Saudi Arabia's drug GMP standard — the PIC/S-member SFDA's Guide to Good Manufacturing Practice, which is substantially PIC/S PE009 (EU GMP Vol. 4) text adopted near-verbatim rather than an independently-drafted Saudi instrument.
Saudi Arabia SFDA Guide to Good Manufacturing Practice (v4.4) Audit-Readiness Rubric — Regscribe v0
(Saudi Food and Drug Authority — Guide to Good Manufacturing Practice for Medicinal Products, Doc. Code OPS-G-080)
Headline finding — read this before scoring anything. SFDA's GMP Guide is not an independently-drafted Saudi text. Structurally and, in very large part, textually, it is the PIC/S GMP Guide (PE009) — which is itself EU GMP Volume 4 — reissued under SFDA's own document-control code, with the chapter/annex numbering, section numbering, and in many places the exact prose of EU GMP Vol. 4 preserved verbatim, including EU-specific terms of art ("Qualified Person," "Marketing Authorisation," "Competent Authorit(y/ies)") that have no independent basis in Saudi statute. This rubric cites SFDA's own document (chapter/section numbers as published by SFDA), because that is the instrument SFDA inspectors actually apply — but a document-analysis tool should not treat this as a "Saudi-specific" framework in the way the Japan or China GMP rubrics in this project are: those are independently-drafted national instruments that separately reference PIC/S/EU GMP as interpretive guidance. SFDA's guide is the reverse — PIC/S/EU-GMP text is the primary Saudi legal instrument, adopted near-verbatim, with a small number of explicit Saudi-specific insertions (see below) applied inconsistently across the document.
What is genuinely Saudi-specific, based on direct primary-text inspection this session:
- The document-control metadata (title page, version history table, document code
OPS-G-080, SFDA logo/branding, "Vision and Mission" statement, contact emails Inspection.Drug@sfda.gov.sa / Drug.Comments@sfda.gov.sa).
- Annex 16 ("Qualified Person and Batch Release") has been explicitly localised: its Scope section reads "guidance on the certification by a Qualified Person (QP) and on batch release within Saudi Arabia" and "the QP is responsible for ensuring that each individual batch has been manufactured and checked in compliance with laws in force in the Saudi Arabia where certification takes place" (sic — the grammatically awkward phrasing is in the source document itself, not a transcription error, and is flagged as evidence the jurisdictional substitution was a manual find-and-replace rather than a full local redraft).
- A small number of chapter-level phrase substitutions were found, e.g. Chapter 6 (§6.30) on-going stability programme text specifies "standardised SFDA guideline conditions for long term testing" where the equivalent EU GMP Vol. 4 Ch. 6 text refers to ICH/VICH climatic-zone conditions — a genuine, if narrow, Saudi-specific substitution.
- Version 4.4's own "What is New" changelog (Document Control page, p.5) states the only substantive change from v4.3 is: "Restructuration [of] the annex to distinguish between different product types: Annex 2A now provides requirements for Advanced Therapy Medicinal Products (ATMPs), while Annex 2B [is] for traditional biological medicinal products." This is itself evidence that SFDA's revision process consists of tracking and re-applying PIC/S/EU-GMP annex restructurings (the EU split its own biologics/ATMP Annex 2 the same way), not independent Saudi rule-making.
- Elsewhere — the large majority of the document — SFDA has not substituted Saudi-specific references at all: Chapter 2 §2.6 on Qualified Person duties still reads "An Qualified Person must ensure that each batch... has been manufactured and checked in compliance with the laws in force in that country" (generic, unedited EU-GMP boilerplate; grammatical "An Qualified Person" article error also preserved from the source), and the Annex 1 glossary still defines sterility by reference to "the European (or other relevant) Pharmacopoeia." A document-analysis tool should therefore not assume any given chapter/annex has been Saudi-localised just because Annex 16 was — check each citation against the actual text, not against a blanket "this is Saudi law now" assumption.
Companion research note: two concurrent Regscribe research efforts are separately covering UAE MOHAP and a GCC-unified-framework rubric. This document does not attempt to reconcile with either — see "GCC relationship" below for what this session could and could not verify about SFDA's role in Gulf-wide harmonization.
Sources used
Regulatory text (primary — fetched and read directly from SFDA's own site):
- SFDA "Guide to Good Manufacturing Practice for Medicinal Products," Version 4.4, document code
OPS-G-080-V4.4/110726, Drug Sector, Operations Sector — fetched directly from https://www.sfda.gov.sa/sites/default/files/2026-05/SFDA%20GMP%20Guideline_%20V%204.4%20%20(1).pdf (linked from SFDA's own regulations index page sfda.gov.sa/en/regulations/69378, where it is listed with "Date: 2026-05-21"). This is the single primary source underlying every citation in this rubric. The PDF (460 pages, a genuine text-layer Microsoft Word-produced PDF, not a scanned image) was successfully extracted in full via pdftotext -layout and read in its entirety at the section-heading level, with representative full-text extraction of Chapters 1–9 and Annexes 1, 15, 16 (the ones scored in detail below).
- PDF metadata confirms: Title "SFDA GMP Guide," Author "Nawaf M. Almutairi," Producer "Microsoft® Word 2019," CreationDate/ModDate both "Thu May 21 2026" — i.e. this file was generated the same day SFDA's site lists it, supporting that it is the genuinely current version as of this session (29 July 2026).
