Jeddah, 21–22 October 2026: Six Legal Questions After the Maritime Congress

Complex law. Clear action.

Reviewed by Oleksandr Sobovyi, Founder & CEO of CORVUS AI — editorial responsibility statement below.

What European and Ukrainian companies should assess before entering Saudi Arabia’s maritime market.

I attended the Saudi Maritime & Logistics Congress at Jeddah Superdome as a visitor, without an exhibition stand or a speaking slot.

It was a deliberate choice. I wanted to observe, listen and ask questions without being tied to a presentation.

One question was particularly important to me:

What happens when a European or Ukrainian company enters Saudi Arabia’s maritime logistics market — after the presentations end and contract negotiations begin?

The scale of investment and ambition is impressive. But commercial opportunities come with legal obligations that are not always visible during initial discussions.

Here are six legal questions I would raise with a client before signing a significant contract.

1. Contract Law: Freedom of Choice Has Limits

European companies often prefer English law and international arbitration. However, a contractual choice-of-law clause does not necessarily mean that every aspect of a transaction will be governed exclusively by the chosen law.

Saudi Arabia’s Civil Transactions Law entered into force on 17 December 2023, introducing a comprehensive codified framework for civil and contractual obligations.

Foreign businesses must therefore consider not only their agreed contractual terms but also any applicable mandatory provisions of Saudi law.

This is particularly important for transactions involving public authorities, port infrastructure, concessions and regulated activities.

Saudi Arabia is a party to the 1958 New York Convention and has its own Arbitration Law and established arbitration institutions, including the Saudi Center for Commercial Arbitration (SCCA).

Nevertheless, an arbitration clause is only one element of contractual protection.

Companies should assess jurisdiction, governing law, the seat of arbitration, interim measures, potential grounds for refusing recognition and the practical enforcement of awards.

Legal takeaway: A contract should be structured not only around how disputes will be resolved, but also around where the counterparty’s assets are located and how a decision can actually be enforced.

2. Regional Headquarters and Local Content: Different Contracts Require Different Structures

Saudi Arabia increasingly uses public procurement and investment policy to encourage international companies to establish a local presence.

Since 1 January 2024, restrictions have applied to certain government contracts involving foreign companies without a regional headquarters in the Kingdom.

These restrictions are not absolute. The framework includes exceptions and specific conditions.

Local content requirements, including those administered by the Local Content and Government Procurement Authority (LCGPA), and workforce localisation rules under programmes such as Nitaqat may also apply.

For a medium-sized European business, the central question is not whether a regional headquarters is always necessary.

It is which legal and operational structure is appropriate for the particular activity, customer and procurement procedure.

Possible arrangements include cross-border service provision, a locally incorporated entity, a branch, a joint venture or a contractual relationship with a local distributor.

Each option has different implications for taxation, licensing, liability, procurement eligibility and intellectual property protection.

Legal takeaway: Choose the market-entry structure after assessing the actual regulatory and procurement requirements, rather than establishing a local entity before there is a clear commercial need.

3. Data and Cybersecurity: GDPR Compliance Is Not Enough

Modern maritime logistics involves much more than ships and containers.

It relies on digital ports, cargo tracking, crew information, automated terminals, predictive analytics and infrastructure management platforms.

European technology providers may therefore face overlapping regulatory obligations.

Saudi Arabia’s Personal Data Protection Law (PDPL), fully applicable following the end of its transition period in September 2024, establishes its own requirements for processing personal data and transferring it internationally.

For example, transferring personal data from Jeddah to a server in Frankfurt is not automatically prohibited.

However, the transfer requires an assessment of the applicable legal grounds, safeguards, restrictions and any sector-specific requirements.

Cybersecurity is another important consideration.

Saudi Arabia’s National Cybersecurity Authority (NCA) has established regulatory frameworks, including the Essential Cybersecurity Controls (ECC).

