ISO 9001 is not generally mandatory in Saudi Arabia. What Saudi rules say, where buyers and SASO product schemes require it, and what ISO 9001:2026 changes.
ISO 9001 is not generally mandatory in Saudi Arabia. We found no Saudi law, regulation or authority decision that requires companies in general to hold an ISO 9001 certificate, after searching the Umm al-Qura gazette, SASO’s technical regulations and e-services guide, the Government Tenders and Procurement Law in its 2019 and 2026 versions, and the contractor classification law and regulations, in Arabic and English, in November 2026. ISO’s own guidance says organisations can choose whether to seek certification.
That answers the legal question. The commercial one is different, because a company can still meet the standard in a SASO product rule, in a tender or in a buyer’s registration form.
Where Saudi rules do name ISO 9001
Where Saudi rules name ISO 9001, they name it for a defined product and usually as one way to show a quality system, not as a certificate every company must hold. SASO uses three patterns.
A quality system is required and a certificate satisfies it. SASO’s programme for the water efficiency card requires an effective factory quality management system and treats an ISO 9001 certificate as covering that item. Its e-services guide repeats it: submit a document showing an effective system, or a valid ISO 9001 certificate. The certificate is optional but saves audit work. Under the Saudi Quality Mark procedures, a valid ISO 9001 certificate from an accredited body lets the granting body drop the quality system audit items and assess only the technical requirements for the product.
The system must follow ISO 9001. Where a technical regulation uses Type 5 under SASO’s General Regulation for Conformity Models, the manufacturer must document its quality management system to ISO 9001 requirements and have it assessed. That applies only to products placed under that model.
If you make or import a regulated product, check the programme for that product. A general statement that ISO 9001 is or is not mandatory will not help you with a shipment.
Government tenders: the requirement sits in the tender
A new Government Tenders and Procurement Law was published in Umm al-Qura on 4 September 2026. It comes into force 120 days after publication, by our count around 2 January 2027, and implementing regulations are due within the same period. Tenders launched under the 2019 law stay under the 2019 law, with some ministerial discretion.
Article 19 requires government entities to run prequalification or post-qualification for the work the regulations specify. Article 20 requires the criteria to be objective, measurable, tied to technical, financial and administrative capacity, and proportionate to the work. The law’s text does not mention ISO, and neither do the 2019 law and regulations we checked.
So when ISO 9001 appears in a Saudi tender, it is that buying entity’s requirement, set through the tender or prequalification documents. Read the exact words. A tender may ask for a certificate, a named edition, an accredited certificate, or only evidence of a quality system, and each one calls for different proof.
The Contractors Classification Law and its regulations do not mention ISO 9001 either. Classification rests on financial, technical and administrative capacity.
Aramco asks manufacturers for it
Aramco separates general registration from manufacturer registration. Its general supplier document list for Saudi-based suppliers covers commercial, tax and bank documents and does not mention ISO 9001.
Manufacturers face more. The Local Manufacturer Registration form asks for a copy of an ISO 9001 certificate, the mandatory quality procedures, a recent surveillance audit report and management review minutes, and it warns that inspectors may visit the plant to assess the system. A certificate on its own does not close that review. The form still refers to the 2008 edition or later, so confirm the edition Aramco accepts before you apply.
Healthcare runs on a different standard
Medical device establishments deal with ISO 13485, not ISO 9001. The Saudi Food and Drug Authority’s establishment requirements call for a quality system certificate to ISO 13485 from a provider it accredits, or for some categories an SFDA inspection report. An ISO 9001 certificate does not stand in for it.
Accredited or not
The word that does the work in SASO’s text is accredited. The Quality Mark shortcut applies only to a valid certificate from an accredited body. A certificate from an unaccredited issuer earns nothing there.
The Saudi Accreditation Center became a signatory to the IAF recognition arrangement for ISO 9001 in January 2024. That recognition role has since passed from IAF to Global ACI, which started operating on 1 January 2026. Before you pay for a certificate, check the certification body is accredited for your scope and confirm it on IAF CertSearch. Aramco’s request for a surveillance report shows what a serious buyer does with the document.
What ISO 9001:2026 changes
ISO published the sixth edition on 16 September 2026. Global ACI, whose transition rules bind accredited certification bodies, calls the overall changes minimal. The ones that need work are:
- quality culture and ethical behaviour, added to leadership and awareness duties
- a quality policy linked to context and strategic direction
- risks and opportunities separated, with distinct action requirements
- change planning that covers how effectiveness is monitored, how changes are communicated and how results are reviewed
- management review inputs extended to changes in interested party needs
The dates are fixed in the Global ACI document:
- 31 March 2027: accreditation bodies ready to assess to the new edition
- 30 June 2027: certification bodies declare readiness
- 30 September 2027: accreditation bodies complete their decisions
- 31 March 2028: no new or initial certificates to the 2015 edition after this date
- 30 September 2029: accredited 2015 certificates stop being valid
The transition can happen at a surveillance audit, a recertification audit or a separate special audit, and it can be remote where the certification body can show the objectives are met. If a company decides not to move, its certificate expires at the end of the period even if it had longer to run.
Ask your certification body now when it expects its accreditation decision and which of your remaining audits it will use. Then close the gaps against the changed clauses and test them in your internal audit, which our ISO 9001 checklist covers. Our guide to how often ISO audits happen explains where the surveillance and recertification visits fall.
What to do
Decide from who is asking. If a SASO programme applies, build to that programme. If a buyer is asking, match its wording and its edition. If nobody is asking, certification is a commercial choice and the case for it should be made on what the system does for your business.
How ESGweise helps
We prepare the quality management system and the evidence behind it; an accredited certification body issues the certificate. See our ISO 9001 certification and ISO certification services. Work is quoted as a fixed scope after a short call.
Frequently asked questions
Is ISO 9001 a legal requirement in Saudi Arabia?
Not generally. We found no Saudi law or regulation requiring companies in general to hold ISO 9001, searching the Umm al-Qura gazette, SASO regulations, the Government Tenders and Procurement Law and the contractor classification rules in November 2026. Specific product rules and individual buyers can still ask for it.
Do government tenders in Saudi Arabia require ISO 9001?
The procurement law does not name it. Article 20 of the law published in September 2026 requires qualification criteria to be objective, measurable and tied to capability, so a buying entity can include ISO 9001 in its own tender or prequalification documents. Read each tender for the exact wording.
Does Aramco require ISO 9001?
For manufacturers, Aramco's Local Manufacturer Registration form asks for a copy of an ISO 9001 certificate, a recent surveillance audit report and quality procedures, and it may send inspectors to the plant. Aramco's general supplier document list does not mention ISO 9001.
Does a Saudi company need an accredited ISO 9001 certificate?
Where a rule gives credit for a certificate, as SASO's Saudi Quality Mark procedures do, it must be valid and issued by an accredited body. An accredited certificate is also the only kind covered by the ISO 9001:2026 transition rules.
By when must a Saudi company move to ISO 9001:2026?
Accredited ISO 9001:2015 certificates stop being valid on 30 September 2029, under the Global ACI transition requirements. No new certificates to the 2015 edition can be issued after 31 March 2028. The move can happen at a surveillance audit, a recertification audit or a special audit.