SFDA registration: a clear guide to medical device approval in 2026

SFDA registration is the shorthand most suppliers use for getting a medical device cleared for sale in Saudi Arabia, and the formal step behind it is a Medical Device Marketing Authorisation (MDMA) from the Saudi Food and Drug Authority. The practical problem for manufacturers and distributors is that the rules sit across a law, an implementing regulation and a series of numbered SFDA documents, and some routes that older guides describe have closed. This guide sets out what applies as of November 2026, with each rule tied to the document that states it.

What SFDA registration means for medical devices

The legal starting point is Article 8 of the Law of Medical Devices and Supplies, which says devices or supplies “may not be circulated unless registered and a marketing authorization is obtained”, according to the English text of the law published by the Ministry of Investment. In practice SFDA registration therefore has two parts: the device needs an MDMA, and the company placing it on the market needs an establishment licence. Both are handled through GHAD, the SFDA electronic system that the regulator’s marketing authorisation requirements name for licensing and MDMA requests.

The volume is large. In a presentation to the International Medical Device Regulators Forum (IMDRF) stakeholder forum on 10 March 2026, Abdullah Alghuraibi, the SFDA’s Executive Director of Medical Devices Evaluation, reported 14,227 MDMA requests in 2025 covering 129,752 products. By class, the SFDA presentation to the IMDRF listed 40,553 Class A, 34,509 Class B, 41,774 Class C and 12,916 Class D products. Our MedTech and diagnostics section follows device approvals and procurement across the Gulf.

The law and the rules in force

The Law of Medical Devices and Supplies was issued by Royal Decree No. M/54 dated 6/7/1442H, which the Ministry of Investment’s English text gives as 18 February 2021. Its Implementing Regulation was issued by SFDA Board of Directors decree No. 3-29-1443 dated 19/2/1443H. The SFDA cites both as the legal basis of its marketing authorisation requirements. The articles that matter most for SFDA registration are these:

• Article 6: an establishment may not carry out activities covered by the law unless it is registered and licensed.
• Article 8: devices and supplies may not be circulated without registration and a marketing authorisation.
• Article 9: the SFDA may exempt innovative devices from some marketing authorisation conditions, provided safety is not compromised.
• Article 15: a foreign manufacturer that wants to circulate products in the Kingdom must appoint an authorised representative.
• Article 18: healthcare providers may not deal with unregistered or unlicensed establishments.
• Article 28: manufacturers, authorised representatives and healthcare providers must report adverse events to the National Centre for Medical Device Reporting (NCMDR).

Article 42 sets the penalties: fines of up to five million riyals, temporary closure for up to 180 days, suspension of a marketing authorisation for up to one year or its revocation, and revocation of a licence. For the acts listed in Article 41(1, 2, 3, 7 and 8), the penalty is imprisonment for up to ten years, a fine of up to ten million riyals, or both. Fines, closure, suspension of a marketing authorisation and bans on activity may be doubled for a repeat violation committed within a year of the first.

The working detail sits in numbered SFDA documents. Requirements carry the prefix MDS-REQ and guidance documents MDS-G. The table lists those used in this guide, with the version and date printed on each as of November 2026.

Document	Subject	Version and date
MDS-REQ 1	Requirements for Medical Devices Marketing Authorization	Version 6.0, 19 December 2021
MDS-REQ 9	Requirements for Licensing of Medical Devices Establishments	Version 2.0, 15 January 2025
MDS-REQ 11	Requirements for Post-Market Surveillance of Medical Devices	Version 2, 23 March 2023
MDS-G008	Guidance on Medical Devices Classification	Version 2.0, 13 December 2022
MDS-G002	Guidance on Innovative Medical Devices	Version 3.0, 16 October 2024
MDS-G11	Guidance on Manufacturing Paths of Medical Devices	Version 2.0, 7 July 2025
MDS-G028	Guidance on Bundling Criteria for Medical Devices within a Single MDMA Application	Version 1.0, 3 May 2026
MDS-G30	SFDA Reliance Approach for Medical Device	Version 1.0, 9 September 2026

Who can apply for SFDA registration

MDS-REQ 1 allows three types of applicant: a local manufacturer, an overseas manufacturer, or the overseas manufacturer’s authorised representative (AR). Before seeking an MDMA, a local manufacturer must hold a medical device manufacturing licence and an AR must hold an AR licence, both issued through the licensing services of the GHAD system. The SFDA’s guidance on manufacturing paths adds that an overseas manufacturer can submit directly through GHAD or authorise its AR to submit, and that “the SFDA grants the MDMA certificate in the name of the manufacturer”.

