English — complete original pages and qualified native search text

MDS – REQ 7 Requirements for Unique Device Identification (UDI) for Medical Devices Version Number: 4.0 Version Date: 24/05/2022

Table of Contents Introduction .............................................................................................................................................................................................................. 3 Purpose ........................................................................................................................................ 3 Scope .......................................................................................................................................... 3 Background ................................................................................................................................. 3 UDI Requirements .............................................................................................................................................................................................. 4 A. General Requirements: ..................................................................................................... 4 B. Direct Marking (DM) ....................................................................................................... 5 C. The UDI-DI Lifecycle ...................................................................................................... 6 D. Saudi Arabia UDI Database - (Saudi-DI) ......................................................................... 7 E. Request for an Exception from or Alternative to the UDI Requirement .......................... 9 Additional Requirements ............................................................................................................................................................................ 10 A. Software as a Medical Device (SaMD) .......................................................................... 10 B. Implantable Devices ....................................................................................................... 10 C. Configurable Devices ..................................................................................................... 11 D. Components and sub-systems ......................................................................................... 11 E. Device constituent parts of “Combination Products” ..................................................... 11 F. Accessories ..................................................................................................................... 11 G. Single Use Device Exception ......................................................................................... 12 H. Procedure Pack and Kits (which includes non-homogenous package configurations)... 12 I. Devices Sold at Retail ..................................................................................................... 13 J. Own Brand/Private Labelers ........................................................................................... 13 K. Relabeled, Repackaged, Remanufactured, and Serviced Devices .................................. 13 Compliance Dates............................................................................................................................................................................................. 14 Annexes .................................................................................................................................................................................................................... 15 Annex (1): Definitions & Abbreviations ................................................................................... 16 Annex (2): List of Changes on the Previous Version ................................................................ 20 MDS-REQ-007-V4/220524 2 / 20

Introduction Purpose This document aims to identify SFDA requirements of Unique Device Identification (UDI) for medical devices. The purpose of UDI requirements and its database is to provide standardized identification of medical devices. The associated device-specific meta-data will support a numerous and various public-health and safety initiatives. These include device traceability, identification of fraudulent medical devices, safety alerts, field safety corrective actions, incident, adverse event reporting, etc. Scope The requirements apply to the following: A. All medical devices and medical supplies and accessories that are intended to be placed on the Kingdom of Saudi Arabia market and not exempted from marketing authorization requirements. B. Manufacturers, Authorized Representatives Background SFDA issued this document in reference to article (10/17) of the " Executive Regulation of Medical Devices Law" issued by Saudi Food and Drug Authority Board of Directors decree No. (3-29-1443) dated 19/2/1443H. MDS-REQ-007-V4/220524 3 / 20

UDI Requirements A. General Requirements: 1. The manufacturer shall assign and manage UDI by following and applying the standards and specification of one of the accepted issuing agencies (GS1, HIBCC and ICCBBA). 2. The marking of the UDI does not replace any other marking or labeling requirements. 3. The UDI shall contain two parts: the UDI-DI and the UDI-PI(s). a. The UDI-DI is unique to a specific manufacturer’s device and provides access to the information in (Saudi-DI) database. Moreover, The UDI-DI shall be globally unique at all levels. b. If a lot number, serial number, software identification, expiration date (use by), or manufacturing date, is on the label or package, it shall be included in the UDI-PI. However, if manufacturing date is not used for control purposes, and other UDI-PIs are present, then manufacturing date may be omitted from the UDI. 4. The UDI shall be placed on the primary label of the device and on all higher levels of packaging and be presented in two forms: a. Easily readable plain-text (Human readable interpretation HRI), and b. AIDC technology. 5. The HRI format shall follow the rules of the UDI issuing agency; it shall be the full, proper HRI, including application identifier (AIs), and NOT a mix of HRI and non-HRI text. 6. If the AIDC technology is not evident upon visual examination of the label or package, the label or package shall disclose the presence of AIDC technology. 7. When there is an AIDC carrier on the product labeling other than the UDI, the UDI shall be easily and readily identifiable. 8. If using a linear barcode on the primary package, the entire UDI shall concatenate into a single barcode. 9. Stacked/spilled barcode alone is not acceptable on the primary package. 10. If the manufacturer is using RFID technology, a linear or 2D barcode or another type of barcode shall also be provided on the label. MDS-REQ-007-V4/220524 4 / 20

