Saudi Government Technology Contracts What Foreign Technology Suppliers Should Prepare Now

Saudi Arabia’s public sector has been central to the country’s digital transformation agenda. Over the past several years, government entities have invested heavily in cloud services, digital platforms, cybersecurity, artificial intelligence, data infrastructure, systems integration and managed technology services as part of the wider Vision 2030 programme.

That opportunity is now entering a more disciplined phase. For foreign technology suppliers, Saudi government contracting is no longer simply a question of submitting a strong technical proposal and competitive pricing. It increasingly requires a Saudi delivery model that can withstand procurement, cybersecurity, data governance, local content, Saudisation and sector regulation.

This matters for a broad range of suppliers, including cloud providers, software vendors, systems integrators, cybersecurity providers, AI businesses, digital platform operators, data analytics companies and managed service providers. It also matters for their in-house legal teams. Many of the issues that determine whether a Saudi government technology project can be won and delivered successfully need to be addressed before the bid is submitted, not after award.

Saudi Arabia is not only continuing to digitise government services. It is also becoming more deliberate how public sector technology is procured, delivered and localised.

The trend has developed over several years. In January 2018, the Ministry of Finance launched Etimad , which is now central to government tenders and procurement. Saudi Arabia’s Cloud First Policy , updated in October 2020, reinforced the policy direction toward cloud adoption by government and other entities. In August 2022, the Digital Government Authority launched its GovTech programme to support the adoption of emerging technologies by government agencies.

In June 2026, the National Cybersecurity Authority (NCA) updated its official pages for the Essential Cybersecurity Controls and Cloud Cybersecurity Controls . In the same month, the Saudi Data & AI Authority (SDAIA) issued its Data Monetization Policy , which is relevant to data products and services based on government data. In parallel, the Ministry of Finance updated a range of government tender, contract, framework agreement and award forms through its Government Tenders and Procurement Law portal .

Local content is also becoming more important for technology procurement. In June 2026, the Saudi Press Agency reported that local content weighting in the financial evaluation of IT service contracts will begin on 1 April 2027 for tenders valued at SAR 10 million or more. This is an important signal for technology suppliers. Local content is no longer relevant only to construction, manufacturing or industrial projects. It is becoming directly relevant to IT services procurement.

The result is clear. Saudi government technology opportunities remain significant, but they are increasingly structured through formal procurement channels, standardised documentation, local content and Saudisation expectations, cybersecurity controls, data governance requirements and regulated delivery models. Foreign suppliers need to prepare accordingly.

A foreign technology supplier may assume that a Saudi government opportunity will be handled like a conventional enterprise technology sale. That assumption can be wrong.

Some opportunities may be procured through Etimad. Others may be structured through framework arrangements, direct procurement channels, strategic partnerships, government related companies, sector platforms or local implementation partners. In some cases, the customer may be a ministry or government authority. In others, the counterparty may be a state-owned company, a Public Investment Fund portfolio company, a government related platform or another entity applying public sector procurement expectations in practice.

This distinction matters because the legal issues are not identical. A ministry procurement may raise Government Tenders and Procurement Law issues directly. A government related company may use its own procurement process but still expect local content, cybersecurity, data and Saudi delivery commitments. A strategic platform may focus less on a single sale and more on capability building, knowledge transfer, local operations and long-term alignment with Saudi Arabia’s national priorities.

For legal teams, the first question should therefore be basic but important. Who is the customer, how is the opportunity being procured and which rules apply to that route?

Foreign suppliers should treat Saudi government technology bids as cross functional projects involving legal, sales, technical, finance, tax, HR, compliance, cybersecurity and delivery teams. The bid team should not wait until the contract is awarded before testing whether the proposed structure works.

Legal teams should identify early which group entity will bid, sign and perform the contract.

This may involve a foreign parent company, a Saudi subsidiary, a Saudi branch, a local distributor, a systems integrator, a joint venture or a subcontracting model. In some cases, the supplier may need to consider MISA licensing, commercial registration, tax registration, Saudisation requirements, local banking, employment arrangements and the practical ability to invoice and receive payment in Saudi Arabia.