- Document Control table (p.4) gives the full version history, independently confirming Version 4.4 supersedes: 1.0 (June 2005, draft), 2.0 (20 April 2011), 2.1 (26 July 2011, "Final"), 3.0 (8 August 2018), 4.0 (5 April 2021), 4.1 (28 August 2022), 4.2 (15 December 2022), 4.3 (29 November 2023), 4.4 (21 May 2026). This resolves what would otherwise be a serious currency risk — earlier WebSearch results surfaced a "Version 3.0" (dated 2011-era per the URL) and a "Version 4.2" (
OPS-G-080-V4.2/110726, hosted at a 2023-01-dated URL) still live at other SFDA URLs; this rubric relies exclusively on the v4.4 text, confirmed via this document's own internal version table to be the current one, not the superseded v3.0/v4.2 copies also still hosted on sfda.gov.sa. Flag for Regscribe: multiple SFDA GMP guideline versions remain simultaneously hosted at different URLs with no redirect/deprecation notice — a scraping/ingestion pipeline must resolve to the regulations-index page's listed current version, not the first PDF a search turns up.
- Table of Contents structure (Chapters 1–9, Annexes 1–20) was extracted in full and used to confirm this guide's chapter/annex numbering is identical to PIC/S PE009 / EU GMP Volume 4's own structure (same 9 chapters, same Annex 1 "Sterile Medicinal Products," Annex 11 "Computerised Systems," Annex 13 "Investigational Medicinal Products," Annex 15 "Qualification and Validation," Annex 16 "Qualified Person and Batch Release," Annex 18 mapping to ICH Q7 API GMP structure verbatim (Quality Management/Personnel/Buildings and Facilities/Process Equipment/Documentation and Records/Materials Management…), etc.) — this is the primary basis for the "headline finding" above, not an inference from secondary sources.
- PIC/S accession: SFDA's own English-language news release,
sfda.gov.sa/en/news/88414 ("SFDA Obtains PIC/S Membership"), states accession was approved during the PIC/S Committee meeting in Geneva, 11–12 May 2023, and that Saudi Arabia is the first Arab country admitted to PIC/S. Cross-checked against PIC/S's own site: picscheme.org's current members listing shows SFDA's accession as "July 2023." This is a real, minor discrepancy between SFDA's own account (approval in May 2023) and PIC/S's own published member-list date (July 2023) that this session could not resolve — most plausibly, May 2023 is the date of committee approval and July 2023 the date participation formally took effect, but this is an inference, not a confirmed fact; flagged rather than guessed at. Also confirmed via picscheme.org/en/news/saudi-arabia-applies-for-pic-s-membership (17 Feb 2020 application) and a separate 2017 pre-accession application news item — the multi-year accession timeline (pre-accession 2017 → application 2020 → admission 2023) is independently consistent across SFDA's and PIC/S's own sites.
- PIC/S member list (
picscheme.org/en/members, fetched directly) independently confirms "Saudi Food and Drug Authority (SFDA)" as the named Participating Authority, address given as Riyadh — used to confirm SFDA (not some other Saudi body) is the correct PIC/S-participating authority.
Legal basis (secondary-sourced — not independently verified against a primary Saudi legal-gazette document this session):
- Multiple secondary sources (a Hammad & Al-Mehdar law-firm client note, a decreesa.com legal-database entry, general WebSearch results) converge on: the "Law of Pharmaceutical and Herbal Establishments and Products" was issued by Royal Decree No. M/108, dated 19/11/1444H (corresponding to approximately June 2023), and SFDA is named as the licensing/enforcement authority for pharmaceutical manufacturing, including mandatory GMP-compliance licensing. This session did not successfully fetch the primary Umm Al-Qura Gazette or a clean copy of the Royal Decree text itself (a direct WebFetch attempt against an SFDA-hosted implementing-regulations PDF failed with a connection error) — the Royal Decree number/date above should be treated as plausible and consistent across multiple independent secondary sources, but not independently primary-verified this session. A separate, older Royal Decree No. D/195 (concerning pharmacy/herbal-establishment practice) was also referenced in search results as a related but distinct instrument — its relationship to the 2023 Law (successor? still partially in force?) was not resolved this session.
- The GMP Guide itself (unlike, e.g., Japan's GMP Ordinance, which opens by citing its own parent statute in Article 1) does not appear, from the sections read this session, to open with an explicit citation to the Law of Pharmaceutical and Herbal Establishments and Products or to a specific enabling statute — the document's own framing is almost entirely in PIC/S/EU-GMP terms ("Manufacturing Authorisation," "national law," "Competent Authorities") rather than Saudi statutory citations. This is consistent with the headline finding that the Guide is substantially an adopted PIC/S/EU text rather than a from-scratch Saudi legal drafting exercise, but it also means Regscribe cannot currently cite a specific Saudi statutory article for "why this Guide is legally binding" the way the Japan or US rubrics can — flagged as a Gap below.
GCC relationship (mixed sourcing — see Gaps for what remains genuinely unresolved):
- WebSearch results (general, not from a single authoritative primary source) describe a GCC Central Committee for Drug Registration (GCC-DR), under the Gulf Health Council, headquartered administratively in Riyadh, operating since a "turning point" reported as May 1999, and describe SFDA as applying "Gulf (GCC/GSO) standards concerning specifications and components" for drug registration purposes (as distinct from GMP inspection specifically). This session found no primary GCC-DR or Gulf Health Council document, and no SFDA document, that states in so many words whether Saudi's own PIC/S-derived GMP Guide is formally adopted as the GCC's own reference GMP standard, or whether SFDA's GMP Guide is simply Saudi's independent national instrument that happens to run in parallel with (rather than being formally incorporated into) GCC-wide drug-registration harmonization. Given that Saudi Arabia is the only GCC member state that is a PIC/S member (SFDA's own release calls it "the first Arab country" in PIC/S, not "first Gulf country to adopt PIC/S standards on behalf of the GCC"), the most defensible reading based on what was verified this session is: SFDA's GMP Guide is Saudi's own national instrument; other GCC states' manufacturing-site GMP inspection regimes were not verified this session to be bound by or formally deferential to it. GCC-DR's harmonization role, as far as this session's sourcing goes, concerns drug registration/dossier requirements, not GMP manufacturing-site inspection standards specifically — these are related but distinct regulatory functions, and conflating them would misrepresent both. This entire paragraph should be treated as a preliminary, imperfectly-sourced characterization pending the concurrent GCC-unified-framework research effort, not as this rubric's final word on the Saudi-vs-GCC relationship.