11. Barcodes shall be verified according to the appropriate ISO/IEC standard, and they shall meet the issuing agency’s grading standards. 12. The UDI shall be readable during normal use and throughout the intended life of the device. 13. The UDI shall be placed so that the AIDC can be accessed during normal operation, storage and transport. 14. If the UDI is readily readable and in the case of AIDC scannable through the device’s package, then the placing of the UDI on the “outer” package shall not be required. 15. Other Production Identifier (PI) (such as expiration, use by date, lot number) shall not be removed from the label or package even if it is being conveyed in the UDI. 16. Placing of the UDI on the label or device itself shall not negatively impact the risk and performance of the device. B. Direct Marking (DM) 1. Reusable devices subject to the UDI requirements shall also bear a DM UDI on the device itself if the device is intended to be used on multiple patients and intended to be reprocessed between patients uses, the UDI must be readable after reprocessing cycles for the intended life of the device. 2. The DM UDI shall be permanent and readable during normal use and throughout the intended life of the device. 3. If the device’s primary label is on the device itself and is permanent – a separate DM UDI is not required. However, the UDI label requirements will apply. 4. The UDI provided through the DM UDI may be: a. Identical to the UDI that appears on the label of the device, or b. A different UDI used to distinguish the unlabeled/unpackaged device. 5. Direct Marking UDI may be provided through either or both of the following: a. Easily readable plain-text/HRI; b. AIDC technology, or any alternative technology, that will provide the UDI of the device on demand. MDS-REQ-007-V4/220524 5 / 20

6. A reusable device is exempt from the DM requirement if the manufacturer can adequately demonstrate and document that: a. Any type of DM would interfere with the safety, performance or effectiveness of the reusable device; b. The reusable device cannot be directly marked because it is not technically feasible; c. The reusable device has been previously directly marked. d. The reusable device is only intended to be cleaned between patient use (and not intended to undergo disinfection and/or sterilization before each use or between uses e. The reusable device is a single-patient use device (that is used more than once on or by the same patient). C. The UDI-DI Lifecycle A new, unique UDI-DI is required whenever there is: 1. change made to a device or its attributes, and the change may include but not limited to the following: a. a new variant such as version, model, etc. b. Could lead to ambiguity in the identification of the device, c. Could affect the traceability of the device, d. Creates a new package, or 2. Change to any of these data elements: a. Issuing Agency b. Primary UDI-DI Number c. Quantity of items within the package d. Brand/Trade Name e. Version or Model f. Clinically Relevant Size g. Labeled as Single Use h. Device required to be labeled as containing natural rubber latex i. MRI safety information (if not already labeled as Safe, Unsafe, or Conditional) j. Device Packaged as Sterile MDS-REQ-007-V4/220524 6 / 20

D. Saudi Arabia UDI Database - (Saudi-DI) 1. The manufacturer, authorized representative, shall submit and maintain the appropriate data to the (Saudi- DI) database for all devices subject to this guidance. 2. The UDI-DI data shall be available in the (Saudi-DI) database at the time the device is placed on the market. 3. For changes not requiring a new UDI-DI, the manufacturer shall update the relevant record within ten working days of making the change. 4. The manufacturer, or its authorized representative, shall validate UDI data during submission process also on an annual basis. 5. SFDA may request additional information, updates, or data confirmations at any time. 6. Some data in the (Saudi-DI) database will be publicly available. 7. The manufacturer, authorized representative shall provide in the (Saudi-DI) database all the following device attribute information unless otherwise noted. 8. All the following device attribute information shall be provided unless otherwise noted. (Note: Some of the data values will be retrieved from SFDA databases and do not require to be entered again in the (Saudi-DI) database: a) Information Retrieved from SFDA database 1 SFDA medical device listing number 6 Name and address of the manufacturer 2 Name and address of the authorized representative. 7 Home-use / lay person 8 Arabic version of Brand/Trade name – for Lay 3 Brand/Trade name person/ home-use devices. Device description – as labeled, in the labeling, or 9 Arabic version of device description – for lay 4 presented in marketing material, including a website. person / home-use devices 5 Risk class of the device. (A, B, C, D) 10 GMDN MDS-REQ-007-V4/220524 7 / 20

