ITF Resources

Standards and rules: what changed, and when

The changes to the standards and Saudi rules that ITF's buyers work to, newest first, with the dates a certified site plans around and what each one does to a certificate or contract you already hold.

ISO 9001:2026 was published on , with a three-year transition expected to run to September 2029. ISO 14001:2026 was published on . FSSC 22000 Version 7 upgrade audits run from FSSC 22000: Version 7 upgrade audits from · to FSSC 22000: Version 7 upgrade audits to · , and the new Government Tenders and Procurement Law takes effect on Government Tenders and Procurement Law: in force · .

Updated · 10 minute read

A vertical timeline from 2024 to 2029, with each dated change as a tick at its real date. 16 January 2024, SAAC becomes an IAF MLA signatory. 1 April 2024, FSSC 22000 Version 6 mandatory. 14 September 2024, the PDPL grace period ends. February 2025, SFDA's food licensing guide. March 2025, SFDA guidance MDS-G024 on ISO 13485. July 2025, the ISO 22002:2025 series. 15 April 2026, ISO 14001:2026 published. May 2026, FSSC 22000 Version 7 published. 4 September 2026, the Government Tenders and Procurement Law published. 16 September 2026, ISO 9001:2026 published, highlighted. 2 January 2027, the procurement law in force. 30 April 2027, the last FSSC Version 6 audits. 1 May 2027, Version 7 upgrade audits open. 30 April 2028, the Version 7 upgrade window closes. September 2029, the ISO 9001 transition is expected to end, highlighted. Beside the axis, the ISO 9001 transition window is highlighted from publication to September 2029, and the FSSC Version 7 upgrade window runs from 1 May 2027 to 30 April 2028. Month-only dates sit mid-month.WHAT MOVED, AND WHEN202420252026202720282029ISO 9001 TRANSITIONV7 WINDOW16 JAN 2024 · SAAC JOINS THE IAF MLA1 APR 2024 · FSSC 22000 V6 MANDATORY14 SEP 2024 · PDPL GRACE PERIOD ENDSFEB 2025 · SFDA FOOD LICENSING GUIDEMAR 2025 · SFDA MDS-G024 ON ISO 13485JUL 2025 · ISO 22002:2025 SERIES15 APR 2026 · ISO 14001:2026 PUBLISHEDMAY 2026 · FSSC 22000 V7 PUBLISHED4 SEP 2026 · PROCUREMENT LAW PUBLISHED16 SEP 2026 · ISO 9001:2026 PUBLISHED2 JAN 2027 · PROCUREMENT LAW IN FORCE30 APR 2027 · LAST FSSC V6 AUDITS1 MAY 2027 · V7 UPGRADE AUDITS OPEN30 APR 2028 · V7 UPGRADE WINDOW CLOSESSEP 2029 · 9001 TRANSITION, EXPECTED ENDMONTH-ONLY DATES SIT MID-MONTHDAY-LEVEL TRANSITION DATES: ASK YOUR CERTIFICATION BODY
Every dated change, to scaleYear-only changes are in the textSwipe to pan

ISO 9001:2026, published

ISO published ISO 9001:2026 on , replacing ISO 9001:2015. A three-year transition is expected to run to September 2029. A 2015 certificate stays valid until it expires or the transition ends, whichever comes first, and normally moves across at a planned audit.

The clause structure is unchanged. What moved: risks and opportunities split into 6.1.2 and 6.1.3, quality culture and ethical behaviour in 5.1.1 and 7.3, a new 5.2.1(e) tying the quality policy to strategic direction, climate carried in from the 2024 amendment, and a rewritten Annex A.

The day-level dates, meaning the last initial audit to the 2015 edition, the last transition audit and the withdrawal of 2015 certificates, come from the IAF resolution and then from each accreditation body. Ask your certification body for its dates in writing. The ISO 9001:2026 transition guide, linked below, sets out the clause-by-clause work.

