BandWatch

1. One-liner

Tracks every Saudi employee’s Qiwa contract status and warns before a silent Nitaqat downgrade blocks your visas.

2. Trend signal — why now?

Three things changed in Saudi Arabia between November 2025 and May 2026, and together they turned a slow-moving quota program into a tripwire.

One: the rule that voids your headcount. From 15 April 2026, a Saudi employee no longer counts toward a company’s Saudization percentage unless their employment contract has been electronically documented and authenticated on the Qiwa platform. GOSI registration remains necessary but is no longer sufficient. Read that twice. You hired the Saudi national. You pay them. You registered them with GOSI. And they contribute nothing to your Nitaqat ratio because a contract sat unauthenticated in a portal nobody on your team logs into.

Two: the safety net was removed. MHRSD launched a new three-year Nitaqat cycle beginning 16 April 2026 and eliminated the Yellow tier. Yellow used to be the warning shelf — the uncomfortable-but-survivable band where you got a chance to fix things. It’s gone. You are now Green or you are Red, and Red is not a warning, it’s a shutdown.

Three: enforcement went real-time. A company’s classification is recalculated continuously by MHRSD based on live data from Qiwa, GOSI, and Mudad. There is no annual review to prepare for. The band moves when the data moves. ZATCA tax compliance is now linked in too — serious tax violations can trigger a Nitaqat downgrade as a joint enforcement measure.

What Red costs you, effective immediately with no grace period: new expatriate visa issuance blocked, Iqama renewals blocked for existing expat staff, profession changes and sponsorship transfers blocked, Etimad government-contract bidding suspended, the General Manager’s own Iqama extension blocked — and your expatriate employees become free to transfer sponsorship to a competitor without your consent. That last one is the killer. Your best people can legally walk, and the good ones will.

Meanwhile the quotas themselves are ratcheting: accounting at 40% and rising ten points annually to 70% by October 2028, procurement 70%, sales 60%, marketing 60% with a SAR 5,500 minimum salary, engineering 30% with a SAR 8,000 minimum, administrative support at 100% localization. Profession-level rules now cover 269 roles. A company can be comfortably compliant at the company-wide level and still be bleeding credit inside a single profession it never thought to check.

The market this lands on is not small. Saudi active commercial registrations exceeded 1.9 million in Q2 2026, representing roughly 1.3 million actual enterprises, and the SME sector employs about 6.5 million people.

Provenance:

• Signal 1 (Demand): From 15 April 2026 a Saudi employee stops counting toward Saudization unless their contract is authenticated on Qiwa; GOSI registration is no longer sufficient. Companies near band thresholds get downgraded by a handful of undocumented contracts. — https://www.middleeastbriefing.com/news/saudi-arabias-nitaqat-2026-update-latest-quotas-by-sector-and-what-foreign-employers-need-to-comply-now/ — observed 2026-08-14
• Signal 2 (Feasibility): Qiwa, GOSI, Mudad and ZATCA expose REST APIs with digital-certificate authentication; HR platforms already auto-submit contracts and track Saudization ratios through them, cutting processing from days to minutes. — https://origami.sa/en/blog/saudi-government-platform-integration-qiwa-gosi-mudad-zatca/ — observed 2026-08-14
• Signal 3 (Economic): Existing Nitaqat tools are free manual-entry calculators. SaudizationMeter — the most sophisticated — has no Qiwa integration and no individual contract-authentication tracking; it recalculates sector thresholds only twice monthly and requires users to type in headcounts. Money is being spent on the category but nobody sells the live gap. — https://www.saudizationmeter.com/en/features — observed 2026-08-14 Category: Regulatory arbitrage

3. The opportunity

Every Nitaqat tool on the market answers the wrong question.

Search “Nitaqat calculator” and you get a wall of them — Bayzat, Jisr, Inclusive Solutions, Kiework, Token Talent, SaudizationMeter. They are all free lead magnets for HR software, and they all work the same way: you type in how many Saudis and how many expats you have, and they tell you what band that math produces.

