Access control technologies decide who can open which door and when. Every system combines a credential (card, personal identification number (PIN), phone or biometric), a reader, a controller and an electrified lock, chosen per door for security level, traffic and environment. On escape routes, the lock arrangement must also follow the egress rules of the adopted building code, so that occupants can always exit, including in a fire or power failure.
Key takeaways
- Encrypted 13.56 MHz smart cards such as MIFARE DESFire EV3 (AES-128) offer stronger protection than legacy 125 kHz proximity cards.
- Fingerprint and face recognition remove lost or shared cards, but biometric data that identifies a person is sensitive data under the Saudi Personal Data Protection Law.
- The Open Supervised Device Protocol (OSDP), published as IEC 60839-11-5:2020, supports encrypted and supervised reader connections.
- The International Building Code (IBC) allows electrically locked egress doors only under specific arrangements: sensor-release doors unlock on fire alarm or sprinkler activation and on power loss; door hardware release (any electric lock, including electromagnetic) unlocks through door-mounted hardware and on power loss.
In this article
- How an access control system works
- Access control credentials compared
- Readers, controllers and communication
- Locks and life safety on escape routes
- Integration with fire alarm, CCTV and building systems
- Step-by-step: specifying an access control system
- Common mistakes, maintenance and what drives cost
- How AZEIDK helps
- FAQ
How an access control system works
The reader passes the credential to a controller, which checks access rights, schedule and door status, releases the lock and logs the event, while server software manages users and reports. Good practice is to choose controllers with a local database, so doors keep working if the network or server fails.
Each door usually has a door contact and a request-to-exit device. The same platform often runs time attendance, visitors, turnstiles and vehicle barriers, and links to closed-circuit television (CCTV) and the fire alarm. See our guide to surveillance and access control systems.
Access control credentials compared
| Credential | Strengths | Limitations | Typical use |
|---|---|---|---|
| PIN | No card to issue; low cost | Codes get shared or observed; best as a second factor | Low-risk rooms, two-factor entry |
| 125 kHz proximity card | Low cost, widely installed | Lacks the cryptographic protection of modern smart cards | Existing sites with a migration plan |
| 13.56 MHz encrypted smart card | MIFARE DESFire EV3, for example, supports AES-128 and is Common Criteria EAL5+ certified (NXP) | Needs card and key management | Offices, hospitals, campuses |
| Mobile credential | No plastic card; access issued and revoked remotely | Depends on the phone, app and reader support | Offices, residential towers |
| Fingerprint | Tied to the person; cannot be lent | Affected by dirty, wet or worn fingers; hygiene concerns | Server rooms, time attendance |
| Face recognition | Contactless and fast at busy entrances | Affected by lighting and sun glare; privacy obligations | Lobbies, turnstiles, attendance |
| Vehicle tags and plate recognition | Hands-free entry at gates | Affected by plate condition and camera position | Parking facilities, compound gates |
Biometrics and personal data in Saudi Arabia
The Personal Data Protection Law (PDPL) lists biometric data that identifies a person among sensitive data, alongside health and genetic data. Good practice: before enrolling fingerprints or faces, define the purpose, inform users, restrict access to the enrollment database and set retention. Store templates encrypted on the device and offer a card alternative where biometrics are not essential.
Readers, controllers and communication
Many readers still use the legacy Wiegand interface. OSDP, overseen by the Security Industry Association (SIA), was approved by the IEC in May 2020 and published as IEC 60839-11-5:2020. It supports two-way communication over two wires instead of twelve or more, its Secure Channel supports AES-128 encryption, and supervision flags a disconnected or faulty reader, so it is the stronger choice for new projects.
Place controllers on the secure side and match features to the risk: anti-passback so a card cannot be handed back, interlocked doors for sensitive rooms, and card plus PIN or face for server and control rooms.
Locks and life safety on escape routes
The lock is where security meets life safety: a fail-safe lock unlocks when power is removed, a fail-secure lock stays locked, and the choice should match the door’s role in evacuation.
| Lock type | On loss of power | Typical use | Watch for |
|---|---|---|---|
| Electromagnetic lock (maglock) | Always releases | Glass and aluminum doors; escape doors under code arrangements | Needs a release arrangement the code and Civil Defense accept |
| Electric strike | Fail-safe and fail-secure versions | Offices and internal doors | With fail-secure strikes, keep free mechanical egress from inside |
| Electrified mortise lock | Either, by configuration | Main entrances and high-security doors | Confirm the inside lever always opens the door |
| Delayed egress device | Releases at once; the IBC (Section 1010.2.13) requires the delay to switch off on power loss | Selected locations only | Only under code conditions and with approval |
The IBC, on which the Saudi General Building Code (SBC 201) is based, limits electrically locked egress doors to specific arrangements. The Minnesota State Fire Marshal summarizes the sensor-release arrangement in its 2020 code (Section 1010.1.9.9; 1010.2.12 in the 2021 IBC):
- Locking units listed to UL 294, Access Control System Units; not permitted in Group H (hazardous) occupancies.
- A sensor on the egress side unlocks the door as a person approaches, and loss of power to the sensor or the lock unlocks it.
- A manual release marked PUSH TO EXIT, within 1.5 m (5 ft) of the door and 1.0 to 1.2 m (40 to 48 in) above the floor, cuts lock power directly and keeps the door unlocked for at least 30 seconds.