MilestoneDate and what it means
Published
TransitionThree years, expected to run to September 2029
A 2015 certificateValid until it expires or the transition ends, whichever comes first
Day-level datesSet by the IAF resolution and your accreditation body, and not all published

A new procurement law for government contracts

A new Government Tenders and Procurement Law was published in Umm Al-Qura on and takes effect on Government Tenders and Procurement Law: in force · , replacing the law issued under Royal Decree M/128 of 2019. Its implementing regulations are still pending.

It governs public-sector contracts, government facility management among them. A contract drafted or bid across Government Tenders and Procurement Law: in force · needs a clear answer on which law governs it.

The delay-penalty caps quoted across this market come from the outgoing law, so this tracker gives no penalty figures. Read the implementing regulations against your own tender once they are issued.

MilestoneDate and what it means
Published, in Umm Al-Qura
In force Government Tenders and Procurement Law: in force ·
ReplacesThe law issued under Royal Decree M/128 of 2019
Implementing regulationsStill pending

FSSC 22000 moves to Version 7

Foundation FSSC published Version 7 of FSSC 22000 in May 2026. Audits against Version 6 continue until FSSC 22000: last Version 6 audits · . Upgrade audits against Version 7 run from FSSC 22000: Version 7 upgrade audits from · to FSSC 22000: Version 7 upgrade audits to · , and your certification body sets where yours falls.

Version 6, the version audits run against until then, was published on and became mandatory on . Version 7 references the reissued ISO 22002:2025 prerequisite programme series.

Take the change list from the Version 7 scheme document itself rather than from a summary of it, and ask your certification body for your upgrade audit date in writing.

MilestoneDate and what it means
Version 7 publishedMay 2026
Last Version 6 audits FSSC 22000: last Version 6 audits ·
Version 7 upgrade audits FSSC 22000: Version 7 upgrade audits from · to FSSC 22000: Version 7 upgrade audits to ·
Version 6Published , mandatory from

ISO 14001 went first, in April 2026

ISO 14001:2026 was published on and replaces the 2015 edition. A 2015 certificate stays valid until it expires or the transition ends, whichever comes first. The end date comes through the IAF resolution and your accreditation body's instruction.

It moved five months before ISO 9001. A site holding both on one document set can often run the two transitions as one piece of work and open its shared procedures once.

For most sites the environmental work is a re-read of the aspects register and the compliance obligations register, then one document re-issue.

MilestoneDate and what it means
Published
A 2015 certificateValid until it expires or the transition ends, whichever comes first
Transition endSet through the IAF resolution and your accreditation body

The prerequisite programme series was reissued

ISO reissued its prerequisite programme series as ISO 22002:2025, starting in July 2025. ISO 22002-100:2025 holds the common requirements across the food, feed and packaging supply chain, with a sector part layered on top for each kind of operation.

FSSC 22000 Version 7 references this series. Until your Version 7 upgrade audit, the category table in Version 6 names the prerequisite standard that applies to your site.

MilestoneDate and what it means
PublishedJuly 2025
Common requirementsISO 22002-100:2025
Sector partsFood manufacturing, catering, food packaging manufacturing, transport and storage, feed and animal food, and retail and wholesale. Farming is still being revised

SFDA mapped ISO 13485 to its own requirements

SFDA's guidance MDS-G024, dated March 2025, maps each clause of ISO 13485 to SFDA's own requirements. What a device manufacturer, importer or distributor has to hold then depends on its establishment category.

Manufacturers, importers and distributors in categories A and B hold an ISO 13485 certificate from a body SFDA recognises. Authorised representatives and category C and D importers and distributors are asked for documented evidence or an SFDA inspection. The category comes from the questionnaire completed in SFDA's GHAD system.

MilestoneDate and what it means
Guidance datedMarch 2025
Standard mappedISO 13485:2016
Categories A and BAn ISO 13485 certificate from a body SFDA recognises
Categories C and DDocumented evidence or an SFDA inspection, as for authorised representatives

SFDA's food licensing guide names a HACCP certificate

SFDA's licensing guide for food and feed manufacturers and warehouses, published in February 2025, lists a HACCP certificate from an accredited certification body among the documents required for an operating licence. Applications run through the Ghad platform.

