When the Saudi Food and Drug Authority (SFDA) published MDS-G027, its Guidance on Digital Health Products, on 11 August 2025, it marked an important consolidation of the Kingdom’s regulatory thinking on one of healthcare’s fastest-moving areas. The document should be read alongside earlier SFDA instruments that have gradually built Saudi Arabia’s digital health regulatory architecture over the past decade or so. Its significance lies less in creating an entirely new regime than in clarifying how existing rules apply to a fast-expanding range of digital products.
The Framework Before MDS-G027
- The SFDA’s work on Software as a Medical Device (SaMD) began with MDS-G23 (Guidance on Software as a Medical Device), first circulated for public comment in March 2018 and finalised in April that year. That guidance incorporated the four foundational IMDRF SaMD documents, covering definitions, risk categorisation, quality management, and clinical evaluation. It established that SaMD is standalone software with a medical purpose, adopted the IMDRF two-dimensional risk matrix, and confirmed that mobile apps meeting the definition are regulated as medical devices. However, MDS-G23 was framed as “considerations” so it functioned more as interpretive guidance than hard law.
- Manufacturers seeking to place medical devices, including SaMD, on the Saudi market must obtain Medical Devices Marketing Authorization through the GHAD portal, appoint a Saudi Authorized Representative if based abroad, prepare a technical file, demonstrate ISO 13485-compliant quality management, and follow the risk-based classification scheme in MDS-G5, which divides devices into Classes A through D. That framework applies equally to hardware and software, with a product’s intended use and risk profile determining its class.
- A more specialised layer came with MDS-G010 in January 2023, SFDA’s Guidance on Artificial Intelligence (AI) and Machine Learning (ML) technologies based Medical Devices. That document covers the device lifecycle, including data quality, algorithm validation, post-market change notification, and links explicitly with the SFDA’s cybersecurity guidance. It also signals that Saudi regulation is not limited to static software but already contemplates AI-enabled products and their governance.
What MDS-G027 Adds
- Against that background, MDS-G027 is mainly clarificatory and integrative. Its stated purpose is to define the categories of digital health products within SFDA scope and distinguish regulated medical devices from general wellness products. That matters because digital health now includes mHealth apps, digital therapeutics, telemedicine systems, wearables, VR/AR tools, AI-enabled software, and other products that do not always fit neatly into older device categories. Similar regulatory classification issues are increasingly being examined by technology lawyers in UAE as digital health solutions continue to expand across the region.
- The guidance maps eight product categories and treats SaMD as the master concept under which most regulated digital health products fall. Its clearest contribution is the practical treatment of the SaMD/SiMD boundary, using a decision flow that asks whether software is an accessory or hardware driver, whether it analyses data beyond storage or archiving, and whether it is intended to benefit individual patients. This gives manufacturers a more operational way to assess classification than existed before.
- MDS-G027 also improves the handling of IVD-related software. The SFDA’s earlier IVD framework and general device rules already applied in principle, but the new guidance shows more explicitly how software that generates diagnostically relevant information from IVD data should be categorised. That is especially useful for laboratory analytics, point-of-care software, and AI-powered diagnostic platforms.
Wellness and Consumer Products
- Another useful contribution is the section on general wellness devices. This area had not previously been codified in a systematic way for digital health products in Saudi Arabia. MDS-G027 adopts a two-part test: a product is a wellness device if it makes no disease-specific claim, or if any disease reference is limited to lifestyle management rather than diagnosis, cure, prevention, or treatment. The guidance also requires bilingual labelling in Arabic and English for non-medical products, reflecting the Kingdom’s regulatory environment.
- The guidance additionally addresses the risk of reclassification where a wellness product is knowingly recommended for medical purposes. In such cases, the manufacturer must report the issue to the SFDA. This is important because it prevents companies from using wellness branding to avoid medical device obligations while effectively marketing a medical product.
Limits and Open Questions
- The guidance does not resolve the hardest global question in digital health regulation: how to deal with continuously learning algorithms after authorisation. MDS-G027 confirms that AI/ML enabled software with a medical purpose is regulated as SaMD and cross-refers to MDS-G010 on validation, transparency, human oversight, and lifecycle change management. But it does not address more advanced issues such as predetermined change control plans or software that materially changes its performance over time. That is likely to require either an updated MDS-G010 or a dedicated future guidance document.
- The SFDA has also shown, in practice, that it will apply independent scrutiny rather than relying on foreign approvals. A recent rejection of an AI/ML powered SaMD intended to predict type 2 diabetes risk illustrates that the authority expects products to meet Saudi safety and efficacy standards on their own merits. For market entrants, that is an important signal that regulatory strategy must be built specifically for the Kingdom.
Regulatory Direction
- As of the article’s date, no later SFDA digital health guidance has been published after MDS-G027. The current framework now consists of MDS-G23 on SaMD, MDS-G010 on AI/ML medical devices, cybersecurity guidance, and the innovative medical devices pathway. Taken together, these instruments give Saudi Arabia one of the more structured digital health regulatory frameworks in the region. Regulatory developments of this nature are also closely followed by a healthcare law firm in UAE advising clients on digital health, medical device compliance, and cross-border healthcare regulations.
- The practical message is that intended use remains the key classification trigger. MDS-G027 gives manufacturers better tools to determine whether a product is a medical device or a wellness product, and whether it falls within SaMD, SiMD, or IVD-related categories. But once a product is classified as a medical device, the full regulatory machinery applies, including technical documentation, clinical evaluation, cybersecurity, AI validation where relevant, post-market surveillance, and local regulatory representation. In that sense, MDS-G027 clarifies the gate, but not the obligations beyond it.
Authors: Shantanu Mukherjee, Varun Alase
