Treat it as two questions. Gulf procurement statutes reach ministries and public authorities; whether they reach a state-owned company differs in every state. Bahrain and Kuwait name such companies inside the law and Oman keeps them there provisionally. Saudi Arabia, the UAE and Qatar leave them outside. That line decides your rights.

Almost every piece of advice written for European vendors treats "the government" in the Gulf as one buyer with one rulebook. It is not. A ministry, a public authority with its own budget, a wholly state-owned company and a sovereign fund's portfolio company sit in four different legal positions, and the position changes again when you cross a border. The practical consequence is that the standstill period, the complaint route, the reasoned debriefing, the payment clock and the local content handicap all switch on and off at a boundary that has nothing to do with how much of the buyer the state owns.

The good news is that the boundary is published in every one of the six states, usually in the first or second article of the procurement law. The bad news is that it is drawn in six different places, three of them the opposite way round from what the market assumes, and one of those three was moved by a deletion that the same decree then partly undid.

Figures and instruments in this article are current as at 31 October 2026. Saudi Arabia replaces its procurement law on 2 January 2027 and the comparisons below state both positions where they differ. On sources: where an instrument has no official English, the quotations are our own translations from the Arabic and the Arabic governs, and we say so at each point; where an official or ministry English exists we quote that text rather than our own rendering. The Saudi quotations are either the official English of the Bureau of Experts at the Council of Ministers or our translations from the Arabic gazette. The UAE federal quotations are the Ministry of Finance's own published English. The Dubai quotations are the Supreme Legislation Committee's English, which itself states that the original Arabic governs in case of conflict. The Abu Dhabi standards and manuals, the ADNOC supplier manuals and the MOIAT guidelines are English originals rather than translations. And we flag one case where a government's own English translation is now out of date against its Arabic.

The six states draw the same line in six different places

Start with the question a European vendor almost never asks: is this buyer inside the procurement law at all?

Saudi Arabia: a company is not in the list. Article 1 of the Government Tenders and Procurement Law defines the governed entities, al-jihat al-hukumiyya, and the official English of the Bureau of Experts at the Council of Ministers renders it as "Ministries, government bodies, public agencies, authorities, and institutions, and other entities with an independent public corporate personality." Article 10 then says, in one sentence, "This Law shall apply to all government agencies." There is no ownership test anywhere in the chapter, and no limb of the definition is capable of catching a joint stock company. The replacement law gazetted on 4 September 2026 keeps the definition and rewrites the scope article to attach to the transaction instead: "The Law applies to all works and procurements of government agencies" (our translation).

The UAE: the test is whether the buyer makes a profit. Federal Law No. 11 of 2023 reaches further than ministries. Its Article 3 covers "Independent Federal Entities" that "have an independent legal personality and the capacity to dispose, prepare, regulate and execute their own budget", so a federal authority with its own money is squarely inside. The third limb is the trapdoor: such an entity must also be "not-for-profit". A federal company falls out of the law not by an exclusion list but by failing the positive definition.

Qatar: two entities are excluded by name, and a third buyer will interest you. Article 2, first paragraph, of the promulgating Law No. 24 of 2015, as replaced by Article 1 of Law No. 17 of 2024, applies the attached law to "the ministries, the other government organs, and the public authorities and public institutions". It then excepts a numbered list, and does so only "within the limits of what the relevant legislative instrument provides": the Armed Forces, the Police, the other military entities and the National Cyber Security Agency, for contracts of a secret character determined by Emiri decision; "QatarEnergy"; "Qatar Investment Authority"; and any entity the Council of Ministers exempts on the Minister of Finance's proposal, which then gets its own tenders and auctions regulation (our translation from the Arabic of the amending law). Two things there are worth a cybersecurity vendor's attention: a national cybersecurity buyer is excluded by name, and the exclusion of an entity under the fourth limb means it gets a different rulebook rather than none.

Note also what the Qatari list tells you about drafting habits. QatarEnergy and the QIA had to be named because both are statutory bodies, established by Decree-Law No. 10 of 1974 and Emiri Decision No. 22 of 2005 respectively, and would otherwise have been caught. Qatar Airways, Ooredoo and the QIA's portfolio companies are not on the list because they are commercial companies rather than public institutions. Ooredoo reached that status the hard way: Law No. 21 of 1998 transformed the Qatar Public Telecommunications Corporation into a shareholding company, and its gazetted articles of association now describe it as "Ooredoo - A Qatari Public Shareholding Company (Q.P.S.C.)". Corporatisation, not exemption, is how a Gulf buyer leaves the procurement perimeter.

Oman: the companies were inside, were deleted, and were then kept. Royal Decree No. 36 of 2008 as enacted applied the Tender Law to state administrative units, public authorities and public institutions "and companies that are independent bodies corporate owned fully by the government", in the Sultanate's own official English. Royal Decree No. 19 of 2011 kept that limb and added a new exclusion for the units that apply the law concerning the financial system of the Diwan of the Royal Court. It was Royal Decree No. 60 of 2013 that struck the companies limb out, and the consolidated text now in force, updated to Royal Decree No. 83 of 2020, does not contain it.

That deletion was not an exclusion, which is the part nobody writes about. Article Two of the same 2013 decree provides that the Tender Law "shall continue to apply to the companies with independent legal personality wholly owned by the Government until their own tenders regulation is issued, after coordination with the concerned entities", with those companies' internal tender units exercising the Tender Board's competences in the meantime (our translation). On the published material an Omani wholly government-owned company is therefore inside the Law until its own regulation appears, which puts Oman closer to Bahrain and Kuwait than to Saudi Arabia. A second loose end points the same way: Article 1 of the consolidated law still defines the "concerned office" as "any unit or government company subject to the provisions of this Law" (our translation). The word "company" was struck from the scope article and left standing in the definitions.

One documentation warning. The consolidation is published by qanoon.om, which expressly disclaims official status, and the Sultanate's own official English PDF is the 2008 original and still prints the clause that was removed. A vendor reading the government's own English file will get the scope of Omani tendering wrong in both directions.

Bahrain: wholly state-owned companies are expressly inside. Article 3 of Legislative Decree No. 36 of 2002, in the official English translation of the Legislation and Legal Opinion Commission published in May 2024, applies the law "to all ministries, organisations, public institutions, municipalities and government authorities that have an independent or supplementary budget and the companies that are fully owned by the government, Consultative Council and House of Representatives."

Kuwait: the oil company's subsidiaries are expressly inside. Article 1 of Law No. 49 of 2016 defines public entities as "the ministries and government departments, and the public authorities and public institutions with an annexed or independent budget, and the companies wholly owned by the Kuwait Petroleum Corporation" (our translation from the Kuwait Al-Youm gazette text of 31 July 2016).

