How to Manage Changing Tariff Regulations Without a Compliance Team
Importers into Saudi Arabia face constant ZATCA, SABER, SASO, and SFDA changes but rarely staff a compliance department. Here is the five-step workflow that replaces the headcount.
On this page
TL;DR
- Regulatory change is now constant, not occasional. Thomson Reuters processed more than 155 million tariff updates in 2025 and expects 2026 to be higher.
- The gap is not awareness, it is capacity: in the 2026 Thomson Reuters Global Trade Report, 72% of trade professionals called tariff volatility their top challenge, but only 7% use software built to manage it.
- A mid-market importer into Saudi Arabia will never staff a trade-compliance department, and does not need to. The job is mechanical: watch the right sources, catch a change the day it lands, and stop a wrong document before it ships.
- This is a five-step workflow, not a headcount. Aradus runs it as a compliance watcher on top of your existing systems.
- Map your highest-risk lane with us: book a working session.
The problem is not one big rule, it is a hundred small changes
Ask an importer into Saudi Arabia what changed in their compliance requirements last quarter and you will get a pause, because the honest answer is: they are not sure. The rules move constantly and quietly. Thomson Reuters, one of the largest trade-content providers in the world, reported that its team processed more than 155 million tariff updates in 2025, and expects 2026 to be higher (source).
Saudi Arabia is a clear case. ZATCA runs a 12-digit integrated tariff and updates it on its own clock, with delta schedules to reconcile. SABER, the Kingdom's conformity platform, keeps changing which HS codes are regulated and what the MIM product-conformity declaration and certificates require. SASO issues technical regulations with their own approval, publish, and mandatory-enforcement dates. The SFDA issues food and cosmetics decisions on a separate cadence, and above all of it the GSO keeps updating the Gulf standards layer that Saudi Arabia inherits. Any one of these can hold a container if you miss it.
None of this is exotic. It is the normal weather of importing into the Kingdom. The problem is that a $10M to $50M importer does not have a person whose job is to watch it.
And your ERP will not do it for you. A regulator publishing a circular is a signal on a website, not a record in a database, and a system of record was never built to go out and get it. That is not a gap in your ERP implementation, it is a gap in the category.
Why the enterprise answer does not fit the mid-market
There is software for this. SAP GTS, e2open, MIC Customs, and Thomson Reuters ONESOURCE are all real, capable global trade management platforms. They are also built for companies that have a trade-compliance function to run them: analysts who configure the rules, interpret the feeds, and own the workflow full time.
A mid-market importer in the Gulf usually does not have that function. Compliance is something the owner, the logistics lead, or the customs broker handles between other jobs, mostly by reacting when a container gets held. Buying an enterprise trade platform to fix that is like hiring a compliance department you then have to staff. The tool assumes the team you are trying to avoid needing.
The real job is smaller and more mechanical than the enterprise framing suggests. Here is how to do it without building a department.
Step 1: Define your compliance surface
You cannot watch everything, and you do not need to. Your actual exposure is the intersection of three things:
- What you move (the goods). Your HS chapters. A cosmetics importer and a steel fabricator do not share a single rule that matters.
- Where you move it (the lanes). Every origin country you buy from and every destination you sell into. A shipment into Saudi Arabia is not one jurisdiction, it is a stack: the Gulf standards layer (GSO), plus the Kingdom's own rules (ZATCA, SASO, SABER, SFDA), plus any city-level requirement on top.
- What kind of rule can touch it (the domains). In practice, regulatory change for a physical import falls into a short list: customs and tariff, conformity and standards, food safety, ingredients and contaminants, labeling, origin-side requirements, packaging and environmental, sector registration, and trade-finance or logistics mandates.
Write this down once. Your HS chapters, your origin and destination countries, and the two or three domains that actually apply to your products. That list is your compliance surface, and it is far smaller than "all trade regulation." Everything after this step is scoped to it.
Step 2: Watch the right sources, layered by lane
Once you know your surface, the sources become specific and finite. For a Gulf importer, they layer region, then country, then local:
- Regional (the shared Gulf layer): the GSO standards and technical-regulation feeds, and Gulf technical regulations filed to the WTO, which often surface a draft rule around 60 days before it is adopted. Saudi Arabia inherits this layer.