b) Information to be Entered in (Saudi-DI) database Variants such as version/model name/number identifier. Note that this is a manufacturer specified identifier – and is 1 10 Catalog number in addition to, and different from, the GMDN Preferred Term identified. Primary UDI-DI on the device’s primary label, which consider a primary key in the database and other DIs are linked to it. It’s the GTIN-14 (GS1) [and for those devices 2 11 Clinically Relevant Size intended exclusively for retail Point of Sale (POS), the GTIN-12/13 provided in a 14-digit format], HIBC-LIC (HIBCC), or ISBT 128-PPIC (ICCBBA) Device labeled as containing natural rubber 3 Quantity – number of devices in this package 12 latex or dry natural rubber Unit of use the DI number (when the number of units Device labeled as "Not made with natural 4 13 (quantity) >1) [can be used in multiple DI records] rubber latex" Production identifier(s) included in the UDI [lot/batch MRI safety status (safe, unsafe, or conditional 5 number, serial number, expiration (use by) date, 14 – or label does not contain) manufacturing date, and/or software version number] Critical warnings or contra-indications (as 6 Is it a software 15 indicated on the device label) The maximum number of reuses (where the label indicates 7 16 Special storage conditions (if labeled) the maximum number of reprocessing cycles) The equivalent DIs to the primary DI If the same device can be provided to the KSA market with different DI 8 (separate DI records for the other DIs may, or may not, be in (Saudi-DI) database). Previous DI (see Chapter One, section C) – the UDI-DI that was changed because there was a change made to a 9 device or its attributes that resulted in a new DI record, a new version or model, or a new package. For Kit / Procedure Pack, or Configurable devices List the components 17 Is it a single-use device or kit / Procedure Pack, or configurable devices 18 Name of the component 19 DI of component 20 DI Issuing agency of component For devices subject to Direct Marking and DM UDI is different than the primary label UDI, 21 provide the Direct Marking Device Identifier (DM-DI) 22 Determine Product Identifier (PIs): lot number, serial number, expiration (use by) date, manufacturing date, The DM UDI is presented as: 23 • Plain-text/human-readable interpretation (HRI) • AIDC For devices packages (repeatable for multiple packages levels ): 24 The Package UDI-DI number 25 Quantity per package 26 Package type (e.g., case, carton, box) MDS-REQ-007-V4/220524 8 / 20

E. Request for an Exception from or Alternative to the UDI Requirement In certain cases, such as space constraints, may need an exception from certain requirement. Therefore, manufacture shall assess the case based on the requirements to 1. A manufacturer, authorized representative may submit a request for an exception from or alternative to any of the requirements. 2. A written request for an exception or alternative shall: a. Identify the device or devices that would be subject to the exception or alternative; b. Identify the specific parts of this guidance for an exception or alternative; c. If requesting an exception, explain why you believe the requirements are not feasible; d. If requesting an alternative, describe the alternative and explain why it would provide for more accurate, precise, or rapid device identification than the requirements or how the alternative would better ensure the safety or effectiveness of the device that would be subject to the alternative. MDS-REQ-007-V4/220524 9 / 20

