Local manufacturer guide

In this guide

References reviewed: October 2026

The short answer: to manufacture medical devices in the Kingdom, your factory needs:

• a valid industrial licence, and a licence from the Saudi Food and Drug Authority (SFDA) for each branch;
• a certificate of conformity with a quality management system under SFDA.MD/GSO ISO 13485:2017, from a body SFDA accepts;
• a full-time technical manager and a full-time quality manager;
• a Marketing Authorization for every device before it circulates;
• a technical file in English for every device.

The official references for this guide are at the end of the page.

Who this guide is for

• Local manufacturers that design and make their devices, or make them to another party's design.
• If your factory also imports or distributes other makers' devices, that activity has its requirements in the importer and distributor guide.

What SFDA requires of your factory

SFDA requires the following, grouped by topic:

Licence

• A valid industrial licence. It is not required for the medical software and applications development activity.
• A separate SFDA licence for each branch of the factory.
• Defining the factory's activity and the risk level of the devices it will make, and classifying devices under the published classification system.
• An undertaking to obtain the Marketing Authorization certificate before circulating any device.
• An undertaking that the factory bears full responsibility for the quality of every batch it makes.
• Application documents in the licensing procedures guide: the title deed or lease, the municipality licence or a MODON or economic-city contract, and the environmental permit from the National Center for Environmental Compliance.
• The factory licence term is five years, with its fee paid per the fees table.
• Applying to renew the licence; you may apply up to 60 days before the current licence expires.
• Notifying SFDA of any change to the information submitted for the licence within 10 days of the change.

Quality system and people

• A certificate of conformity with quality management system requirements under SFDA.MD/GSO ISO 13485:2017 or equivalent, for all medical device factories.
• The certificate issuer is an office inside the Kingdom licensed by SFDA, or an office outside it holding accreditation from the International Accreditation Forum (IAF). SFDA publishes a list of designated conformity assessment bodies.
• A full-time technical manager whose responsibilities and tasks are defined. The requirements give ten responsibilities as examples: design, new products, technical requirements, standards, processes, support, testing, the Marketing Authorization file and its updates, and new technologies.
• A full-time quality manager who develops, applies, reviews and continually improves the quality management system. This person is responsible for regulatory compliance, including verifying product conformity during manufacture and before final approval for circulation.
• Appointing a person to deal with the NCMDR on reports, chosen from the two full-time managers: technical or quality.
• Overseeing sterilization verification and biocompatibility tests where they apply.

The device and its file

• A device does not circulate before it holds a valid Marketing Authorization. The local manufacturer applies for it after the factory is licensed.
• Carrying out the necessary technical tests, and technical and reference tests per the standards.
• A technical file in English covering six areas: description, variants and accessories; design and manufacture; risk management; verification and validation, applicable clinical evidence included; the post-market surveillance plan; and the applicable report.
• Clinical evidence: MDS-REQ-001 sets out the clinical evaluation route and post-market clinical follow-up for devices other than in vitro diagnostics, and the performance evaluation report for in vitro diagnostics. The text does not by itself require a new clinical study for every device.
• A post-market surveillance plan and report; the report type and frequency depend on the device's risk class and route. Classes C and D report yearly, and class A when needed.
• Assigning and managing the Unique Device Identification (UDI) per GS1, HIBCC or ICCBBA standards, with a device identifier and a production identifier. Its carrier goes on the label and higher packaging levels, in a form people can read and a form scanners can read.
• Submitting Saudi-DI data and making it available when the device is placed on the market, updating a change that needs no new identifier within 10 working days, and validating the data at submission and every year.
• Samples made for the quality certificate: an outer label stating they are not for circulation; they are not circulated or advertised.
• Following the special requirements for some devices, such as home-use or implanted devices.
• Providing after-sales services, including servicing and approved spare parts for the devices concerned.
• Informing the NCMDR of a delay or unavailability of a device that poses a potentially high risk to medical services.

Vigilance and corrective action

• Reporting incidents and complaints to the National Center for Medical Devices Reporting (NCMDR): within 2 days for a serious public health threat, 10 days for an incident that led or could have led to death or serious injury, and 30 days otherwise, counted from the incident or from becoming aware of it.
• Answering the NCMDR's follow-up question on an investigation within 5 days.
• A follow-up report when the investigation passes 30 days. The final report comes within 15 days if the device needs no examination, 30 days if it must be withdrawn and examined in the Kingdom, and 60 days if outside it.
• A field safety corrective action in five stages: reporting to the NCMDR; then notifying those affected and submitting the implementation plan within 5 days, in parallel (the plan needs the NCMDR's approval); then carrying it out; then closing it with the NCMDR's confirmation.