Enforcement / failure-pattern data:
- No SFDA-published, English-language, per-clause GMP inspection-deficiency dataset (i.e., nothing analogous to MHRA's published GMP Inspection Deficiency Data Trend reports used in the
gmp-gdp-rubric.md companion doc) was found this session. This appears to be a genuine transparency gap, not a search failure — consistent with the same gap already documented for Japan and (presumably) other non-EU/UK regulators in this project's companion rubrics.
- One real, dated, named-enough 2025 enforcement action was found and is used below: Gulf News (
gulfnews.com, 17 July 2025) reported that SFDA suspended the Saudi-market registration of a European pharmaceutical manufacturing facility (the facility's specific name was not disclosed in the article) as a "precautionary measure," following an inspection under SFDA's foreign-factory oversight program that found "serious breaches of Good Manufacturing Practices (GMP)," described as "significant failures in production procedures" and "deficiencies in internal quality systems" posing "direct risk to the safety of medicines destined for the Saudi market." This is a real, dated, English-language trade/news-press report of an actual SFDA enforcement action — but it is trade-press-sourced, not an SFDA-published inspection report or disposition notice, and the facility's identity and the specific GMP clause(s) violated were not disclosed in the source and are therefore not independently attributable to a specific chapter/annex of this rubric. Marked [REPRESENTATIVE] below, not [HISTORICAL], since it is current (2025) rather than founding-era.
- A general SFDA-recall-volume data point (52 drug recalls in 2018, up from 9 in 2010, per a secondary source surfaced in WebSearch results but not independently verified against a primary SFDA recall-log this session) suggests SFDA does conduct and publicly track recalls, but this session did not locate a browsable, English-language, per-incident SFDA recall database to mine for clause-specific examples. Flagged as a follow-up in Gaps.
- No FDA-Warning-Letter-equivalent SFDA disposition-notice format was identified — unlike FDA's public Warning Letters or even Japan's prefectural suspension orders, this session found no evidence SFDA publishes individual, named enforcement notices in a consistently browsable English-language format. This is the single biggest sourcing gap in this document relative to the
cfr210-211-rubric.md standard, and is consistent with (arguably worse than) the equivalent gap already flagged in jp-gmp-rubric.md and cfr58-glp-rubric.md.
Rubric legend
Each row: Requirement (plain language) → Citation → Evidence that demonstrates compliance → Common failure pattern
Failure-pattern cells are marked:
- [REPRESENTATIVE] — either (a) the 2025 SFDA foreign-factory-suspension case above (real, dated, trade-press-sourced, not attributable to a specific clause), or (b) a well-established GMP failure mode inherited directly from the underlying PIC/S/EU-GMP text this Guide reproduces, cross-referenced to the MHRA deficiency-data examples already sourced and verified in this project's
gmp-gdp-rubric.md companion — since SFDA's text is, clause-for-clause in most chapters, the same text MHRA inspects against in the EU/UK, the same real-world failure patterns are directly applicable, not merely analogous. Where a row's failure pattern is inherited this way, it is stated explicitly.
- [ANALOGOUS] — a real, confirmed case or data point that is structurally similar and instructive but not itself an SFDA GMP-clause enforcement action (none used in this document's main tables; the one enforcement case found is used as [REPRESENTATIVE] with its own caveats stated inline, per this project's convention of not inventing a category that isn't needed).
- [UNVERIFIED — flagged, not used] — reserved marker; nothing in the tables below relies on an unverified claim. The two genuinely unresolved factual questions (Royal Decree currency, GCC-DR's exact relationship to GMP inspection specifically) are called out in prose in Sources/Gaps rather than smuggled into a table row.
- No [HISTORICAL] marker is used — this document does not attempt to research SFDA's or the Guide's own founding history (e.g., why Saudi Arabia began regulating pharmaceutical manufacturing at all); that would be a different research question than the one asked.