Whether particular requirements apply depends on the organisation, the infrastructure involved, contractual commitments and sector-specific rules.

European companies already working under GDPR and NIS2 may have a useful organisational foundation, including established risk management, incident response and access control processes.

But European compliance does not automatically establish compliance with Saudi requirements.

Legal takeaway: Before deploying a digital logistics platform, conduct a Saudi–EU regulatory gap assessment covering data flows, cloud infrastructure, supplier contracts and applicable cybersecurity obligations.

4. Sanctions and Export Controls: Legal Risk Begins Before Delivery

This is one of the most sensitive issues for European and Ukrainian companies operating in international maritime logistics.

EU sanctions obligations do not disappear when a European business enters a third-country market.

Council Regulation (EU) No 833/2014 establishes extensive restrictions relating to Russia, including measures affecting maritime transport, designated vessels, oil-related transactions, technology and services.

Legal distinctions matter.

There is no general EU prohibition on providing services to every vessel commercially described as part of the “shadow fleet”.

The applicable restrictions depend on the particular vessel, transaction, service, cargo and legal provision.

Article 3s, for example, imposes restrictions concerning certain vessels listed under the sanctions framework.

Other relevant measures include the Russian oil price-cap mechanism, Article 8a on best efforts concerning certain entities outside the EU, and Article 12g, which requires contractual restrictions on re-export to Russia for specified goods and technology in defined circumstances.

Council Regulation (EU) No 833/2014 — EUR-Lex

European suppliers should therefore assess not only their immediate Saudi counterparties, but also beneficial ownership, end users, vessels, routes, intended applications and potential onward transfers.

Export controls create a second layer of risk.

Regulation (EU) 2021/821 governs controls on exports, brokering, technical assistance, transit and transfers of certain dual-use items and technologies.

Maritime unmanned systems, surveillance equipment, navigation technologies, communications equipment and autonomous control systems may fall within export control requirements, depending on their technical specifications, classification and intended use.

Not every autonomous maritime system is automatically a dual-use item.

Military equipment is subject to separate national export control regimes.

For Ukrainian developers, Ukrainian legislation governing the international transfer of military and dual-use goods and technologies must also be considered.

Importantly, controls may apply not only to the physical delivery of equipment but also to certain transfers of technology, software and technical assistance.

Legal takeaway: Product classification, sanctions screening and end-use verification should take place before committing to supply, demonstrating controlled technology or transferring technical documentation.

5. Autonomous Ships: International Rules Are Taking Shape

On 22 May 2026, the International Maritime Organization (IMO) adopted the International Code of Safety for Maritime Autonomous Surface Ships (MASS Code), through Resolution MSC.595(111).

The Code initially operates as a non-mandatory instrument, applicable from 1 July 2026.

IMO's roadmap envisages the adoption of a mandatory MASS Code by July 2030, with an anticipated entry into force on 1 January 2032.

IMO — Maritime Autonomous Surface Ships

For developers of autonomous maritime technologies, this is an important development.

Regulatory attention is shifting towards operational safety, remote control, human oversight, cybersecurity and the allocation of responsibility.

Of particular significance is IMO's approach that the master retains overall responsibility for the vessel, even when not physically on board.

This does not eliminate questions concerning the responsibilities of remote operation centres, software developers, system integrators, operators and insurers.

European manufacturers must also consider the EU AI Act — Regulation (EU) 2024/1689.

However, its application cannot be determined simply by establishing that a product uses artificial intelligence.

The assessment must consider the system's intended purpose, its safety function, territorial scope, applicable exclusions and the specific obligations imposed on relevant operators.

Systems developed and used exclusively for military, defence or national security purposes require particular attention to the exclusions provided under the AI Act.

Legal takeaway: Developers should begin building safety evidence, contractual responsibility frameworks, human oversight mechanisms and regulatory documentation before autonomous maritime solutions reach commercial deployment.

