Risk Analysis Data and the Essential Safety and Performance Principles List

1. Key takeaways

Article 10(2) of the Implementation Rules requires, in item (5), the submission of risk analysis material for the medical device, and in item (6), the submission of the list of basic safety and performance principles for the medical device. These two documents are the bridge that connects the technical evidence in the registration dossier to the statutory requirements: Article 12(1) of Law No. 12/2025 requires the device to satisfy, at the same time, four requirements — quality standards, effectiveness, safety, and the name, labelling and instructions for use — and the list of basic principles is precisely the index that responds, item by item, to those four requirements.

• The list of basic principles functions as an index: every principle must point to the document and section where the supporting evidence sits.
• Risk analysis material is process evidence: it must show the full chain from identification to residual-risk acceptability.
• Filing applications do not require the principles list but do require the technical requirements, because Article 21(2)(4) cites items (4) and (7) only.
• Both documents are potential triggers for refusal of registration under Article 16.
• A file request arising from defects in either document suspends the 70 or 100 working day assessment period.

2. Legal basis

The two obligations are grounded in the attachment list of the Implementation Rules, while the substantive requirements they serve come from the founding law. The classification ruling carries the technical requirements that the dossier must reflect, and the filing provision confirms that the principles list is a registration-stage document.

3. Expert insights

First observation: the principles list is an index, not a conclusion. Its function is to let ISAF navigate the dossier: for each basic principle, which technical document and which section contains the corresponding evidence. A bare statement of conformity without a pointer cannot be verified by the reviewer and typically leads to a file request, and such a request suspends the 70 or 100 working day assessment period. Compilation teams should treat the mapping table as the spine of the dossier and build the underlying documents around it, rather than drafting the list last as an afterthought.

Second observation: the risk analysis material is process evidence. Unlike the declaration-like character of the principles list, the risk analysis must present the complete chain of risk identification, risk evaluation, risk control measures, and the judgement on the acceptability of residual risks. Both documents are indispensable, and neither can substitute for the other. A principles list that asserts conformity without a documented risk process behind it, or a risk file that never reaches a residual-risk conclusion, each fails on its own terms; reviewers look for the two documents to corroborate one another.

Third observation: filing does not mandate the principles list, but does mandate the technical requirements. Article 21(2)(4) cites items (4) and (7) of Article 10(2) — the declaration of standing and the technical requirements — and does not cite items (5) and (6). This aligns with the formal-review positioning of the filing channel: the filer certifies technical parameters but is not required to lay out the full conformity architecture. Companies holding both registered and filed products therefore maintain two different documentation depths for the same device family, and internal templates should reflect that distinction.

Fourth observation: these two documents are potential triggers for refusal of registration. Article 16 provides that registration is refused where the device does not meet the requirements of Article 12; and the proof of the Article 12 requirements falls precisely on the list of basic principles and the risk analysis material. The quality of these documents directly determines the outcome of the assessment; this is not a formality. A dossier that treats the principles list as a bureaucratic annex risks a substantive refusal rather than a mere file request, because the list is the reviewer’s primary instrument for testing whether the statutory requirements have actually been met.

4. Practical recommendations

• Build the mapping table before writing the documents: list, for each of the four Article 12 requirements, a three-column table of principle, evidence, and document location.
• Write the risk analysis as a closed loop: identification, then evaluation, then control measures, then residual risk acceptability, then the benefit-risk conclusion.
• State the reason for every not-applicable entry: an unexplained ‘N/A’ is treated as a failure to respond.
• Cross-check against the summary test report and the clinical evaluation material: the standards and technical parameters cited in all three places must be identical.

5. Verification checklist

• □ The principles list responds, item by item, to the four requirements of Article 12
• □ Every principle points to the document and section where the corresponding evidence is located
• □ The risk analysis material presents a complete closed loop
• □ Every not-applicable entry states its reason
• □ Cross-checking against the technical requirements, summary test report and clinical evaluation material is consistent
• □ It has been confirmed whether items (5) and (6) are needed in the filing scenario

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for Macao, China. Our team prepares SSM-compliant dossiers, coordinates language and legalisation requirements, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com