CHAPTER 1 — Pharmaceutical Quality System
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 1 | A Pharmaceutical Quality System (PQS) appropriate to the manufacture of medicinal products must exist, ensuring (among ~17 enumerated elements) product realisation, product/process knowledge management, clearly specified managerial responsibilities, a documented approved-supplier system, prospective evaluation/approval of changes prior to implementation, root-cause-based deviation investigation, and that no product is sold or supplied before a Qualified Person (QP) has certified the batch. | SFDA GMP Guide v4.4, Ch. 1, §1.1–1.4(i)-(xvii) | Quality Manual; org chart showing QA/QP reporting lines; change-control log showing pre-implementation approval dates; QP batch-certification records pre-dating shipment dates | [REPRESENTATIVE] This chapter's text is, verbatim, EU GMP Vol. 4 Chapter 1 — the same clause numbering (§1.4(viii)-(ix) state-of-control, §1.4(xii)-(xiii) change control, §1.4(xiv) root-cause analysis, §1.4(xv) QP certification-before-release) that MHRA's own published deficiency data (used in gmp-gdp-rubric.md) identifies as the #1 most-cited deficiency group of all 10 tracked in the EU/UK (27 Critical/293 Major/555 Other, 2015 data) — there is no reason to expect the underlying failure modes differ for a Saudi-licensed site scored against the identical text. |
| 2 | Annual/rolling Product Quality Review (PQR) across the standard ~12 elements (starting materials, in-process/finished results, OOS, deviations, changes, stability, complaints/recalls, contractual-arrangement review per Ch. 7). | SFDA GMP Guide v4.4, Ch. 1, PRODUCT QUALITY REVIEW section | PQR reports, one per product/product family, evidencing each element and a documented CAPA/revalidation decision | [REPRESENTATIVE] Same clause substance as EU GMP Ch.1 §1.10-1.11; PQR gaps recur inside "Quality System" and "Complaints and Recall" findings per the MHRA data cited in the companion EU rubric. |
| 3 | Quality Risk Management (QRM) must be applied systematically, with the level of effort/formality/documentation proportionate to the level of risk. | SFDA GMP Guide v4.4, Ch. 1, QUALITY RISK MANAGEMENT section | QRM SOP; risk-assessment records referenced by other GMP decisions (e.g. cross-contamination dedication decisions in Ch.3/Ch.5) | [REPRESENTATIVE] Same substance as EU GMP Ch.1's QRM section; a QRM programme that exists as a standalone SOP but is not actually referenced by the specific downstream decisions it is meant to justify (dedicated-facility decisions, cleaning-limit decisions) is the standard "QRM theatre" finding pattern. |
CHAPTER 2 — Personnel
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 4 | Key Management Personnel — heads of Production and Quality Control — must be appointed, must be independent from each other, and (per §2.6) a Qualified Person (QP) must be designated whose duties include ensuring each batch was manufactured/checked in compliance with the laws in force and the Marketing Authorisation. | SFDA GMP Guide v4.4, Ch. 2, §2.2, §2.5–§2.6 | Organisation chart showing Production/QC/QP reporting lines are independent, not converging below a single non-quality executive; QP appointment/authority record | [REPRESENTATIVE] §2.6's text retains the EU-GMP phrase "in compliance with the laws in force in that country" generically (not "in Saudi Arabia" specifically) — see headline finding above; this is the same head-of-Production/head-of-QC independence check documented as the EU/US/Japan "independence-in-name-only" pattern across every companion GMP rubric in this project — check the actual reporting line, not the org-chart label. |
| 5 | Personnel must receive initial and continuing training, including GMP-principle and hygiene training relevant to their role; specific/deeper training required for personnel working with highly toxic, hazardous, or highly sensitising materials. | SFDA GMP Guide v4.4, Ch. 2, TRAINING section | Training plan/schedule mapped to role; specialised-training records for personnel in high-hazard areas | [REPRESENTATIVE] Same substance/structure as EU GMP Ch.2 training provisions; the standard failure pattern (training recorded but not mapped to the individual's actual current role/duty) applies identically. |
CHAPTER 3 — Premises and Equipment
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 6 | Premises/production areas must be designed to prevent cross-contamination, with Quality Risk Management used to decide whether dedicated facilities/equipment are required (mandatory where the risk cannot be adequately controlled operationally/technically, where toxicological data does not support a controllable risk — e.g. beta-lactam sensitisation — or where safe residue limits cannot be analytically verified). | SFDA GMP Guide v4.4, Ch. 3, §3.6 | Cross-contamination risk assessment referencing toxicological/potency data and citing the specific §3.6 criteria; dedicated-facility documentation where triggered | [REPRESENTATIVE] Verbatim EU GMP Ch.5/Annex text lineage — directly the same clause MHRA's published deficiency data (companion EU rubric) documents as a recurring Major finding: "no formal process to define how organisational/technical measures should be developed... to prevent cross contamination," shared equipment "not... considered as part of the cross contamination risk assessment." |
| 7 | Equipment and premises must be maintained/cleaned per detailed written procedures, sited to permit contamination-minimising environmental control (lighting, temperature, humidity, ventilation, pest/unauthorised-entry prevention). | SFDA GMP Guide v4.4, Ch. 3, §3.1–3.5 | Facility maintenance/cleaning SOPs and logs; environmental-control monitoring records; access-control records | [REPRESENTATIVE] Same content as EU GMP Ch.3 General/Premises sections. |
CHAPTER 4 — Documentation
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 8 | The full GMP document taxonomy — Site Master File, specifications, manufacturing/processing/packaging/testing instructions, SOPs, protocols, technical agreements (instructions-type) and records, Certificates of Analysis, reports (records-type) — must be defined, and all data on which quality decisions are based must be identified as raw data, whether paper, electronic, or hybrid. | SFDA GMP Guide v4.4, Ch. 4, "Required GMP Documentation (by type)" | Document taxonomy mapped one-to-one against a facility's actual SOP/record index; explicit "raw data" designation in the relevant data-governance procedure | [REPRESENTATIVE] Same content, including the PAT/real-time-release-data footnote, as the current (2015-rev) EU GMP Vol.4 Ch.4 text — the companion EU rubric's MHRA-sourced findings (pencil/tippex use, overwritten hand-recorded data, retrospectively re-issued records) apply identically to a document scored against this identical text. |
