Every Saudi enquiry we get starts in the same place.

Who is buying, and is it a government body?

That splits the answer in two.

For a private company in Riyadh, Jeddah or Dammam, choosing a foreign development partner is a commercial decision.

For a ministry or a state owned entity, it became a legal one on 1 January 2024.

We are an Indian firm and we deliver in the Gulf, including for Triolift in Saudi Arabia. These are the rules we work inside, with the parts we cannot answer marked unanswered rather than guessed.

General information, not legal or tax advice.

The can and cannot table

Contracting above SAR 1 million

Private sector: No RHQ requirement.

Government: Blocked without a Saudi RHQ, related parties included.

Source: Mayer Brown.

Contracting below SAR 1 million

Private sector: No RHQ requirement.

Government: Exempt from the RHQ requirement.

Source: Vistra.

VAT on the supply

Private sector: 15% standard rate, raised from 5% on 1 July 2020.

Government: Same treatment.

Source: PwC.

Bidding on Etimad as a foreign supplier

Private sector: Not applicable.

Government: A Ministry of Investment licence, temporary Ministry of Commerce registration, or a registered Saudi agent is required, alongside the RHQ position.

Source: US International Trade Administration.

Competing against an equally qualified Saudi bidder

Private sector: No statutory preference.

Government: Agencies must prefer Saudi and majority Saudi owned suppliers. GCC products carry up to a 10% price advantage.

Source: US International Trade Administration.

Issuing tax invoices from the ERP

Private sector: Must integrate with the ZATCA Fatoora platform.

Government: Same requirement.

Source: ZATCA.

Moving Saudi personal data to India for support

Private sector: Requires a lawful purpose, safeguards and a transfer risk assessment. There is no adequacy finding for India.

Government: Same baseline, although sector rules may add further requirements.

Source: Clyde & Co.

The private sector position and the 15% VAT

Saudi Arabia charges VAT at 15%, raised from 5% with effect from 1 July 2020.

That rate is the fixed point.

Which party accounts for the tax on a cross border supply, and whether a non resident supplier carries its own registration obligation, turns on the customer's VAT status and on the contract.

Put those mechanics to ZATCA or to Saudi counsel before you price the work.

Here is the part we will not pretend to know.

Whether a foreign software company can lawfully invoice a Saudi private client with no local entity of any kind is a question we could not settle.

We looked for an authority in either direction and found none.

Anyone who tells you flatly that it is fine, or flatly that it is prohibited, is going further than the published material supports.

Ask a Saudi lawyer before you sign.

The government line, stated plainly

On 1 January 2024 the Regional Headquarters rule took effect.

Saudi government agencies cannot contract with foreign companies that hold no RHQ licence in the Kingdom.

The restriction reaches related parties, so a group cannot route the work through a sister entity.

Three qualifications matter.

Procurements estimated below SAR 1 million, roughly USD 265,000, are exempt.

It is a government rule and does not apply to private sector contracts.

Limited exceptions also exist, including contracts performed outside the Kingdom and single qualified bidder situations.

An RHQ is not a nameplate.

Licence holders must start operations within six months and employ 15 full time staff in year one, three at C-suite level.

Separately, the amended Government Tenders and Procurement Law enacted in 2019 requires agencies to prefer Saudi individuals, establishments and majority Saudi owned suppliers.

GCC origin products can carry up to a 10% price advantage where foreign bidders compete.

To appear on Etimad at all, a foreign supplier needs a Ministry of Investment licence, temporary registration with the Ministry of Commerce, or a Saudi agent registered with the Ministry.

What that means for how we sell

We lead with private sector and enterprise work.

That is where an Indian delivery partner competes on merit rather than on paperwork.

For government work we go through a Saudi partner, and we say so in the first call rather than the fifth.

It has cost us conversations.

It has also stopped us wasting three months on a tender we could not have signed.

We hold no Saudi trade licence, no local address and no Saudi team.

Where a client needs a Saudi contracting party, that is a partner arrangement, stated in the contract.

What ERP software in Saudi Arabia has to comply with on day one

Two things bind almost every Saudi deployment, whoever your vendor is.

Withholding tax

Article 68 of the Income Tax Law puts withholding tax on payments from a Saudi resident to a non resident, at a rate that depends on what you are paying for.

Technical and consulting services: 5%

Royalties: 15%

Management fees: 20%

ZATCA draws the software line this way:

Rights to reproduce and sell the software, or source code access with rights to modify: Point to a royalty at 15%.

Support, maintenance, updates, training and installation: Point to a technical service at 5%.

Development for a fee, with ownership passing: Technical service.

Tax is payable within the first ten days of the following month.

So your contract drafting decides your tax rate.

An agreement bundling a source code licence with five years of support invites the higher rate across the whole value.

Treaty relief may reduce it, so check the India and Saudi treaty against your facts.

ZATCA Phase 2

Any ERP that raises tax invoices in the Kingdom has to integrate with the Fatoora platform.

