The MDSAP Certificate as QMS Evidence in SFDA Applications

1. Key takeaways

In its Quality Management System paragraph, MDS-G030 (V1.0 / 2026-09-09) states something directly actionable: the SFDA accepts MDSAP certificates and audit reports issued by MDSAP auditing organizations as evidence of conformity with the QMS requirements. This turns the QMS step from preparing a separate set of documents for Saudi Arabia into submitting the MDSAP results already in hand. Three preconditions must hold simultaneously: the certificate was issued by an MDSAP-recognised auditing organization; the certificate is within its validity; and its scope covers the activities and product categories in this application. The conventional ISO 13485:2016 requirement has not been cancelled — Law M/54 Article 1 defines the QMS by the latest version of ISO 13485 or an equivalent standard, and the licensing premise of MDS-REQ 9 (V1.0 / 2022-07-31) and the inspection logic of MDS-REQ 10 (V1.0 / 2022-06-22) continue to apply. Regulatory information verified as of 29 October 2026.

• The SFDA accepts MDSAP certificates plus audit reports from MDSAP auditing organizations as QMS evidence.
• Three simultaneous preconditions: recognised issuing body, valid certificate, scope covering the filed activities and categories.
• ISO 13485:2016 remains the baseline under Law M/54 Article 1, MDS-REQ 9 and MDS-REQ 10.

2. Legal basis

The following instruments govern the QMS acceptance, its statutory definition and the licensing and inspection layers around it.

3. Expert insights

1. In the conventional pathway the QMS is a separate leg

In many companies’ mental model the QMS certificate is an attachment placed behind the technical file. The Saudi system does not work that way. The technical file answers whether this product is safe and performs as intended; the QMS answers whether this company can consistently make the same safe, performing product. The two land on different levels: the former is carried by an Annex, the latter directly determines whether the establishment licence under MDS-REQ 9 can be issued. That MDS-G030 devotes a separate paragraph to the QMS means this leg is also brought within what can be relied upon, rather than passing by default. One companion rule is easily missed: the MDMA validity cannot exceed the expiry date of the supporting QMS certificate (article 20 of this series) — the expiry of the MDSAP or ISO 13485 certificate therefore truncates the MDMA’s validity backwards. The QMS certificate is not a static document filed once; it is a living document that keeps affecting the certificate’s force.

2. MDSAP’s marginal value is merging several audits into one

MDSAP was designed so that one audit satisfies several regulatory jurisdictions at once; five participate — the US FDA, Health Canada, Australia’s TGA, Japan’s MHLW/PMDA and Brazil’s ANVISA (per the latest official MDSAP publication). For Chinese manufacturers the arithmetic is direct: if the product line already plans to enter two or more of the US, Canada, Australia and Japan, MDSAP’s marginal cost is already falling, and SFDA acceptance pushes the fifth stop’s cost to nearly zero. Conversely, a company targeting only Saudi Arabia should not pursue MDSAP for its own sake — a single ISO 13485:2016 certificate issued by an SFDA-recognised CAB costs less and is functionally sufficient. This is an account to be run against the company’s own market structure, not a default pursuit of the highest certificate tier.

3. Certificate scope matters more than the certificate name

MDS-G030’s original words accept the MDSAP certificate and the audit report issued by the auditing organization — the two are listed side by side, and the meaning is clear: the report records what was audited, where, and which activities were covered; what the SFDA wants to see is that process record, not the letterhead. The common failure is a certificate whose stated activity scope does not cover the filing content — for example a certificate covering only design and development while the Saudi filing also involves local assembly or labelling, or a site list omitting the factory actually producing the product. There is also a Saudi-specific question: the Manufacturer definition in Law M/54 Article 1 counts refurbishing, assembling, packaging and labelling as manufacturing, so an entity performing these actions in the Kingdom may be deemed a manufacturer, and if it is not inside the QMS certificate scope the verification chain breaks. Aligning this before scheduling the audit costs far less.

Two related articles read well together: the reliance pathway’s time account is in https://www.grzan.cn/regulations/saudi/sfda-reliance-pathway-mds-g030-12 , and the linkage between MDMA validity and renewal is in https://www.grzan.cn/regulations/saudi/mdma-validity-and-renewal-20 .

4. Practical recommendations

• First confirm that the issuing body is an MDSAP-recognised auditing organization, and keep the body’s credential evidence and the audit report originals.
• Align the site list and activity scope in the certificate annexes with the products and factories in this application item by item; where gaps appear, complete the audit before filing rather than filing first.
• Set an expiry alert for QMS certificates: record the expiry dates of ISO 13485 / MDSAP certificates in the ledger, because they constrain the MDMA validity.
• Companies that have completed MDSAP should have the corrective-action records for the last audit’s findings ready, deliverable immediately if the SFDA asks.
• Companies serving only the Saudi market need not pursue MDSAP for its own sake; an ISO 13485 certificate in the 2016 edition per MDS-REQ 9 and MDS-REQ 10 suffices.
• If assembly, packaging or labelling is planned inside Saudi Arabia, determine early whether that entity triggers the Manufacturer definition and bring it into QMS coverage.
• Record in the Annex (1) explanatory material the fact, reasons and evidence of whether MDSAP was used in this application, forming a traceable decision record. GRZAN archives this decision record together with the audit report for direct retrieval when answering later queries.

5. Verification checklist

• □ The MDSAP certificate (or ISO 13485:2016 certificate) is valid and the issuing body holds the relevant qualification
• □ The certificate’s product categories and activity scope include the content of this application
• □ The certificate’s site list includes every factory actually producing the product
• □ The MDSAP audit report original is archived, with audit scope, dates and findings
• □ Corrective actions on findings are closed, with evidence submittable alongside the report
• □ The QMS certificate expiry date is recorded in the ledger and the MDMA validity boundary is projected from it
• □ Where in-Kingdom assembly, packaging or labelling is involved, it has been confirmed whether the entity constitutes a Manufacturer and has been brought into the QMS

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Saudi Arabian market. Our team manages SFDA MDMA applications across classes, prepares reference-approval dossiers, and supports post-market vigilance obligations. Business enquiries: info@grzan.com