Standards and rules: what changed, and when
The changes to the standards and Saudi rules that ITF's buyers work to, newest first, with the dates a certified site plans around and what each one does to a certificate or contract you already hold.
ISO 9001:2026 was published on , with a three-year transition expected to run to September 2029. ISO 14001:2026 was published on . FSSC 22000 Version 7 upgrade audits run from FSSC 22000: Version 7 upgrade audits from · to FSSC 22000: Version 7 upgrade audits to · , and the new Government Tenders and Procurement Law takes effect on Government Tenders and Procurement Law: in force · .
Updated · 10 minute read
ISO 9001:2026, published
ISO published ISO 9001:2026 on , replacing ISO 9001:2015. A three-year transition is expected to run to September 2029. A 2015 certificate stays valid until it expires or the transition ends, whichever comes first, and normally moves across at a planned audit.
The clause structure is unchanged. What moved: risks and opportunities split into 6.1.2 and 6.1.3, quality culture and ethical behaviour in 5.1.1 and 7.3, a new 5.2.1(e) tying the quality policy to strategic direction, climate carried in from the 2024 amendment, and a rewritten Annex A.
The day-level dates, meaning the last initial audit to the 2015 edition, the last transition audit and the withdrawal of 2015 certificates, come from the IAF resolution and then from each accreditation body. Ask your certification body for its dates in writing. The ISO 9001:2026 transition guide, linked below, sets out the clause-by-clause work.
| Milestone | Date and what it means |
|---|---|
| Published | |
| Transition | Three years, expected to run to September 2029 |
| A 2015 certificate | Valid until it expires or the transition ends, whichever comes first |
| Day-level dates | Set by the IAF resolution and your accreditation body, and not all published |
A new procurement law for government contracts
A new Government Tenders and Procurement Law was published in Umm Al-Qura on and takes effect on Government Tenders and Procurement Law: in force · , replacing the law issued under Royal Decree M/128 of 2019. Its implementing regulations are still pending.
It governs public-sector contracts, government facility management among them. A contract drafted or bid across Government Tenders and Procurement Law: in force · needs a clear answer on which law governs it.
The delay-penalty caps quoted across this market come from the outgoing law, so this tracker gives no penalty figures. Read the implementing regulations against your own tender once they are issued.
| Milestone | Date and what it means |
|---|---|
| Published | , in Umm Al-Qura |
| In force | Government Tenders and Procurement Law: in force · |
| Replaces | The law issued under Royal Decree M/128 of 2019 |
| Implementing regulations | Still pending |
FSSC 22000 moves to Version 7
Foundation FSSC published Version 7 of FSSC 22000 in May 2026. Audits against Version 6 continue until FSSC 22000: last Version 6 audits · . Upgrade audits against Version 7 run from FSSC 22000: Version 7 upgrade audits from · to FSSC 22000: Version 7 upgrade audits to · , and your certification body sets where yours falls.
Version 6, the version audits run against until then, was published on and became mandatory on . Version 7 references the reissued ISO 22002:2025 prerequisite programme series.
Take the change list from the Version 7 scheme document itself rather than from a summary of it, and ask your certification body for your upgrade audit date in writing.
| Milestone | Date and what it means |
|---|---|
| Version 7 published | May 2026 |
| Last Version 6 audits | FSSC 22000: last Version 6 audits · |
| Version 7 upgrade audits | FSSC 22000: Version 7 upgrade audits from · to FSSC 22000: Version 7 upgrade audits to · |
| Version 6 | Published , mandatory from |
ISO 14001 went first, in April 2026
ISO 14001:2026 was published on and replaces the 2015 edition. A 2015 certificate stays valid until it expires or the transition ends, whichever comes first. The end date comes through the IAF resolution and your accreditation body's instruction.
It moved five months before ISO 9001. A site holding both on one document set can often run the two transitions as one piece of work and open its shared procedures once.
For most sites the environmental work is a re-read of the aspects register and the compliance obligations register, then one document re-issue.
| Milestone | Date and what it means |
|---|---|
| Published | |
| A 2015 certificate | Valid until it expires or the transition ends, whichever comes first |
| Transition end | Set through the IAF resolution and your accreditation body |
The prerequisite programme series was reissued
ISO reissued its prerequisite programme series as ISO 22002:2025, starting in July 2025. ISO 22002-100:2025 holds the common requirements across the food, feed and packaging supply chain, with a sector part layered on top for each kind of operation.
