Rules for Regulating Free and Open Source Government Software

Show Law Preamble

  • The Council of Ministers

  • Having reviewed the submission received from the Royal Court under No. 1346 dated 1442/1/8 AH, including the letter of King Abdulaziz City for Science and Technology No. 101 dated 1442/1/5 AH, concerning the draft Rules Governing Free and Open-Source Government Software.

  • Having reviewed the aforementioned draft Rules.

  • Having reviewed the Council of Ministers’ Decisions No. (362) dated 1437/9/1 AH and No. (418) dated 1442/7/25 AH.

  • Having reviewed Memoranda No. (631) dated 1442/4/17 AH, No. (1024) dated 1442/6/25 AH, and No. (1879) dated 1442/10/28 AH, prepared by the Bureau of Experts at the Council of Ministers.

  • Having reviewed the recommendation prepared by the Council of Economic and Development Affairs No. (29-42/27/D) dated 1442/7/6 AH.

  • Having reviewed the recommendation of the General Committee of the Council of Ministers No. (7883) dated 1442/11/11 AH.

  • Hereby decides as follows:

    • First: Approval of the Rules Governing Free and Open-Source Government Software, in the attached form.
    • Second: All government entities shall, within (90) days of the launch of the Government License, amend the ownership policy applicable to systems whose source code is intended to be published, with the exception of security and military entities, which shall be subject to their respective special provisions as stipulated in their laws, statutes, or internal regulations.
    • Third: The Digital Government Authority shall establish a repository for government software into which government entities shall deposit the source code of their software. This shall take place within (90) days of the issuance of the Rules referred to in Clause (First) of this Decision.
    • Fourth: A national committee shall be formed, chaired by the Digital Government Authority and comprising the Ministry of Communications and Information Technology, King Abdulaziz City for Science and Technology, the Public Investment Fund, the National Cybersecurity Authority, the Saudi Data and AI Authority, and the Communications and Information Technology Commission, to monitor the implementation of the Rules referred to in Clause (First) of this Decision, enhance development opportunities, manage the repository referred to in Clause (Third) of this Decision, and identify the key impediments and proposed solutions for overcoming them. The Authority may seek the assistance of whomever it deems appropriate, and this committee shall submit an annual report to the Council of Ministers.

  • Prime Minister

A- Definitions

  • The following words and phrases, wherever they appear in these Rules, shall have the meanings set forth opposite each of them:

    • 1- Rules: Rules Governing Government Free and Open Source Software.
    • 2- Authority: Digital Government Authority.
    • 3- Source Code: The commands and instructions written in one of the programming languages comprising any computer program.
    • 4- Free and Open Source Software Community: Users and developers of free and open source software.
    • **5- Free and Open Source Software: **Software that may be freely used, copied, modified, and shared.
    • 6- Government License: A license whose terms of issuance are specified in a document issued by the Authority, applicable to government-owned software.
    • **7- Publication: **Making state-owned source code available to the public in accordance with the terms of the Government License.
    • 8- Repository: An electronic platform for depositing government software.
    • 9- Government Software: Any source code written for the benefit of a government entity and owned by the State.

B- Purpose of the Rules

  • 1- Enhance opportunities for the reuse of government software, while allowing access to and publication of the source code, thereby opening avenues for cooperation among Government Agencies, unifying the standards between them, increasing transparency, ending vendor lock-in, and reducing the difficulties of integrating software from more than one source.
  • 2- Guide Government Agencies regarding the considerations to be taken into account when purchasing or developing software customized for them.
  • 3- Establish a unified policy for government requirements for receiving and reusing government software, thereby enabling all affiliated Government Agencies to benefit from its use, including the requirements for its delivery and making it widely available across the government.
  • 4- Establish the infrastructure requirements necessary for the deployment of government software in a manner that safeguards the rights of the Government Agency.

C- Scope of Application of the Rules

  • The Rules shall apply to the following:

    • 1- All government entities, except security and military entities that are subject to special provisions in accordance with the provisions established in their laws, statutes, or internal regulations.
    • 2- All source code that the Government or companies owned by it have contracted to develop through a local or international supplier.
    • 3- All source code written by government entities or any of the companies owned by them.