That was a fine product in 2024. In 2026 it is dangerously wrong, because the number you type in is not the number the Ministry uses. The Ministry counts authenticated Saudi employees. You count employed Saudi employees. The gap between those two numbers is invisible to you, invisible to your calculator, and it is exactly the thing that pushes you into Red.

I checked the most serious tool in the category directly. SaudizationMeter has the official MHRSD logarithmic formula, 2,807 ISIC4 sub-sectors, a what-if scenario engine, auto-solve hiring recommendations, band-drop alerts. Genuinely good work. And it does not connect to Qiwa, GOSI, or Mudad at all — manual data entry, CSV import, threshold sync twice a month. It explicitly does not track individual contract authentication status. So its band-drop alert fires on numbers you gave it, not on reality. It will tell you you’re Green while MHRSD has you Red.

The incumbents that do integrate — the full Saudi HRMS suites — sell you a payroll and HR system. That’s a rip-and-replace decision, a procurement cycle, and a per-employee-per-month bill for modules you didn’t want. Watily bundles Nitaqat into a suite alongside WhatsApp Business API and ZATCA e-invoicing. Nobody sells the single sharp thing: watch my authentication gap and my profession-level quotas continuously, and scream at me before the band moves.

The wedge is that this is a monitoring problem disguised as a calculation problem. Calculation is a solved commodity — the formula is public. What nobody sells is the continuous reconciliation between three government systems and your actual payroll, surfaced as a countdown rather than a snapshot. That’s the 10× difference: not better math, but knowing on the day a contract lapses instead of on the day your GM can’t renew his Iqama.

4. Target market

• Primary customer: HR Manager, Finance Director, or owner-operator at a Saudi private-sector SME with 20–300 employees and a meaningful expatriate workforce — construction and real-estate contractors, engineering firms, clinics and polyclinics, accounting and professional-services practices, logistics and facilities-management companies. Riyadh, Jeddah, Dammam/Khobar first. These are companies with enough headcount that manual tracking breaks, but not enough to employ a dedicated government-relations (GR) team.

• Why they buy: Because Red is an operational death sentence delivered without warning. The compliance problem becomes a commercial problem fast: you can’t renew work permits, you gradually lose your expatriate workforce, operations suffer, revenue falls. They are not buying a compliance nicety. They are buying insurance against losing their staff and their government contracts. The second reason is subtler and equally sharp — profession-level tracking across 269 roles means a company-wide Green can hide a profession-level violation, and no owner has that in their head.

• Rough TAM reasoning: ~1.3 million actual enterprises in Saudi Arabia. Most are micro and out of scope. The addressable slice is establishments large enough to have mixed Saudi/expat workforces near a band threshold — call it the 20–300 employee segment across quota-heavy sectors. Real estate and construction alone surpassed 370,000 SME establishments, 23% of Saudi SMEs, with worker counts up 52%. If even 60,000–100,000 establishments nationally are threshold-sensitive with real expat dependency, and I need ~700 of them to hit $1M ARR, the funnel math is not the constraint.

• Why now for them: Yellow is gone, so there is no soft landing. The Qiwa authentication rule landed 15 April 2026 and most companies have not audited their back-catalog of contracts against it. The new three-year cycle started 16 April 2026 with higher quotas, and accounting quotas step up again every year through October 2028. Every one of those is a date on which a currently-compliant company silently isn’t.

