Risk Management File in Saudi Arabia: ISO 14971 under MDS-REQ 1 Annex (3)

1. Key takeaways

The risk management file is a mandatory component of Saudi technical documentation, fixed at item 5 of MDS-REQ 1 Annex (3), and it is simultaneously one of the 6-item simplified documents for low-risk devices. The SFDA recognizes ISO 14971 through two channels. The first is legal: Article 1 of Royal Decree No. M/54 defines the quality management system by reference to the latest version of ISO 13485 or an equivalent standard. The second is the reliance pathway: MDS-G030 accepts MDSAP certificates together with the corresponding audit reports as QMS evidence. The GRZAN view is that the risk management file in Saudi Arabia is not a stand-alone report but the hub connecting the EPSP, clinical evaluation, and post-market surveillance.

• Item 5 of Annex (3) fixes the risk management file inside the technical documentation.
• The same file is one of the 6-item simplified documents for low-risk devices.
• Recognition of ISO 14971 is indirect, through ISO 13485 and the reliance pathway, not by naming a version year.
• Every risk control measure in the EPSP checklist must trace to a numbered risk entry in the risk management file.
• Post-market information write-back is the loop most likely to be inspected, supported by the NCMDR reporting duties under MDS-REQ 11.
• Adverse event reporting runs on 2, 10, and 30-day tiers; investigations on 15, 30, and 60-day tiers.

2. Legal basis

The table below sets out the instruments and clauses on which the risk management obligation rests. Regulatory information verified as of October 29, 2026.

3. Expert insights

Recognition is indirect, not by naming a version. In the visible public texts the SFDA does not adopt wording such as a mandatory ISO 14971:20XX designation. Instead it lands risk management inside the manufacturer’s quality system through the reference to ISO 13485 and through the statutory status of the risk management file. The practical effect of this indirect recognition is that structuring the file to ISO 14971 is safe, but the mandatory force of the version year is weaker than in the EU.

For Chinese manufacturers this means the file can be organized around the current ISO 14971 process, risk analysis, risk evaluation, risk control, evaluation of residual risk, management review, and production and post-production information, without agonizing over the version year. What matters is whether the process closes its loop, whether post-production information is written back, and whether the control measure for every risk can be located against a specific design output. Confirmation of the version year is covered by the verification actions in Section 5.

The risk management file is the landing layer of the EPSP, not a parallel document. Every risk control measure written in the EPSP checklist should find a numbered risk entry in the risk management file, where its evaluation conclusion, its control measures, and the acceptability judgment on the residual risk can be seen. If the two documents cannot trace to each other, reviewers will find the argumentation broken.

This is especially visible in the three-tier priority order: if the risk management file shows that the only control for a risk is a warning in the instructions for use while the EPSP checklist claims the risk was eliminated by design, the two contradict each other, and the contradiction is a hard defect that can be identified directly. For how to write the EPSP, see https://www.grzan.cn/regulations/saudi/essential-principles-of-safety-and-performance-24 .

Write-back of post-production information is the link most likely to be checked in Saudi Arabia. The risk management process requires post-production information to be written back into the risk file. This link has explicit administrative support in Saudi Arabia: MDS-REQ 11 requires adverse events and complaints to be reported to the NCMDR on tiers of 2 days for a serious public health threat, 10 days for possible death or serious injury, and 30 days for other cases, with investigations and final reports on tiers of 15, 30, and 60 days.

If the post-production information chapter of the risk management file stays empty over a period in which adverse event reports have been filed, the contradiction will be pointed out directly in an inspection. The GRZAN practice is to bind the rhythm of the risk management review to the periodic safety update report (PSUR); see https://www.grzan.cn/regulations/saudi/pms-report-and-psur-by-risk-class-45 .

One cross-requirement deserves separate note: once a field safety corrective action (FSCA) occurs, the corrective action itself must be written back into the risk file, since it both corrects existing risk controls and may itself introduce new risks. If the corrective action involves a design or material change, it must first be tested against the significant change criteria. The closed loop from notification to closure of an FSCA appears at https://www.grzan.cn/regulations/saudi/field-safety-corrective-action-process-44 , and the change test at https://www.grzan.cn/regulations/saudi/significant-and-non-significant-change-46 .

4. Practical recommendations

• Organize the risk management file to the process structure of ISO 14971 and place the acceptability criteria matrix at the front of the file.
• Number the risk entries and build a two-way reference table with the clause numbers of the EPSP checklist.
• State for every risk which tier its control measure belongs to: design control, protective measures including alarms, or safety information.
• The evaluation of residual risk must give a clear conclusion and a benefit-risk judgment; never write that risk has been reduced to acceptable without a basis.
• Establish a write-back mechanism for post-production information: NCMDR reports, complaints, FSCAs, recalls, literature, and vigilance information on similar devices must all be captured.
• Bind the risk management review cycle to the PSUR cycle and retain the review records for inspection.
• Manufacturers on the reliance pathway can prepare the MDSAP certificate and audit reports in parallel as QMS evidence to avoid duplicate assessment; see https://www.grzan.cn/regulations/saudi/mdsap-certificate-as-qms-evidence-15 .
• Have the GRZAN regulatory team verify the consistency of the risk file with the other chapters of the technical documentation, focusing on whether numbered references have lapsed.

5. Verification checklist

• □ The risk management file is in place against item 5 of Annex (3)
• □ The file structure covers risk analysis, evaluation, control, residual risk evaluation, management review, and post-production information
• □ The version year of ISO 14971 has been confirmed and the standard text retained (the practical estimate item must be checked against current SFDA practice)
• □ Risk entry numbers and EPSP checklist clause numbers trace in both directions
• □ Control measure tiers are marked clearly, with no case of an instruction-for-use warning substituting for design control
• □ Residual risk evaluation carries a clear conclusion and the basis of the benefit-risk judgment
• □ The post-production information chapter shows write-back records or an established write-back mechanism
• □ The three NCMDR reporting timeframes of 2, 10, and 30 days are embedded in internal procedures

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Saudi Arabian market. Our team prepares SFDA-compliant STAR dossiers, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com