Medical device regulatory readiness in the GCC: Saudi Arabia and UAE

Saudi Arabia: The Saudi Food and Drug Authority (SFDA) regulates devices under the Law of Medical Devices and Supplies (Royal Decree No. M/54 of 1442H/2021) and its Implementing Regulations (SFDA Board decisions issued 2022; subsequent circulars through 2025). Core requirements are set out in SFDA MDS-REQ 1 Essential Principles of Safety and Performance, Saudi Vigilance guidance (e.g., MDS-G5 series), and market authorization procedures via GHAD (the SFDA e-portal) and the Medical Devices National Registry (MDNR). Foreign manufacturers must appoint a Saudi Authorized Representative (AR). Marketing requires MDMA for the device (or family) and Importer Registration (IR) for each importer. UAE: The Ministry of Health and Prevention (MOHAP) regulates devices nationally under Federal Law No. 8 of 2019 on Medical Products, the Profession of Pharmacy and Pharmaceutical Establishments and its Implementing Regulations (latest substantial amendments 2022–2024), with device registration and listing in the National Device Registry (NDR). A UAE-based Authorized Local Agent/Representative is required; importers need a MOHAP Medical Store license. Emirate authorities—Dubai Health Authority (DHA) and Department of Health Abu Dhabi (DOH/HAAD)—impose additional controls (facility licensing, tender formularies, traceability for selected implantables), but MOHAP registration is the national baseline. GCC: The Gulf Standardization Organization (GSO) continues work toward greater convergence; as of 2026, no unified Gulf registration replaces national SFDA or MOHAP approvals.

Both SFDA and MOHAP align to GHTF/IMDRF risk classes. Saudi Arabia: General medical devices are Class A, B, C, D per GHTF rules; IVDs follow Classes A–D. Borderline and software classification follow EU/GHTF principles; for SaMD, intended use and impact on diagnosis/therapy elevate risk. SFDA issues classification determinations via GHAD when needed. UAE: MOHAP applies GHTF-based rules (A–D for devices and IVDs). MOHAP may reference EU MDR/IVDR rules for detailed determinations. For accessories and kits, classification is driven by the highest-risk constituent. For implantables and life-support devices, expect Class C/D (devices) or C/D (IVDs) and enhanced dossier expectations. Implications: Higher classes trigger deeper technical review, stricter clinical evidence expectations, and shorter post-market reporting timelines.

Saudi Arabia (SFDA): - Establishment: Create GHAD accounts; register the manufacturer and the Saudi Authorized Representative (AR) in MDNR. Importers obtain Importer Registration (IR). - Evidence: SFDA recognizes approvals from Founding Regulatory Authorities (FDA, EU [CE under MDR/legacy MDD where valid], Health Canada, TGA, MHLW/PMDA). Recognition shortens review but does not waive MDMA. - Submission: Apply for Medical Device Marketing Authorization (MDMA) per device family via GHAD. Provide STED/IMDRF Technical Documentation (device description, Essential Principles checklist to MDS-REQ 1, risk management per ISO 14971, clinical evidence, labelling/UDI data, manufacturing/QMS evidence [ISO 13485 or MDSAP], AR mandate, importer details). SFDA may request supplementary review or site inspection. - Timelines: Typical clock for FRA-backed Class B/C is ~30–60 working days; Class D or non-FRA may run 60–120+ working days depending on queries. UAE (MOHAP): - Establishment: Appoint a UAE Authorized Local Agent; ensure importer holds MOHAP Medical Store license. - Classification: Request classification if uncertain. - Submission: File NDR registration with technical file (GHTF-aligned), evidence of approval in FRA jurisdictions (if available), QMS (ISO 13485), labelling and Arabic materials, and free-sale/legalization as required. - Timelines: Typical 45–90 working days; expedited when robust FRA approvals exist. DHA/DOH may require device listing in procurement systems post-MOHAP approval.

