The Saudi Regulatory Landscape: What International Health Companies Actually Need to Know

Ask most international health companies what their biggest concern is about entering Saudi Arabia, and regulation comes up almost immediately.

The SFDA. The SCHS. MoH licensing. Entity registration. It can feel like a wall.

And the regulatory piece is genuinely important—it has to be done properly, in the right sequence, and with the right support. There’s no shortcut worth taking.

But here’s the thing most companies get wrong: they treat regulation as the primary obstacle. In reality, it’s a process to be managed. The companies that stall in Saudi usually don’t stall because of regulatory failure. They stall because they haven’t addressed the commercial, relational, and structural foundations that sit alongside it.

Regulation is a prerequisite. It’s not a strategy.

With that framing in place, let’s walk through what the landscape actually looks like.

The three main bodies you need to understand

Saudi Arabia’s healthcare regulatory environment sits across three main institutions, and understanding what each of them governs matters more than most companies initially appreciate.

The Saudi Food and Drug Authority (SFDA) is responsible for approvals relating to medical devices, diagnostics, pharmaceuticals, food products, and cosmetics. If your solution requires any kind of product registration—a device, an IVD, a software-as-medical-device classification—this is the primary body you’ll engage with.

The Saudi Commission for Health Specialties (SCHS) governs the licensing and classification of healthcare professionals operating in the Kingdom. If your service involves clinical practitioners, telemedicine specialists, or any kind of professional credentialing, SCHS is relevant to your operating model.

The Ministry of Health (MoH), through its various departments and the regional health clusters, governs broader healthcare operations, facility licensing, and procurement frameworks for public sector engagement. If you’re looking to work with the public system—hospitals, clinics, cluster procurement—understanding MoH structure is foundational.

These three don’t operate in isolation. Your pathway through them will depend on what you’re offering, how it’s classified, and where in the system you’re trying to operate.

Medical device registration: what the process actually looks like

For companies in medtech and diagnostics, the Saudi route to market runs through the SFDA’s Medical Device Marketing Authorization (MDMA) process.

As of 2026, all medical devices must follow the MDMA2 route—the Saudi national pathway—which requires a full Technical File Assessment (TFA) submitted through the SFDA’s GHAD portal. This applies regardless of device class and regardless of whether you already hold a CE mark, FDA 510(k), or other international approval.

International manufacturers must appoint an SFDA-licensed Authorised Representative (AR) in the Kingdom. This isn’t optional. The AR submits your application, manages post-market obligations, and acts as your in-country regulatory interface. Choosing the right AR matters—not just for compliance, but for how your application is positioned and followed up.

On timelines: Companies are often surprised by the range here. In straightforward cases where documentation is complete and well-organised, the initial review can be completed within 30–60 days. Full approval, including technical file review, typically takes between 3 and 6 months for lower-risk devices. For higher-complexity devices, or where documentation gaps require resolution, the process can extend to 12–14 months or longer.

This is not unusual by global standards. But it does mean that regulatory preparation needs to begin considerably earlier than most companies plan for. The companies that find the process most frustrating are usually the ones who started too late.

A few practical observations worth noting:

Prior international approvals (CE, FDA) support your application but don’t replace the SFDA review. Build your TFA with the Saudi submission explicitly in mind—don’t simply repurpose a European technical file and expect it to land cleanly.

Classification matters. Getting your device class right at the outset affects which pathway you follow and how your timeline is managed. Taking advice from someone with direct SFDA experience at this stage pays for itself quickly.

Digital health and software: a more nuanced picture

Companies working in health software, AI diagnostics, or digital health platforms face a slightly different regulatory environment—one that is still evolving.

The SFDA has been developing its framework for Software as a Medical Device (SaMD), broadly aligned with international IMDRF guidance. The classification and registration requirements for digital health tools depend significantly on the intended use and risk classification of the software.

Telehealth platforms, clinical decision support tools, and AI-powered diagnostic applications each sit in different places within this framework. The picture is more dynamic than for traditional hardware devices, which means engaging with specialists who are actively tracking SFDA SaMD policy is important.

What’s clear is that Saudi Arabia is not waiting for a fully mature regulatory framework before moving forward with digital health adoption. Pilots and procurement can proceed in parallel with registration processes in some cases—but this requires careful structuring from the outset.

Entity structure and business setup

One question that comes up consistently from companies at early-stage market entry is whether they need a local entity to do business in Saudi Arabia.

For most meaningful commercial engagement—especially with public sector institutions, government procurement, or hospital systems—the answer is effectively yes.

The options include a fully owned foreign entity under the MISA (Ministry of Investment) framework, a joint venture with a Saudi partner, or operating through a locally established distributor or authorised representative. Each has different implications for control, liability, and the depth of commercial relationship you can build.

Since 2021, international companies have been able to establish 100% foreign-owned entities in Saudi Arabia across most sectors. This has removed a barrier that previously pushed many companies toward partnership structures by necessity. That said, the choice between operating independently or with a local partner isn’t purely a regulatory one—it’s a commercial and strategic question that deserves careful thought.

A local entity signals seriousness and permanence to health system stakeholders. It enables direct contracting with public institutions. And increasingly, larger health clusters are asking for it as a condition of engagement—particularly for anything beyond an initial pilot.

The sequencing question

Where many companies go wrong is in the sequencing: they treat regulatory approval as something to complete before engaging the market, and then discover that the market relationships they need to build take just as long—sometimes longer—than the approval process itself.

The companies that navigate this most effectively run both tracks in parallel. Regulatory preparation begins early. Commercial and relationship-building activity begins at the same time. By the time approvals are in place, there’s already an engaged pipeline rather than a starting position.

This requires a clear understanding of what you can and cannot do at each stage. Pre-commercial engagement, educational activity, and pilot structuring can often begin well before formal registration is complete—if you approach it correctly.

What this means for your market entry plan

Getting the regulatory piece right in Saudi Arabia is non-negotiable. But the companies that do best here are the ones who have built their market entry plan around the regulatory timeline rather than being surprised by it.

That means starting the process earlier than feels necessary. It means investing in qualified in-country support from the outset. It means understanding the distinction between SFDA, SCHS, and MoH, and knowing which of those is most relevant to your specific offering. And it means treating compliance not just as a box to tick, but as part of how you build credibility with the health system you’re trying to work with.

At Welcome Health Ventures, regulatory navigation is a core part of how we support companies entering Saudi Arabia. Not because it’s the most exciting part of market entry—it usually isn’t—but because getting it wrong early creates problems that take much longer to fix than it would have taken to get right in the first place.