Additional Requirements A. Software as a Medical Device (SaMD) / Software in a Medical Device (SiMD) 1. SaMD and SiMD that are distributed in both a physical, packaged form and in a form that is not packaged (e.g., when downloaded) may use the same or a different UDI for each form. 2. UDI shall be applied to the physical media and label or package that containing SaMD /SiMD. 3. UDI shall be provided on a readily accessible screen for the user in an easily readable plain-text format (e.g., in an about, help, or start-up screen). 4. Software lacking a user interface (e.g., middleware for image conversion) shall be capable of transmitting the plain-text/HRI portion of the UDI through an Application Programming Interface (API). 5. Only the plain-text/HRI portion of the UDI shall be required in the software display and shall include the relevant Products Identifier (PIs) / application identifier (AIs). 6. In addition to the change rules outlined in Chapter One, section (C), a new UDI-DI shall be required whenever there is a major modification that impact: a. The original performance and effectiveness, b. The safety or the intended use of the Software, or c. The interpretation of data. B. Implantable Devices 1. Implantable devices that include a patient Implant card shall contain the device's identification, including its UDI information. 2. The full UDI (UDI-DI and UDI-PI) of an implantable device shall be readily available, either electronically or readable (scannable), at the point of implantation. 3. All active implantable devices shall be controlled by serial number. MDS-REQ-007-V4/220524 10 / 20

C. Configurable Devices 1. An UDI shall be allocated to the configurable device in its entirety and called the configurable device UDI. 2. The configurable device UDI shall be placed on the assembly that will not be exchanged during the lifetime of the system and shall be identified as the Configurable device UDI. 3. If the configurable device UDI is present electronically and not physically located on the label, then the location and how to access it shall clearly describe and identify to the user in the label and the operation interface D. Components and sub-systems 1. Each component or sub-system that can be removed or separated from the configuration or is available and distributed on its own (placed on the market) shall have its own, separate UDI and meet all of the other UDI requirements. 2. Components that significantly change the intended purpose, safety, or performance of the device shall, for the purposes of UDI, be considered a remanufacturing operation – and as such, subject the entire device to a new UDI-DI. E. Device constituent parts of “Combination Products” When a device is placed on the market or put into service, incorporates a substance which, if used separately, would be considered to be a medicinal product, and as per SFDA classification and authorization the medical device(s) and medical supply, and/or its accessories, shall meet the UDI requirements. F. Accessories Each accessory that can be installed or removed by the end-user (regardless of whether it is commercially available and distributed on its own) or is available and distributed on its own (placed on the market), shall have its own, separate UDI and meet all of the other UDI requirements of this guidance. MDS-REQ-007-V4/220524 11 / 20

G. Single Use Device Exception 1. Individual single-use devices, which are labeled and packaged individually, are not required to have the UDI on the individual device label/package if all of the following conditions are thoroughly documented and met – the single-use devices are: a. All of the same version or model, b. Distributed together in a single package, c. Stored in that package until removed for use, d. Not intended for individual distribution, and e. Not implantable devices. 2. The primary UDI will be on the package of these individual single-use devices. 3. When this exception is used, (Saudi-DI) database will require that a Unit of Use DI be assigned to the unmarked individually labeled and packaged device and entered into the database. 4. UDI Direct marking is not a mandatory requirement on single-use devices H. Procedure Pack and Kits (which includes non-homogenous package configurations) 1. A procedure pack or kit shall have its own, unique UDI (DI and PI) – referencing this specific collection of devices. 2. All of the devices within the pack/kit shall be marked with their own UDI. unless the device is: a. An individual single-use disposable device, which cannot be used outside the context of the kit or procedure pack, or b. Otherwise exempt from having an UDI on the label or package of the device that is in the kit or procedure pack. MDS-REQ-007-V4/220524 12 / 20

