ISO 13485 for device makers and distributors
A medical device quality system built to the standard and to what SFDA expects your type of establishment to hold.
- Standard
- ISO 13485:2016, adopted as SFDA.MD/GSO ISO 13485
- Certificate required
- Manufacturers, importers and distributors in categories A and B
- Authorised reps, categories C and D
- Documented evidence, or an SFDA inspection
- Certificates issued by
- Bodies SFDA recognises: SFDA-licensed in the Kingdom, IAF-accredited outside it
- First system
- Timeline set at scoping, by what you do
ISO 13485:2016 is the quality management standard for medical devices. SFDA requires manufacturers, importers and distributors in establishment categories A and B to hold an ISO 13485 certificate from a body it recognises, and asks authorised representatives and category C and D importers and distributors for documented evidence or an SFDA inspection. We build that system with your people.
- 01 Enquiry
- 02 Survey
- 03 Scope
- 04 Plan
- 05 Execute
- 06 Evidence
- 07 Review
- 08 Next cycle
ISO 13485 for device makers and distributors sits at step 5 of the same eight steps, with health's names. You receive completed task records.
The distributor running a factory's manual
A common failure is a distributor holding a quality manual written for a factory.
It describes design control, production and process validation that the company does not do. Meanwhile the things a distributor must do well are thin or missing.
Ask a distributor to trace one lot of catheters from the day it arrived to the three hospitals that received it, and the answer is often a spreadsheet with the hospital column blank. Ask to see the complaint log, and product complaints sit beside late-delivery complaints. Ask how an adverse event reaches SFDA, and nobody owns it. Those are the questions an SFDA inspector asks. They are also the ones that matter on the day a manufacturer issues a recall.
ISO 13485 lets a company exclude design and development where it does not design, with the justification written into the manual. A distributor's system should be smaller than a manufacturer's, and sharper where the risk is: traceability, storage, complaints, reporting and control of the manufacturers it buys from.
What ISO 13485 adds to ISO 9001, and where it asks for more
Companies holding ISO 9001 often assume the step is small. It is not. ISO 13485 adds device-specific requirements and makes some shared ones stricter, because it is written for regulators rather than for customers.
| Requirement | What it means in practice | Clause |
|---|---|---|
| Regulatory requirements built into the system | Your procedures cite what SFDA requires, not only what the standard says. | Throughout, from 4.1 |
| A medical device file per device type | One file that holds or points to everything about the device. | 4.2.3 |
| Risk management across product realisation | A documented risk process, usually built on ISO 14971. | 7.1 |
| Traceability | Lot or serial numbers traceable to the customer who received them. | 7.5.9 |
| Preservation of product | Storage and handling conditions controlled, and the records read. | 7.5.11 |
| Complaint handling | Every complaint assessed for whether it must be reported. | 8.2.2 |
| Reporting to regulatory authorities | A procedure that ends at SFDA, with a named person responsible. | 8.2.3 |
| Validation of software used in the system | The spreadsheet or system you track lots in is validated for that use. | 4.1.6 |
Documents you keep
The requirement map
What SFDA expects of your establishment type, on one page, with the requirements that sit beside the quality system.
The gap report
Clause by clause and SFDA requirement by requirement, with every exclusion justified.
The documented system
Sized to your activities and under your document control, with procedures written by the people who do the work.
The traceability register
Lot or serial numbers from goods-in to the customer, and the mock recall record that tests it.
The complaint and vigilance procedure
Every complaint assessed, ending at a written decision on whether it is reported to SFDA.
The internal audit report and review minutes
The system audited as an assessor would audit it, then reviewed by management, before anybody external arrives.
Seven steps, from category to readiness pack
Each step ends with something on paper.
- 01
Establish your category and role
Manufacturer, authorised representative, importer, distributor or a mix, and which SFDA requirements follow. Ends with the one-page requirement map.
- 02
Walk a device through the business
From purchase order to hospital delivery, and back again for a complaint or a recall. Ends with the process map, risks marked.
- 03
Gap analysis
Every clause and every mapped SFDA requirement against what exists. Ends with the gap report and the justified exclusions.
- 04
Build
Procedures written with the people who do the work, and forms designed for the warehouse floor, all under document control.
- 05
Run it
Real records: goods received, deliveries made, a complaint handled and a mock recall traced from goods-in to the hospital.
- 06
Internal audit and management review
The system audited as an assessor would audit it, findings closed, then reviewed and minuted by management.