5. Product sketch (MVP)

• Authentication gap ledger — every Saudi employee on the payroll, with a live status: contract authenticated on Qiwa (counts), or not (doesn’t count). The headline number is “you think you have 41 Saudis; the Ministry counts 34.”
• Live band position with distance-to-Red — current Nitaqat band, computed on Ministry-recognised headcount, plus the exact number of authenticated Saudi employees standing between you and a downgrade.
• Profession-level quota breakdown — per-profession compliance across the covered roles (accounting, sales, marketing, engineering, procurement, admin support), including the salary-threshold rules that void credit for underpaid employees (SAR 5,500 marketing, SAR 8,000 engineering) and the salary-tier credit multipliers.
• Countdown alerts — Arabic and English push/WhatsApp/email warnings on the events that move your band: a contract expiring without renewal, a Saudi employee resigning, an authentication lapse, a quota step-up date, a new hire not yet documented.
• Departure simulator — “if these two Saudi employees resign next month, what band am I in?” and the inverse, “how many hires at what salary get me back to Mid Green at minimum cost?”
• Remediation worklist — a ranked queue of the specific unauthenticated contracts to fix first, ordered by how much band credit each one unlocks.
• Audit trail export — a dated PDF/Excel record of band position over time, for the GR file and for the board.

6. AI angle — what’s load-bearing

Honest answer: AI is the extraction and interpretation layer, not the core. The core is the integration and the monitoring loop, and I’d rather say that plainly than dress this up as an AI product it isn’t.

Where AI genuinely earns its place:

Document reconciliation. Saudi SMEs hold employment contracts as Arabic PDFs, scans, and photos across shared drives and WhatsApp threads. Matching a scanned bilingual contract to a payroll record to a Qiwa authentication status — across Arabic and English name transliterations, where “Mohammed Al-Otaibi” and “Muhammad Alotaibi” are the same person — is exactly the fuzzy-matching problem that got cheap and reliable in the last 18 months and was miserable before. That reconciliation is the product’s hardest real work.

Profession classification. Quota rules attach to profession codes across 269 covered roles, and the profession on the Iqama frequently does not match the job the person actually does or the title payroll uses. Classifying free-text Arabic job titles into the Ministry’s profession taxonomy — and flagging where the recorded profession diverges from the actual role in a way that creates exposure — is a language task, not a rules task.

Regulatory change tracking. Quotas, thresholds and salary minimums move on published schedules and on unpublished ministerial circulars, in Arabic. Monitoring MHRSD and Qiwa publications and translating a change into “this affects 6 of your employees, here’s the new number” is genuine ongoing AI work and doubles as the content engine for distribution.

If you removed the AI you’d still have a product — a worse, more manual one with a services layer doing the matching. That’s a fair criticism and it’s why defensibility scores a 6 and not a 9. The moat here is the integration plus the regulatory maintenance, not the model.

7. Localization angle

This is a localization play end to end — it does not exist outside Saudi Arabia.

• Language: Arabic-first, with English for the large expatriate-managed segment. Bilingual output is mandatory; the GR officer works in Arabic and the CFO may not.
• Payment rails: Mada cards and SADAD for B2B, local SAR pricing. A USD Stripe checkout signals “foreign vendor” and slows procurement.
• Government integration: The entire product is Qiwa, GOSI, Mudad and ZATCA integration. Digital certificates, and the establishment-level access model where a company grants a delegate access, are the actual build.
• Regulatory: The product is the regulation. Nitaqat has no analog elsewhere — the closest cousins are Emiratisation in the UAE and Omanisation, which is the natural expansion path once the Saudi engine works.
• Distribution: LinkedIn is unusually strong among Saudi HR professionals, and the Monsha’at SME support ecosystem plus regional chambers of commerce are real, reachable channels.

The flip side: a foreign solo founder cannot do this alone. Saudi entity, local partner, and Arabic-native support are prerequisites, not nice-to-haves. That’s the domain-expertise-required tag and it’s load-bearing.

