Medical Device Regulation in the GCC: Compliance Guide

The Gulf Cooperation Council (GCC) medical device market is one of the fastest-growing regions globally, driven by increasing health-care expenditure, population growth, and digital health adoption. However, bringing a medical device to market across GCC states requires navigating a complex regulatory environment that combines national-level registration with emerging harmonisation efforts. This guide provides a comprehensive overview of medical device regulation across the GCC.

Medical Device Regulators by Country

Each GCC member state has its own national regulatory authority responsible for medical device oversight. While the GCC Central Committee for Medical Devices (CCMD) and the Gulf Health Council (GHC) work toward harmonisation, registration remains a national competence:

Medical Device Classification System

The GCC has largely adopted risk-based classification systems aligned with international standards, though specific classification criteria vary by country. The most common framework is based on the Global Harmonisation Task Force (GHTF) model, with four risk classes:

• Class A (Low risk) – Non-invasive devices, bandages, examination gloves, tongue depressors
• Class B (Low-moderate risk) – Invasive devices for short-term use, hypodermic needles, suction equipment
• Class C (Moderate-high risk) – Devices in contact with the central circulatory system, bone fixation plates, ventilators
• Class D (High risk) – Implantable devices, pacemakers, heart valves, drug-eluting stents

Registration Process

While national processes differ, the general medical device registration pathway in the GCC follows a consistent pattern:

• Step 1: Pre-market assessment – Determine device classification and identify the applicable regulatory pathway. Devices with prior approval from a reference regulatory authority (US FDA, EU CE Mark, UK MHRA, Japan PMDA, Health Canada, TGA Australia) benefit from expedited review in most GCC states.
• Step 2: Establish a local presence – Most GCC countries require the manufacturer to appoint a local authorised representative (LAR) or agent. The LAR is legally responsible for post-market surveillance and adverse event reporting.
• Step 3: Compile registration dossier – The dossier typically includes device description, intended use, labelling, quality management system certification (ISO 13485), clinical evaluation report, and risk management file (ISO 14971).
• Step 4: Submit application – Submission is electronic through each country’s portal (e.g., SFDA GHAD, UAE RAPID system, NHRA e-Services). Fees vary significantly, from AED 5,000 in the UAE to SAR 15,000 in Saudi Arabia.
• Step 5: Technical review – The regulatory authority reviews the dossier. Deficiencies are communicated through query letters, and the applicant must respond within specified timelines (typically 30–90 days).
• Step 6: Registration and listing – Successful devices are issued a registration certificate and listed on the national medical device registry. Certificates are valid for 2–5 years depending on the country.

Quality Management Systems: ISO 13485

ISO 13485 certification is a prerequisite for medical device registration across the GCC. All GCC regulators require manufacturers to demonstrate an ISO 13485-certified quality management system. Key requirements include:

• Documented design and development processes
• Purchasing controls for critical components and raw materials
• Production and service provision controls
• Monitoring and measurement of product and QMS processes
• Internal audit and management review programmes
• Corrective and preventive action (CAPA) systems

Notably, Saudi Arabia’s SFDA requires ISO 13485 certification by an SFDA-recognised certification body, which may differ from the manufacturer’s existing certifier. The UAE accepts any ISO 17021-accredited certification body but requires evidence of ongoing surveillance audits.

Clinical Evaluation Requirements

Clinical evaluation is required for Class C and D devices across the GCC. The requirements are closely aligned with EU MEDDEV 2.7/1 Rev.4 and the Clinical Evaluation Reports (CER) required for CE marking. The clinical evaluation must demonstrate:

• Clinical safety based on available clinical data
• Clinical performance consistent with the manufacturer’s claims
• Acceptable benefit-risk profile for the intended population

The SFDA is notably more prescriptive, requiring clinical investigation data for certain Class D devices even if a CER based on literature exists. The UAE accepts EU-approved CERs but may request supplementary data for devices intended for the local population.

Labelling Requirements

GCC labelling requirements are detailed and strictly enforced. Key requirements include:

• Language – Labelling must be in Arabic and English. In Saudi Arabia, Arabic text must have equal prominence. The UAE and Bahrain accept bilingual labelling with Arabic information on the outer packaging.
• Content – Labels must include device name, manufacturer details, LAR details, registration number, expiry date, batch/lot number, storage conditions, and any warnings or contraindications.
• Symbols – Standardised medical device symbols (ISO 15223-1) are accepted, but symbols must be explained in Arabic and English.
• Unique Device Identification (UDI) – Saudi Arabia and the UAE have adopted UDI requirements aligned with the International Medical Device Regulators Forum (IMDRF) framework. Compliance is mandatory for Class C and D devices and phased for lower classes.

Adverse Event Reporting and Post-Market Surveillance

Post-market surveillance obligations apply across all GCC states. Manufacturers and LARs must:

• Report serious adverse events within 10 days (or 48 hours for life-threatening events)
• Submit periodic safety update reports (PSURs) at defined intervals (typically annually for Class C and D)
• Maintain complaint handling and CAPA systems accessible to the regulator on request
• Report field safety corrective actions (FSCAs) including recalls within 24 hours of decision
• Maintain records for a minimum of 10 years (extended to 15 years for implantable devices)

The SFDA operates the most active enforcement regime, with regular market surveillance inspections and substantial fines for non-compliance. The UAE’s MOHAP conducts risk-based inspections, while other GCC states are progressively strengthening enforcement capabilities.

FAQ

Do I need separate registrations for each GCC country?

Yes, with one partial exception. The Gulf Health Council’s GCC Central Committee for Medical Devices has a harmonised registration programme, but it currently covers only a limited scope of low-risk (Class A) devices. For the vast majority of devices, separate national registrations are required.

How long does medical device registration take in the GCC?

Timelines vary by country and device class. Saudi Arabia is typically the fastest (3–9 months for Class A–C), while Kuwait and Oman can take 12–24 months. The UAE averages 4–9 months for MOHAP routes. Planning for 6–18 months across the region is realistic.

Do I need an ISO 13485 certificate for registration?

Yes. ISO 13485 certification is mandatory for medical device manufacturers in all GCC states. Some countries (notably Saudi Arabia) require certification by a specifically recognised body.

Is CE or FDA approval recognised in the GCC?

Yes, but with limitations. Saudi Arabia, the UAE, and Bahrain offer expedited review for devices with prior EU CE Mark or US FDA approval. However, you still need to submit a registration dossier; prior approval reduces, but does not eliminate, the regulatory burden.

What are the costs for medical device registration?

Registration fees vary significantly. Saudi Arabia charges SAR 10,000–15,000 per device. The UAE charges AED 5,000–10,000. Bahrain charges BHD 200–500. Additional costs include LAR appointment, ISO 13485 certification, translation, and regulatory consulting.

Can a single LAR cover all GCC countries?

No. Each country requires a locally registered authorised representative. Some companies offer regional LAR services with offices in multiple GCC states, but each country’s LAR must be registered locally.

Ready to Register Your Medical Device in the GCC?

Our regulatory affairs team has extensive experience navigating GCC medical device registration across all risk classes. We provide gap analysis, registration dossier preparation, local authorised representative services, and post-market surveillance support.

Contact our medical device regulatory team for a free preliminary assessment of your device’s GCC registration pathway.