So the market's working assumption, that a state-owned company sits outside the procurement law, is correct in Saudi Arabia, the UAE and Qatar and wrong in Bahrain, Kuwait and, on the published material, Oman. Three of the six states reach into the state-owned sector by express words, and two of those three reach specifically into the national oil company.

Saudi Arabia: a company was never inside, which is why the Fund and the Central Bank had to be named

The Saudi position repays a closer look, because it shows why the exclusion is structural rather than discretionary, and because the inference most people draw from it is backwards.

Clause Fourth of Royal Decree No. M/76, which carries the new law, continues three categories of exemption: those issued to government agencies under Article 95 of the 2019 law, those limited in duration or tied to a named project, and "the exemptions issued to each of: (the Public Investment Fund, and the Saudi Central Bank)" (our translation). Those two are the only buying entities named as exempt anywhere in the decree. Aramco is not named. No portfolio company is named. We have written elsewhere about what those two exemptions mean for a vendor chasing Vision 2030 technology budgets; here the question is the mechanism.

The likeliest reason is the one that matters commercially. The Public Investment Fund and the Saudi Central Bank are bodies established by Royal Decree with their own legal personality, which is the shape of the last limb of the Article 1 definition, so an exemption was the only way out of it. A joint stock company never needed one because it was never inside. We put that as a reading rather than a finding: the decree lists the two of them as a third category alongside the Article 95 exemptions issued to government agencies, which leaves open whether their exemptions were granted under Article 95 at all. What does not depend on the reading is the structural point. An exemption can be revoked and a definition cannot be without amending the law, and the drafters had the chance to add an ownership limb in the 2026 recast and did not take it. So a PIF portfolio company's position is more durable than the Fund's own.

There is one limb that cuts the other way, and it is easy to miss because it sits in the closing provisions rather than the scope chapter. Article 93 of the 2019 law reads, in the official English, "Companies carrying out works and procurements on behalf of government agencies shall comply with the provisions of the Law." The new law restates it at Article 95 and adds the Regulations to the obligation, plus a carve-out: such companies "may be exempted from some of those provisions in accordance with what the Regulations clarify" (our translation).

That is not a theoretical limb for a software vendor. It is the exact shape of the Saudi government's own technology delivery companies, which exist to build and operate platforms for ministries, and it reaches any programme manager, systems integrator or procurement agent a ministry routes a technology buy through. So the question "do I get a standstill period?" cannot be answered by asking who the counterparty is. It has to be answered by asking in what capacity the counterparty is buying. And from 2 January 2027 even that answer is provisional, because the Regulations that may carve such companies out of "some of those provisions" have not been written yet.

One further change closes the door behind the Fund and the Central Bank. Article 97 of the new law permits an exemption only where it "be limited in duration, or specific to particular works or procurements, or to a defined category of works and procurements" (our translation), and requires the requesting agency to document the financial and economic effects including the effect on local content. From 2 January 2027 a new exemption cannot be open-ended or entity-wide. The two existing positions survive as grandfathered exceptions, not as a template anyone else can follow.

Etimad's own buyer register tells you which side a Saudi buyer is on

There is a way to settle the question for any Saudi buyer in about a minute, and as far as we can tell nobody uses it.

The Etimad procurement platform publishes, with no login and no account, a machine-readable list of every government buying entity registered on it, at the endpoint /Tender/GetAllAgenciesAsync. On 31 October 2026 it returned 291,866 bytes and 1,832 registrations, under 1,793 distinct names.

Three things in that file are worth a vendor's attention.

The first is the identifier. Most entities carry a hierarchical government agency code, 1,167 of them twelve digits long in three-digit groups and 1,736 of twelve digits or more: the Royal Court is 001001001000, the Digital Government Authority is 162000000000. Twenty-four entities instead carry a bare ten-digit code. For twenty of those the code is a Saudi commercial register number, identifiable by its chamber of commerce prefix, 1010 for Riyadh, 4030 and 4031 for Jeddah, 3550 for Tabuk, and all twenty have the word "company" in their name. The other four are a university, two institutes and an academy whose internal codes merely happen to run to ten characters. So the platform's data model can identify a buyer by its commercial register entry rather than by a place in the government hierarchy, and for twenty entities it does.

It is not consistent about it, and the inconsistency is a practical warning rather than a quibble. Three of the twenty-three entities whose name contains the word "company" are identified by a government hierarchy code instead, and two of those are the same company registered twice, once under a commercial register number and once under a hierarchy code: the Saudi Water Partnership Company and the national unified medical procurement company each appear in both forms. Saudi Arabian Airlines is on the register too, under an eleven-digit code and with no company word in its name at all. So a count of companies on this register is a floor rather than a measure, and a vendor may be looking at one of two buyer records for the same counterparty.

The second thing is who is absent. Searching the 1,832 names, with the alef, ya and ta-marbuta forms normalised and bidi control characters stripped, and testing each target on at least two distinct substrings including a root carrying no definite article, returns no match at all for Aramco, SABIC, stc, Saudi Electricity, the National Water Company, Elm, Thiqah, Tahakom, the Public Investment Fund itself, Qiddiya, Roshn, Red Sea Global, the Diriyah company, Alat or Humain. The Diriyah Gate Development Authority, a public body, is on the list; the Diriyah company is not. The Saudi Data and Artificial Intelligence Authority is on the list, as an authority. The Digital Government Authority is on the list twice, once as itself and once as its Vision Realization Office.

And NEOM is on the list, as "NEOM Company" with the commercial register number 3550134238. That is the single most useful line in the file, because NEOM Company is wholly owned by the Public Investment Fund, so being a PIF-owned company is not by itself what keeps a buyer off the government platform. Nor is the registration nominal: on 21 October 2026 NEOM Company had a live tender on Etimad, for the outsourcing of marine operations services at NEOM Port. NEOM also runs its own supplier portal on the GEP Business Network, where its published three steps end with "Once selected, you'll gain access to NEOM's procurement opportunities and be invited to participate in relevant tenders", so an Etimad registration and an invitation-gated portal of its own are not alternatives.

Two cautions on how far the register takes you. These are counts and keyword searches over a registration list, so the company count is a classification on the single Arabic word for company rather than arithmetic, and the absences are absences of the strings we searched for. And registration is not a measure of activity: we could show that two of the twenty-four commercial-register-coded entities had live tenders in October 2026, and we could prove nothing either way about the other twenty-two.

