Guidance on Artificial Intelligence (AI) and Machine Learning (ML) technologies based Medical Devices
Saudi Arabia · Guideline · Saudi Food and Drug Authority
Our summary
This guidance establishes requirements for obtaining marketing authorization in Saudi Arabia for AI and ML-based medical devices used to identify, treat or forecast health conditions. Manufacturers must provide technical documentation covering device specifications, risk assessments, clinical evidence of safety and effectiveness, and post-market monitoring plans. The guidance requires validation testing demonstrating the device meets its design specifications and performs safely under normal and foreseeable abnormal conditions.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
5 sections
Jump to a chapter
Introduction
Risk Management
Risk analysis must explore questions about diagnostic or treatment recommendations, information significance, target population, urgency, error detectability, autonomous functions, configurability, continuous learning capability, performance adjustment over time, off-label uses, misuse potential, patient condition restrictions in training data, and learning-related impacts. Additional risks include failure to act, data drift, data abundance with knowledge gaps, and fragmented data formats. When occurrence probability cannot be estimated, risks should be based on harm severity alone.
Quality Management Systems
Manufacturers must design, manufacture, and monitor AI/ML devices in accordance with ISO 13485, including developing quality policies, objectives, and procedures; assigning personnel with competencies in technology, software engineering, and clinical aspects; providing necessary infrastructure and resources; maintaining systematic documentation with robust configuration and change management; and implementing post-market surveillance with logging, complaint analysis, problem identification, corrective action, and evaluation using leading and lagging safety indicators. Manufacturers must maintain monitoring procedures for recognizing deliberate and accidental security risks during post-market surveillance and should use findings from prior project reviews and internal or external audits to enhance protection, functionality and reliability of AI/ML systems. Manufacturers should collect adverse event reports to SFDA and post-market data to guide decisions on forthcoming product versions.
Change Notification
Requires manufacturers to notify SFDA within 10 days of significant changes or 30 days of non-significant changes affecting device safety or effectiveness via the GHAD electronic system. The manufacturer must evaluate, verify and validate all changes through their quality management system procedures and categorize them accordingly.
Annexes
This annex provides definitions and abbreviations used in the guidance, including terms related to AI and ML in the medical sector such as AI-based medical devices, machine learning algorithms, genetic algorithms, and types of clinical studies. It also lists relevant reference standards and reading materials for software-based medical devices and AI/ML regulatory frameworks.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 10 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 2 of 4
- Risk classification, not covered
- Prohibited practices, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 2 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
Technical safeguards 2 of 4
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 2 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 2 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 14 are shown.
Risk Management 5 controls
- ObligationApplies to: ProviderDrafted by the Index
Manufacturers should include data scientists in cross-functional teams performing risk management tasks for AI and ML medical devices.
- ObligationApplies to: ProviderDrafted by the Index
Manufacturers should prepare a risk management plan documenting the scope of activities, assigned responsibilities, review requirements, acceptability criteria, residual risk evaluation, control implementation and effectiveness, post-production information collection, and procedures for updates and version rollback.
- ObligationApplies to: ProviderDrafted by the Index
For ML-based medical devices that connect to other devices or IT systems, the risk management plan should address risks related to interoperability.
- ObligationApplies to: ProviderDrafted by the Index
Manufacturers should ensure adequate training of human personnel to manage algorithm errors and limitations in ML systems that may not achieve complete accuracy.
- ObligationApplies to: ProviderDrafted by the Index
Risk analysis for ML medical devices should explore risks including whether the software provides diagnostic or treatment recommendations and how significantly such information influences clinical outcomes.
Quality Management Systems 5 controls
- ObligationApplies to: ProviderDrafted by the Index
Organizations must design, manufacture and monitor AI and ML devices in accordance with ISO 13485 quality management standards.
- ObligationApplies to: ProviderDrafted by the Index
Organizations must assign personnel competent in technology, software engineering and clinical aspects to AI and ML projects.
- ObligationApplies to: ProviderDrafted by the Index
Organizations must provide and maintain infrastructure throughout the AI and ML lifecycle to support development, production and maintenance of devices.
- ObligationApplies to: ProviderDrafted by the Index
Organizations must maintain documented configuration and change management processes with systematic documentation and traceability to identify constituent parts, record changes and enable recovery or recreation of past software versions.
- ObligationApplies to: ProviderDrafted by the Index
Organizations must conduct post-market surveillance including monitoring, logging, tracking of complaints, analysis of quality data and corrective actions to address identified problems.
Change Notification 4 controls
- ObligationApplies to: ProviderDrafted by the Index
Manufacturers should notify SFDA within ten days of significant changes or thirty days of non-significant changes affecting device safety or effectiveness via the GHAD electronic system.
- ObligationApplies to: ProviderDrafted by the Index
Manufacturers should incorporate procedures in their quality management system for assessing changes, classifying them as significant or non-significant, informing SFDA, and completing assessment through their established verification and validation protocols.
- ObligationApplies to: ProviderDrafted by the Index
Manufacturers should submit a version control form to SFDA describing each change, its classification, date, reason, and relevant supporting documentation.
- Applies to: ProviderDrafted by the Index
Manufacturers may defer updating non-significant changes that cannot reasonably affect device safety or effectiveness until the time of renewing medical device marketing authorization certificates.
Change history
No changes recorded since we began monitoring this policy.