FSSC 22000 Version 7 references this series. Until your Version 7 upgrade audit, the category table in Version 6 names the prerequisite standard that applies to your site.
| Milestone | Date and what it means |
|---|---|
| Published | July 2025 |
| Common requirements | ISO 22002-100:2025 |
| Sector parts | Food manufacturing, catering, food packaging manufacturing, transport and storage, feed and animal food, and retail and wholesale. Farming is still being revised |
SFDA mapped ISO 13485 to its own requirements
SFDA's guidance MDS-G024, dated March 2025, maps each clause of ISO 13485 to SFDA's own requirements. What a device manufacturer, importer or distributor has to hold then depends on its establishment category.
Manufacturers, importers and distributors in categories A and B hold an ISO 13485 certificate from a body SFDA recognises. Authorised representatives and category C and D importers and distributors are asked for documented evidence or an SFDA inspection. The category comes from the questionnaire completed in SFDA's GHAD system.
| Milestone | Date and what it means |
|---|---|
| Guidance dated | March 2025 |
| Standard mapped | ISO 13485:2016 |
| Categories A and B | An ISO 13485 certificate from a body SFDA recognises |
| Categories C and D | Documented evidence or an SFDA inspection, as for authorised representatives |
SFDA's food licensing guide names a HACCP certificate
SFDA's licensing guide for food and feed manufacturers and warehouses, published in February 2025, lists a HACCP certificate from an accredited certification body among the documents required for an operating licence. Applications run through the Ghad platform.
That makes HACCP a licence condition for a food manufacturer, separate from any scheme a customer writes into a contract. It is the item with the longest lead time, because a certification body needs a plan that runs and records that show it running.
| Milestone | Date and what it means |
|---|---|
| Guide published | February 2025 |
| Names | A HACCP certificate from an accredited certification body |
| Licence validity | One to three years |
| Applied through | Ghad |
RCER-2025 in the Royal Commission cities
The Royal Commission for Jubail and Yanbu has published RCER-2025, the 2025 edition of the Royal Commission Environmental Regulations. Inside Royal Commission cities, RCER applies in addition to the national environmental rules, not instead of them.
In the 2015 edition, volume two set out the environmental permit programme: an Environmental Permit to Construct and an Environmental Permit to Operate. An obligations register for a site in Jubail or Ras Al Khair should be read against the current volumes rather than a summary of the 2015 edition.
| Milestone | Date and what it means |
|---|---|
| Edition | RCER-2025, published on the Royal Commission's own site |
| Applies | Inside Royal Commission cities, on top of national rules |
| Previous edition | RCER-2015 |
The PDPL grace period ended in September 2024
Saudi Arabia's Personal Data Protection Law came into force on , and its one-year grace period ended on PDPL: grace period ended · . SDAIA has enforced it since. It applies to any organisation processing personal data in the Kingdom, whatever its size.
The law was issued by Royal Decree M/19 and amended by Royal Decree M/148. Being ready means records of processing, privacy notices, a process for data subject rights and a procedure for notifying SDAIA within 72 hours of becoming aware of a breach that could cause harm.
| Milestone | Date and what it means |
|---|---|
| In force | |
| Grace period ended | PDPL: grace period ended · |
| Regulator | SDAIA |
| Breach notice | Within 72 hours of becoming aware, where harm is possible |
Saudi accreditation joined the IAF MLA
The Saudi Accreditation Center, SAAC, became an IAF MLA signatory for main scope ISO/IEC 17021-1, including the ISO 9001 sub-scope, on . That recognition is what makes a SAAC-accredited management system certificate readable abroad.
SAAC accredits certification bodies and does not certify organisations itself. To check a certificate, read the accreditation body named on it, then verify the certification body on that accreditation body's own published list.
| Milestone | Date and what it means |
|---|---|
| Signatory from | |
| Main scope | ISO/IEC 17021-1, including the ISO 9001 sub-scope |
| What it means | A SAAC-accredited certificate is recognised through the IAF MLA chain |
ECC-2:2024 replaced the 2018 controls
The National Cybersecurity Authority's Essential Cybersecurity Controls moved from ECC-1:2018 to ECC-2:2024. The 2024 version has 4 domains, 28 subdomains, 108 main controls and 92 subcontrols, against 5 domains, 29 subdomains and 114 controls in the first.
ECC binds government bodies, their affiliates and entities that own, operate or host critical national infrastructure, and many private suppliers meet it through a contract clause. A gap register or supplier questionnaire still using ECC-1 control numbers points at a structure that no longer exists, so map each line to the full ECC-2 reference once.
| Milestone | Date and what it means |
|---|---|
| Current version | ECC-2:2024 |
| Replaced | ECC-1:2018 |
| Structure | 4 domains, 28 subdomains, 108 main controls, 92 subcontrols |
| Certificate | None exists. NCA checks compliance through self-assessment, its compliance tool and field audits |
Climate entered the management system standards in 2024
In 2024 a climate-action amendment ran across the Harmonized Structure standards. It adds climate change to the context in clause 4.1 and a note on interested parties in clause 4.2. ISO 22000 and ISO 45001 each carry it, with no transition period.