The third thing is a planning fact rather than a legal one. Thirty-nine entities carry codes beginning "VRO", nine characters rather than a digit string. Nineteen of them are a named ministry's Vision Realization Office; the rest are the equivalent office of an authority, a programme centre or an institute, and ten are registered under the parent body's own name with only the "VRO" suffix to distinguish them. Either way the point for a vendor is the same: a body's Vision Realization Office is a separate registered buying entity from the body itself. If you have been told that a Vision 2030 programme is funded out of a ministry's budget, the entity that buys it may not be the entity you have been talking to.

Every state-linked Saudi company whose supplier route we could verify runs its own invitation-gated portal on a commercial platform rather than on Etimad. Aramco's own supplier resources page states that "Aramco's supplier registration shall be completed through Aramco's e-Marketplace Platform", hosted on the SAP Ariba network, and neither that page nor Aramco's supplier FAQ mentions Etimad or the procurement law at all. That the government's own technology companies are approached as commercial accounts rather than through tenders is a point we made in the Vision 2030 budgets piece; what is new is the mechanics. Elm's supplier onboarding guide, published through SAP Ariba's own support library, runs "Supplier Request", then "Invitation Mail to Register", then sign-in, with supplier status shown as "Invited" or "Not Invited". For a vendor that is as important as the legal point: there is no single place to find these opportunities, and you cannot bid until somebody inside invites you.

What changes when the buyer is a company

Here is the part most European vendors get wrong, and they get it wrong in both directions.

On the evidence available, a Saudi state-owned company owes a foreign bidder none of the following, all of which a government agency does owe: the standstill period; the statutory grievance route to the agency and then to the ministry committee, with its refundable deposit; the payment chain and the new no-new-awards sanction; mandatory publication of the tender through the portal; the prohibition on specifying a brand name; and the reasoned recommendation required before an abnormally low bid, 25 percent or more below the estimated cost, can be excluded.

The deposit is worth stating precisely, because it changes in nine weeks. Today it is half the initial bid guarantee under Article 86(4) of the 2019 law, in the official English "a guarantee, equal to half the amount of the initial guarantee", which works out at 0.5 to 1 percent of bid value because the initial guarantee is 1 to 2 percent. From 2 January 2027 Article 84(4) of the new law makes it a flat 0.5 percent of the offer value, or SAR 15,000 where the appeal is against a prequalification decision. In either case it comes back if the appeal succeeds.

Now the part that cuts against the usual framing. The reasoned debriefing right a European vendor assumes it is losing does exist against a government agency, and it is better than the equivalent in several European systems. It simply does not live in the Law. Article 49 of the 2019 law says only that "A government agency shall announce the tender results and notify the other bidders thereof, in accordance with the Regulations", and Article 47 of the new law is to the same effect. It is Article 85(2) of the Implementing Regulations that supplies the substance: the other bidders are to be notified of the results of the competition "and the reasons for their exclusion, including the technical scores of their offers" (our translation). Articles 85(1) and 85(3) go further and put the winner's name and the contract value on the portal for every procurement above SAR 100,000.

So against a Saudi government agency a European bidder is owed written reasons and its own technical marks. Against a state-owned company it is owed nothing. And from 2 January 2027 even the agency's obligation is only as good as the replacement Regulations, because Article 47 of the new law delegates the content in the same words and those Regulations do not yet exist.

One thing a vendor assumes it has, and never did, is confidentiality of its own price. Article 23 of both laws obliges the agency to protect the confidentiality of the buyer's estimated cost, while Article 37(4) of the 2019 law requires the agency to announce the names of bidders through the portal. The law protects the buyer's number, not yours. We built a working price benchmark out of exactly that asymmetry in pricing software for GCC buyers.

The standstill, which is the most valuable of what you genuinely lose, is also shrinking. Article 53 of the 2019 law gives "a suspension period of not less than five working days and not more than 10 working days" in the official English, and the Regulations call the same window a standstill period at Article 87(1). Article 50(1) of the new law cuts the floor to three working days, and Article 50(2) is new: as an exception to paragraph 1, "the government agency is exempted from the standstill period in the cases the Regulations specify" (our translation). From 2 January 2027 the Regulations may dispense with it altogether, and the Regulations do not yet exist.

The tax boundary follows the same line, and the Saudi authority gives the same reason for it. ZATCA's Guideline for the Contracting Sector under VAT Provision, Second Issue, May 2026, states at section 4.2 that "Tax is due on all supplies of goods or services made to Government Entities under contracts concluded in accordance with the Government Tenders and Procurement Law. In these cases, tax becomes due on the date the payment order for the claim related to the taxable supply is issued, or on the date the consideration (or part of it) is received, whichever is earlier." That relief, which spares a vendor from funding output VAT before it is paid, is gated on the contract being concluded under the procurement law and not on the buyer being state-owned. Which state-owned companies this excludes, and the four other excluded cases, we set out when we wrote about what happens if a Gulf customer does not pay. What is worth adding here is ZATCA's stated ground for the exclusion: that the concept of government agencies does not apply to such companies. The tax authority and the procurement law draw the boundary in the same place, for the same definitional reason.

One certificate, two channels: the local content regime crossed the line in 2023

The handicaps did not stay on the government side of the boundary, and the single most useful fact in this section is a date.

In June 2022 the Saudi Council of Ministers issued Cabinet Resolution 658, which extended the local content regime to companies the state majority-owns. We could not obtain the primary instrument from any reachable source, so what follows is the enumeration published by the advisory firm ASG, now DGA Group, in an analysis dated 1 August 2022, and it should be read as a firm's summary rather than as the text. It lists a mandatory list of national products which "must be purchased locally"; an annual duty to report a local content score; a price preference for SMEs, under which "All contracts with an estimated cost of less than SAR 50 million ($13.3 million) can buy local products at a 10 percent premium"; a price preference for national products; and a rule that "As part of a financial bid, the weighting of a vendor's local content score must not be less than 30 percent." The same source dates the regulations' entry into force to 18 December 2022, requires companies wholly owned by the Kingdom to be in compliance within a year of that, by 18 December 2023, and says that for companies in which the state holds more than 50 but less than 100 percent "the regulation encourages compliance within the first year and makes it mandatory after that."

So selling to a Saudi state-owned company is not rule-free. You carry a buy-local mandate, an SME price preference you cannot benefit from, a minimum local content weighting of 30 percent on the financial bid, and behind all of it the need for a local content certificate authenticated by the Local Content and Government Procurement Authority. How the government channel's own non-price weighting is built and scored, and why it is capped in practice, is the subject of how Gulf enterprise procurement actually works, and we do not repeat it here. The two regimes are not expressed in commensurable terms and we will not pretend they are: what is comparable is that the government agency's non-price weighting is both higher and published, and the state-owned company's is neither.