8. Business model — path to $1M–$5M ARR

• Pricing: SAR 450/month ($120) for 20–50 employees; SAR 900/month ($240) for 51–150; SAR 1,800/month (~$480) for 151–300. Annual prepay standard in this market, which helps cash flow enormously. Multi-establishment groups (very common — one owner, several CRs) pay per establishment with a group discount.
• ACV: SAR 10,800 ($2,900) blended, assuming the mix skews to the mid tier and most customers prepay annually.
• Rough math to $1M ARR: ~345 customers at $2,900 ACV. In a market of 1.3M enterprises with 370K+ in construction and real estate alone, that is a rounding error of the addressable base. Realistically reachable in 18–24 months with a two-person sales motion.
• Rough math to $5M ARR: ~1,700 customers, which needs either channel leverage through PEOs, GR consultancies and accounting firms reselling, or an expansion into UAE Emiratisation to widen the base. I’d expect a genuine partner channel to be doing half the volume by then.
• Expansion path: Per-establishment expansion within groups is the cleanest lever. Then adjacent monitoring on the same integrations — WPS wage-protection compliance, GOSI reconciliation, Iqama and work-permit expiry tracking, ZATCA linkage — each of which rides the connections already built. A managed-remediation tier (we fix the authentication backlog for you) is a natural high-margin services attach for the panicked Red-band customer.

9. Go-to-market wedge — first 100 customers

• Free “Authentication Gap Audit” as the wedge. One-time connect, and we tell you: here is your real Ministry-recognised Saudi headcount versus your payroll headcount, and here is your true distance to Red. This is a genuinely scary number that no existing free calculator can produce, because producing it requires the integration. The audit is the product demo and the qualification step simultaneously — anyone whose gap is non-zero is a hot lead that day.
• Target the sectors on a quota ratchet, in order. Accounting practices first: their quota went to 40% in October 2025 and steps up ten points every year to 70% by October 2028, so they have a scheduled annual panic. Saudi accounting and audit firms are a listable, finite population through SOCPA and chamber directories. Same play for engineering consultancies (30% + SAR 8,000 threshold) and marketing agencies (60% + SAR 5,500).
• Sell through GR consultancies and PEOs, not around them. Every Saudi SME above ~50 staff already pays someone — a GR officer, a PEO, an HR consultancy — to handle Qiwa and Iqama paperwork. These firms manage dozens of client establishments and are drowning in exactly this. Give them a multi-client console and revenue share. Twenty consultancies with fifteen clients each is the whole first 300.
• LinkedIn in Arabic, aimed at the specific rupture. Saudi HR professionals are unusually active on LinkedIn. Publish one hard, specific post: “Your Saudi employees stopped counting on 15 April. Here’s how to check.” Not thought leadership — a checkable claim with a free audit attached. Pair with the regulatory-change tracking from section 6 as an Arabic-language Nitaqat changes newsletter, which compounds and is cheap because the AI is already doing the monitoring for the product.
• Chambers of commerce and Monsha’at ecosystem. Riyadh, Jeddah and Eastern Province chambers run SME programming constantly and are hungry for compliance content. A workshop titled “Nitaqat 2026: what changed and why your band is wrong” fills a room, and the room is pre-qualified.

10. Build complexity — justification

Medium. The compliance math itself is public and straightforward — MHRSD publishes the formula and the thresholds, and free calculators already implement it, so that part is a well-specified afternoon rather than a research problem. The real work is threefold: government platform integration under digital-certificate authentication across Qiwa, GOSI and Mudad, each with its own access model and no forgiving sandbox; the Arabic/English entity-reconciliation layer that matches payroll records to contracts to authentication statuses; and the ongoing regulatory maintenance to keep 2,807 sub-sector thresholds and 269 profession rules current.

Call it 12–16 weeks to a credible v1 for a pair, assuming government API access is granted without a multi-month wait — and that assumption is the single largest schedule risk in the plan. A manual-upload fallback (customer exports their Qiwa roster, we reconcile it) de-risks the launch and should be built first regardless, because it lets you sell and learn while integration access is pending.

