Linking Post-Market Surveillance with UDI Data Maintenance

1. Key takeaways

MDS-REQ 7 V4.0 (MDS-REQ-007-V4/220524, version date 2022-05-24) provides that the manufacturer or the AR must submit and maintain data in the Saudi-DI database, that the data in GHAD and Saudi-DI (such as model names and GMDN codes) must be accurate, and that new UDI-DI data must already be in the database when the device is placed on the market. This requirement turns UDI from a one-off pre-market coding exercise into a continuous post-market maintenance duty, and it interlocks directly with the traceability system requirement of MDS-REQ 11: the device identification in the traceability ledger comes from the UDI-DI, so once the database lags, traceability cannot land. UDI consists of the UDI-DI (device identifier) and the UDI-PI (production identifier), and the recognised issuing agencies are GS1, HIBCC and ICCBBA.

• The manufacturer or AR must submit and maintain Saudi-DI data continuously.
• Model names and GMDN codes must match between GHAD and Saudi-DI.
• New UDI-DI data must be in the database before the device ships: data first, shipment second.
• Recognised issuing agencies: GS1, HIBCC and ICCBBA.
• Direct marking (DM) for reusable devices must remain readable over the expected lifetime.

2. Legal basis

The UDI data duty derives from MDS-REQ 7 and interlocks with the traceability requirements of MDS-REQ 11; the parent law and implementing regulation supply the enabling provisions, while the phased mandatory dates are a practical estimate pending verification.

3. Expert insights

1. Data consistency is a requirement spanning two systems. The wording of MDS-REQ 7 is not that data must be filled into Saudi-DI, but that the data in GHAD and Saudi-DI must be accurate. The two systems are maintained by different processes: GHAD carries the MDMA application and technical files, Saudi-DI carries the UDI data. Model names and GMDN codes must be identical in both places; if a model change is made on the GHAD side without synchronising the Saudi-DI side, an inspection shows the same device pointing to two different identities across two official systems. For Chinese manufacturers with many models and frequent iterations, this means UDI maintenance must be folded into change management: every change judgement described in article 46 should carry a linked check of whether the UDI-DI is affected.

2. The pre-market data requirement pushes UDI from the back office to the shipping gate. MDS-REQ 7 requires new UDI-DI data to be in the database when the device is placed on the market, meaning data in first, shipment second. The point where this rule bites in the supply chain is that the UDI-DI of a new model or new packaging level must be submitted to Saudi-DI after the production plan is fixed and before the finished goods ship. UDI must appear on the device label and all higher packaging levels, presented both as easily readable plain text (HRI) and through automatic identification and data capture technology (AIDC); barcodes must be verified against the applicable ISO/IEC standards. Reusable devices subject to UDI must also bear a direct mark (DM) on the device body, permanent and readable throughout normal use and the expected lifetime; once such a device has left the factory, retrofitting the mark costs far more than completing it before shipment.

3. Vigilance data and UDI data interlock in both directions. MDS-REQ 11 requires a traceability system recording all supply and distribution information. The minimum usable set of that complete information is UDI-DI plus batch or serial number: a traceability ledger without UDI cannot locate the affected scope in a real event, which directly causes the incomplete FSN distribution described in article 44. In the other direction, vigilance data should also feed back into UDI maintenance decisions: a batch repeatedly showing the same failure mode may indicate that a BOM or process change has substantively affected the device identity, triggering an assessment of whether a new UDI-DI is needed. GRZAN designs these two data flows as one closed loop: vigilance ledger, batch location, UDI review, new UDI-DI where necessary, synchronised to Saudi-DI and GHAD.

The basic rules of UDI coding and issuing agencies are covered at https://www.grzan.cn/regulations/saudi/udi-and-saudi-di-database-37 , and the scope-location logic for vigilance events at https://www.grzan.cn/regulations/saudi/field-safety-corrective-action-process-44 .

4. Practical recommendations

• Make whether the UDI-DI is affected a fixed question in the change judgement checklist, used together with the nine-dimension list of article 46.
• Run a quarterly reconciliation between GHAD and Saudi-DI, comparing model names and GMDN codes item by item.
• Move the UDI-DI submission node forward in the production plan; models not yet in the database are barred from shipment.
• Complete direct marking (DM) on reusable devices before they leave the factory and verify readability over the expected lifetime.
• Use UDI-DI plus batch or serial number as the minimum field set of the traceability ledger so the affected scope can be located.
• Let repeated failure modes in the vigilance ledger trigger a UDI review assessing whether a new UDI-DI is needed.
• Appoint the AR or an internal owner for Saudi-DI maintenance, keeping the timestamp and receipt of every submission.
• Check the current UDI mandatory batches on the Saudi-DI and GHAD portals (a practical estimate) and adjust the label switchover plan accordingly.

5. Verification checklist

• □ The change judgement checklist includes the question of whether the UDI-DI is affected
• □ The quarterly GHAD and Saudi-DI reconciliation mechanism is running
• □ UDI-DI submission is positioned in the production plan as a shipping gate
• □ Direct marking of reusable devices was completed before shipment and verified
• □ The traceability ledger field set meets batch-location requirements
• □ Repeated vigilance failure modes have triggered the UDI review process
• □ The Saudi-DI maintenance owner has been appointed and receipts archived
• □ The current UDI mandatory batches have been checked on the portals (a practical estimate)

Regulatory information verified as of October 29, 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Saudi Arabian market. Our team manages adverse event reporting and recall coordination with the SFDA National Center, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com