The fact that earns the section is what happened next, and it is a convergence rather than a divergence. Aramco's iktva programme states flatly on its own site that "iktva is now an integral part of Saudi Aramco procurement; therefore, participation is required for doing business with Saudi Aramco." Its 2024 and 2025 guidelines both carry a section headed "Objective of 2023 Changes" recording that "an alignment was reached with the Local Content & Government Procurement Authority (LC&GPA) to enhance local reliability by unifying local content measurements and authentication certificate to maximize Local Content in the Kingdom and ensure the efficiency of its processes." The operative instruction is that "The Local content certificate (LC) must be approved and authenticated by the Local Content & Government Procurement Authority (LC&GPA)."

Read that twice. Since 2023 the Kingdom has had one local content certificate rather than two, and the national oil company, which no procurement law reaches, surrendered its own measurement standard to the government regulator's. For a vendor the practical reading is better than it sounds: one localisation investment now addresses the government channel and the state-owned channel at once. The burden is heavier on the Aramco side, because iktva asks for the certificate plus certification of the survey by one of its approved independent audit firms plus a five-year action plan developed with Saudi Aramco plus annual resubmission of the score, where the government regime asks for the certificate. But it is the same certificate.

The honest summary of the Saudi position, then, is not an absence of rules on one side of the line. It is that the compliance obligations have crossed the boundary and the procedural protections have not. That combination, the burden of the public regime with the deal risk of the private one, is the worst of the two for a foreign vendor, and nothing we found suggests it is about to change: every published step since 2019 has tightened local content around state-owned buyers, and not one has extended procedure to them.

The UAE drew the line, then filed it in a treaty

The UAE answers the same question three times over, at federal, emirate and company level, and the answers do not rank the way anyone expects.

Federally, the boundary is the not-for-profit test in Article 3 of Federal Law No. 11 of 2023, quoted above. Article 4 then adds a published exclusion list that names the Ministry of Defence, the Armed Forces, the UAE Security Authorities and the Ministry of Interior for military and security purchases, and excludes by subject matter construction projects and contracts, medicines and medical supplies, public-private partnership contracts, and, at limb (n), "Federal Entities and Procurement that are excluded by Cabinet decision made pursuant the Ministry's opinion." Article 41 adds a second escape: "An exemption may be made from any of the provisions of the Law with the approval of the Cabinet if the need arises, based on a request of the relevant Federal Entity, provided that the object and justifications of the exception are specified." The conditions there bite on the requesting entity, not on publication. Nothing requires the exemption to be announced, so the federal perimeter is revocable entity by entity with no duty to tell the market.

Then there is the single best sentence on this subject anywhere in Gulf primary material, and it is in a trade agreement. Annex 11-A of the UAE and New Zealand Comprehensive Economic Partnership Agreement schedules the entities the UAE commits to procurement discipline. Section A lists 29 central government entities at a threshold of SDR 134,000, of which fourteen are not ministries, including the Federal Tax Authority, the UAE Space Agency, the Emirates School Establishment and the Federal Judicial Office. That Section A list, and the published tender windows that go with it, we costed out in how long is a GCC enterprise sales cycle.

Section B is the "Other Entities" slot, which in agreements of this kind is where a party schedules the bodies below central government that it is willing to commit, typically utilities and state-owned enterprises. In the UAE's schedule it is the only non-central slot. Under the heading "OTHER ENTITIES" it reads, in full:

"Not applicable for the United Arab Emirates."

The UAE was asked, in a binding treaty negotiation, which of its emirate bodies and government-owned companies it would commit to procurement rules. It answered: none. That is the UAE's own considered position, filed in an instrument it signed, and it is worth more than any inference from a website.

At emirate level the picture is sharper than the federal one in two respects and worse in a third.

Dubai Law No. 12 of 2020 defines a "Government Entity" to include "Any of the Government departments, public agencies or corporations, Government councils or authorities, or other entities affiliated to the Government", and then excludes, at Article 4(b)(1), "any Government Entity which is established, or whose business is regulated, under legislation that stipulates that its Contracts and Inventory Management be governed by special regulations". That exclusion is self-executing, and the law proves it by contrast: the very next limb, Article 4(b)(2), excludes an entity only "pursuant to a resolution of the Chairman of the Executive Council or his authorised representative". Limb (1) needs no such resolution. A Dubai government-related entity established by its own decree, with its own contracting rules, falls out of the law the moment that decree says so, and no list of the entities that have fallen out is ever published.

The eSupply portal's published roster bears this out exactly. It describes itself as the portal for "over 40 major Dubai Government entities", and Dubai Municipality, the Roads and Transport Authority, Dubai Customs, the Dubai Health Authority, Dubai Courts and the Land Department are on it. DEWA, the Emirates Group, Dubai Holding, Emaar and du are not.

Dubai is also, surprisingly, the better of the two UAE layers on grievance procedure. Article 118 gives "Any affected party" thirty days to submit a written grievance "without prejudice to his right to recourse to courts", gives the committee thirty days to decide, and bars from that committee "any Person who has participated in taking the contested procedure, decision, or measure". Article 120(b) provides that, where no amicable settlement is reached, "the courts of the Emirate, including the Dubai International Financial Centre Courts, will have jurisdiction to hear all the disputes arising from performance of the Contract", subject to an exemption at Article 120(e) that needs the Ruler's prior approval. The federal regime gives a supplier five business days to file and declares the committee's decision "final and not subject to appeal" at Article 49(1) of Cabinet Resolution No. 122 of 2024, deeming silence a rejection at Article 48(4). Dubai's decision is final too, at Article 118(c); the difference is the preserved court route in 118(a).

Two qualifications, because a reader who stops at "better on grievances" will be misled. The federal regime has something Dubai does not, which is the obligation at Article 33(1) of Cabinet Resolution 122 to answer an unsuccessful supplier within ten business days, a free loss-review channel that almost no foreign vendor uses, and which has three published exemptions at Article 33(2), the live one for enterprise software being a "direct mandate" to a specific supplier "for strategic reasons". And Dubai's Article 119 is strongly pro-government: a government entity "will not be held liable towards any party contracting with it, or towards third parties, for any damage sustained by them as a result of performing the Contract, unless the Government Entity has contributed to this damage", while Article 120(c) forbids an arbitration seated outside the Emirate and 120(d) forbids any contractual reference to FIDIC terms.