- Activation of the fire alarm or sprinkler system, where provided, unlocks the door until the system is reset.
For electrically locked egress doors, including electromagnetic locks, the door hardware release arrangement (2021 IBC Section 1010.2.11) requires hardware on the door leaf that releases the lock with one hand, and loss of power must unlock the door. NFPA 101 has similar provisions. The Saudi Building Code and Civil Defense set the edition that applies and what is accepted. On fire-rated doors, use locks and strikes tested with the door assembly, as our fire-rated doors guide explains.
Integration with fire alarm, CCTV and building systems
Door release on fire alarm is defined in the cause and effect matrix and driven from the fire alarm panel through control modules or relays. Good practice is a supervised, hardwired release that removes lock power directly, independent of access control software or the network. Our fire alarm control panel guide explains how these outputs are specified.
Linking access events to CCTV shows video of every forced door or denied entry (see our IP vs analog CCTV guide); elevators and the building management system are other common links. Secure the network with a separate virtual LAN (VLAN), no default passwords and encrypted readers. Escape doors also need adequate emergency and exit lighting.
Step-by-step: specifying an access control system
- List every controlled door and classify it by security level, traffic and whether it is on an escape route.
- Agree the release arrangement for each escape door with the consultant before choosing locks.
- Choose credentials per door, with encrypted cards as the baseline and two-factor entry for high-risk rooms.
- Specify OSDP readers with Secure Channel enabled, and controllers that work if the network fails.
- Define fire alarm release and the interfaces with CCTV and elevators.
- Check data protection obligations for biometrics and set retention for logs and templates.
- Size power supplies and batteries, and confirm each lock’s behavior on power loss.
- Test every door at commissioning: card, exit button, alarm release and power failure, and record the results.
Common mistakes, maintenance and what drives cost
Common site mistakes
- Magnetic locks on escape doors without an approved release arrangement.
- Software-only fire alarm release, with no hardwired path.
- Unencrypted proximity cards on sensitive doors.
- Readers or controllers mounted on the unsecured side.
- Unsupervised door contacts, so doors propped open go unnoticed.
Inspection and maintenance
Minnesota requires monthly tests of the sensor and manual release and annual tests of the fire alarm, sprinkler and loss-of-power release functions. Whatever the local interval, test every escape door on alarm and power loss, check batteries, review logs and remove departing users’ credentials promptly. Include these checks in your annual maintenance contract.
What drives cost
- Number of doors and the share needing two-factor entry or interlocks.
- Credential type: proximity, encrypted smart card, mobile or biometric.
- Lock hardware and door type, especially glass and fire-rated doors.
- Turnstiles and vehicle barriers.
- Software licenses, integration with fire alarm, CCTV and elevators, cabling and commissioning.
How AZEIDK helps
AZEIDK’s low current systems and security and surveillance systems solutions cover access control, time attendance, audio and video intercom, turnstile gates, and parking barriers and vehicle access, from site assessment and selection to supply, installation and testing. Our programming and systems integration team reviews the cause and effect matrix and interface requirements and verifies fire alarm panel connections with other systems within the defined integration scope, and our fire-rated doors and emergency exit solutions cover emergency exit doors and exit hardware.
The AZEIDK products page lists ZKTeco face recognition terminals, access controllers, tripod and full-height turnstiles and time attendance devices; Hikvision card access controllers, face access terminals and barrier gates; Dahua access controllers, card readers, turnstiles and swing barriers; and BFT automatic parking barriers. See also our news on access control and security gates.
FAQ
What is the most secure access control credential?
No single credential suits every door. For most doors, encrypted 13.56 MHz smart cards or mobile credentials balance security and convenience. For server and control rooms, combine two factors, such as card plus PIN or card plus face. Avoid relying on legacy 125 kHz proximity cards in sensitive areas.
Do biometric access systems raise data protection issues in Saudi Arabia?
Yes. The Personal Data Protection Law treats biometric data that identifies a person as sensitive data. Define why you collect it, inform users, limit who can access templates and logs, and set retention periods. Where biometrics are not essential, offer a card alternative, and take legal advice on large deployments.
What is the difference between fail-safe and fail-secure locks?
A fail-safe lock unlocks when power is lost; a fail-secure lock stays locked. Fail-safe locks, such as magnetic locks, suit doors that need to release for evacuation; fail-secure locks suit perimeter and high-security doors, provided free mechanical egress from inside is kept where the door is an exit.
Can a magnetic lock be used on an emergency exit door?
Only under an arrangement the code allows. The IBC treats two arrangements separately. Sensor release uses an egress-side sensor, a PUSH TO EXIT button that cuts lock power, and unlocking on fire alarm or sprinkler activation and on power loss. Door hardware release (electromagnetic or other electric locks) uses door-mounted hardware that releases the lock with one hand, and the door unlocks on power loss. Agree the arrangement with the consultant and Civil Defense first.
How should access control be linked to the fire alarm?
Through the cause and effect matrix: the fire alarm panel releases escape route locks, ideally through a hardwired interface that removes lock power directly, and the doors stay unlocked until the system is reset. Test release on alarm and on power loss at commissioning and in maintenance.
Planning access control for your facility? Share your door schedule and drawings, and our team will help you match credentials, locks and egress arrangements to each door. Contact the AZEIDK team