I. Devices Sold at Retail 1. For devices intended exclusively for retail point of sale, the UDI-PI(s) do not need to be included in the UDI’s AIDC or other alternative data capture that appear on the point of sale package. 2. Higher levels of packaging, not intended for retail Point of Sale, shall contain the full UDI. 3. A device intended both for retail and used in clinical environments, e.g., hospitals. Shall also contain the full UDI on the label and packaging, in addition to the retail data carrier. J. Own Brand/Private Labelers For the purposes of UDI, an Own Brand or Private Labeler, who labels a device from a third party under his name and/or Trade/Brand name, is considered the manufacturer of the devices – and is responsible for the UDI of the labeled device. K. Relabeled, Repackaged, Remanufactured, and Serviced Devices 1. Re-labelers, re-packagers, and re-manufacturers, shall create their own, new UDI for the relabeled, repackaged, or remanufactured medical device, which shall replace the OEM’s UDI where it exists. 2. The new UDI shall meet all of the requirements of this guidance. 3. The re-processor, re-labeler, re-packager, re-furbisher, or re-manufacturer shall keep, where available, a record of the UDI of the original device. MDS-REQ-007-V4/220524 13 / 20

Compliance Dates • The UDI database (Saudi-DI) has been launched and become effective since 1st October 2020. • The enforcement plan will be in phases based on device risk classes and according to SFDA announcement on the website : https://sfda.gov.sa/ar/node/80966 . Therefore, all medical devices subject to this guidance shall comply with UDI requirements within the announced timeframe. • The required data shall be submitted in the (Saudi-DI) database; and UDI shall be available on device before the deadline of the compliance date. • Medical devices imported before compliance date can be distributed for 1 years after the compliance date. MDS-REQ-007-V4/220524 14 / 20

Annexes MDS-REQ-007-V4/220524 15 / 20

Annex (1): Definitions & Abbreviations KSA Kingdom of Saudi Arabia SFDA Saudi Food and Drug Authority MDS Medical Devices Sector Medical Device Any instrument, apparatus, implement, implant, in vitro reagent or calibrator, software, or material used for operating medical devices, or any other similar or related article, intended to be used alone or in combination with other devices for diagnosis, prevention, monitoring, controlling, treatment, or alleviation of disease or injury, or for compensation for an injury; investigation, replacement, modification, or support of the anatomy or of a physiological process; supporting or sustaining life; controlling or assisting conception; sterilization of medical devices; providing information for medical or diagnostic purposes by means of in vitro examination of specimens derived from the human body; and does not achieve its primary intended action by pharmacological, immunological or metabolic means, but which may be assisted in its intended function by such means. Medical Supply A medical substances and products used in diagnosis, treatment, prosthetics, orthotics, or in disability cases or other medical uses for humans, including medical gases. Accessories Any material or product intended specifically to be used with a medical device to enable it to achieve its purpose. Manufacturer Any national or foreign establishment the purposes of which include designing or manufacturing medical devices for use under its name within the Kingdom or abroad. Manufacturing includes: refurbishing, assembling, packaging, and labelling. Establishment A legal entity engaged in an activity related to medical devices. Authorized Representative A legal person based in the Kingdom who has written authorization from a manufacturer located outside the Kingdom to represent it in the Kingdom with regard to the implementation of this Law and its Regulation. MDS-REQ-007-V4/220524 16 / 20

DI Device Identifier DM Direct Marking GMDN Global Medical Device Nomenclature GTIN Global Trade Item Number HIBC Health Industry Bar Code HRI Human Readable Interpretation OEM Original Equipment Manufacturer PI(s) Production Identifier(s) (Saudi-DI) database Saudi Arabia Unique Device Identifier Database Medical Device Marketing The code assigned by the SFDA to one or more medical devices, that have been Authorization (MDMA) included in a single marketing authorization application, to indicate these devices are Number authorized to be placed on the KSA market. National Registry Number The number issued to a person by the SFDA under the establishment registration provisions of the Medical Devices Interim Regulation. Medical Device National The code assigned by the SFDA to a single medical device to indicate the device is Listing Number authorized to be placed on the KSA market and facilitate traceability. Component A part that is used to create or modify a finished medical device. Software as a Medical Software as a Medical Device (SaMD) means software intended to be used for one Device (SaMD) or more medical purposes that perform this purpose without being part of a hardware medical device. Implantable Device Any device, including those that are partially or wholly absorbed, which is intended: − To be totally introduced into the human body or, − To replace an epithelial surface or the surface of the eye, by surgical intervention which is intended to remain in place after the procedure. Active Implantable Medical Any implantable device, the operation of which depends on a source of energy other Device than that generated by the human body for that purpose, or by gravity, and which acts by changing the density of or converting that energy. Devices intended to transmit energy, substances or other elements between an active device and the MDS-REQ-007-V4/220524 17 / 20