Where Dubai is plainly worse is nationality. Article 16(a)(1) requires a bidder to "be a natural or legal person who is a UAE national or a national of a Gulf Cooperation Council state", and Article 16(b) then makes foreign participation a discretionary derogation: a government entity "may enter into a Contract with a non-UAE national individual, with a company or corporation licensed in a free zone ... or with a foreign company or corporation operating outside of the UAE, subject to satisfying the rules and conditions stipulated in this Law ...". Federally, a non-resident bid is normal, and the Ministry of Finance publishes "Foreign Supplier: Companies located outside UAE, and without a local branch in UAE" as a registration category in its own taxonomy, a point we developed in do you need a local entity to sell software in the UAE. Same country, opposite defaults.

One note on currency of the Dubai text. Law No. 10 of 2026, issued 27 February 2026, amends Law No. 12 of 2020, but it supersedes Article 76 alone, on delay in supplying materials. The definition, the scope exclusion, the nationality rule and the grievance and jurisdiction articles quoted here stand as enacted in 2020. The new Article 76 is worth knowing in its own right, and it tightened against suppliers: the delay penalty is "zero point five per cent (0.5%) of the value of the contracted materials for each day of delay", capped at "twenty per cent (20%)", and at the cap the entity may, "without the need for a notice or court judgment", either buy at the supplier's expense plus "ten per cent (10%) of the value of the contracted materials as administrative fees", or "revoke the Contract, confiscate the Performance Bond, and claim compensation for damage".

Abu Dhabi's procurement rulebook is a departmental circular rather than a law. The Abu Dhabi Procurement Standards rest on Department of Government Support Circular No. 3 of 2021, cited by number in the Emirate's own Local Content Guidelines, whose governing-legislation article lists no procurement law at all: only the 2020 law that established the Department, the Department's own circular, an Executive Council circular on the Local Content Program, and a Department of Economic Development policy. The Standards apply to "the government entities and any other organisation included through a resolution issued by the Executive Council or by any other body authorised by the Executive Council", and section 2.3 lets the Executive Council or an authorised body "exclude any government entity from the application of the Procurement Manual". No list of included or excluded entities is published. The only definition in the Abu Dhabi stack is in the Local Content Guidelines, which define "Government Entities" as "The departments, authorities, public institutions, agencies, centers, councils, funds, and any other entity affiliated with the Abu Dhabi Government", and that enumeration contains no companies. That makes the exclusion of ADNOC, ADQ and Mubadala a sound inference and not a published fact, and we say so rather than dress it up.

Abu Dhabi does publish one thing nobody else does, and it is a payment deadline you cannot have. The Abu Dhabi Procurement Manual records that for recognised micro, small and medium enterprises "All dues shall be paid to the MSMEs within a period of 15 days from the date of the invoice", and the same term for Emirati Entrepreneurs, defined as organisations "having Abu Dhabi DED commercial licenses and owned in 100% by UAE nationals (including partners)". It is the only hard contractual payment term published at any UAE layer, and a European software company cannot qualify for it. There is a softer instrument that is not nationality-gated and is better news: Abu Dhabi Executive Committee Circular No. 1 of 2019 directs government bodies and companies to update their contracts so that payment is made within thirty days of a relevant invoice. That is a direction to amend contracts rather than a term, and it prescribes no remedy, but it is worth quoting in a negotiation, as we noted in the non-payment piece.

Then there is ADNOC, which is the largest technology buyer in the country and the clearest single case of a company that no procurement law reaches publishing exactly how it will treat you.

ADNOC's Supplier Hub guided tour states that "Prequalified suppliers shall be able to receive tender invitations based on ADNOC business requirement". Nothing in ADNOC's published supplier material points to a public tender board; on the Supplier Hub, which is the only supplier route ADNOC publishes, entry is prequalification and then invitation. And section 8 of the Supplier Hub registration manual, headed "Registering from Outside the UAE", is published in full on the open web:

"Follow this section where your company is registered outside the United Arab Emirates. This route has four stages - 1 License, 2 Company, 3 Contacts & Declaration, 4 Review and completes registration only."

The manual repeats the point as a note: "This route completes registration only." The Abu Dhabi route in the same document runs eight steps, adding owners and sponsor, products and services, documents and compliance, which is the prequalification evidence. Put the two together and a foreign-registered company learns, before spending a dirham, that it can register and will not enter the invitation pool. Step 3 of the foreign route also asks the applicant to "Enter the ADNOC Account Manager details", so you must already know someone inside ADNOC to complete the form.

The In-Country Value certificate completes the circle, and it does so by a mechanism that is not a formal eligibility bar. No instrument we could read makes an ICV certificate a precondition to bidding at ADNOC: the words "tender", "mandatory", "precondition" and "prerequisite" appear nowhere in the 30-page MOIAT certification guidelines, which are a calculation manual. On the guidelines as published, though, a European software company has no route to a certificate. A certificate attaches to a licence: "The ICV Certificate shall be obtained for each legal entity of the Supplier that intends to be certified. Each license of a company is considered an independent legal entity, even if the ownership is the same. However, if a company has different branches in the same Emirate with identical activities and ownership listed on the licenses, then one combined ICV Certificate will be issued for the company in that Emirate." The licence is the bar, not the accounts: the guidelines require figures aligned with statements "audited by a licensed auditor in the UAE", but they also allow a company less than ten months old to use unaudited management accounts, and in another passage they require only an "independent licensed auditor" with no UAE requirement, so the instrument is inconsistent with itself on the audit and we rest on the licence instead.

One qualification we could not resolve, and it is in the same CEPA schedule as Section B. In Section E the UAE states that "suppliers holding the National Added Value (ICV) certificate shall receive an additional 25% bonus in bid evaluations, in accordance with the ICV guidelines", and then, verbatim, that "Suppliers from New Zealand are eligible to obtain this certification." That is a published statement that a foreign supplier may obtain the certificate, without saying by what route, and we could not find the route.

What happens to a vendor that cannot produce one is published, and it is gentler than people expect and worse than it looks. Article 7(4) of the Abu Dhabi Local Content Guidelines provides that "If the Supplier fails to submit the Certificate, it shall not be excluded from the tender, yet the Local Content will score zero", against a weighting the Abu Dhabi Procurement Manual puts at 40 percent of the financial and commercial evaluation score. We have written about that scoring and about the narrower point that the trigger is non-submission rather than non-possession, with a grace period available under Article 7(3), in how Gulf enterprise procurement actually works. The distinction matters here: a vendor that cannot obtain a certificate at all is in a worse position than one that simply failed to file, because no grace period helps it. Article 8(2) adds the sting for a European group: "the Certificate is issued to the the supplier itself and not the parent company or another company in the same group", the duplicated word being the guidelines' own.