- Country (Saudi Arabia): ZATCA for the tariff and duty lines, SABER and SASO for conformity (which HS codes are regulated, what the MIM declaration and certificates require), and the SFDA for food and cosmetics decisions. The Saudi Press Agency often carries the earliest signal that one of these is about to change.
- Local: any city-level or authority-specific requirement that applies on top, checked where it is relevant to your goods.
A change usually shows up in one of five channels: an official portal, an HTML notices page, a PDF circular, an email newsletter, or a government social feed. The point is not to read all of them every day. It is to know which handful map to your surface, and to check them on a schedule instead of when a container is already stuck.
Step 3: Map the change to the SKUs it affects, and flag it with the reason
Watching is only useful if a change gets connected to your goods. A new SASO conformity requirement or a shift in a ZATCA tariff line does not matter to you in the abstract. It matters if it hits one of your HS chapters on a lane you actually run.
This is the step that quietly eats time when it is manual, and it is the step Aradus automates. The compliance watcher monitors the sources tied to your surface, and when something changes, it maps the change to the specific SKUs, orders, or shipments it affects and flags it with the reason, not just a link to a circular. You see "this affects these three active shipments, because of this rule," instead of a feed you have to interpret yourself.
That sentence only works because the shipments are already attached to the orders they belong to. A rule change against a list of HS codes is a newsletter. A rule change against three named containers in transit is a decision.
Step 4: Validate the documents against the current rule before the shipment moves
Most customs holds and demurrage charges do not come from not knowing a rule. They come from a document that does not match the rule: a missing conformity certificate, an origin declaration that is now insufficient, a label that no longer meets the current standard.
So the fourth step is to check the shipment's documents against the current requirement before it ships, not after it is held. Aradus's document validation cross-checks the paperwork for a shipment against what its lane and goods require, and catches the gap while there is still time to fix it. Clearance-ready before the container leaves, instead of a scramble at the port.
That is the whole 1-10-100 economics of a document error: the same mismatch costs a fraction to catch at the desk than it does once it has triggered a hold.
Catching the gap is only half of it. Closing it usually means getting a document out of somebody else: an original certificate that has not arrived, or a reissue from whoever got a field wrong. That chase is its own job, and we wrote about it in the calls nobody makes.
Step 5: Route only the judgment calls to a person
The reason this works without a compliance team is the exception boundary. The repetitive part, watching sources, matching changes to SKUs, checking documents against rules, is done in full by the system. What reaches a person is only the small set of things that genuinely need a decision: an ambiguous classification, a rule that could be read two ways, a change big enough to reprice a lane.
That is the difference between automation an operator trusts and automation that creates a second mess. The owner or logistics lead still decides the hard calls. They just stop spending their mornings hunting for the changes in the first place.
What this does not do
Aradus is not a customs broker and does not file your declarations. It is not your system of record, and it does not replace SAP, your ERP, or your broker relationship. It watches the sources that apply to you, flags changes to the goods they affect, and validates documents against the current rule, on top of the systems you already run. Turn it off and nothing breaks, you go back to watching by hand.
What good compliance automation needs first
Three things make this work, and they are worth having in place regardless of tooling:
- A written list of your HS chapters and your active lanes. This is your surface, and everything scopes to it.
- A named exception owner. Someone has to be the person the flagged judgment calls route to.
- Consistent document intake. If shipment documents arrive in ten different ways, validation is harder. One consistent path makes it reliable.
The takeaway
You do not need a compliance department to keep up with GCC tariff and conformity change. You need to define your surface, watch the handful of sources that map to it, connect each change to the goods it affects, and check your documents before they ship. That is a workflow, and it is one Aradus runs for mid-market importers as a compliance watcher on top of their existing systems.
In the wider automation sequence, compliance comes last but never never: it is the lowest-frequency flow with the highest cost per miss, and it is worth knowing where it sits in the full back-office sequence before you start. If tariff and conformity changes are catching you at the port instead of before, that is the workflow to fix first. Book a working session and we will map your highest-risk lane with you.
Sources
- Thomson Reuters, "What today's tariff authorities actually demand": https://tax.thomsonreuters.com/blog/what-todays-tariff-authorities-actually-demand-the-data-visibility-and-compliance-gaps-most-manufacturers-havent-closed/
- Aradus, "Your ERP Did Not Fail. It Was Never Going to Do This.": https://www.aradus.ai/blog/why-erp-doesnt-eliminate-manual-work