For multinational groups, the Regional Headquarters programme may also need to be considered where government contracting is part of the regional strategy. The issue should not be approached mechanically. The legal team should assess whether the particular procurement requires an RHQ position, whether any exemption or alternative route may be available, and whether the proposed contracting structure is consistent with the tender documents and the group’s wider Saudi strategy.

For many government tenders, suppliers need to understand how Etimad works in practice. The Ministry of Finance describes Etimad as supporting government tenders, procurement, contract management, budgeting, payments and financial rights. For foreign suppliers, the practical point is that Etimad may affect tender access, bid submission, evaluation, award, contract administration and payment processes.

Legal teams should check whether the supplier is properly registered, whether the correct entity is using the platform, whether powers of attorney and authorisations are in place, and whether the bid submission process is consistent with internal approval procedures.

This is not only an administrative step. Tender deadlines, bid bonds, authorised signatories, mandatory forms, Arabic documents, local classifications and platform access can all affect whether a bid is validly submitted.

Localisation is no longer a secondary issue. It can affect bid competitiveness, delivery credibility and compliance after award.

Foreign technology suppliers should consider how their proposal contributes to Saudi Arabia’s local economy. This may include Saudi employees, Saudi based technical support, local subcontractors, local service providers, training programmes, knowledge transfer, local data centre or cloud arrangements, and the use of Saudi assets and infrastructure.

Saudisation also needs to be treated as part of the delivery model, not just an HR compliance item. Government customers may be more comfortable with suppliers that can show Saudi based capability, Arabic language support, trained Saudi staff and a credible plan for long term local service continuity.

For foreign suppliers, the practical point is straightforward. A bid that relies almost entirely on offshore delivery may be technically strong but commercially weaker than a bid that combines global technology with a credible Saudi delivery plan.

Cybersecurity should be addressed at the bid stage. It should not be left to the technical team after contract signature.

The NCA has published the Essential Cybersecurity Controls, which are important for government and critical sector projects. For cloud arrangements, the Cloud Cybersecurity Controls are particularly relevant because they address cloud service providers and cloud service tenants and reflect data localisation considerations.

These controls can affect the whole contract structure. They may influence hosting location, access rights, encryption, identity management, privileged access, subcontracting, audit rights, vulnerability management, incident response, business continuity, disaster recovery and customer reporting.

Legal teams should also monitor the NCA’s draft national framework for cybersecurity information sharing and incident response published through the national public consultation platform. If adopted, it may affect incident notification timelines, evidence preservation, regulator communication, restrictions on sharing incident information and the way suppliers support government customers during cybersecurity events.

The contractual point is important. A supplier should not accept cybersecurity obligations without checking whether its technical architecture, subcontractor arrangements, global incident response procedures and support model can comply in Saudi Arabia.

Cloud and data issues are central to many Saudi government technology projects.

Foreign suppliers should check whether the proposed solution involves SaaS, PaaS, IaaS, managed services, remote access, data analytics, AI training, international support or overseas storage. Each of these may raise different legal and regulatory issues.

Suppliers offering cloud services or cloud-based elements in a Saudi government technology project should familiarise themselves with CST’s Cloud Computing Services Provisioning Regulations and related guidance, as there could be a variety of implications depending on the nature of the service offering. Suppliers should also check whether the customer’s data is government data, personal data, confidential data, cybersecurity data or sector regulated data. The answer may affect hosting, transfer, access, retention, deletion, audit and incident response obligations.

For AI and data analytics projects, legal teams should also consider whether the solution involves automated decision making, sensitive personal data, government datasets, sector data or data sharing with affiliates and subcontractors outside Saudi Arabia.

The practical question is not simply whether the supplier can host the solution. The better question is whether the supplier can lawfully operate the proposed solution for this customer, using this architecture, these support teams and these subcontractors.

Foreign suppliers should also consider whether the project involves access to, processing of, enrichment of or commercialisation of government generated data.

This is particularly important for AI, analytics, digital platform, smart city, IoT, geospatial, health tech, transport, education tech and public service transformation projects. In these projects, the commercial value may not sit only in the software or platform. It may also sit in the insights, models, dashboards, predictions, benchmarks or other data based outputs created from government data.