And the ICV programme is the one mechanism by which the UAE's published rulebook has escaped the federal perimeter into the commercial entities. MOIAT defines "Participating Entities" as "All government entities and companies who have implemented the In-Country Value (ICV) program", and the labels MOIAT attaches to each participant logo on its programme page name ADNOC, Mubadala, the Emirates Nuclear Energy Corporation, Etihad Rail, Aldar, Etisalat, Edge, Shurooq and a Department of Economic Development. The Ministry publishes no roster of participating entities anywhere we could find, so verify any particular entity before relying on it. But the direction of travel is the opposite of the usual story: a sovereign investor that no procurement law touches has voluntarily adopted a federally published formula a vendor can read and self-score against, and the Ministry itself publishes the link between ADNOC and the programme that ADNOC's own documents leave you to infer.

Bahrain, Kuwait and Oman put the company inside the law

These are the three states the market has backwards, and in Bahrain's case the proof is published monthly.

Bahrain. Article 3 binds "the companies that are fully owned by the government", and Article 37 makes publication a statutory duty: "All the award decisions shall be announced on a monthly basis in the Official Gazette." The Tender Board discharges it with a monthly awarded tenders report, published as a PDF with no login, 129 of them current to August 2026. The format, and what it is good for as a price benchmark, we covered in pricing software for GCC buyers.

What is new is who is in it. The July 2026 report covers 37 reporting entities, and among them are Bahrain Mumtalakat Holding Company, which is the sovereign fund itself, Bapco Refining, Bapco Upstream, Gulf Air, Bahrain Airport Company, Edamah and Bahrain International Circuit, alongside the ministries, the Electricity and Water Authority and the Information and eGovernment Authority. A software-relevant line from that month: the National Bureau for Revenue, tender TB/40259/2026, for the provision of policy support services for digital transformation opportunities, awarded to the bidder the report prints as "PRICEWATER HOUSE COOPERS" at BHD 601,288.600, about USD 1.6 million. The report is in Arabic only, and the English of that subject and of the entity names is ours.

Bahrain also moved in 2026, and it moved the opposite way to the assumption. Law No. 30 of 2026, issued 14 June 2026, replaced Article 11 bis. It did not exempt state-owned companies; it raised their self-handling threshold while keeping them inside. An ordinary disposing party may run its own procedures up to fifty thousand dinars, and "as for companies wholly owned by the State, they shall carry out these procedures in respect of tenders, bids, procurements and sales whose value does not exceed one hundred thousand dinars. In all cases the Board shall be notified of the list of those procurements at least once every three months" (our translation from the Arabic). The one new exemption power Bahrain created, a new Article 3 bis, is limited to contracts "whose procedures are carried out and performed outside the Kingdom of Bahrain", and is conditional on the entity having a Board-approved procedure regulation and reporting quarterly.

Note a documentation trap here, and it is the case we flagged at the top. The official English consolidation of the Bahraini law was published in May 2024 and still carries the pre-2026 figures of twenty-five thousand and fifty thousand dinars. Law No. 30 of 2026 exists in Arabic only; the Commission's own amendment index lists it as untitled with no English version. So the government's own English text is now out of date on this article, and a vendor relying on it will have the thresholds wrong.

Bahrain publishes one more thing we had expected to find nowhere outside Saudi Arabia: a forward plan. The Tender Board serves a 42-page bilingual Tender and Auction Plan for 2027, with no login, listing roughly 760 planned tenders by entity, subject and description, plus a separate table of six planned prequalifications. The publishing date is given as a year and a quarter, and there are no estimated values. Bapco Refining alone appears with 36 planned tenders, at rows 215 to 250, several of them control-system and CCTV replacements. Four software-relevant entries, all from Government Hospitals: tenders subjected "Digital Pathology", "Unified Call Center" and "Cybersecurity NDR Advanced (AI + MDR)", the last described as needed "to enhance the organization's cybersecurity posture by providing AI-driven network threat detection, continuous monitoring, and managed detection and response", and one described simply as "To outsource 6 IT software developers".

Kuwait. Article 1 names the Kuwait Petroleum Corporation's wholly-owned companies as public entities, which puts its subsidiaries inside the Public Tenders Law by express words. The carve-out at Article 2 is a delegation with conditions, not an exemption: contracts above the threshold go to the Central Agency for Public Tenders, a purchase unit at KPC handles those below it, and that unit "shall observe the provisions of this Law in its procedures" and must refer its contract minutes to the Agency, the State Audit Bureau and the Ministry of Finance (our translation). The same instruction attaches even to the genuinely excluded upstream operations. And the closing words of Article 2 make the law the residual default: "And in all cases the provisions of this Law and its Regulation shall apply to whatever has not been the subject of a special provision concerning the operation of each of these public entities" (our translation). Kuwait's position on a foreign bidder's registration obligation, which was rewritten in 2024, is in which GCC country should you enter first.

Software is a service and falls in the standard purchase lane, so a software contract with a wholly KPC-owned company is inside the statute, with two qualifications. Software supplied as one of "the specialised services connected with the drilling and maintenance of oil wells" falls in the excluded upstream limb, which catches a good deal of subsurface software. And the Agency's own jurisdiction limb reaches only purchase contracts "performed inside the State of Kuwait", so where a licence is delivered from abroad the lane itself is arguable (our translations).

Kuwait also has the strongest published-pipeline duty in the Gulf on the face of the text, and nobody writes about it. Article 33 of Law No. 49 of 2016 provides that "Government entities shall prepare and publish their binding annual plans for supply, works-contracting and services contracts, and shall prepare a schedule of the tenders and prequalifications they will float, at least ninety (90) days before floating them, together with a summary of the tender or the prequalification, and accordingly it is prohibited to contract for the purpose of exhausting financial appropriations, and it is likewise prohibited to contract in the last month of the financial year except in exceptional cases required by the necessities of work and with the approval of the Minister supervising the competent government entity" (our translation). The word we have translated as "binding", mulzima, is in the Arabic and attaches to the plans. Saudi Arabia's equivalent duty, at Article 12 of its own law, is expressly stripped of any obligation to offer what the plan contains.

KPC's own portal does publish the pipeline. The K-Tendering site serves a live tender list with no login, headed by the Higher Purchasing Committee's announcement of the tenders it is floating, with event ID, title, type, publication and closing dates and bid bond value, current to the end of October 2026 and including scope such as "Supply of New Hardware for Cyber Security For All Vessels". What it does not publish is prices: the "Bid Results" menu item points to a work-in-progress page, as do the three approved-supplier and prequalification lists, and "Past Opportunities" sits behind a login. So Kuwait publishes the pipeline and not the prices, and Bahrain publishes both.