| 9 | Records must be contemporaneous and corrections must not obscure the original entry — the ALCOA data-integrity baseline. | SFDA GMP Guide v4.4, Ch. 4, "Good Documentation Practices" | Batch records with visible, traceable corrections (strike-through + reason + date + initials, not obliteration) | [REPRESENTATIVE] Directly the same failure mode MHRA's data (companion EU rubric) documents as a data-integrity-critical finding — "Inappropriate changes made by obscuring data via fixing stickers over entries." |
CHAPTER 5 — Production
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 10 | Processing operations must follow validated, clearly defined procedures; validation must be prospective, covering critical process steps and significant process changes. | SFDA GMP Guide v4.4, Ch. 5, PRINCIPLE / VALIDATION section | Process validation protocol/report pre-dating routine production use of a new/changed process | [REPRESENTATIVE] Same "retrospective validation not acceptable" principle as EU GMP Ch.5/Annex 15 — see Annex 15 rows below for the fuller validation-specific treatment. |
| 11 | Rejected/recovered/returned materials and products require documented, risk-assessed handling before re-introduction or disposal. | SFDA GMP Guide v4.4, Ch. 5, "Rejected, Recovered and Returned Materials" | Rejection/recovery/return log with disposition decision and QC/QA sign-off | [REPRESENTATIVE] Same content as EU GMP Ch.5's equivalent section. |
CHAPTER 6 — Quality Control
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 12 | Each manufacturing-authorisation holder must have a Quality Control Department, independent from other departments ("independence of Quality Control from Production is considered fundamental"), responsible for sampling/testing/specification/release-decision organisation. | SFDA GMP Guide v4.4, Ch. 6, §6.1 | QC department org chart showing reporting line independent of Production; QC-authored release-decision records | [REPRESENTATIVE] Direct structural analogue to FDA's §211.22(a) QCU independence and every other companion-rubric "independence-in-name-only" check in this project — a QC head reporting through Production management, despite an independent-sounding title, is the standard finding. |
| 13 | An on-going stability programme must monitor the product over its shelf life per an approved protocol, with storage conditions matching product labelling. | SFDA GMP Guide v4.4, Ch. 6, §6.30–§6.32 | On-going stability protocol and data, referencing storage conditions consistent with the currently-approved labelling | [REPRESENTATIVE] §6.30's storage-condition language substitutes "standardised SFDA guideline conditions" for the ICH/VICH climatic-zone reference used in the equivalent EU GMP Ch.6 text — one of the few genuine Saudi-specific textual edits found this session (see headline finding); a stability programme referencing generic ICH climatic-zone conditions rather than SFDA's own published conditions guidance would technically miss this specific substitution, though the underlying substance (Zone-appropriate storage conditions for a hot/arid climate) is likely similar in practice. |
CHAPTER 7 — Outsourced Activities
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 14 | Outsourced (contracted) manufacturing/testing/distribution activities require a written Contract defining each party's GMP responsibilities; the Contract Giver must assess Acceptor suitability before outsourcing and retain access to all outsourced-activity records (manufacturing, analytical, distribution, reference samples). | SFDA GMP Guide v4.4, Ch. 7, §7.13 and General/Contract Giver sections | Signed technical/quality agreement; Contract-Giver pre-qualification audit record; evidence the Giver retains or can access Acceptor records | [REPRESENTATIVE] Same clause substance as EU GMP Ch.7 — the companion EU rubric's MHRA-sourced findings ("no proceduralised assessment of the suitability of the Contract Acceptor," Technical Agreements missing/out of date) apply directly. |
CHAPTER 8 — Complaints and Product Recall
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 15 | A system must exist to record, assess, investigate, and review complaints (including potential quality defects) and, where necessary, effectively and promptly recall product from the distribution network; Quality Risk Management governs the investigation/decision-making, and Competent Authorities must be informed in a timely manner of a confirmed quality defect. | SFDA GMP Guide v4.4, Ch. 8, PRINCIPLE and following sections (Personnel and Organisation; Procedures for Handling and Investigating Complaints; Investigation and Decision-making; Root Cause Analysis and CAPA; Product Recalls) | Complaint log with investigation records; recall SOP and mock/real recall records; SFDA-notification record for any confirmed defect, with a timestamp demonstrating "timely" reporting | [REPRESENTATIVE] Same substance as EU GMP Ch.8 (2013-rev "Complaints, Quality Defects and Product Recalls" chapter) — this is the 2nd-most-cited MHRA deficiency group in the companion EU rubric's data (10 Critical/25 Major/94 Other), and given the identical underlying text, the same failure modes (deviation/CAPA not actually tied to closure, self-reported "timely" notification that in practice was delayed) are directly applicable evidence to look for here. This is also the chapter most directly implicated, in substance though not by name, in the 2025 SFDA foreign-factory-suspension case described in Sources — "significant failures in production procedures" and "deficiencies in internal quality systems" are consistent with (though not confirmed to specifically be) a Ch.1/Ch.8-type finding; the source did not specify which chapter(s) were actually cited. |
CHAPTER 9 — Self-Inspection
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 16 | Self-inspections must be conducted to monitor GMP-implementation/compliance and propose corrective measures, per a documented programme. | SFDA GMP Guide v4.4, Ch. 9, PRINCIPLE | Self-inspection schedule and completed reports; corrective-action records tied to specific findings, tracked to closure | [REPRESENTATIVE] Same substance as EU GMP Ch.9 and directly analogous to the "self-inspection theatre" finding pattern (schedule exists on paper, no completed reports, or findings with no tracked CAPA) already documented across this project's Japan/EU companion rubrics. |
ANNEX 1 — Manufacture of Sterile Medicinal Products
This annex is, on direct text comparison, the fully-rewritten EU GMP Annex 1:2023 text — the Scope section's own wording ("may be used to support the manufacture of other products that are not intended to be sterile such as certain liquids, creams, ointments and low bioburden biological intermediates") and its Contamination Control Strategy (CCS) framing match the 2023 EU rewrite verbatim, not the older pre-2023 EU Annex 1. This is a materially important currency finding: SFDA's sterile-manufacturing annex is current with the 2023 EU rewrite, not a stale pre-2023 version — worth noting given how recently (and disruptively, for many manufacturers) that EU rewrite took effect.