D- Considerations for Purchasing Government Software

  • Each Government Agency, when it needs to purchase software, shall follow the following steps:

    • 1- First Step: Evaluate and study the government software available in the repository for use, in coordination with the Authority.
    • 2- Second Step: If the evaluation and study indicate that no software meeting the need is available, the Government Agency may search for off-the-shelf software, giving preference to free and open-source software, in coordination with the Authority.
    • 3- Third Step: If nothing meets the need, the Government Agency may develop its own software.

H- Special Provisions for Contracting on the Construction of Government Software

  • When a government agency contracts with a vendor to develop software, it shall comply with the following:

    • 1- The vendor shall deliver the source code and the documents relating thereto to the government agency.
    • 2- The vendor shall secure unlimited rights to the source code and its related materials, permitting reuse, copying, modification, and distribution among government agencies without the need for the original vendor, while providing an open source version for the public benefit of the source code to all government agencies.
    • 3- The vendor shall hold high-level quality certifications in the required field of work.
    • 4- Priority in contracting shall be given to national vendors that meet the requirements and technical conditions of the government agency.
    • 5- Government agencies shall be required, when carrying out additional development of commercial software for procurement, to stipulate upon contracting that ownership of, or the right to use, such development shall vest in the Government.

W- Considerations for the Publication of Government Software

  • 1- If government entities wish to participate with the free and open-source software community in developing government software, they shall assess cybersecurity risks—in accordance with the requirements issued by the National Cybersecurity Authority—in coordination with the Authority prior to publication.

  • 2- If there is no cybersecurity breach, the government entity may publish the source code in accordance with its priorities and in coordination with the Authority.

  • 3- When any government entity publishes source code and makes it available to the free and open-source software community, it shall prepare its relevant departments to interact with the information community by:

    • A- Receiving proposals for amendments and additions to such source code.
    • B- Encouraging government employees to contribute to the development of government software.
    • C- Presenting the challenges and problems relating to the systems used by government entities to the free and open-source software community.

Z - Special Prohibitions on the Publication of Government Software

  • First: Do not publish the source code of government software in the following cases:

    • 1- If the publication contravenes the provisions of an applicable law, intellectual property rights, or an international treaty to which the Kingdom is a party.
    • 2- If the publication would threaten National Security, disclose the State’s confidential information, or violate the personal privacy of individuals.
    • 3- If the publication would threaten the cybersecurity of the Government Agency.

  • Second: If a cybersecurity threat is found to exist after publication, the Government Agency shall coordinate with the Authority to suspend publication until such threat is addressed.

H - Considerations for the Implementation of Rules

  • 1- The Authority shall be responsible for providing guidance and support to facilitate the implementation of the Regulations and monitoring the compliance of government entities with their implementation, and shall oversee the implementation of annual national awareness campaigns to raise awareness of the advantages of free and open-source software and the Regulations governing it.
  • 2- Each government entity shall maintain a dedicated inventory of software, and such software shall be in a format ready for deposit.
  • 3- The Authority shall develop a government software repository into which government entities shall deposit the source code of their software and for which it shall provide the necessary protection by applying the requirements of the Cybersecurity Controls for Sensitive Systems issued by the National Cybersecurity Authority, in accordance with relevant best practices, while enabling the free and open-source software community to contribute to development.
  • 4- The Authority shall determine the mechanism necessary to encourage government entities to publish the source code of their software and shall submit any matters requiring the completion of statutory procedures in this regard.
  • 5- The Authority shall launch the Government Software License Document.
  • 6- The directors of information technology departments and procurement departments in all relevant government entities shall observe the Regulations and align their requirements with the internal bylaws.
  • 7- The Authority shall, in coordination with the Ministry of Finance and other relevant entities, prepare contract templates specifically for the procurement of software, in accordance with the principles stipulated in the Regulations.
  • 8- The Authority shall include the transition to free and open-source software within the National Measurement of Electronic Transactions.
  • 9- The Authority shall encourage state-owned companies to contribute to the software repository in order to enhance their commercial opportunities.