One Kuwaiti caution. Law No. 94 of 2026 is reported by Al Tamimi to have been published on 27 September 2026 and to take effect three months later, raising the Agency's threshold for domestic contracts in the KPC group among other changes. We could not obtain it in primary form and state nothing from it, which is also why no threshold figure appears above. The live risk to the Article 1 definition is corporatisation, because corporatisation is precisely how Ooredoo left Qatar's perimeter; we could find no primary or attributable source for the Kuwaiti instrument said to be doing it for the oil sector, so we state nothing about that either.

Oman. Oman's wholly government-owned companies are inside the Law until their own tenders regulation issues, as set out above, and no such regulation has surfaced. The irony is that being inside the Omani Law buys a bidder remarkably little. Neither the Tender Law, nor its Executive Regulations issued by Tender Board Decision No. 29 of 2010, nor the 2023 Regulation for the Organisation of Unified Procurement, which expressly covers information technology among its categories, contains the Arabic words for grievance, complaint, objection or challenge, or any word for payment of dues. Both regulations are served through the Authority's own e-tendering portal rather than as open documents, so you will need to go through the portal to read them. There is no standstill, no debriefing right and no publication of award values.

Oman does require a forward plan, but not a published one: Article 4 of the 2023 Regulation obliges each entity to prepare an annual plan of its expected procurement categories, the categories being owned and leased vehicles, facilities management and information technology, and to furnish it to the Tender Board's General Secretariat before 31 December each year. It goes to the Secretariat, not to the market.

So the genuinely process-free Gulf buyer in this group is not a national oil company at all. It is an ordinary Omani ministry, where the governing instruments give a losing bidder no complaint route, no reasons, no standstill and no published award, while a wholly state-owned Bahraini company publishes both its forward plan and its award values.

Who signs, and who pays

Two operational questions decide whether a government-linked deal is worth pursuing, and the two largest Gulf markets answer them in mirror image. Saudi Arabia publishes the signature threshold in the law and delegates the payment clock to a regulation. The UAE federal regime publishes the payment chain's every procedural deadline and leaves both the signature threshold and the payment clock unpublished.

Take the signature first, because there is a change coming that almost nobody has priced in. The Saudi delegation ceiling rises from SAR 10 million to SAR 50 million on 2 January 2027, which we set out alongside the rest of the published Saudi clock in how long is a GCC enterprise sales cycle. What that piece does not have is the second paragraph of the new Article 51, and it is the one that matters when you are reading a signature block. Paragraph 1 caps a delegate's decision at fifty million riyals. Paragraph 2 then lets the head of the agency delegate officials "to sign contracts and other documents requiring the signature of the head of the government agency" (our translation), with no value limit attached at all. So the decision is capped and the signature is not. Who signed your contract and who decided to award it are, by design, two different questions, and the signatory's seniority tells you nothing about the approval level.

The UAE federal position on the same question is the sharpest published contrast in this article. Article 5(1) of Cabinet Resolution No. 122 of 2024 states that "The Delegation of Authority Matrix, issued by decision of the Minister, shall determine the authorities of persons authorized to approve financial and non-financial decisions related to Federal Entity Purchases, and the financial limits associated therewith ...". The Matrix is a ministerial decision the Resolution references and does not reproduce. We searched the whole 119,731 bytes of extracted text from the Resolution's official English for "AED", "Dirham" and "dirham". There is one hit, in Article 4(2)(d), on accepting offers in currencies other than the dirham. There is not a single monetary figure in the instrument, nor any four-figure number other than the years it cites.

Saudi Arabia prints the number in the law; the UAE federal regime prints only the fact that a number exists. Dubai, for its part, prints its own ladder: Law No. 12 of 2020 sets direct procurement below "one hundred thousand dirhams (AED 100,000.00)", one or more solicited bids "between one hundred thousand dirhams (AED 100,000.00) and five hundred thousand dirhams (AED 500,000.00)", and committee-run tendering above that. So the negative is true of the federal rulebook and false of the country.

Now the payment clock, where the comparison that earns its keep is a matched pair rather than a statute.

The only published payment term we could obtain from a Gulf state-owned company is QatarEnergy's, and it is the single most useful document for a vendor anywhere in this article. Its General Terms and Conditions of Purchase, Schedule C, Revision 5 of January 2024, is linked openly from a page stating that they apply "to all QatarEnergy purchases of materials and equipment", though that page also still tells bidders that the version "dated 10/21 or referred to in the Request for Quotation (RFQ) document" will apply, so confirm which revision your own RFQ pulls in. Article 4.8 promises payment "Within thirty (30) days from receipt by Purchaser of a correctly prepared and adequately supported invoice". Thirty days is less than half the Saudi statutory schedule for a government agency, which runs to roughly eighty calendar days on a clean claim and which we set out limb by limb in what happens if a Gulf customer does not pay.

Then read the next clause. Article 4.9 provides that "the receipt of the invoice is not when it is sent by Seller but it is when the acknowledgment is sent by Purchaser in electronic form to Seller." Article 4.12 gives the buyer twenty-one of those thirty days to dispute an invoice and sends the disputed part to the back of the next invoice. And Article 4.15 says that, "notwithstanding anything to the contrary in the Purchase Order", the "Purchaser shall not be liable to pay any interest on any delayed payments."

So the state-owned company's published term is shorter than the ministry's statutory one, and it achieves much the same effect as the Saudi regulation's restart provision without a statute: the buyer controls when the clock starts and owes nothing for missing it. The lesson is not that state-owned buyers pay slowly. On the one matched pair of published terms we could find, the state-owned buyer pays faster. The lesson is that it pays as a matter of its own choice rather than your entitlement, and that in both cases the step nobody puts a clock on is the buyer's own act: the agency's upload of the payment order, or the company's acknowledgement of the invoice.

Two Saudi changes from the amendment gazetted on 5 June 2026 are worth a vendor's attention because they are in your favour, and both are new.

The first removed two clearance certificates and a retention floor. Article 111 of the Implementing Regulations previously disbursed the final payment certificate, "which must not be less than (10%) in public construction contracts and (5%) in other contracts", against a completion certificate from the agency, a certificate from the zakat and tax authority proving payment of zakat or tax, a certificate from the General Organization for Social Insurance confirming registration and paid insurance entitlements, and whatever the approved contract forms demanded (our translation of the November 2022 print). The amended text keeps only the first and the last. Three things went: the minimum size of the final certificate, the tax clearance and the social insurance clearance. For a European vendor with no Saudi establishment the social insurance certificate was the hardest of the three to produce, and the deleted floor means an agency is no longer obliged to hold 10 or 5 percent of the contract back to the end.