That makes HACCP a licence condition for a food manufacturer, separate from any scheme a customer writes into a contract. It is the item with the longest lead time, because a certification body needs a plan that runs and records that show it running.

MilestoneDate and what it means
Guide publishedFebruary 2025
NamesA HACCP certificate from an accredited certification body
Licence validityOne to three years
Applied throughGhad

RCER-2025 in the Royal Commission cities

The Royal Commission for Jubail and Yanbu has published RCER-2025, the 2025 edition of the Royal Commission Environmental Regulations. Inside Royal Commission cities, RCER applies in addition to the national environmental rules, not instead of them.

In the 2015 edition, volume two set out the environmental permit programme: an Environmental Permit to Construct and an Environmental Permit to Operate. An obligations register for a site in Jubail or Ras Al Khair should be read against the current volumes rather than a summary of the 2015 edition.

MilestoneDate and what it means
EditionRCER-2025, published on the Royal Commission's own site
AppliesInside Royal Commission cities, on top of national rules
Previous editionRCER-2015

The PDPL grace period ended in September 2024

Saudi Arabia's Personal Data Protection Law came into force on , and its one-year grace period ended on PDPL: grace period ended · . SDAIA has enforced it since. It applies to any organisation processing personal data in the Kingdom, whatever its size.

The law was issued by Royal Decree M/19 and amended by Royal Decree M/148. Being ready means records of processing, privacy notices, a process for data subject rights and a procedure for notifying SDAIA within 72 hours of becoming aware of a breach that could cause harm.

MilestoneDate and what it means
In force
Grace period ended PDPL: grace period ended ·
RegulatorSDAIA
Breach noticeWithin 72 hours of becoming aware, where harm is possible

Saudi accreditation joined the IAF MLA

The Saudi Accreditation Center, SAAC, became an IAF MLA signatory for main scope ISO/IEC 17021-1, including the ISO 9001 sub-scope, on . That recognition is what makes a SAAC-accredited management system certificate readable abroad.

SAAC accredits certification bodies and does not certify organisations itself. To check a certificate, read the accreditation body named on it, then verify the certification body on that accreditation body's own published list.

MilestoneDate and what it means
Signatory from
Main scopeISO/IEC 17021-1, including the ISO 9001 sub-scope
What it meansA SAAC-accredited certificate is recognised through the IAF MLA chain

ECC-2:2024 replaced the 2018 controls

The National Cybersecurity Authority's Essential Cybersecurity Controls moved from ECC-1:2018 to ECC-2:2024. The 2024 version has 4 domains, 28 subdomains, 108 main controls and 92 subcontrols, against 5 domains, 29 subdomains and 114 controls in the first.

ECC binds government bodies, their affiliates and entities that own, operate or host critical national infrastructure, and many private suppliers meet it through a contract clause. A gap register or supplier questionnaire still using ECC-1 control numbers points at a structure that no longer exists, so map each line to the full ECC-2 reference once.

MilestoneDate and what it means
Current versionECC-2:2024
ReplacedECC-1:2018
Structure4 domains, 28 subdomains, 108 main controls, 92 subcontrols
CertificateNone exists. NCA checks compliance through self-assessment, its compliance tool and field audits

Climate entered the management system standards in 2024

In 2024 a climate-action amendment ran across the Harmonized Structure standards. It adds climate change to the context in clause 4.1 and a note on interested parties in clause 4.2. ISO 22000 and ISO 45001 each carry it, with no transition period.

ISO 9001:2026 and ISO 14001:2026 carry the amendment into their new editions, so a site that took it in 2024 has that row of its transition already closed. The amended clause 4.1 asks you to determine whether climate change is a relevant issue, so be ready to show that you considered it. It is a short item to close.