The law defines an AR as “a legal person based in the Kingdom who has written authorization from a manufacturer located outside the Kingdom”. The SFDA establishment licensing requirements, MDS-REQ 9, set out what the AR itself must do to be licensed:

• be a legal entity under Saudi regulations;
• appoint an authorised person with an appropriate qualification in a related field to deal with the SFDA;
• hold a separate licence for each manufacturer it represents;
• ensure no other AR has been appointed for the same class or general group of devices;
• document its agreement with the manufacturer, covering the activities performed, the device types, post-market surveillance and termination;
• confirm its information annually, represent the manufacturer before the SFDA and cooperate in post-market surveillance.

When an agreement ends, the manufacturer must appoint a replacement and notify the SFDA, and the outgoing AR’s responsibility does not end until a replacement is appointed or the devices are no longer on the market. Annex 2 of MDS-REQ 9 sets licence periods and fees for each establishment type. This guide does not quote the AR figure, because the columns of that table cannot be read unambiguously in the published PDF; applicants should confirm the amount with the SFDA.

MDS-REQ 9 covers ten establishment types in all, from local manufacturers and ARs to importers and distributors, warehouses, testing laboratories, conformity assessment bodies and maintenance service providers. The SFDA issues licences “valid for one year or similar renewable periods”, and a renewal request can be submitted 60 days before expiry. Companies offering these services in the Kingdom appear in our Suppliers Guide.

Risk classes A to D and why they matter

Classification drives the SFDA registration fee, the technical file and the post-market workload. The SFDA Guidance on Medical Devices Classification (MDS-G008) sets four classes for general medical devices: Class A (low risk), Class B (low to medium), Class C (medium to high) and Class D (high). Class A devices that are supplied sterile, incorporate a measuring function or are reusable surgical instruments are rated low to medium.

For in-vitro diagnostic (IVD) devices the same letters are defined by individual and public health risk, from Class A (low individual risk and low public health risk) to Class D (high individual risk and high public health risk). The guidance contains 22 classification rules for general medical devices and states that “the manufacturer is responsible for determining the classification of a device”. The technical file must give the risk class and justify the rule applied.

Emergo by UL, a regulatory consultancy, reported in January 2023 that MDS-G008 replaced the earlier MDS-G42 guidance, kept the classification rules and revised the examples; infusion cannulas moved from Class C to Class B. Because the MDMA fee rises with each class, a classification that is wrong in either direction costs money or time.

The SFDA registration process step by step

The SFDA registration sequence below follows MDS-REQ 1 and the documents cited. It is a planning summary, not a substitute for them.

1. Classify the device. Apply the rules in MDS-G008 and record the rule used, since the technical documentation must justify it.
2. Secure the right licence. Overseas manufacturers appoint a licensed AR. Local manufacturers need a manufacturer licence, which under MDS-G11 requires a quality management system certificate to ISO 13485:2016 from a conformity assessment body accredited by the SFDA.
3. Register on GHAD. MDS-REQ 9 requires an account on the SFDA Unified Electronic System (GHAD) and an establishment number before licence requests.
4. Build the technical file. Annex 3 of MDS-REQ 1 covers medical devices and Annex 4 covers IVDs. The file must include a full set of labels for the device and packaging, and symbols must conform to ISO 15223-1.
5. Check the labelling. Information for lay-use devices and self-testing IVDs “shall be in both the Arabic and English languages”, and labelling “shall not include the SFDA logo”.
6. Submit the MDMA application through the GHAD marketing authorisation services, using the SFDA application form.
7. Pay the fee when the SFDA requests it. An SFDA answer in its FAQ section says payment “must be done during 30 calendar days”.
8. Keep the MDMA current. Provide technical documentation within 10 days of any SFDA request, notify significant changes within 10 days of the occurrence, and renew before expiry.