ZATCA announced Wave 25 in July 2026, covering taxpayers whose VAT subject revenues exceeded SAR 187,500 during 2022, 2023, 2024 or 2025.

Integration is required by no later than 1 February 2027.

That threshold is half the previous wave, pulling a long tail of mid sized Saudi businesses into scope for the first time.

If your vendor cannot show you a working Fatoora integration, with clearance, reporting and the extra mandatory fields handled, you are buying a rebuild.

Data: PDPL, cross border transfers and where we actually host

The Saudi Personal Data Protection Law was issued by Royal Decree M/19 of 16 September 2021, amended by M/148 of 27 March 2023, and became effective on 14 September 2023.

The one year grace period ended on 14 September 2024.

It has been fully enforceable since.

There is no absolute general localisation mandate.

There are conditions.

A transfer abroad needs a permitted purpose, data minimisation, and appropriate safeguards where the destination has not been found adequate.

SDAIA has published no adequacy list, so India has no adequacy finding and an Indian vendor should plan on Saudi standard contractual clauses plus a transfer risk assessment.

SDAIA issued its risk assessment guidelines in February 2025.

Disclosing sensitive data with intent to harm can draw imprisonment of up to two years and a fine of up to SAR 3 million, with other violations reaching SAR 5 million and fines doubled for repeat offences.

Here is what we do rather than what is theoretically available.

We deploy in region on request, on AWS, Azure or Google Cloud Platform, with the region chosen to meet the client's residency requirement and infrastructure billed to the client at cost.

Where a client prefers it, we deploy to their own on premise servers.

Sub-processors are those cloud providers or the client's own infrastructure, plus error and performance monitoring, analytics and product telemetry, and helpdesk tooling.

Our certification position

We do not hold ISO 27001.

Implementation is underway, an auditor has been appointed, and certification is targeted for Q1 2027, January to March.

ISO 9001 is in progress and not yet held.

We do not hold CERT-In empanelment.

Where a Saudi client needs an empanelled audit, the client commissions it, we build to the auditor's requirements and implement every finding.

Our trust page carries the current position, not an aspirational one.

The working week changes your delivery calendar

Saudi Arabia works Sunday to Thursday, with the weekly holiday on Friday and Saturday.

That was set by Royal Order of 23 June 2013, applied to government bodies from 29 June 2013.

Gulf calendars are not uniform, and teams that assume one shared calendar get this wrong.

For a joint India and Saudi calendar it works out better than people expect.

India runs Monday to Friday.

Sunday is a Saudi working day and an Indian rest day.

Friday is the reverse.

You get four fully shared working days:

Monday to Thursday.

So we put every steering call, sign off and go live decision inside Monday to Thursday.

Sunday is for India side preparation, not meetings.

We start cutovers on a Saudi Thursday evening so the client has Friday and Saturday to stabilise before Sunday trading.

Ramadan hours change all of this, and need planning three months out.

UAE and Saudi Arabia side by side

Buyers running a Gulf wide rollout ask for this constantly.

Standard VAT rate

Saudi Arabia: 15%, from 1 July 2020.

United Arab Emirates: 5%.

Withholding tax to non residents

Saudi Arabia: 5% technical and consulting services, 15% royalties, 20% management fees.

United Arab Emirates: Currently set at 0%.

Working week

Saudi Arabia: Sunday to Thursday, with Friday and Saturday weekend.

United Arab Emirates: Not the Saudi pattern. Confirm the working week and weekend your UAE counterparty actually runs before fixing a delivery calendar.

Local entity requirement

Saudi Arabia: Required for government contracts above SAR 1 million via an RHQ licence. Not required by that rule for private contracts.

United Arab Emirates: No equivalent RHQ rule.

Cross border data transfer

Saudi Arabia: PDPL enforceable since 14 September 2024. No SDAIA adequacy list, so safeguards plus a risk assessment.

United Arab Emirates: Governed separately under UAE federal data protection law.

Do not copy a UAE contract into a Saudi deal. The tax clause alone will be wrong.

Market context: where the Saudi money went in 2025

These are the Digital Government Authority's numbers for 2025.

Total government ICT spending: SAR 31.90 billion

Value of government contracts: SAR 31.70 billion

Number of contracts: More than 6,145

Cloud computing spend: Up 42% compared with 2024

AI and emerging technology spend: Up 20%

Local content share of government software procurement: 49%

SME contract value: SAR 9.23 billion, representing 29% of contract value

Source: Digital Government Authority, reported by the Saudi Press Agency.

If your plan for the Kingdom is government revenue, plan for a Saudi partner from the start.

Proof: Triolift in Saudi Arabia

We name clients only where they have cleared it.

Triolift, in Saudi Arabia, is one of them.

We have built in the elevator and lift sector for years, and our ElevatorPlus product has over 2,000 users.

