The IoT Regulations

​

Article (1): Introduction

The Communications and Information Technology Commission (CITC) has responsibility, in accordance with the Telecommunications Act, Telecom Act Bylaw, CITC Ordinance and paragraph (Seventh) of the Council of Ministers Decree No. (292) dated 27/4/1441AH, for regulating the telecommunications and IT sector in the Kingdom. This includes regulating key elements of IoT technology, IoT connectivity providers and IoT devices. CITC's areas of responsibility, as it relates to IoT, includes the provisioning of services on telecommunication networks, the use of licensed and unlicensed spectrum, international roaming, radio and telecommunications equipment.

The Kingdom of Saudi Arabia (Kingdom or KSA) is aiming to become a leading country in the application and development of IoT technologies and services. It is crucial that this growth occurs in a safe and orderly manner, consistent with accepted international standards, and encourages innovation by local and global businesses operating in the Kingdom.

The IoT regulations (the regulation) sets out regulations specific to IoT technology, IoT connectivity, IoT devices and IoT connectivity service providers in the Kingdom. This document outlines the requirements specific to IoT that must be followed. The Regulation's role is to elaborate the specific details of the IoT regulatory environment in the KSA in a clear and transparent manner.

Article (2): DefinitionsThe words and expressions defined in the CITC regulations shall have the same meaning when used in this regulations Document. For the purposes of this regulations Document, the following words and expressions shall have the meanings assigned to them below:

CITC Website: (www.citc.gov.sa).

Internet of Things (IoT):  A network of devices that are autonomously able to sense, monitor, or interact with the surrounding environment, in addition to collect and exchange data. IoT consists of three main components, IoT Device, IoT Connectivity and IoT Platform.

IoT Device: A physical object connected to a network via IoT connectivity, has the ability to transmit data, can be identified across that network, and can communicate to other physical objects or IoT platforms.

IoT Connectivity:  A communication network that enables the IoT devices to connect and transmit data between each other or to the internet.

IoT Connectivity Provider: Any Entity that provides an IoT connectivity commercially.

IoT User: Any Entity that uses an IoT solution.

IP (Internet Protocol) Address: The unique address that identifies a device on the internet or a local network.

Low Power Wide Area Networks (LPWAN): Low power wireless wide area network technologies that interconnect devices with low bit rates.

License-Exempt Frequency: Use of radio spectrum without the user being required to possess a frequency license issued by CITC.

On premise: Areas located within private premises, which include personal houses, private compounds, and universities.

Out of Premise: Areas located in public premises, which include streets, public areas and parks.

​​

Article (3): IoT Devices

3.1  All IoT devices must comply with the Technical Specifications published on CITC website.

3.2 The IoT devices must be approved by CITC and obtain Certificate of Conformity before applying for Customs Clearance permission. The Equipment Approval and Customs Clearance requirements and procedures are detailed in the "Regulations for Importation and Licensing of Telecommunications and Information Technology Equipment" document published on CITC website.

3.3 The IoT devices shall have the capability to allow the credentials to be modified and the ability to reset the IoT devices back to the default factory settings.

3.4 The features of a device and its functionality should be indicated on the device's user manual. This information must include the relevant features of the device and its functionality when connectivity is limited, interrupted or unavailable.

3.5 CITC encourages the use of IPv6 as it provides many technical benefits in addition to the larger addressing capacity.

3.6 CITC encourages IoT users to ensure the interoperability between IoT devices and IoT connectivity, in addition to ensure the interoperability between IoT devices and IoT platform.

​

Article (4): IoT Connectivity Service Provisioning

IoT connectivity can be provided using wireless networks, and they can be classified into:

·   IoT connectivity using licensed frequency bands

·   IoT connectivity using license-exempt frequency bands

The main requirements for IoT connectivity service provisioning are as follow:

4.1 IoT Connectivity, using licensed frequency bands (e.g. mobile, satellite), must be provided only by a CITC connectivity licensee. The conditions and commitments for the licenses are available in CITC website.

4.2 The IoT connectivity using license-exempt frequency bands can be classified into Wide Area Networks (WAN) and Local Area Networks (LAN). The IoT connectivity using license-exempt frequency WAN, including LPWAN and any license-exempt frequency network that has similar WAN characteristics, must be provided by “Facilities-Based Unified Telecommunications Services" licensee, or “Providing IoT services using license-exempt frequencies" licensee.

4.3  The license-exempt frequency WAN, including LPWAN or any network that has similar WAN characteristics, can be built and used on premise for non-commercial purposes without the condition of having “Providing IoT services using license- exempt frequencies" license, with the following conditions:

4.3.1 Compliance with the data security, privacy and protection requirements in KSA.

4.3.2   Compliance with the 'Specification for Low Power Wide Area Networks (LPWAN) Equipment operating in License-Exempt Frequency Bands' (RI114), available on CITC website.

4.3.3   IoT devices must be imported by the owners of those premises or by a licensed connectivity provider indicated in (4.2).

4.3.4   The network must be implemented by the owners of those premises or by a licensed connectivity provider indicated in (4.2).

4.4    License-exempt frequency bands can be used only as a secondary use, thus, the networks operating in these bands must not cause any interference to the current or future primary users. The users of these networks must not ask any protection from interference caused by the current or future primary users.

4.5    The users of the license-exempt frequency bands must stop using these bands upon CITC request within the timeframe specified by CITC.

4.6    The users of the license-exempt frequency bands must comply with any updates of the 'National Frequency Plan' and the related technical specifications, available on the CITC website.

4.7  The WLAN IoT connectivity are subject to the WLAN Regulations, available on the CITC website.

4.8   All IoT mobile-based connectivity must use numbers from the machine-to-machine (M2M) numbering range as per the 'National Numbering Plan' published on CITC website.

4.9   IoT connectivity providers must ensure that IoT users are aware of the following:

4.9.1  The importance of the network security and provide recommendations on data protection.

4.9.2    The effective use, characteristics, quality of service of the IoT connectivity.

4.9.3    The risk of interference from other users of shared bands, with possible detrimental effect on quality of service.

​

Article (5): General Provisions

5.1  CITC reserve the right to request a report or regular reporting from any loT connectivity provider. Such reports could include any information and data related to the services that have been provided or are currently being provided. CITC will define the reporting requirements with the service provider, including the data required and the timeframe in which to provide these reports.

5.2  CITC encourages all IoT solution providers and IoT connectivity providers to ensure that all their offerings are published publicly.

5.3    CITC encourages all IoT solution providers to register in “Manassa Tech" available on CITC website.

5.4   All IoT connectivity providers and IoT solutions providers must adhere to all laws, regulations and requirements issued by CITC or other authorities in the Kingdom, including data management, security, privacy and protection.

​