11. Gating checklist

Gate	Pass?	Note
Legal in target market	✅	Compliance monitoring tool; requires proper data handling under Saudi PDPL and customer-granted platform delegation. No regulatory approval needed to launch.
Ethical — no harm / dark patterns	✅	Helps employers comply with localization law and helps Saudi nationals get properly documented contracts. Fear-based marketing must stay factual — the risk is real, so state it accurately and don’t inflate it.
Market exists (evidence above)	✅	Dozens of competing free calculators prove category demand; the paid gap is the live integration nobody offers.
1–5 person team can build this	✅	Pair of engineers plus an Arabic-native domain/sales lead.
Launchable with <$50K / ₹40L	✅	Main costs are Saudi entity setup, local partner, and integration compliance overhead. Comfortably under $50K.

All five pass.

12. Feasibility score

Axis	Weight	Score	Notes
Problem intensity	20	17/20	Red band blocks visas, freezes Iqama renewals, suspends Etimad bidding, and lets expat staff leave without consent — immediately, no grace period. Yellow tier removed means no soft landing. Not 19–20 only because many companies sit comfortably Green and feel nothing until they don’t.
Demand evidence	15	11/15	Strong indirect evidence: a crowded field of free Nitaqat calculators, HRMS vendors all marketing Qiwa/GOSI compliance, dated regulatory changes with real teeth. Docked for the thing I could not find — verbatim SME operator complaints. Saudi SME owners don’t post their compliance problems on Reddit, which means demand is inferred from vendor behaviour and regulation rather than heard directly. That gap is the main reason confidence is Medium, not High.
Build feasibility	15	11/15	Formula is public and integrations are documented, but government API access under digital certificates is real work with real gatekeeping, and the Arabic reconciliation layer is fiddly. 12–16 weeks for a pair.
Distribution clarity	15	12/15	Named, listable channels: SOCPA accounting firms, engineering consultancies, GR/PEO resellers, chambers, Arabic LinkedIn. The free Authentication Gap Audit is a genuinely differentiated hook. Docked because Saudi SME sales is relationship-led and slower than a self-serve motion.
Revenue mechanics	15	12/15	SAR 450–1,800/mo is well inside Saudi SMB software norms, annual prepay is the market default, and 345 customers to $1M is very achievable against the base. Docked because the $5M case leans on a partner channel that is assumed, not proven.
Time to first revenue	10	7/10	The manual-upload fallback means you can sell before integration access lands, and the audit hook converts fast. But Saudi B2B procurement plus entity setup realistically puts first paid customer at 8–12 weeks post-launch, not four.
Defensibility	10	6/10	Soft moat: government integrations are a genuine barrier, and the regulatory-maintenance burden across 2,807 sub-sectors and 269 professions compounds and punishes casual entrants. But an established Saudi HRMS could ship this as a feature, and several have the integrations already. Speed and focus, not structural protection.
Total	100	76/100

13. Qualitative modifiers

Founder-fit tags

domain-expertise-required · sales-heavy · technical-heavy

This one is unusually fit-sensitive. Without a Saudi-based, Arabic-native partner who can navigate government platform access and sell into HR departments, a foreign technical founder will stall out at the integration-access stage and never recover the time.

Key assumptions to validate (5)

1. Assumption: A meaningful share of Saudi SMEs have a non-zero authentication gap — Saudi employees on payroll whose contracts aren’t authenticated on Qiwa. How to test: Run the manual audit free for 20 companies via a GR consultancy partner. If the median gap is zero, the entire wedge collapses and this becomes just another calculator. This is the single most important test and it is cheap.
2. Assumption: Third parties can get programmatic or delegated access to Qiwa/GOSI data on a customer’s behalf at SME scale. How to test: Apply for developer access directly and talk to two Saudi HRMS vendors who already integrate. Get a written answer on timeline and eligibility before writing integration code.
3. Assumption: SMEs will pay SAR 450–1,800/mo for monitoring when calculators are free. How to test: Price test with 30 qualified prospects post-audit. Watch whether the fear converts to a card, specifically among companies whose audit showed a real gap.
4. Assumption: GR consultancies and PEOs will resell rather than build it themselves. How to test: Pitch the multi-client console to 10 consultancies; measure how many want revenue share versus how many say they’d rather have their own.
5. Assumption: Profession-level tracking across 269 roles is a felt pain, not just a theoretical one. How to test: In the 20 free audits, count how many companies are company-wide compliant but violating at profession level. If it’s rare, cut the feature and simplify.

