all must provide a verifiable firmware hash—even if unchanged across versions.

Implement internal firmware version tracking and minimal viable OTA logging

Analysis shows many Chinese manufacturers maintain firmware builds without consistent version tagging or persistent local logging of upgrade events. A pragmatic first step is to enforce semantic versioning (e.g., v2.1.0), generate SHA-256 hashes at build time, and retain logs capturing firmware version, UTC timestamp, and user action (e.g., “consent granted”, “auto-update triggered”). No cloud backend is required—local device logs exported manually suffice if auditable and time-stamped.

Prepare documentation handover protocols between R&D, QA, and regulatory teams

The new requirement bridges engineering and compliance functions. Current practice often isolates firmware development from certification documentation. Enterprises should establish clear internal SOPs defining who generates the hash, who archives logs, who validates completeness, and who submits—all prior to SABER application initiation.

Editorial Perspective / Industry Observation

Observably, this update reflects SASO’s broader shift toward software-defined product oversight—not just hardware conformity. It signals growing regulatory attention to embedded intelligence, update accountability, and consumer consent transparency in connected consumer electronics. While enforcement begins May 2026, it is better understood as an early-stage signal rather than a fully matured regime: no public guidance yet defines acceptable log granularity, retention duration beyond six months, or consequences of partial log loss. The requirement currently tests operational readiness more than technical sophistication—and its long-term impact hinges on whether SASO extends similar expectations to other regulated categories like medical-grade or wellness devices.

Conclusion: This policy change marks a procedural inflection point for beauty device exporters targeting Saudi Arabia—not a fundamental product redesign mandate, but a documentation and traceability threshold. Its significance lies less in novelty and more in execution discipline: firms with robust firmware governance will face minimal friction; those relying on ad-hoc builds and undocumented updates will encounter registration delays and recurring rejections. Currently, it is best understood as a compliance checkpoint emphasizing verifiability and record continuity—not a functional restriction on device capabilities.

Source: Public SASO announcement regarding SABER platform updates for HS 8543.70 beauty devices, effective May 10, 2026. Note: Specific technical implementation guidelines (e.g., log schema, hash upload method) remain pending official publication and are subject to ongoing monitoring.