Inspection and records

• When preparing for a factory inspection: sending the site details, scope, quality manual, and the applicable procedures and records, confirming the date, reviewing the plan, and paying the inspection fee if SFDA asks for it.
• SFDA issues the factory inspection report within 15 working days. The factory answers nonconformities on the form with a plan covering root cause, correction, prevention and timing, within the period in SFDA's letter. It has at most three chances to amend the plan, then carries it out and obtains SFDA's confirmation.
• A database archiving all related data, documents and operations, easy to access and retrieve, for at least 5 years.
• Giving SFDA documents and information within 10 days of its request.

The documents your factory needs

You receive your documents as Word files in your establishment's name, and you review and approve them your own way before you submit them — and we guide you step by step to issuing your approved edition.

The package of a local manufacturer that does not supply sterile devices holds 112 files:

• 10 core documents;
• 23 procedures;
• 79 forms and records.

A factory that supplies sterile devices also gets the documents for validating sterilization and the sterile barrier system, and the counts follow the establishment's activity and its answers.

Core documents (10)

The eight shared documents (start here, the declaration, the quality manual, the quality policy and objectives, the management representative decision, the organization chart and job descriptions, the forms booklet, and the document list with retention periods), plus two factory documents: its activity requirements and their records.

Procedures (23)

The fifteen shared quality system procedures (from document control P-01 to customer order review P-15), plus the factory procedures:

Forms and records (79)

The shared quality system forms, plus the factory forms:

• F-60 Register of factory licences and quality system certificates
• F-61 Factory inspection preparation file and its report
• F-62 Technical manager and quality manager appointment file
• F-63 Design and development project file
• F-64 Technical file and risk management file
• F-65 Design verification, validation and technical test reports
• F-66 Design transfer to production record
• F-67 Design change record and notice to the design owner
• F-68 List of raw material and component suppliers and their evaluation
• F-69 Purchase orders and supplier change notices
• F-70 Incoming material inspection and release form
• F-71 Traceability record from raw material to recipient
• F-72 Process validation, equipment and personnel qualification file
• F-73 List of production and measuring software and its validation
• F-74 Sterilization and sterile barrier system validation file (for factories that supply sterile devices)
• F-75 Production environment monitoring and clean-area entry record
• F-76 Sterilization cycle record (for factories that supply sterile devices)
• F-77 Batch record
• F-78 Product status and location cards
• F-79 Batch release form
• F-80 UDI register and its Saudi-DI submission
• F-81 Device file: classification, Marketing Authorization and after-sales services
• F-82 Vigilance and field safety corrective action register

What we add from practice, which is not SFDA text: some of the package is a practical arrangement we suggest; leaving it out is not a breach of a published duty. It includes:

• a list of the factory's devices with each device's risk class, classification rule and assignment date;
• a signed release decision for every batch;
• reassessing biocompatibility after a change of material, process or supplier, according to risk.

Preparation steps

A suggested order, each step building on the one before:

1. Obtain the industrial licence, and prepare the title deed or lease, the municipality licence and the environmental permit.
2. Define the factory's activity, and classify each device you will make by its risk.
3. Appoint the full-time technical manager and quality manager, and set out their responsibilities in writing.
4. Build and apply the quality management system, then obtain the certificate of conformity from a body SFDA accepts.
5. Prepare each device's technical file in English, its tests and its UDI.

6. Apply for the factory licence with its two undertakings:

   • obtaining the Marketing Authorization before circulation;
   • responsibility for the quality of every batch.

   Then prepare for the inspection visit.

7. After licensing:

   • apply for a Marketing Authorization for each device;
   • submit the Saudi-DI data before placing it on the market.

8. After placing on the market:

   • run the post-market surveillance plan and its reports by device class;
   • keep to the reporting deadlines.

Questions for your activity

Does a local manufacturer need an ISO 13485 certificate?
Yes. General clause (6) requires all medical device factories to obtain a certificate of conformity with quality management system requirements. The category A and B qualifier in the same clause concerns importers and distributors.

Does medical software development need an industrial licence?
No. The medical software and applications development activity is expressly exempt from the industrial licence condition.

Do I need a licence for each branch of the factory?
Yes, a separate licence for each branch.

What language is the technical file in?
English. It covers six areas, from the device description to the post-market surveillance report.

Do I need a new clinical study for every device?
The text does not say so by itself. MDS-REQ-001 sets out the clinical evaluation route and when clinical follow-up is needed; where a study was carried out, it is documented in the device file.

May I make samples before I have the Marketing Authorization?
Samples for the quality certificate carry an outer label stating they are not for circulation, and are not circulated or advertised.

When do I submit UDI data?
It must be available in the Saudi-DI database when the device is placed on the market, and is validated at submission and every year.

Questions we ask to tailor your documents to your factory

References