IT Company Setup in Saudi Arabia

A foreign-owned IT company holds two licenses: the MISA investment license, which permits foreign ownership, and the Ministry of Commerce commercial service license, which authorizes the activity. Both are filed as one engagement. Most software, IT services and consulting activities need nothing more at the licensing stage.

The exceptions are activities that touch regulated infrastructure or security. And if you also sell hardware or equipment, that part of the business is trading and needs a commercial trade license on top of the service license.

The Communications, Space and Technology Commission (CST) registers companies that provide cloud computing services in the Kingdom. Registration is by class. Class A requires a Tier 2 or higher facility certificate or ISO/IEC 27001 for the data centers; Classes B and C require Tier 3 or higher.

Most software companies consume cloud services rather than provide them, and registration applies to the provider. If you sell to government or regulated clients, expect them to ask which registered provider hosts your platform.

Providing telecommunications services needs a license or registration under CST's classification, which runs from carrier and internet services to IoT and virtual network operators. The General Class License requires a Commercial Registration valid in the Kingdom for at least three months, with the activity listed. A new company cannot apply on day one, so the gap belongs in the launch plan.

The National Cybersecurity Authority (NCA) keeps a register of cybersecurity service providers and licenses managed security operations center (MSOC) services. A broader licensing framework for cybersecurity services, products and solutions went through public consultation in 2026. If cybersecurity is your core activity, registration with the NCA belongs in the setup plan.

Even if you are not a cybersecurity company, your clients may be bound by NCA's Essential Cybersecurity Controls. They apply to government entities and their affiliated companies, and to private operators of critical national infrastructure. Those clients write cybersecurity requirements into supplier contracts, and the controls require monitoring and operations centers that serve them over remote access to be fully located in Saudi Arabia.

The Personal Data Protection Law, overseen by SDAIA, has been fully enforceable since September 2024. It governs how you collect and process personal data and sets conditions for transferring it outside the Kingdom. Decide where customer data will be stored before you sign your first contract, not after.

Government procurement runs through Etimad, and you can bid once you hold a CR, are registered on the relevant platforms and meet Saudization requirements. Multinationals bidding for government work also need a Regional Headquarters license.

Large buyers such as Aramco, SEC and NEOM run their own vendor registrations, and technology and data suppliers are commonly asked for ISO/IEC 27001 certification. Both take weeks, so they are worth starting while the company is being formed.

Every company with employees is placed in a Nitaqat band based on its share of Saudi nationals, and the band governs visas, iqama renewals and transfers. New companies get a grace period before the ratio applies; use it to plan which roles are expatriate specialists and which can be Saudi hires from the start.

Some roles carry their own localization rules on top of the band, including customer-facing telecom roles. Check the job families your model depends on before you commit to a headcount plan.

These are the issues that most often stall IT and software entrants after the CR is issued.