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 17 | A documented Contamination Control Strategy (CCS) must be established across the entire sterile-manufacturing facility/process, applying Quality Risk Management "in its entirety" rather than only at specific stated-limit checkpoints. | SFDA GMP Guide v4.4, Annex 1, §1 Scope / §2 Principle | Facility-wide CCS document referencing personnel, premises, equipment, utilities, and environmental/process monitoring as an integrated system, not a checklist | [REPRESENTATIVE] This annex is Regscribe's eu-annex1-rubric.md companion doc's direct subject matter, reproduced here verbatim by SFDA — a document-analysis pass on a Saudi sterile-drug site should cross-reference both rubrics; the CCS-gap findings already researched for eu-annex1-rubric.md apply with essentially no adaptation needed, since the underlying text is identical. |
| 18 | Facility, equipment, and process design/qualification/validation must protect against microbial, particulate, and endotoxin/pyrogen contamination, with technologies such as RABS/isolators/robotic systems/rapid methods considered to increase protection. | SFDA GMP Guide v4.4, Annex 1, §2.1 | Facility design/qualification package; technology-selection rationale referencing the CCS | [REPRESENTATIVE] Same substance as EU GMP Annex 1:2023 §2.1. |
ANNEX 2A / 2B — Advanced Therapy Medicinal Products (ATMPs) / Biological Medicinal Substances and Products
This is the annex v4.4's own changelog says was newly restructured — prior versions (through v4.3) apparently carried a single combined Annex 2; v4.4 splits it into 2A (ATMPs) and 2B (traditional biologicals), tracking the equivalent EU-GMP annex split.
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 19 | Manufacturers must first determine, using the Annex's own "illustrative guide to manufacturing activities," whether a given product/process step falls under Annex 2A (ATMP) or Annex 2B (traditional biological) — the two annexes carry different personnel, premises, documentation, and QC requirements. | SFDA GMP Guide v4.4, Annex 2A/2B, SCOPE + Table 1 (each annex) | Documented product-classification rationale (ATMP vs. traditional biological) referencing the Annex's own illustrative table, retained alongside the manufacturing dossier | [REPRESENTATIVE] This scope-determination step is the newest addition in v4.4 and has no precedent in the pre-v4.4 combined annex — a document-analysis tool trained against an older SFDA GMP version (or against the pre-split EU Annex 2) would not know to check for this classification step; flag as a version-currency-sensitive check specific to this rubric's v4.4 basis. |
| 20 | Biological-product-specific controls apply per Annex 2B Part B by product subtype (animal-sourced, allergen, animal immunosera, vaccines, recombinant, monoclonal antibody, transgenic animal/plant, gene therapy, somatic/xenogeneic cell therapy and tissue-engineered products) — each subtype carries distinct starting-material, seed-lot/cell-bank, and QC provisions. | SFDA GMP Guide v4.4, Annex 2B, Part B (B.1–B.10) | Subtype-specific starting-material/seed-lot/cell-bank documentation matched to the correct B.1–B.10 subsection | [REPRESENTATIVE] Structurally identical to Japan's biological-origin-drug provisions (GMP Ordinance Arts. 26-30, per the companion jp-gmp-rubric.md) and to EU GMP's equivalent Annex 2 — the common failure mode across all three is applying general (non-biological) documentation/retention rules to a biological product that requires the longer/more detailed subtype-specific rules instead. |
ANNEX 8 — Sampling of Starting and Packaging Materials
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 21 | Sampling of starting/packaging materials must be performed by qualified personnel per a documented, risk-based sampling plan, with samples representative of the whole batch/container population sampled. | SFDA GMP Guide v4.4, Annex 8, PRINCIPLE / STARTING MATERIALS | Sampling SOP with defined sample-size/location rationale; sampler qualification records | [REPRESENTATIVE] Same content as EU GMP Annex 8; the standard failure mode is a sampling plan applied uniformly regardless of supplier-risk tier rather than the risk-based n-sqrt-N-plus-1-style approach EU/PIC/S guidance describes. |
ANNEX 11 — Computerised Systems
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 22 | Risk management must be applied across the computerised-system lifecycle to determine validation/data-integrity control extent; audit trails must be enabled for GMP-relevant changes/deletions and reviewed regularly; access control must prevent unrestrained deletion rights. | SFDA GMP Guide v4.4, Annex 11 (content confirmed present via TOC; full clause-level text not separately re-extracted this session — see note below) | System risk assessment; audit-trail configuration evidence; access-control matrix showing no analyst-level delete rights on production systems | [REPRESENTATIVE] This annex's TOC position and title ("Computerised Systems") match EU GMP Annex 11 exactly; the companion gmp-gdp-rubric.md's MHRA-sourced findings (no individual log-on/no access-level separation on HPLC systems; audit trail not fully enabled; adjustable system clocks) are directly applicable given the shared text lineage, but this session did not independently re-extract Annex 11's full clause-by-clause wording from the SFDA v4.4 PDF the way it did for Chapters 1-9 and Annexes 1/15/16 — flagged as a shallower-verified row than the others above. |
ANNEX 13 — Manufacture of Investigational Medicinal Products (IMPs)
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 23 | IMP manufacture requires its own quality assurance, personnel, documentation (including product specification file, randomisation code, blinding procedures where applicable), production, and QC arrangements, distinct from commercial-product GMP, plus specific reference and retention sample requirements. | SFDA GMP Guide v4.4, Annex 13, sections per TOC (Clinical Trials; Quality Assurance; Documentation; Production; Quality Control; Reference and Retention Samples) | IMP-specific product specification file; randomisation-code control record; IMP reference/retention sample log distinct from commercial-product retention | [REPRESENTATIVE] Same annex content/structure as EU GMP Annex 13 — the blinding/randomisation-code control requirement is the IMP-specific check with no direct commercial-GMP analogue, and is the first place a document-analysis tool should look when the document under review is clinical-trial-supply-related rather than commercial. |