MilestoneDate and what it means
Amended2024
Clauses4.1 context, and a note on interested parties in 4.2
Transition periodNone
Carried intoISO 9001:2026 and ISO 14001:2026

What did not move: ISO 45001 and ISO 22000

ISO 45001 remains the 2018 edition and ISO 22000 remains the 2018 edition, each with its 2024 climate amendment. No new edition of either has been published, so a 2018 certificate is fully current and there is no transition to make.

A revision of ISO 45001 is expected, and nothing changes for a 45001 system until a new edition is published and a transition is announced. Anyone offering an ISO 45001 transition today should be asked which edition they mean.

StandardWhere it stands
ISO 450012018 edition, with its 2024 climate amendment
ISO 220002018 edition, with Amendment 1:2024
A 2018 certificateFully current, with no transition to make
01

The dates people ask about

Q01

When does the ISO 9001:2026 transition end?

A three-year transition is expected to run to September 2029. The last dates for initial audits to the 2015 edition, for transition audits and for withdrawing 2015 certificates come from the IAF resolution and then from each accreditation body. Get your certification body's dates in writing.

Q02

When do FSSC 22000 Version 7 audits start?

Upgrade audits against Version 7 run from to . Audits against Version 6 continue until . Your certification body sets where your own upgrade audit falls inside that window.

Q03

Was ISO 45001 revised in 2026?

No. ISO 9001 and ISO 14001 moved to 2026 editions. ISO 45001 remains the 2018 edition with its 2024 climate amendment, and a 2018 certificate is fully current.

Q04

Does the 2024 climate amendment have a deadline?

It carries no transition period. It adds climate to the context in clause 4.1 and a note on interested parties in 4.2, and ISO 9001:2026 and ISO 14001:2026 carry it into their new editions.

Q05

When does the new procurement law apply?

From . It was published in Umm Al-Qura on and replaces the law issued under Royal Decree M/128 of 2019. Its implementing regulations are still pending, so read them against your own tender once they are issued.

/

Each change, covered in full

Guide

The ISO 9001:2026 transition

The six changes, what your certificate is worth, and how to find your transition slot.

Read more
Guide

What is in a Saudi FM contract

The eight parts of an FM agreement, and where the new procurement law touches government work.

Read more
Guide

FSSC 22000 or ISO 22000

Version 7 dates, the current editions table and how the contract clause decides the scheme.

Read more
ITF Consult

Moving to ISO 14001:2026

The aspects register, the obligations register and running both 2026 transitions in one pass.

Read more
ITF Consult

FSSC 22000 readiness

The ISO 22000 base, the ISO 22002-100:2025 prerequisites and the additional requirements.

Read more
ITF Consult

Consulting inside Jubail

RCER on top of national rules, and the construct and operate permits written into the register.

Read more
ITF Health

ISO 13485 for device companies

What SFDA asks each establishment category to hold, and the system that answers it.

Read more
Guide

SFDA food facility requirements

The approvals before Ghad, the HACCP condition and the order they have to happen in.

Read more
ITF Cyber

PDPL for operations managers

The dates, the regulator and a twenty-line checklist for an ordinary company.

Read more
Guide

ISO 9001 certification in Saudi Arabia

Accreditation, SAAC and the IAF MLA, and the seven stages to a certificate.

Read more
ITF Cyber

NCA ECC-2:2024 explained

The four domains, who the controls bind and the first week after a clause lands.

Read more
ITF Consult

ISO 22000 implementation

The 2018 edition with its 2024 climate amendment, and the CCP and OPRP split.

Read more
ITF Consult

What is coming for ISO 45001

The 2018 edition is current, and nothing changes until a new one is published.

Read more
Guide

The glossary

CAPA, OPRP, Stage 2, AMC, SLA and the Saudi regulators, each answered in forty words or fewer.

Read more

Put your own dates against these

Most of the planning comes down to two expiry dates and one audit calendar. Send us your certificates and we will lay your transitions out against the dates on this page.

Book a transition review