6. Anti-Corruption Compliance: An Intermediary Can Become the Most Expensive Part of a Transaction

Large infrastructure and public procurement projects often involve local agents, commercial intermediaries and consultants.

Using an intermediary is not unlawful in itself.

The risk arises when services are poorly defined, fees cannot be commercially justified or the arrangement involves improper influence over a public decision-maker.

Saudi Arabia has its own anti-corruption framework, including its Anti-Bribery Law.

Dutch companies must also consider relevant provisions of the Netherlands Criminal Code and the applicable rules on criminal jurisdiction.

Where a sufficient UK connection exists, the UK Bribery Act 2010 may create additional exposure, including corporate liability for failure to prevent bribery by associated persons.

The applicability of these regimes depends on the circumstances and cannot be inferred solely from the use of a foreign intermediary.

Before signing an agency agreement, companies should verify beneficial ownership, reputation, the services to be provided, the commercial justification for remuneration, payment arrangements and contractual audit and termination rights.

Legal takeaway: Anti-corruption due diligence is not an administrative exercise after selecting a partner. It should inform the decision whether to enter into the relationship at all.

What I Took Away from Jeddah

The Saudi Maritime & Logistics Congress demonstrated the scale of interest in maritime infrastructure, digital logistics and technological development across the region.

For me, the most important conclusion was a legal one.

Market entry does not end when a contract is signed. A company must be able to perform that contract lawfully, protect its rights and enforce its counterparty's obligations.

This is particularly relevant for European and Ukrainian businesses developing autonomous systems, maritime security technologies, digital infrastructure and dual-use solutions.

Ukrainian developers have gained practical expertise in maritime unmanned systems and security technologies. These capabilities may create opportunities for international industrial cooperation.

But turning technological capability into an international contract requires more than engineering readiness.

It requires proper product classification, a lawful technology transfer structure, end-user verification, intellectual property protection, sanctions compliance and a defensible allocation of contractual responsibility.

Where Should Companies Start?

For a European or Ukrainian company considering Saudi Arabia or another Gulf market, I would recommend an initial legal assessment covering four areas:

1. Market entry: What corporate structure, licences and procurement qualifications are required?

2. Export controls: Are the products, software or technologies subject to export restrictions?

3. Data and cybersecurity: How can data processing, international transfers and cybersecurity obligations be managed lawfully?

4. Sanctions and third-party due diligence: Who is the ultimate end user, which restrictions apply and what risks exist within the supply chain?

These questions should be addressed before significant expenditure on local establishment, tender preparation or technology transfer.

CORVUS AI advises on European and cross-border legal and regulatory matters, including sanctions, export controls, AI governance, contractual risk and regulatory compliance, coordinating with local legal counsel where required.

Disclaimer

This article has been prepared by CORVUS AI for general informational and educational purposes only. It is intended to make complex legal and regulatory developments easier to understand.

It does not constitute legal advice and does not create a professional adviser–client relationship. The information should not be relied upon as a substitute for advice based on the specific facts, circumstances and applicable law relevant to your organisation or project.

The article reflects our understanding of the law and regulatory framework as of the date of publication. Legislation, case law, regulatory guidance and administrative practice may subsequently change. While reasonable care has been taken in preparing this article, CORVUS AI does not warrant that the information is complete or remains current after the date of publication. We do not undertake to update this content.

To the fullest extent permitted by applicable law, CORVUS AI excludes liability for loss arising from reliance on this article. Nothing in this article constitutes an offer or solicitation to provide regulated legal services in any jurisdiction where doing so would be unlawful.

AI-assisted preparation: This article was prepared with the assistance of AI tools. Its legal analysis, conclusions and final text were subject to human review and editorial control and were reviewed and approved prior to publication by Oleksandr Sobovyi, Founder & CEO of CORVUS AI. CORVUS AI retains editorial responsibility for the published content.

For advice tailored to your organisation, project or specific circumstances, please contact CORVUS AI.

Complex law. Clear action.