SDAIA’s Data Monetization Policy is therefore relevant to the contract structure. Legal teams should check whether the supplier will receive government data, whether the supplier may use that data to develop value added products or services, whether raw data sales are prohibited, whether a data sharing agreement is required, who owns the underlying data and resulting outputs, and whether registration through an approved data marketplace or platform is required.

SDAIA also maintains a National Registry for Revenue Generation from Data Services and Products , which enables providers to register products or services covered under the Data Monetization Policy. This is a useful reminder that data monetisation may involve platform registration and compliance steps, not only bilateral contract negotiation.

The practical point is that government data should not be treated as ordinary customer data. If the supplier’s solution depends on government datasets, the bid and contract should clearly address permitted use, intellectual property, data sharing, licensing, confidentiality, privacy, cybersecurity, localisation, revenue sharing and exit.

Many foreign technology suppliers deliver through a combination of global affiliates, offshore development centres, cloud providers, cybersecurity specialists, implementation partners and local subcontractors. That model may be efficient, but it must be checked against the tender documents and contract.

Government technology contracts may restrict subcontracting, assignment, changes in key personnel, remote access, use of third-party platforms, data transfer, support from outside Saudi Arabia and changes to the delivery team. Some contracts may require approvals before subcontractors are appointed or replaced. Others may require obligations to be flowed down to subcontractors.

Legal teams should identify all key delivery parties before bid submission. This includes affiliates, cloud providers, implementation partners, support centres, cybersecurity vendors, data processors and local Saudi partners.

If the supplier cannot deliver without those parties, the bid and contract should be structured accordingly.

Technology suppliers often focus on technical scope and price, but government payment mechanics can be just as important.

Ministry of Finance Decision No. 1097, published in June 2026, amended parts of the Executive Regulations of the Government Tenders and Procurement Law that address issues commonly affecting government projects, including contract signing timelines, payment schedules, final payment mechanics, variations, additional works and termination for public interest.

For technology contracts, these points have practical consequences. Payment milestones should be aligned with objective deliverables and acceptance criteria. Licence activation, cloud capacity, implementation resources, testing environments, integrations and subcontractor commitments should not be triggered without a clear payment and acceptance structure.

Legal teams should check whether payment is tied to delivery, acceptance, budget approval, milestone certification, invoicing through the required platform, or other procedural steps. They should also check whether the supplier has any right to suspend services for failure to pay, and whether that right is realistic in a government contract.

Government technology projects often evolve after award. Scope may change because of integration issues, cybersecurity requirements, data migration problems, user acceptance testing, regulatory changes, new stakeholders or changes in the customer’s operating model.

The contract should therefore include a workable change control process. This is especially important where the supplier may be asked to provide additional modules, integrations, reports, cybersecurity enhancements, Arabic localisation, data migration, training, support hours or implementation resources.

Legal teams should avoid relying on informal emails or operational understandings. If additional work requires approval under the procurement rules or contract, that approval should be obtained before the supplier commits resources.

Termination provisions need careful review in government technology contracts.

A supplier may invest upfront in mobilisation, local hiring, cloud capacity, licences, implementation teams, subcontractors and security approvals. If the customer has a right to terminate for public interest or convenience, the supplier should understand what compensation is available, what costs are recoverable, and what happens to committed third party costs.

Exit obligations also matter. Government customers may require transition assistance, data return, data deletion, source materials, escrow, knowledge transfer, continuity support and cooperation with replacement vendors. These obligations should be priced and operationally understood before the contract is signed.

Bird & Bird advises foreign technology suppliers on Saudi market entry, public sector procurement, technology contracting, cybersecurity, data, cloud, AI, intellectual property and commercial delivery models.

For Saudi government technology opportunities, we help in-house legal teams review tender documents, identify Saudi procurement and delivery risks, assess entity and licensing options, address local content and Saudisation requirements, and align contract terms with the supplier’s technical architecture and operating model. We also advise on NCA, cloud, cybersecurity, data, AI, government data and data monetisation issues, including where international delivery or support teams are involved.

Foreign technology suppliers that prepare early will be better placed to submit credible bids, negotiate workable contracts and deliver government technology projects in Saudi Arabia without needing to restructure the project after award.

This article is intended to provide general information only and does not constitute legal advice. Specific legal advice should be obtained before taking, or refraining from taking, any action based on the matters discussed in this article.