Risk flags

1. Platform dependency (severe): The product is entirely dependent on Qiwa/GOSI/Mudad access. If the Ministry restricts third-party integration, or ships a first-party dashboard that surfaces the authentication gap natively, the product loses its reason to exist overnight. Governments building free versions of your product is a live risk when the government owns the data.
2. Regulatory whiplash: Nitaqat rules have changed repeatedly — the Yellow tier existed and then didn’t. Quotas ratchet on published schedules but circulars land without warning. Maintenance is permanent operating cost, and it’s also the moat, so this cuts both ways.
3. Incumbent absorption: Bayzat, Jisr and the Saudi HRMS suites already hold the integrations and the customer relationship. If the gap becomes widely understood, they ship it as a feature inside a product the customer already pays for. The counter is speed and being the sharp single-purpose tool, but it’s a real 12-month threat.
4. Market access: Requires a Saudi entity and local partnership. A solo foreign builder cannot execute this. Adds cost, time, and dependency on finding the right partner.
5. Demand evidence is inferred, not heard: I could not source direct SME operator complaints. The pain is structurally obvious and the regulation is documented, but I’m reasoning from regulation and vendor behaviour rather than from customers saying it out loud. Twenty conversations resolve this in a week and should happen before any code.

14. Structured verdict

Score:                  76/100
Verdict:                GO
Confidence:             Medium
Best-fit builder:       Technical pair with a Saudi-based Arabic-native domain partner;
                        prior Saudi HR/GR or govtech integration experience is a large edge
Time to revenue:        8–12 weeks post-launch (manual-audit fallback sells before integration lands)
Capital to launch:      $25–40K (Saudi entity setup, local partner, integration compliance)
Top 3 assumptions to validate first:
  1. Non-zero authentication gap is common — 20 free manual audits via a GR partner
  2. Third-party Qiwa/GOSI access is obtainable — apply directly, confirm timeline in writing
  3. SMEs pay for monitoring when calculation is free — price test 30 post-audit prospects
Kill criteria:
  - Abandon if median authentication gap across 20 audited companies is zero or near-zero
  - Abandon if Qiwa/GOSI third-party access is denied or gated beyond 6 months with no
    workable delegated-access fallback
  - Abandon if MHRSD ships a first-party authentication-gap alert inside Qiwa
  - Abandon if <5 of 30 qualified prospects convert to paid after seeing their own gap number

15. Next step — 1-week validation sprint

• Day 1–2: Lock the regulatory ground truth. Pull the MHRSD Developed Nitaqat documentation and the April/May 2026 circulars directly rather than through secondary coverage. Confirm precisely what authentication status is required, how MHRSD treats an unauthenticated contract in the calculation, and whether any transition relief applies. Simultaneously file for Qiwa developer/integration access to start that clock on day one — it is the longest pole.
• Day 3–4: Recruit one GR consultancy or PEO with 15+ client establishments. Offer a free manual authentication-gap audit across their book: they export the Qiwa roster and the payroll roster, we reconcile by hand. Target 20 establishments. This requires no product at all and produces the only number that matters.
• Day 5: Decide on the measured gap. Go if ≥40% of audited establishments show at least one Saudi employee on payroll whose contract is not authenticated on Qiwa, and ≥3 of them are within two authenticated employees of a band downgrade. That combination means the gap is both common and consequential, which is the whole thesis. Below that, the fear isn’t real, the free calculators are good enough, and this is a PASS — walk away having spent one week and no code.