MDS-REQ 1 offers a documentation route for low-risk devices, but it excludes IVDs, sterile devices, devices with a measuring function, reusable surgical instruments and novel devices. For eligible devices the file has six elements: device description and specification; information supplied by the manufacturer; an essential principles checklist; evidence of compliance with the applicable essential principles; the risk management file; and the post-market surveillance plan and report. Bundling of devices in one application is allowed under Annex 15, and SFDA guidance MDS-G028, version 1.0 dated 3 May 2026, sets criteria for four bundling categories: device family, system, procedure pack and IVDs.

Innovative devices have a separate track. Under SFDA guidance MDS-G002, a device with innovative features and no local or global equivalent, offering a considerable clinical advantage, can receive a free pre-submission assessment and then priority assessment of its MDMA application. The guidance is explicit that “priority treatment does not mean that reviews will be shortened or reduced in any way”; designated devices move to the front of the queue. It also allows conditional marketing authorisation, subject to post-market requirements.

SFDA registration fees, timelines and validity

The SFDA publishes an undated MDMA fee sheet titled “Elevation Fees of Medical Device Marketing Authorization (MDMA)”. The amounts it lists, as of November 2026, are below. Currency is as stated by the SFDA.

Application	Fee
New application, Class A	SAR 15,000
New application, Class B	SAR 19,000
New application, Class C	SAR 21,000
New application, Class D	SAR 23,000
Renewal (reduced fee)	SAR 5,000
Administrative changes, such as adding models, changing the brand name or updating labels and instructions	SAR 1,100
Change of risk class, or of legal manufacturer name or address	Full fee for the risk class

The fee sheet’s lead-time column shows 35 working days once, beside Class A, and nothing beside Classes B to D. It does not state how long an MDMA stays valid.

For applications made through the reliance pathway described below, guidance MDS-G30 gives a review time of 35 to 60 working days for all four classes, “provided that the application is complete and all required documentation has been submitted”. The SFDA documents reviewed for this guide do not publish an average approval time for applications assessed on the full technical file. MDS-REQ 1 says the MDMA must be renewed before it expires and that “a renewal request can be submitted 90 days before its expiry date”.

The SFDA may request all technical documentation at any point, including after authorisation, with a 10-day deadline. Changes to the risk class or the legal manufacturer attract the full MDMA fee again, so a corporate restructuring can carry an SFDA registration cost. For comparison with another market’s fee cycle, see our report on the MHRA’s annual device registration fee deadline in the UK.

Reference markets: the closed GHTF route and the 2026 reliance pathway

Older SFDA registration guides describe a route that relied on approval in a founding jurisdiction of the Global Harmonization Task Force (GHTF): Australia, Canada, Japan, the United States and the European Union. The SFDA guidance MDS-G5 of June 2020 required devices to comply with the regulations of one of those founding members, plus Saudi provisions on labelling and supply, and listed the evidence expected from each, such as 510(k) clearance for the US or a TGA conformity assessment certificate for Australia.

That route has closed. An SFDA announcement of December 2019 moved the last day for accepting applications via the GHTF route from 1 January 2020 to 31 March 2020. A later SFDA circular, dated 28 December 2020, extended it again: new marketing authorisation requests via the GHTF route would be accepted until 1 July 2021, and renewal and update requests until 1 January 2022.

Emergo by UL, a regulatory consultancy, reported in May 2021 that the SFDA had then moved the cut-off for new GHTF-route applications to 1 January 2022, the same date as renewals, and that authorisations issued under the route would remain valid until their assigned expiry dates. The SFDA’s circulars page now marks the December 2020 circular as inactive.