Both SFDA and MOHAP expect a certified ISO 13485 QMS (or equivalent evidence). SFDA accepts ISO 13485 certificates from accredited bodies and will leverage MDSAP or FRA audits as supportive evidence; it does not replace MDMA. Importers/distributors must maintain procedures for storage, distribution, traceability, and vigilance. For software devices, lifecycle controls per IEC 62304 and cybersecurity per IMDRF principles are expected in the technical file. Change control must ensure registered labelling and intended use remain consistent; significant changes typically require prior approval/update. Internal audits and management reviews are routinely requested during technical review or inspections.

Saudi Arabia: SFDA operates a UDI system aligned to IMDRF with issuing agencies (e.g., GS1, HIBCC, ICCBBA). Device Identifier (DI) and production identifiers must appear on labels for most classes; UDI master data must be uploaded via MDNR/GHAD per SFDA circular timelines (phased by class; as of 2026, Classes B–D are fully enforced; Class A largely in scope with specific exceptions). Labels/IFUs must be Arabic or bilingual; eIFU is acceptable for professional-use devices if an Arabic summary and access instructions are provided. The Saudi Authorized Representative and importer details must be on labelling or accompanying documentation. Animal-derived materials (e.g., gelatin, tallow) require declarations of source and halal compliance or risk justification per SFDA guidance. UAE: MOHAP requires labelling compliant with GHTF/EU-style content; Arabic is mandatory for patient-facing information and outer packaging for consumer-use devices, with English commonly accepted for professional-use labelling when an Arabic IFU/insert or summary is available. NDR captures DI/master data; UDI is being phased in prioritizing high-risk and implantable devices, aligned to IMDRF and GS1. DHA/DOH may impose additional traceability (e.g., GTIN capture in hospital systems).

Saudi Arabia: Manufacturers, ARs, and importers must operate PMS proportional to risk, including complaint handling, trend analysis, and FSCA execution. Serious incidents must be reported to Saudi Vigilance within tight timelines (e.g., immediately for serious public health threats; typically within 10 calendar days for serious incidents; within 30 days for non-serious malfunctions leading to FSCA), with Field Safety Notices in Arabic and distribution tracking. Periodic reporting and post-market clinical follow-up (PMCF) may be requested for high-risk devices. UAE: MOHAP’s medical device vigilance program requires prompt reporting of serious incidents (commonly within 10 days from awareness) and submission of FSCAs/recalls; notifications to emirate authorities (DHA/DOH) may also be required where devices are placed or used. The Authorized Local Agent coordinates case intake, investigation, and communication. MOHAP may request PSUR-style summaries or PMCF updates for certain high-risk/innovative devices. Recordkeeping: Maintain complaint files, investigation reports, CAPA, distribution traceability, and communication logs for inspection.

Days 0–30: - Gap assessment vs SFDA MDS-REQ 1 and MOHAP dossier expectations; confirm device family strategy and FRA evidence (FDA/CE/HC/TGA/PMDA). - Appoint/contract Saudi AR and UAE Authorized Local Agent; verify importer licensing (KSA IR; UAE Medical Store). - Freeze intended use/label claims; start Arabic translation plan; collect halal/source declarations if animal-derived materials. Days 31–60: - Build STED/IMDRF technical file (device description, EP checklist, RMF to ISO 14971, clinical evidence, QMS certs, labelling with UDI, manufacturing and sterilization evidence). - Create GHAD/MDNR and MOHAP/NDR accounts; prepare establishment documents, PoA/legalization. - Pre-submit classification queries if borderline/SaMD. Days 61–120: - File SFDA MDMA and MOHAP NDR submissions; respond to queries within 5 working days to protect clocks. - Prepare DHA/DOH listing artifacts (forms, GTINs) if targeting public tenders. - Stand up PMS procedures, vigilance contacts, and Arabic FSN templates. Days 121–180: - Complete importer onboarding, UDI data loads, and shipment release SOPs. - Pilot traceability in UAE facilities as required; rehearse recall. - Post-approval: book initial distributor training; align change control with notification/variation triggers.