ANNEX 15 — Qualification and Validation
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 24 | Retrospective validation is explicitly "no longer considered an acceptable approach." Qualification/validation scope and extent must be based on a documented risk assessment; computerised systems used in manufacturing must additionally be validated per Annex 11. | SFDA GMP Guide v4.4, Annex 15, PRINCIPLE / GENERAL | Validation protocol/report pre-dating first productive use of the system/process/change; risk-assessment record justifying the qualification/validation scope chosen | [REPRESENTATIVE] Text is verbatim EU GMP Annex 15's General principle (including the identical "no longer considered an acceptable approach" phrasing) — the companion EU rubric's MHRA finding ("Qualification documents provided by equipment suppliers were not adopted into the company's Pharmaceutical Quality System to ensure appropriate review") applies directly. |
| 25 | Cleaning validation must include scientifically justified carryover limits and worst-case/hard-to-clean-location sampling, not visual-clean-only evidence. | SFDA GMP Guide v4.4, Annex 15, CLEANING VALIDATION section | Cleaning validation protocol/report with toxicological-carryover-limit rationale and swab data from worst-case locations | [REPRESENTATIVE] Same content as EU GMP Annex 15 §10; the companion EU rubric's MHRA finding ("no swabs have been taken from difficult to clean areas... limits... restricted to the difficulty of cleaning") applies directly. |
ANNEX 16 — Qualified Person and Batch Release
This is the one annex this session found to be explicitly, if imperfectly, localised to Saudi Arabia — see headline finding above for the exact quoted "within Saudi Arabia" / "in the Saudi Arabia" text.
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|
| 26 | The Qualified Person (QP) is responsible for ensuring each individual batch was manufactured and checked in compliance with laws in force in Saudi Arabia (per this Annex's own localised text) where certification takes place, and in accordance with the Marketing Authorisation and GMP; batch release comprises (i) checking manufacture/testing per defined procedures, (ii) QP certification, and (iii) transfer to saleable stock/export — shipment must not occur before QP certification. | SFDA GMP Guide v4.4, Annex 16, Scope / General Principles | QP-certification record, signed and dated before the recorded shipment/transfer-to-saleable-stock date; if certification and transfer-to-stock occur at different sites, the written inter-site agreement | [REPRESENTATIVE] A shipment/transfer date on or before the QP-certification date is the single most bright-line, high-severity, automatable finding in this entire document — structurally identical to the "batch released before QP certification" critical-finding pattern flagged in the companion EU rubric (Ch.1 §1.4(xv) cross-reference) and to the analogous 21 CFR 211 / Japan Art. 12 "shipment before release decision" checks documented in the cfr210-211 and jp-gmp companion rubrics. Given this is the one annex SFDA explicitly localised in its own text, this is arguably the single clause in the whole document most defensibly describable as "Saudi GMP law" rather than "PIC/S text applied in Saudi Arabia." |
Cross-reference: SFDA GMP Guide v4.4 vs. PIC/S PE009 / EU GMP Vol. 4 vs. 21 CFR 210/211
| SFDA GMP Guide concept | PIC/S PE009 / EU GMP Vol. 4 relationship | Nearest 21 CFR 210/211 analogue | Notes |
|---|
| Entire Chapters 1-9 + Annex structure/numbering | Identical — same chapter titles, same annex numbers and titles (1 Sterile, 2 ATMP/Biological, 8 Sampling, 11 Computerised Systems, 13 IMP, 15 Qualification/Validation, 16 QP/Batch Release, 18 ≈ ICH Q7 API GMP) | Parts 210/211 (different structure entirely — subpart-based, no annex system) | This is a structural identity, not mere similarity — see headline finding. |
| Qualified Person (QP) — Ch.2 §2.6, Annex 16 | Identical EU-law concept, term retained verbatim (including "An Qualified Person" article-agreement error preserved from source) | No direct analogue — §211.22 QCU is a unit with disposition authority, not a named individually-accountable certifying person; closer to FDA biologics' concept of a person authorized to release, but not identical | A document-analysis tool built primarily against 21 CFR 210/211 assumptions should not assume a "QP" role maps to a US "QC manager" — it is a distinct, EU-originated legal role that SFDA has imported wholesale. |
| Annex 1 Contamination Control Strategy (CCS) | Identical to EU GMP Annex 1:2023 rewrite (confirmed via direct text comparison this session) | No direct 21 CFR 210/211 analogue at this granularity — closer to a Regscribe-internal cross-reference with the companion eu-annex1-rubric.md | Reuse eu-annex1-rubric.md's CCS-scoring logic essentially unmodified for a Saudi sterile-site document. |
| "National law" / "that country" generic phrasing (most chapters) | Verbatim, unedited EU-GMP boilerplate — not substituted with "Saudi Arabia" or a specific Saudi statute in the majority of the document | N/A | The one clear exception is Annex 16 (see above) — do not assume the rest of the document has been similarly localised. |
| Standardised "SFDA guideline conditions" for on-going stability (Ch.6 §6.30) | Narrow, confirmed textual substitution for the EU text's ICH/VICH climatic-zone reference | §211.166 stability testing (structurally similar requirement, differently worded) | One of the only clause-level Saudi-specific edits found this session — flag as a genuinely Saudi-specific scoring node, not a reused EU node. |
Recommendation: because SFDA's text is, for the large majority of chapters/annexes, identical to the text already modeled in gmp-gdp-rubric.md and eu-annex1-rubric.md, Regscribe's shared "Evidence Type" layer should be reused as-is for SFDA scoring (no new evidence-type taxonomy needed) — the only genuinely new tags worth adding are qp_certification_saudi_localised (for Annex 16's explicit jurisdictional text) and sfda_stability_conditions (for Ch.6 §6.30's substituted phrase), both narrow and clause-specific rather than framework-wide.