Across the company we have delivered more than 730 projects for over 500 clients worldwide since we were founded in 2018, across more than 25 industry verticals.

What the Saudi work taught us that the India work did not: the calendar, the invoice format, and that the compliance conversation belongs at the start of an engagement, not at user acceptance testing.

A Saudi client will forgive a slower build.

They will not forgive an ERP that cannot clear an invoice through Fatoora.

Accucia's view

Three positions, including the one that costs us money.

1. We will not tell you that invoicing a Saudi private client from India with no local presence is definitely fine.

It might be.

We found no authority saying so, and none saying otherwise.

Some vendors will give you a confident yes because it closes the deal.

Take Saudi counsel and get it in writing.

If that answer sends you to a local vendor, so be it.

2. Do not chase Saudi government ERP work directly.

With no RHQ and no partner, the SAR 1 million threshold, the RHQ rule and the local preference in the procurement law stack against you.

We would rather win three private manufacturing deals than lose eighteen months on one tender.

3. Build the compliance layer before the feature layer.

ZATCA integration, PDPL transfer documentation and the withholding tax treatment of your own contract are not phase two items.

We have seen Gulf ERP projects reach the demo stage looking excellent, then stall for four months on invoice clearance.

Cost drivers here are scope, integration count, ZATCA clearance work, data residency and migration size.

If your roadmap includes AI assistants reading live ERP data, the connection layer matters as much as the model, which is why we treat MCP integration as part of the ERP build, not a separate project.

Want a straight read on your own situation? Talk to us.

Frequently Asked Questions

Can a foreign company sell ERP software in Saudi Arabia?

Foreign vendors do build and support ERP for Saudi private companies.

Government contracting is restricted separately.

Whether you can invoice a Saudi private client with no local entity at all is a question we could not settle from published authority, so take Saudi legal advice on your specific arrangement before signing.

What is the Saudi RHQ rule for government contracts?

Since 1 January 2024, Saudi government agencies cannot contract with foreign companies that hold no Regional Headquarters licence in the Kingdom, and the restriction extends to their related parties.

Procurements estimated below SAR 1 million are exempt.

Limited exceptions exist.

The rule does not apply to private sector contracts.

Does the RHQ rule apply to private companies in Saudi Arabia?

No.

The Regional Headquarters requirement binds Saudi government agencies in their contracting.

It does not restrict a private Saudi company from buying software or services from a foreign vendor.

Private buyers should still check tax, data transfer and invoicing obligations.

What VAT applies when an Indian vendor supplies ERP to a Saudi business?

Saudi VAT is charged at a standard rate of 15%, raised from 5% on 1 July 2020.

Which party accounts for that tax on a cross border contract depends on the customer's VAT status and on the contract.

What withholding tax applies to software payments in Saudi Arabia?

Technical and consulting services attract 5%, royalties 15%, and management fees 20%.

ZATCA treats rights to reproduce or modify source code as royalties, while support, maintenance, training and paid development are treated as technical services.

Your contract wording therefore matters.

When is the ZATCA Phase 2 deadline for Wave 25?

ZATCA announced Wave 25 in July 2026.

It covers taxpayers whose VAT subject revenues exceeded SAR 187,500 during 2022, 2023, 2024 or 2025.

Selected taxpayers must integrate their e-invoicing systems with the Fatoora platform by no later than 1 February 2027.

Does Saudi Arabia require ERP data to be stored inside the Kingdom?

There is no absolute general localisation mandate under the PDPL.

Transfers abroad need a permitted purpose, data minimisation and appropriate safeguards.

Sector specific rules may add requirements.

Is India recognised as adequate for Saudi personal data transfers?

No.

SDAIA has not published an adequacy list, so no country currently holds a Saudi adequacy finding, India included.

Indian vendors should plan on Saudi standard contractual clauses and a documented transfer risk assessment.

What are the penalties under the Saudi PDPL?

Disclosing or publishing sensitive personal data with intent to harm the data subject can draw up to SAR 3 million and up to two years imprisonment.

Other violations reach fines of up to SAR 5 million.

Penalties may be doubled for repeat offences.

What is the working week in Saudi Arabia?

Saudi Arabia works Sunday to Thursday, with Friday and Saturday as the weekly holiday.

For India–Saudi projects, Monday to Thursday are the four shared working days.

How much does the Saudi government spend on ICT?

The Digital Government Authority reported government ICT spending of SAR 31.90 billion in 2025, across more than 6,145 contracts.

Cloud computing spend rose 42% and AI and emerging technology spend rose 20% compared with 2024.

Local content made up 49% of government software procurement.

Can a foreign vendor bid on Etimad tenders?

A foreign supplier needs a Ministry of Investment licence, temporary registration with the Ministry of Commerce, or a Saudi agent registered with the Ministry.

The Government Tenders and Procurement Law also requires agencies to prefer Saudi and majority Saudi owned suppliers, and the RHQ rule applies above SAR 1 million.

Most foreign vendors partner locally.