Saudi Arabia has signed but not ratified the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Saudi Arabia has adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

Saudi Arabia has adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

According to the GSO Technical Regulation for Low Voltage Electrical Equipment and Appliances – BD-142004-01, which includes an amendment and an update of the first edition, number (BD07070503) was implemented in 2007. Electrical appliances designed to be used in a certain rated voltage range must be sold bearing the G mark after being certified by the GCC Notified Body.
Products that fall under List 1 under the Regulation are low-risk; thus, a self-declaration form prepared by the manufacturer can be made by affixing the “G” before placing the product on the market. Products that fall under List 2 are higher-risk electrical products, which will undergo mandatory Type testing and review of the product's Technical File to verify conformity before authorisation is granted to affix the “G” mark before placing the product onto the market.
However, for List 2 products, manufacturers must choose a single Notified Body (NB) entity to examine the technical design of a product and verify that the technical design of the product meets the requirements of the applicable Gulf Technical Regulations and for the issuance of an evaluation report with a Gulf Type Examination certificate and shall be issued a certificate from the NB.
It is reported that not all agencies offering Saudi Standards, Metrology and Quality Organization (SASO) Certificate of Conformity (CoC) services are recognised in Saudi Arabia, which can complicate companies wishing to export their goods to Saudi Arabian markets. These certificates should be obtained only from authorised agencies recognised in Saudi Arabia.

According to Art. 8 of the Regulations for Licensing of Telecommunications and Information Technology Equipment, imported ICT products to Saudi Arabia cannot clear customs without the Communications, Space & Technology Commission (CST) Certificate of Conformity (CoC). The ICT equipment must comply with the technical specifications issued by the CST. The CST does not accept similar conformity certificates from other countries.

The National Cybersecurity Authority (NCA) has launched the National Cryptographic Standards (NCS) to meet the national need by specifying the minimum requirements necessary to provide the degree of protection required for national data, systems and networks using cryptographic mechanisms for civilian and commercial purposes, based on global best practices and global standards.
However, Art. 13.8 of the Regulations for Licensing of Telecommunications and Information Technology Equipment provides a general requirement to disclose details of encryption systems contained in telecommunications and IT equipment intended to be supplied and used in the kingdom.

Under Art. 15 of the E-Commerce Law, a business must register their e-shop in the Commercial Register in accordance with the Law of the Commercial Register, with the detailed requirements specified in the Implementing Regulations. Art. 12 of the Implementing Regulations provides that a trader must register the main electronic shop in the Commercial Register within 30 days of its establishment by submitting an electronic application via the Ministry’s website. The application must include, at a minimum, the applicant’s name, commercial registration number, the activities to be carried out through the electronic shop, and a description and address of the main electronic shop.
Where a practitioner seeks to register an electronic shop in order to acquire trader status, the application must instead contain the practitioner’s name and identification number, residential address, telephone number and e-mail address, together with the activities to be conducted through the electronic shop and a description and address of the main electronic shop.

It is reported that the de minimis threshold, that is the minimum value of goods below which customs do not charge duties, is SAR 1000 (approx. USD 250), above the 200 USD threshold recommended by the International Chamber of Commerce (ICC).

According to Section 4 of the Saudi Domain Name Registration Regulation, domain name registration services are restricted to the following categories: (i) entities physically located in Saudi Arabia; (ii) natural persons holding a Saudi national ID or Premium Residency; (iii) entities licensed by a competent authority in Saudi Arabia; and (iv) owners of trademarks or trade names registered in Saudi Arabia. In addition, a local administrative contact is required for each registration. Domain name services for Saudi country-code top-level domains (ccTLDs), including the Saudi ASCII ccTLD (.sa) and the Saudi IDN ccTLD, are managed by the Saudi Network Information Center (SaudiNIC).

The E-Commerce Law establishes a comprehensive framework for consumer protection applicable to online transactions. This legislation governs e-commerce activities between consumers in Saudi Arabia and service providers globally, including transactions between individuals. The law encompasses provisions on various issues, such as the protection of consumer data, transparency in contracting and electronic advertisements, as well as consumer rights, including the right to returns and cancellations under specific circumstances. According to regulatory authorities, the implementation of this framework has enhanced trust in online transactions and has made it easier for consumers to file e-commerce-related complaints with the authorities, owing to the strengthened consumer protection measures.

The Regulations for Providing Digital Content Platform Services issued by the Communications, Space and Technology Commission (CST) establish licensing, registration, and notification requirements for local and international digital content platforms within their scope. Covered services include satellite pay-TV, IPTV, video-on-demand (video OTT), audio-on-demand and internet radio, social media, video-sharing, and e-sports participation platforms (Arts. 4–5).
Under Art. 5 and Annexes 1–2, satellite pay-TV and IPTV platforms must obtain a CST licence, valid for 10 years, and pay application and annual regulatory fees. Video OTT platforms and audio-on-demand/internet radio platforms must obtain Category A registration, valid for five years, and pay a registration fee. Social media, video-sharing, and e-sports participation platforms must obtain Category B registration, which is open-ended and not subject to application or annual fees.
In addition, Art. 9 provides that foreign service providers without a commercial registration and/or a foreign investment licence in the Kingdom may contact CST to clarify the requirements for obtaining a CST licence and to confirm the status of an application once submitted. This clarification may be sought before completing the legal steps to obtain a commercial registration, a foreign investment licence, and/or other authorisations required to provide the licensed service in the Kingdom.
Moreover, these service providers shall appoint a Platform Liaison Officer in order to receive and respond to the CST's communications and requests.

According to Section 4 of the Regulations of the General Class License (GCL), the GCL permits the provision of various telecommunications services, including Virtual Voice Services (VVSP). The Regulations on the Provision of Virtual Voice Services further clarify that permit holders may provide virtual voice services via Internet protocol to end users in Saudi Arabia and may purchase and operate the associated equipment.
As set out in Section 6, an applicant for a VVSP permit must apply via the e-licensing system, hold a valid GCL with at least six months’ remaining validity, and submit a valid Saudi commercial registration (with at least three months’ remaining validity) indicating the relevant activity, together with a company profile, technical specifications of the systems and devices, numbering requirements and the required regulatory compliance information. Under Section 5, permit holders must establish in the Kingdom both a network operations centre to provide customer and support services and the technical and interconnection equipment necessary to meet the requirements imposed by the competent authorities. All international telecommunications traffic must pass through networks of CST-licensed international carriers, and CST allocates numbering resources and signalling point codes in accordance with the national numbering plan and related regulations, which the permit holder must use in compliance with CST decisions (Sections 5-1 to 5-5).

It is reported that Saudi Arabia prohibits all imports of goods and services from Israel. Additionally, it is reported that Saudi Arabia has extended this ban to all products and services from Lebanon since 2021.

According to Art. 5.4 of the Internet of Things (IoT) Regulatory Framework, all SIM cards used in IoT devices must be issued by telecommunications service providers licensed by the the Communications, Space & Technology Commission (CST)

According to Art. 9.1 of the Regulations for Licensing of Telecommunications and Information Technology Equipment, any party wishing to import telecommunications and IT equipment, that is in the list of restricted goods, shall apply for Customs Clearance Permission from the Communications, Space, and Technology Commission (CST). The list of restricted goods and their tariff codes can be found at Zakat, Tax and Customs Authority website, however, this is not accessible. It is reported that restricted products include wireless products, satellite internet services, equipment transmitting pictures wirelessly, and pre-paid telephone recharging cards.