Gaps / follow-ups before this goes into production scoring
- The Royal Decree establishing SFDA's legal authority for this GMP Guide (cited above as Royal Decree No. M/108, ~June 2023, "Law of Pharmaceutical and Herbal Establishments and Products") was sourced entirely from secondary legal-commentary sites this session — a direct WebFetch attempt against an SFDA-hosted implementing-regulations PDF failed with a connection error, and no primary Umm Al-Qura Gazette text was retrieved. Recommend a dedicated follow-up to fetch the SFDA-hosted implementing-regulations PDF (
sfda.gov.sa/sites/default/files/2025-05/SFDA28122020ee1.pdf — URL found but not successfully fetched) or the primary gazette text, before citing a specific Royal Decree number/date in any customer-facing context.
- The Saudi-vs-GCC relationship is the single biggest open question flagged explicitly by this task and remains only partially resolved. This session confirmed Saudi Arabia is the sole GCC member in PIC/S, and found general (non-primary-sourced) descriptions of a GCC Central Committee for Drug Registration (GCC-DR) covering drug registration/dossier harmonization — but found no primary document stating whether SFDA's GMP Guide is formally the GCC's own reference GMP standard for manufacturing-site inspection, as opposed to simply being Saudi's own national instrument that other GCC states do not necessarily defer to for GMP inspection purposes specifically (as distinct from registration/dossier acceptance). This should be reconciled against the concurrent GCC-unified-framework research effort rather than resolved unilaterally here.
- Annex 11 (Computerised Systems) was confirmed present and correctly titled/numbered via the table of contents, but its full clause-by-clause text was not independently re-extracted and read this session the way Chapters 1-9 and Annexes 1/15/16 were — row 22 above is therefore a shallower-verified citation than the rest of this document. Recommend a follow-up pass reading Annex 11's actual body text (located via
grep -n "^ANNEX 11$" in the extracted .txt, or by re-running pdftotext -layout and reading the relevant page range) before treating row 22 as fully verified.
- PIC/S accession-date discrepancy (SFDA's own "11-12 May 2023 Geneva approval" vs. PIC/S's own member-list "July 2023") was not resolved — both are primary-ish sources (SFDA's own news release; PIC/S's own current member list) that simply state different dates, most plausibly reflecting approval-vs.-effective-date, but this is an inference, not a confirmed fact.
- No SFDA-published, per-clause GMP inspection-deficiency dataset exists (or was found) in English, unlike the MHRA data underlying
gmp-gdp-rubric.md. Every failure-pattern cell in this document is therefore either (a) the single 2025 trade-press-sourced enforcement case, whose facility identity and specific clauses violated are unknown, or (b) inherited directly from the MHRA/EU findings already sourced for the companion gmp-gdp-rubric.md and eu-annex1-rubric.md, on the reasoning that identical underlying text plausibly produces identical failure modes — this is a defensible but explicitly inferential severity-weighting basis, not an empirically Saudi-specific one. If Regscribe wants Saudi-specific severity weighting, Chapter 1 (PQS/change-control/QP-certification), Chapter 8 (complaints/recall), and Annex 16 (QP-certification-before-shipment) are this session's reasoned high-consequence defaults.
- Only Chapters 1-9 and Annexes 1, 2A/2B (TOC-level), 8, 11 (TOC-level only), 13, 15, and 16 were examined this session; Annexes 3-7, 9-10, 12, 14, and 17-20 (veterinary premixes, immunological veterinary products, medicinal gases, herbal medicinal products, liquids/creams/ointments sampling, aerosols, radiopharmaceuticals, plasma-derived products, QP certification appendix material, real-time-release/parametric release, and the ICH-Q7-structured API annex) were confirmed present via the table of contents and page-range structure but not read or scored in this rubric — a production pass covering veterinary, herbal, radiopharmaceutical, plasma-derived, or API manufacturing in the Saudi market should read those annexes directly from the source PDF (saved locally during this session) rather than relying on this rubric's silence on them as "not required."
- This rubric deliberately does not attempt to score SFDA's separate Natural Health Products GMP guideline, Blood Establishments GMP guideline, or Good Pharmacovigilance Practices (GVP) guideline (all found live on sfda.gov.sa during this session's searches, at their own separate document codes/URLs) — these are distinct SFDA instruments outside this task's scope (drug/medicinal-product GMP specifically), analogous to how
jp-gmp-rubric.md explicitly excludes Japan's separate GQP/GVP ordinances. Flagged as candidate future rubrics, not folded into this one.