patient, without any significant change, shall not be deemed to be active devices. Software shall also be deemed to be an active device. Configurable Device A device that consists of several components which can be assembled by the manufacturer in multiple configurations. The individual components may be medical devices themselves. Reusable Devices Devices that are used more than one time and may require cleaning, disinfection, sterilization, or refurbishing between uses on different patients. Single Use Medical Device A disposable article intended for use on a patient in a single medical procedure. Procedure pack combined in one kit to meet user requirements, which may contain non-medical devices. Kit A set of components that are packaged together and used to perform a specific in vitro diagnostic examination, or a part thereof Unique Device A series of numeric or alphanumeric characters that is created through a globally Identification (UDI) accepted device identification and coding standard. It allows the unambiguous identification of a specific device on the market. The UDI is comprised of the UDI- DI and the UDI-PI. Note: The word "Unique" does not imply serialization of individual production units. Device Identifier a unique numeric or alphanumeric code specific to a device and that is also used as (UDI-DI) the "access key" to information stored in the (Saudi-DI) database. Production Identifier (UDI- A numeric or alphanumeric code that identifies the unit of device production. The PI) different types of Production Identifier(s) include, but are not limited to, serial number, lot/batch number, software version number, manufacturing date and expiration (use by) date. Direct Marked/Marking A permanent marking providing the UDI on the device itself. UDI (DM UDI) Primary UDI-DI The UDI-DI on the device’s primary label, which consider a primary key in the database and other DIs are linked to it (e.g., packages, Direct Mark) For those situations where there is no device label or package containing the label, the DM UDI-DI, or the Unit of Use UDI-DI (as applicable). MDS-REQ-007-V4/220524 18 / 20

Unit of Use DI a way to associate the use of a device to/on a patient to data related to that patient in instances when an UDI is not labelled at the level of the device unit of use (e.g., several device units contained in a plastic bag). Human Readable A legible interpretation of the data characters as encoded in the UDI. Interpretation (HRI) Automatic Identification Any technology that conveys the UDI or the device identifier of a device in a form and Data Capture (AIDC) that can be entered into an electronic patient record or other computer system via an automated process. AIDC technologies include, but are not limited to, bar codes, smart cards, biometrics and RFID. Label Any written statement, information, or illustration printed on a medical device, including identifying information, technical description, method of use, and manner of storage and transportation. Primary Label The label on the device itself, or, if there is no label or label information on the device itself, on the label of the package containing the device Primary package This is the lowest level of a medical device package containing a full UDI. Package The various levels of homogenous packages that contain a defined quantity of a single type (a single UDI-DI) of devices, e.g. each carton or case. Shipping Container A container used during the shipment or transportation of devices, such as a pallet or tote, and whose contents vary both within the container and from one shipment to another. Shipping container’s traceability is controlled by a process specific to the applicable logistics systems. Radio Frequency An AIDC technology that uses communication by radio waves to exchange data Identification (RFID) between a reader and an electronic tag attached to an object, for the purpose of identification. MDS-REQ-007-V4/220524 19 / 20

Annex (2): List of Changes on the Previous Version Number & Date Changes Description of the Previous Version 3.00 • Change the title from guidance to requirements. 06/09/2020 • Delete section “Management of UDI Issuing Agencies” • Delete Chapter “UDI in Healthcare Delivery”. • Update and modify “Background” and “Definition and Abbreviations” sections in reference to “Medical Devices Law” and its executive regulation. MDS-REQ-007-V4/220524 20 / 20