The lowest-risk products lost their shortcut too. Emergo by UL reported in January 2023 that SFDA circular MDS-CIR-001-V1/220324 had set 27 September 2022 as the deadline for new and renewal applications under the simplified Medical Device National Registry (MDNR) listing for non-measuring, non-sterile Class A devices, and that Class A devices without valid registration were to be removed from the market. The law still defines the MDNR as the registry in which devices, supplies and establishments are entered.

MDS-REQ 1 version 6.0 does not name reference jurisdictions; it says its annex requirements are harmonised with international regulatory requirements. An SFDA FAQ on the “Technical File assessment (TFA) track” points applicants to guidance MDS-G5 for the documents required.

Reliance on foreign approvals has since returned in a new form. SFDA guidance MDS-G30, “SFDA Reliance Approach for Medical Device”, version 1.0 dated 9 September 2026, lets manufacturers and ARs rely on an approval by a recognised regulatory authority (RRA) “to reduce the documentation requirements and shorten review timelines”. The RRAs it lists are the Therapeutic Goods Administration (Australia), Health Canada, the national competent authorities of the EU and EEA, the PMDA (Japan), the MHRA (UK) and the FDA (US), and the SFDA says the list may be updated. To qualify, a device must:

• hold a valid marketing authorisation or approval from at least one RRA;
• be technically identical to the authorised device, including design, manufacturing process and intended use;
• meet Saudi requirements on electrical supply under the Saudi Building Code, labelling and instructions in the required languages, and storage and transport conditions.

The guidance excludes products that reached a market through self-registration or self-declaration, products granted market access “primarily by demonstrating substantial equivalence to a predicate device”, custom-made devices and products under significant recalls or restrictions, and says software as a medical device and AI-enabled devices may be excluded. Applicants answer the reliance question in the MDMA application, upload evidence of each approval and attach a signed Reliance Form. The SFDA also accepts Medical Device Single Audit Program (MDSAP) certificates and audit reports as evidence of quality management system conformity, and it retains full decision-making authority.

Post-market duties after an MDMA

An MDMA starts a set of continuing obligations. Article 30 of the law requires manufacturers and ARs to report foreign safety alerts, risks to safety and completed field safety corrective actions (FSCAs) to the NCMDR, and Article 31 requires establishments and healthcare providers to suspend circulation during a safety alert until the NCMDR confirms the corrective action is complete. The SFDA post-market surveillance requirements, MDS-REQ 11, set these deadlines:

Event	Deadline
Serious public health threat	Within 2 days of occurrence or awareness
Threat of death or serious injury	Within 10 days
Any other adverse effect	Within 30 days
Reply to an NCMDR follow-up request	Within 5 days
Final investigation report	15 days without testing; 30 days with testing in the Kingdom; 60 days with testing abroad
Report an FSCA affecting the Kingdom	Within 2 days of the FSCA letter’s issue date
Notify importers, distributors, healthcare providers and users	Within 5 days of reporting to the NCMDR
Submit the FSCA implementation plan	Within 5 days of reporting to the NCMDR

Progress reports are required if an investigation takes more than 30 days or an FSCA is expected to take more than 90 days, and an FSCA is not closed until the NCMDR confirms it. MDS-REQ 1 adds periodic reporting by class: Class A manufacturers prepare a post-market surveillance report, Class B manufacturers update the periodic safety update report (PSUR) at least every two years, and Class C and D manufacturers update it at least annually.

The authority’s 2025 figures show the scale. On a post-market surveillance slide labelled 2025, its IMDRF presentation reported 183,644 adverse event and complaint reports, of which 125,662 came from manufacturers and companies and 57,696 from healthcare providers, and said 478 safety alerts affected the Saudi market out of 2,698 detected globally. Article 16 of the law also requires manufacturers to provide after-sale services; our analysis of how Saudi health buyers lock in device maintenance for up to five years shows where that duty meets procurement.

Drug registration in brief

SFDA registration for medicines runs through the Drug Sector, not the medical devices process. For new chemical entities and biologics already approved by a reference agency, the SFDA guidance on verification and abridged pathways (reference DS-G-020, version 3.0, updated 20 October 2025 with an implementation date of 20 January 2026) sets two reliance routes:

• Verification: the product must be approved and marketed by both the US Food and Drug Administration and the European Medicines Agency; the stated review timeline is 30 working days.
• Abridged: approval by either agency; the stated review timeline is 60 working days.