- 07
You choose a certification body
You approach a body SFDA recognises, on your schedule, with the readiness pack in hand.
A Riyadh distributor, from a borrowed manual
A Riyadh distributor supplies single-use devices to hospitals from several overseas manufacturers. Its licence renewal is due, a hospital tender has asked for ISO 13485, and it holds ISO 9001 with a manual a previous consultant wrote for a manufacturing plant.
We start with a mock recall: pick a lot delivered last year and trace it. The goods-in record has the lot number; the delivery notes do not. The warehouse temperature logger records every hour, and nobody has read the data in months. Complaints about damaged cartons and complaints about device performance share one log, and none has been assessed for reporting to SFDA.
The manual is cut down to what the distributor does, with design and production excluded and justified. Lot numbers are added to the delivery note and the traceability register. The logger data is reviewed weekly and the review is signed. Complaints are split, and device complaints go through an assessment that ends at a reporting decision. A supplier file is opened for each manufacturer, holding its marketing authorisation, its certificate and the agreement.
After the team has produced records, the mock recall is repeated and traces to every hospital. The distributor holds a quality manual with justified exclusions, a procedure set, the traceability register, two mock recall records, the complaint and vigilance log, a supplier file per manufacturer, an internal audit report and management review minutes. It then approaches a certification body of its own choosing.
SFDA's expectations, by establishment
The standard is the same for everyone. What SFDA asks you to hold is not. Its March 2025 guidance, MDS-G024, maps each clause of ISO 13485 to its own requirements. Your category as an importer or distributor comes from the questionnaire you completed in SFDA's GHAD system, and if you do not know it, it is the first thing we find out.
A full system, with a certificate
A full ISO 13485 system with a certificate from a body SFDA recognises, covering design wherever you design. Beside it sit an industrial licence, the technical documentation for each device and its marketing authorisation.
- Design and development in scope wherever you design
- Production and process validation records from the system in use
- A medical device file for each device type
Evidence of the system, or an inspection
Documented evidence of the quality system, or an SFDA inspection report. The work beside it is the relationship with each manufacturer you represent.
- A written agreement with each manufacturer
- Records of every task done for them
- A procedure to follow up field safety corrective actions
A certificate, sized to distribution
An ISO 13485 certificate. The system is built around traceability, storage and complaints, with design and production excluded and the justification written into the manual.
- A tracking procedure for every device supplied
- A storage and transport procedure to MDS-REQ 12
- A supplier file for each manufacturer
Documented evidence, or SFDA's own inspection
SFDA accepts documented evidence of the system or its own inspection. Either way the evidence is an ISO 13485 system, with the same tracking and storage procedures as a category A or B company.
Storage and transport under a licence
Storage and transport to MDS-REQ 12, a technical manager and a licence. Where the warehouse belongs to a distributor, its conditions and records become part of that distributor's quality system.
Questions device companies ask
We only distribute. Do we really need ISO 13485?
If SFDA places you in category A or B, yes, a certificate. In categories C and D, SFDA accepts documented evidence or its own inspection, and the evidence is an ISO 13485 system either way. The system for a distributor is smaller than for a manufacturer.
We hold ISO 9001. Is that enough?
Not for SFDA. ISO 13485 adds device-specific requirements and makes some ISO 9001 requirements stricter, as the table above shows. Your 9001 system is a good foundation, and much of it carries over.
What goes in a medical device file?
Clause 4.2.3 asks for one file per device type that holds or points to everything about it: the description and intended use, the labelling, the specifications, and the procedures for making, storing, handling, installing and servicing it. For a distributor, much of it is the manufacturer's documentation, referenced and kept current.
Can you get us certified?
No. We build the system and you approach a certification body SFDA recognises. SFDA keeps the two roles apart: staff of the bodies it licenses must not have consulted on medical devices, and may hold no financial interest in the companies they assess.
How long does it take?
The timeline is set at scoping, from what you do with devices and what your current system already covers. Most of it is spent producing records, which need time to exist.
Around this
ISO 9001
The foundation most device distributors already hold, and the part of it that carries across.
Read moreITF ConsultInternal audit
The audit that has to run before any certification body arrives, done the way an assessor does it.
Read moreITF TrainingDocument control course
For the people who will keep the procedures and records under control once the build is done.
Read moreSectorMedical device companies
What ITF Health does for device makers, importers and distributors.
Read morePart of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
Start with the requirement map
One page that says what SFDA expects of your establishment type, and where your current system stands against it.