CAFM software for facility management in Saudi Arabia

ZATCA has introduced e-invoicing in two phases. Phase 1 (Generation) has applied since 4 December 2021. Phase 2 (Integration) began on 1 January 2023 and is rolling out in waves: the invoicing solution connects to ZATCA's FATOORA platform through an API, and each tax invoice (the kind usually issued between businesses) must be cleared by ZATCA before it is shared with the buyer. Simplified invoices are reported within 24 hours.

The 25th wave, announced on 24 July 2026, covers taxpayers whose VAT-subject revenue exceeded SAR 187,500 in any year from 2022 to 2025, and they must integrate by 1 February 2027. Few FM companies or subcontractors of any size will fall below that line.

A CAFM system does not usually issue the tax invoice; the finance system does. What the CAFM holds is everything the invoice depends on: the contract, the rate card, the completed work orders, approved quotations and the SLA deductions. If that data is wrong or late, a cleared invoice is only a faster way to bill the wrong amount. Ask any vendor to show how it reaches your invoicing solution.

The National Cybersecurity Authority's Essential Cybersecurity Controls apply to government entities, their companies and affiliates, and private organisations that own, operate or host critical national infrastructure. The 2018 edition required covered organisations using cloud services to host and store their information inside the Kingdom. The 2024 revision moved data localisation to the National Data Management Office, and sector rules can still require it, so the question has not gone away.

Separately, the Personal Data Protection Law, overseen by SDAIA, has been fully enforceable since 14 September 2024 and has its own rules on transferring personal data outside the Kingdom. A CAFM system holds more personal data than people expect: resident and tenant names, phone numbers, unit numbers, technician locations and site photographs.

If you serve a ministry, a government-owned developer or a giga-project, expect the hosting question first. Reflexion is offered as SaaS, as a single-tenant private cloud, or on-premise on your own infrastructure, which keeps the data on servers you choose.

The Law on Implementation of the Saudi Building Code (Royal Decree M/43, 2017) applies the code to the design, construction, operation, maintenance and modification of buildings, and lists the General Directorate of Civil Defense among the agencies that monitor it. The fire code within it, SBC 801, covers fire protection systems such as sprinklers, standpipes and fire alarms.

For an FM team the practical consequence is evidence. When Civil Defense, an insurer or the owner's consultant asks for a year of fire pump tests, the answer should be a report filtered by building and asset, showing who did each test, when, where, and with which photographs. Statutory checks belong in the PPM schedule with the rest of the maintenance, not in a separate file.

Arabic is the language of government correspondence and, on many sites, of the supervisors and technicians closing work orders. Site teams are usually mixed, so the useful test is whether a technician can use the mobile app in the language they work in, not whether the desktop has an Arabic menu.

Owners and authorities may also want reports in Arabic and English side by side, and some government documents and contracts are dated in the Hijri calendar. Check how the system handles both before you build your reporting around it. Lattice runs implementation and support from Dubai with Arabic-language capability.