SASO Updates SABER Platform: Firmware Hash & OTA Logs Mandatory for Beauty Devices

Saudi Standards, Metrology and Quality Organization (SASO) updated the SABER certification platform on May 10, 2026, requiring firmware SHA-256 hash values and complete over-the-air (OTA) upgrade logs for all registered beauty electronic devices—including radiofrequency (RF) devices, microcurrent devices, and LED phototherapy devices. This change directly affects manufacturers, exporters, and brand owners supplying such products to the Saudi market, particularly those relying on OEM partners in China with historically limited firmware version control and log retention practices.

Event Overview

On May 10, 2026, SASO revised its SABER platform registration requirements for cosmetic electronic devices. Effective immediately, applicants must upload both the SHA-256 hash of the device’s firmware and a full set of OTA upgrade logs during product registration. Products failing to meet this requirement will have their registration suspended. No transitional period or grandfathering clause has been publicly announced.

Industries Affected by Segment

Original Equipment Manufacturers (OEMs) — Especially China-based Beauty Device Suppliers

OEMs are directly impacted because they produce and flash firmware onto devices. The new rule exposes gaps in firmware version management, build traceability, and systematic logging of OTA events—common weaknesses among mid-tier Chinese beauty device manufacturers. Impact manifests as delayed or rejected SABER registrations, increased technical documentation burden, and potential liability if firmware-related compliance issues arise post-market.

International Brand Owners and Importers

Brands placing beauty devices into the Saudi market must now verify their OEM partners’ firmware governance capabilities—not just final product testing. Failure to confirm that firmware hashes and OTA logs are consistently generated, archived, and auditable may result in shipment holds or market access suspension. This elevates due diligence from hardware compliance to embedded software accountability.

Regulatory Compliance and Certification Service Providers

Third-party conformity assessment bodies and SABER agents must adapt internal workflows to validate firmware hash integrity and assess the completeness and authenticity of OTA logs. Their role shifts from reviewing static test reports to verifying dynamic firmware lifecycle documentation—a capability not uniformly present across current service providers.

Key Points for Enterprises and Practitioners to Monitor and Act Upon

Monitor official SASO communications for implementation clarifications

As of now, SASO has not published detailed technical specifications—for example, acceptable log formats, minimum required log fields (e.g., timestamp, version ID, success/failure flag), or whether logs must cover historical upgrades or only the latest version. Enterprises should track SASO’s official notices and SABER platform help documentation for updates.

Assess firmware management maturity across supplier tiers—starting with top-tier OEMs

Brand owners should conduct immediate technical audits of their primary OEMs’ firmware release processes: Do they generate and store SHA-256 hashes per build? Are OTA logs captured automatically during development, QA, and production flashing? Is there version-level mapping between hardware serial numbers and firmware builds? Prioritize suppliers demonstrating documented, repeatable practices.

Distinguish between policy signal and operational readiness

This requirement is not merely procedural—it reflects SASO’s broader move toward software-defined product safety oversight. While enforcement currently targets registration, future phases could extend to post-market surveillance (e.g., mandatory firmware update reporting or vulnerability disclosure). Companies should treat this as an early indicator of evolving regulatory expectations for connected health and wellness devices.

Update internal SOPs and supplier agreements ahead of audit cycles

Integrate firmware hash generation and OTA log archiving into quality management systems (e.g., ISO 13485 or IEC 62304 where applicable). Where contracts with OEMs lack clauses covering firmware documentation ownership, traceability, and audit rights, revise them before next SABER renewal or new model submission.

Editorial Observation / Industry Insight

Observably, this update signals SASO’s transition from hardware-centric conformity assessment to embedded software accountability—particularly for consumer-facing medical-adjacent devices. Analysis shows it is less a one-off compliance hurdle and more a structural shift aligning with global trends (e.g., EU MDR Annex I §17.2 on software validation, FDA’s SaMD guidance). From an industry perspective, the timing suggests growing scrutiny of firmware integrity in non-invasive aesthetic devices, where uncontrolled OTA behavior could affect safety, efficacy, or user experience. Current enforcement appears focused on registration gatekeeping; however, sustained attention is warranted as SASO builds capacity for deeper software review.

This is not yet evidence of active post-market firmware monitoring—but it establishes the foundational documentation infrastructure required for such oversight.

In summary, SASO’s May 2026 SABER update introduces enforceable software traceability requirements for beauty electronics entering Saudi Arabia. Its significance lies not in novelty alone, but in its concrete operational impact on supply chain transparency and firmware governance. It is best understood not as a temporary administrative step, but as the first formalized checkpoint in a longer-term regulatory trajectory toward verifiable, auditable device software lifecycles.

Source: Official SASO announcement via SABER platform interface, dated May 10, 2026. Note: Technical implementation details—including log format standards, archival duration, and audit protocols—remain pending official clarification and are subject to ongoing observation.