The second moved the payment schedule onto your side of the table. Article 88(4) of the Regulations, as amended, now provides that "The competitor shall submit the schedule of payments within its offer, and the agency may review it and request its amendment as it deems appropriate, and it is approved by agreement with the competitor at the offer-examination stage." If the agency then writes a different schedule into the contract, the winning bidder may refuse it, and if the agency does not correct it within ten working days the bidder may ask to withdraw and have its guarantees returned, a request that goes to the offer-examination committee rather than an automatic right (our translations). The payment schedule in a Saudi government deal is now something you propose and negotiate, not something you receive.

Neither of those reaches a state-owned company, because both sit in the Regulations of a law that does not apply to one.

Elsewhere, there is no statutory supplier payment period to lose. Article 35(1) of UAE Federal Law No. 11 of 2023 says only that "The Federal Entities shall be liable for making payments to the Suppliers in accordance with the provisions and deadlines stipulated in the contract." Cabinet Resolution 122 of 2024 is dense with deadlines, five, ten, fifteen, thirty and sixty business days, and not one of them is a deadline to pay an invoice; the nearest thing is Article 13(8), a flexibility to vary payment terms in favour of SME suppliers. We found no statutory supplier payment period in Qatar's law or its 2019 Regulations, in Oman's Tender Law or its two sets of regulations, in Bahrain's law or in Kuwait's law either. In each case that negative is scoped to the instruments we read, and for Bahrain and Kuwait we could not read the implementing regulations.

What this means in practice

The first thing to do on any Gulf deal where the buyer's name contains the words "authority", "corporation", "holding" or "company" is to find out which instrument the buyer sits inside, before you price and before you decide whether to bid direct or through a partner. That takes an hour, not a week, and in every one of the six states the answer is in the first three articles of the procurement law.

Then act on it in four specific ways.

If the buyer is a company, move your protections into the contract, because the statute will not supply them. You are not negotiating around an absence of rules; you are negotiating back what the statute would otherwise have given you. Against a Saudi government agency you already have written reasons and your own technical scores under Article 85(2) of the Regulations, so do not spend negotiating capital asking for them. Against a company you have nothing, so ask for a notification-and-reasons undertaking on award, a defined payment period with a defined start event, and confidentiality of commercial terms. That last one is worth asking for even against an agency, because the law protects the buyer's estimated cost and publishes the bidders' names. And price the payment risk rather than assuming it away: a thirty-day term that starts on the buyer's acknowledgement is not a thirty-day term, and QatarEnergy's published clauses are the model to read before you accept anyone else's.

Treat the local content certificate as one investment, not two. In Saudi Arabia, since the 2023 alignment, the Local Content and Government Procurement Authority certificate serves both the government channel and Aramco's iktva submission, so a single localisation decision addresses both. In the UAE the mechanics run the other way and are harsher: on the guidelines as published, an ICV certificate attaches to a UAE licence, so without one you have no route to a certificate, score zero on local content, and forfeit forty percent of the financial criterion in Abu Dhabi. If a meaningful share of your Gulf pipeline is government-linked, that single fact is a stronger commercial argument for incorporating locally than any of the usual ones.

Register before you have a pipeline, not after. This inverts the normal sequence and it is forced on you by how these buyers work. ADNOC's published route gives a foreign-registered company registration only, and prequalification is the precondition for receiving an invitation. Abu Dhabi's Government Procurement Gate lets an Abu Dhabi DED licensee self-register, while a company licensed anywhere else "must complete the mandatory form titled 'Request from Entity' and submit it to the government entity you wish to engage with", which means a buyer has to sponsor you in. Aramco and Elm both run invitation-gated portals on SAP Ariba and NEOM runs one on GEP. In every one of those cases the first conversation you need is not about your product; it is about getting a vendor identifier. Whether a partner should hold that identifier instead of you is the question we worked through in finding and structuring a GCC reseller or channel partner, and there is one new fact to add on the Saudi side. Article 90 of the new law widens the list of people who are not treated as prohibited intermediaries. The 2019 article covered only "Distributors or agents authorized by original producers", in the official English. The new article adds two limbs: "the franchise holder and those in their position", and "those licensed under the law to carry on intermediation business" (our translation). The second limb is about regulated brokers, not about anyone holding a software licence.

Use the published pipelines that nobody reads. Bahrain's Tender Board serves a 2027 forward plan of roughly 760 tenders, by entity and subject, with no login, and its monthly award reports give you the winner and the value to three decimal places. Kuwait's statute requires binding published annual plans with ninety days' notice, and KPC's own portal serves a live loginless tender list. Neither is a secret and neither needs a local presence to read. If you are assessing whether a smaller Gulf market has real demand for what you sell, those two files will tell you more in an afternoon than a market study will in a month, and they will tell you which named entities are buying it. Oman, by contrast, requires its entities to file a plan covering information technology with the Tender Board's General Secretariat every December and to show it to nobody, which is worth knowing before you pay for Omani market research.

One timing point to close on, because it affects anything you are pricing now for delivery next year. The new Saudi procurement law takes effect on 2 January 2027 and delegates to Implementing Regulations both its entire payment chain and the circumstances in which the standstill period can be dispensed with. Article 99 gives the Ministry, in coordination with the Authority, 120 days from publication to prepare those Regulations, issued by ministerial decision and taking effect with the law. Those 120 days do not expire until 2 January 2027 itself, so nothing is late. But as at 31 October 2026, under two months after the law was gazetted and nine weeks before it bites, nothing has been published, and the Ministry is still amending the 2019 Regulations instead. Anyone quoting a Saudi public-sector deal today for delivery in 2027 cannot read the payment terms or the standstill rules that will govern it. Build that into the price or into the schedule, and re-read the Regulations the week they appear.

If you are weighing up a government-linked opportunity in the Gulf and want a second opinion on which side of the line the buyer sits, get in touch.

Sources

This article is general information about published laws and regulations and is not legal, tax or licensing advice. Instruments, thresholds and figures are stated as at 31 October 2026 and several of them are known to be changing: the Saudi Government Tenders and Procurement Law is replaced on 2 January 2027 and its Implementing Regulations had not been published when this was written, Bahrain's official English consolidation is out of date against its own 2026 amendment, and Kuwait's Public Tenders Law is reported to have been amended with effect from late December 2026. Where an instrument has no official English we have quoted our own translation and said so, and the Arabic governs. Take advice on your own facts before relying on any of it.