Essential Principles of Safety and Performance in Saudi Arabia: Closing the Risk Control Loop

1. Key takeaways

The Essential Principles of Safety and Performance (EPSP) form the justification spine of Saudi technical documentation, carried by two separate lists: non-IVD devices use Annex (1) of MDS-REQ 1 and IVDs use Annex (2), and the two must not be mixed. What closes the loop is not merely filling in a checklist but the fact that risk control must follow a 3-tier priority order: first eliminate or reduce risk through safe design and manufacture, then apply protective measures including alarms, and only last rely on safety information, meaning warnings, contraindications, and precautions. Treating the instructions for use as the primary risk control measure is the most typical way this loop breaks. In the 6-item simplified document list for low-risk devices, the Essential Principles Checklist and the evidence of conformity appear as two separate items: the former is the index, the latter the substance.

• EPSP checklists use Annex (1) for non-IVD devices and Annex (2) for IVDs.
• Risk control follows a strict 3-tier priority: design and manufacture, then protective measures including alarms, then safety information.
• Reversing the order, for example substituting a warning for a design fix, breaks the conformity argument.
• The EP Checklist is an index that must point to evidence; it is not itself the evidence of conformity.
• Safety information only works as the last tier if it actually reaches the user, which ties EPSP to label and IFU language requirements.
• An EU GSPR matrix migrates to Saudi Arabia at low marginal cost; a 510(k)-only package usually requires rebuilding the argument.

2. Legal basis

The table below maps the instruments supporting the EPSP obligation, their document numbers and dates, the relevant clauses, and the key points of the original text. Regulatory information verified as of October 29, 2026.

3. Expert insights

The three-tier priority order is a rule that forbids reversal. Under the EPSP the order of risk control runs: inherent safety at the design and manufacturing level, then protective measures including alarms, then safety information in the form of warnings, contraindications, and precautions. The order looks like engineering common sense, but it operates as a compliance rule that forbids reversal: if a risk could have been eliminated by design and is instead addressed only by a warning in the instructions for use, the conformity argument for that EPSP clause does not stand.

When GRZAN reviews a technical file, the first step is to examine the distribution of risk control measures. If the safety information column carries a dense set of entries while the design control column is nearly empty, the file has a high probability of attracting a deficiency request in Saudi Arabia.

The same rule also triggers a connected obligation: since safety information may only be used as the final layer, once it is adopted it must actually reach the user. This binds the EPSP to the language requirements for labels and instructions for use. A warning addressed to lay users that exists only in English means the third tier of control has not taken effect in Saudi Arabia. The specific treatment of language layering appears in article 30 of this series.

The EP Checklist is an index, not a conclusion. The Essential Principles Checklist is often written as a set of ticked boxes. Under the Saudi retrieval logic, its function is to give reviewers a locating entry point: every row must be able to point to a specific design output, verification report, or risk management record. The checklist itself does not constitute conformity; the evidence does.

This also explains why, in the 6-item simplified list for low-risk devices, the Essential Principles Checklist and the evidence of conformity are listed as two separate items, the former being the index and the latter the substance. Merging the two into a single document deprives the reviewer of the retrieval path.

Comparison with the EU, the United States, and China. The General Safety and Performance Requirements of the EU MDR are structurally very close to the Saudi EPSP, and both stress the hierarchical order of risk control, so most of the conformity argument built for CE can be reused. The US FDA does not adopt a single essential principles list but works through consensus standards and substantial equivalence; China’s NMPA corresponds through its own Essential Principles of Safety and Performance checklist. The practical consequence for Chinese manufacturers is that a company already holding an EU GSPR conformity matrix migrates to Saudi Arabia at low marginal cost, whereas a company holding only FDA 510(k) material needs to rebuild the entire argument.

On the position of labels and instructions for use within risk control, see also https://www.grzan.cn/regulations/saudi/arabic-labeling-and-ifu-requirements-30 ; on the connection between the EPSP and the risk management file, see https://www.grzan.cn/regulations/saudi/risk-management-file-iso-14971-25 .

4. Practical recommendations

• Obtain the current original text of Annex (1) or Annex (2) first and build a clause-by-clause matrix by clause number; never carry over clause numbers from an older version.
• For every EPSP clause record at least three things: whether it applies, the method or standard adopted if it applies, and the evidence file and page number it points to.
• Fill risk control measures in three columns, design control, protective measures, and safety information, and self-check whether any risk that could have been designed out carries only a warning.
• When citing harmonized standards, state the standard number and version year and the specific clause coverage, avoiding a blanket claim of conformity to a named standard.
• Cross-reference the EP Checklist and the risk management file: every risk control row in the checklist should trace back to a specific risk number in the risk management file.
• If the product contains software or artificial intelligence components, explain separately the control tier for algorithmic risks and note that such products may be excluded from the reliance pathway; see https://www.grzan.cn/regulations/saudi/samd-and-aiemd-reliance-exclusion-16 .
• On the reliance pathway, EPSP conformity can support the Annex (1) rationale statement; see https://www.grzan.cn/regulations/saudi/sfda-reliance-pathway-mds-g030-12 .
• Have the GRZAN regulatory team re-check the clause mapping before submission, focusing on rows left as not applicable without any justification.

5. Verification checklist

• □ Confirmed whether Annex (1) (non-IVD) or Annex (2) (IVD) applies
• □ Clause numbers taken from the current version of MDS-REQ 1 and not carried over from an old version (the practical estimate item has been re-checked)
• □ Every EPSP clause carries an applicability judgment, a method or standard, and an evidence anchor
• □ Risk control measures are filled in the three-tier priority order with no reversed cases
• □ The safety information column is not used as the primary risk control measure
• □ The EP Checklist and the risk management file trace back to each other
• □ Cited harmonized standards state the standard number and version year
• □ Whether Annex (1) or Annex (2) has been upgraded has been checked on the SFDA website

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Saudi Arabian market. Our team prepares SFDA-compliant STAR dossiers, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com