In both cases the application must reach the SFDA within two years of the reference approval, the clock starts when the Drug Sector approves the requested pathway by email, and a designation decision is due within ten working days. Products found ineligible move to other pathways and registration fees are not refunded. Blood products, advanced therapy medicinal products and veterinary vaccines are excluded. Our report on the SFDA breakthrough track for Roche’s Wilsirdli covers one recent expedited medicine case.

What changed in 2025 and 2026

The authority has reissued or dated several documents that bear on SFDA registration since the start of 2025. The dates below are those printed on the documents or shown on the SFDA regulations list for medical devices and its guidance list.

• 15 January 2025: MDS-REQ 9 version 2.0 on establishment licensing.
• 23 March 2025: MDS-G26, guidance on companion diagnostic IVDs.
• 22 June 2025: MDS-REQ 2, Requirements for Clinical Trials of Medical Devices.
• 7 July 2025: MDS-G11 version 2.0 on manufacturing paths, covering technology transfer and localisation, circulation, import for manufacturing and certificates of free sale.
• 11 August 2025: MDS-G027, guidance on digital health products.
• 20 October 2025: drug verification and abridged pathways version 3.0, implemented from 20 January 2026.
• 11 January 2026: MDS-REQ 10 on quality management system inspections and audits, and MDS-REQ 12 on transport and storage.
• 3 May 2026: MDS-G028 on bundling criteria for a single MDMA application.
• 15 July 2026: MDS-G029, guidance on risk communication of medical devices.
• 20 July 2026: MDS-REQ 8 on approval for advertising and awareness campaigns.
• 2 August 2026: MDS-REQ 3 on safe use of medical devices inside healthcare facilities.
• 9 September 2026: MDS-G30, the reliance approach for marketing authorisation.

What it means for suppliers and investors

For an overseas manufacturer, the AR appointment deserves the same diligence as a distribution deal. The law makes it compulsory, MDS-REQ 9 bars a second AR for the same class or group, and the outgoing AR stays responsible until a replacement is in place. A change of partner therefore has to be sequenced around licences and MDMA records, not only commercial terms, or SFDA registration of the portfolio can stall.

The reliance pathway changes the calculation for companies with approvals from the six listed regulators, but its exclusions matter: a US clearance based mainly on substantial equivalence to a predicate device does not qualify, and software and AI products may be refused the route.

Companies with large catalogues still face fees per application, from SAR 15,000 to SAR 23,000 for new filings and SAR 5,000 for renewals, which makes the bundling rules in MDS-G028 material. Local manufacturing is the other lever: MDS-G11 sets out how technology transfer and contract manufacturing fit the licensing and MDMA rules, including the requirement for a quality assurance agreement between legal and contracted manufacturers.

The post-market deadlines, two days for a serious public health threat or an FSCA, assume someone in the Kingdom can act quickly. That favours ARs and distributors with regulatory staff on the ground, and it is a due diligence point for investors buying into Saudi distribution businesses.

What to watch next

• How the reliance pathway in MDS-G30 works in practice, including review times against its 35 to 60 working day range and any additions to the list of recognised regulators.
• Guidance on medical device cybersecurity risks, which the authority listed as under development in March 2026 alongside risk communication and bundling guidance; the latter two were issued in May and July 2026.
• Any revision of MDS-REQ 1, the core MDMA requirement. Version 6.0 dates from December 2021; the SFDA page for it was last updated in July 2024.
• Unique device identification. The SFDA’s IMDRF presentation cited MDS-REQ 7, its requirements for unique device identification, under the heading “UDI Compliance”, with SAUDI-DI figures of 460,745 devices from 1,782 manufacturers.
• Changes to the MDMA fee sheet, which is undated, and to review lead times for Classes B to D, which it does not print.
• Further localisation measures under the manufacturing paths guidance.

We log Saudi regulatory deadlines and decisions on The Tracker. Readers with corrections to this SFDA registration guide can reach the desk through our contact page.