ISO 9001:2026 and ISO 14001:2026 carry the amendment into their new editions, so a site that took it in 2024 has that row of its transition already closed. The amended clause 4.1 asks you to determine whether climate change is a relevant issue, so be ready to show that you considered it. It is a short item to close.
| Milestone | Date and what it means |
|---|---|
| Amended | 2024 |
| Clauses | 4.1 context, and a note on interested parties in 4.2 |
| Transition period | None |
| Carried into | ISO 9001:2026 and ISO 14001:2026 |
What did not move: ISO 45001 and ISO 22000
ISO 45001 remains the 2018 edition and ISO 22000 remains the 2018 edition, each with its 2024 climate amendment. No new edition of either has been published, so a 2018 certificate is fully current and there is no transition to make.
A revision of ISO 45001 is expected, and nothing changes for a 45001 system until a new edition is published and a transition is announced. Anyone offering an ISO 45001 transition today should be asked which edition they mean.
| Standard | Where it stands |
|---|---|
| ISO 45001 | 2018 edition, with its 2024 climate amendment |
| ISO 22000 | 2018 edition, with Amendment 1:2024 |
| A 2018 certificate | Fully current, with no transition to make |
The dates people ask about
When does the ISO 9001:2026 transition end?
A three-year transition is expected to run to September 2029. The last dates for initial audits to the 2015 edition, for transition audits and for withdrawing 2015 certificates come from the IAF resolution and then from each accreditation body. Get your certification body's dates in writing.
When do FSSC 22000 Version 7 audits start?
Upgrade audits against Version 7 run from to . Audits against Version 6 continue until . Your certification body sets where your own upgrade audit falls inside that window.
Was ISO 45001 revised in 2026?
No. ISO 9001 and ISO 14001 moved to 2026 editions. ISO 45001 remains the 2018 edition with its 2024 climate amendment, and a 2018 certificate is fully current.
Does the 2024 climate amendment have a deadline?
It carries no transition period. It adds climate to the context in clause 4.1 and a note on interested parties in 4.2, and ISO 9001:2026 and ISO 14001:2026 carry it into their new editions.
When does the new procurement law apply?
From . It was published in Umm Al-Qura on and replaces the law issued under Royal Decree M/128 of 2019. Its implementing regulations are still pending, so read them against your own tender once they are issued.
Each change, covered in full
The ISO 9001:2026 transition
The six changes, what your certificate is worth, and how to find your transition slot.
Read moreGuideWhat is in a Saudi FM contract
The eight parts of an FM agreement, and where the new procurement law touches government work.
Read moreGuideFSSC 22000 or ISO 22000
Version 7 dates, the current editions table and how the contract clause decides the scheme.
Read moreITF ConsultMoving to ISO 14001:2026
The aspects register, the obligations register and running both 2026 transitions in one pass.
Read moreITF ConsultFSSC 22000 readiness
The ISO 22000 base, the ISO 22002-100:2025 prerequisites and the additional requirements.
Read moreITF ConsultConsulting inside Jubail
RCER on top of national rules, and the construct and operate permits written into the register.
Read moreITF HealthISO 13485 for device companies
What SFDA asks each establishment category to hold, and the system that answers it.
Read moreGuideSFDA food facility requirements
The approvals before Ghad, the HACCP condition and the order they have to happen in.
Read moreITF CyberPDPL for operations managers
The dates, the regulator and a twenty-line checklist for an ordinary company.
Read moreGuideISO 9001 certification in Saudi Arabia
Accreditation, SAAC and the IAF MLA, and the seven stages to a certificate.
Read moreITF CyberNCA ECC-2:2024 explained
The four domains, who the controls bind and the first week after a clause lands.
Read moreITF ConsultISO 22000 implementation
The 2018 edition with its 2024 climate amendment, and the CCP and OPRP split.
Read moreITF ConsultWhat is coming for ISO 45001
The 2018 edition is current, and nothing changes until a new one is published.
Read moreGuideThe glossary
CAPA, OPRP, Stage 2, AMC, SLA and the Saudi regulators, each answered in forty words or fewer.
Read morePart of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
Put your own dates against these
Most of the planning comes down to two expiry dates and one audit calendar. Send us your certificates and we will lay your transitions out against the dates on this page.