GCC First Aid Kit Rules: Saudi Arabia and UAE Compliance

The Gulf is one of the fastest-moving first aid kit markets in the world, and one of the most consistently misread by suppliers who treat it as a single region.

It is not. Saudi Arabia and the United Arab Emirates run different regulators, different registration routes, different label requirements and different workplace rules. A kit that clears customs in Jeddah has not thereby cleared Dubai.

There is one thing the two markets share, and it catches more exporters than any other detail: the registration layer and the workplace layer are separate. Getting a product registered is not the same as having a product an employer can lawfully put on a factory floor — and far too many suppliers discover this after the container has shipped.

Here is how both layers work.

1. The first rule: you need a local partner in both markets

Neither market permits a foreign manufacturer to register directly. All six GCC member states require foreign medical device manufacturers to appoint a local authorised representative before products can be registered or sold.

The requirement exists for a practical reason: regulators need a legally accountable local entity to act as the point of contact for post-market surveillance, recalls, labelling compliance, and ongoing regulatory communication. Without a representative, a foreign manufacturer has no legal standing to register a device or to answer a regulator's questions within the jurisdiction.

Saudi Arabia requires an In-Country Representative holding a valid medical device establishment licence. It must be a Saudi-registered legal entity, and it is responsible for submitting the device registration application, maintaining the product licence, and managing post-market obligations. Its name and licence number appear directly on the product registration. Notably, SFDA has tightened this requirement in recent years: the representative is now expected to hold ISO 13485 certification or demonstrate equivalent quality management system compliance.

The UAE operates a parallel structure through the Ministry of Health and Prevention (MOHAP). Foreign manufacturers appoint a UAE-based authorised representative — also referred to as a local technical representative — holding a valid trade licence covering medical devices. That entity submits the registration dossier through the MOHAP online portal and remains accountable for product compliance throughout the product's commercial life in the market.

If you are sourcing from a Chinese manufacturer and selling into the Gulf, the representative is not a formality you delegate and forget. It is the entity that answers when SFDA or MOHAP calls, and its quality is a direct factor in your regulatory standing.

2. Saudi Arabia: the SFDA registration route

Saudi Arabia's medical device market is regulated by the Saudi Food and Drug Authority (SFDA). Selling an unregistered medical device in the Kingdom is not permitted.

Classification. SFDA uses a four-tier, risk-based classification:

Classification determines the conformity assessment route, the depth of the technical file, whether a conformity assessment body must be involved, and how long registration takes. Producers are expected to complete the classification on the basis of intended use, duration of contact, degree of invasiveness, energy supply, sterility and whether the device incorporates a medicine — and to document the reasoning.

For first aid kits, the classification question is the same one that matters in Europe: it is driven by the contents. A non-sterile kit of low-risk consumables sits in a very different place from a kit containing sterile dressings or trauma components. This is worth establishing before anything else, because it determines everything downstream.

The route. Registration runs through the GHAD electronic system. In outline:

1.Confirm the classification and the applicable conformity assessment route

2.Appoint an SFDA-licensed In-Country Representative and complete establishment registration in GHAD

3.Prepare the technical file — device description, intended use, materials, manufacturing process, risk management file, clinical or performance evaluation, verification and validation reports, stability data

4.Where required, obtain a conformity certificate from an SFDA-recognised assessment body

5.Submit the marketing authorisation application through GHAD with the representative's authorisation letter, business licence, QMS certificate, conformity certificate, technical file summary, labels, instructions for use and a free sale certificate

6.Pay the applicable fees, respond to queries, and on approval place the device on the Saudi market

Marketing authorisations are typically valid for five years, after which re-registration is required. Post-market obligations continue throughout: adverse event reporting, market surveillance and quality control. SFDA can require a recall, suspend sales or withdraw a registration.

Labelling. Labels and instructions for use must meet SFDA requirements, and Arabic is generally required, with English commonly required alongside. Content typically has to include the manufacturer, the authorised representative, certification information, warnings, storage conditions and UDI information.

One note that surprises suppliers: Class A can in some cases allow self-declaration, but sterile, measuring or special-function products still require a conformity assessment body. "Low risk" does not automatically mean "no third party." Expect registration timelines measured in months, and plan market entry around that timetable rather than around a purchase order.

3. Saudi Arabia: what employers are actually required to do

Registration gets your product into the country. It does not tell an employer what to buy. That is a separate framework, and it is the layer most suppliers never explain to their customers.

The baseline comes from the Ministry of Human Resources and Social Development (HRSD) and the National Council for Occupational Safety and Health: employers must maintain stocked medical aid cabinets on site, keep trained first aiders available during working hours, and post safety instructions in Arabic — with additional language provisions where the workforce is multilingual. That last point matters in practice: Jubail, Yanbu and Dammam run large multilingual workforces, and a safety notice nobody can read does not discharge the duty.

Above the baseline sit the contractor standards governing the industrial market. Saudi Aramco's contractor medical standard, GI 150.002, together with the MMSR manual, sets out kit sizing widely referenced across the Eastern Province: sites with fewer than 50 workers require at least one 10-unit kit, and sites with 50 or more at least one 36-unit kit, with contents defined in the MMSR attachments.

Training requirements scale with hazard. Commonly cited guidance puts the general requirement at one certified first aider per 25–50 workers depending on site risk classification, with high-hazard oil, gas and petrochemical operations often requiring one certified responder per 10 workers. Certificates are typically valid for two years and are generally expected to come from TVTC-approved training providers.

Two contextual facts explain why this market is tightening rather than loosening. Saudi Arabia's workplace injury rate has fallen substantially since 2018 as part of the Vision 2030 safety agenda — and as the floor rises, what passed an audit five years ago increasingly does not.

Selling into Saudi industrial or Aramco-linked accounts and unsure which kit size applies? Send us your site profile and we will map the configuration to the applicable unit size and contents specification.

4. UAE: Dubai Municipality's workplace rules

The UAE's picture is more fragmented, because occupational safety is administered both federally and at emirate level — Abu Dhabi under the OSHAD framework, Dubai under its own instruments.

For Dubai specifically, Administrative Resolution No. (7) of 2022 approved a workplace first-aid manual for the emirate, placing workplace first aid inside a formal compliance structure. The requirements as commonly applied:

Three operational obligations come with the boxes:

Monthly inspection. Employers are expected to inspect first aid boxes monthly — checking expiry dates, quantities against the minimum, cleanliness and condition of the box itself — and to restock immediately after use or on discovering expired items. Records of inspections should be documented.

Injury records. Workplaces must maintain an injury record book covering injuries requiring first aid treatment: date, time, employee details, location, description of the injury and how it occurred, treatment provided, name of the person who administered it, whether further medical attention was required, and witnesses where applicable. Records are generally retained for at least five years.

Clear identification and awareness. Employees need to know where the boxes are. A box in the right place that nobody can find fails the same test as a box in the wrong place.

Feedback from the market suggests a compliant basic box for a small office typically costs in the order of AED 200–400, with premium configurations at AED 500–800, and a full first aid room fit-out in the tens of thousands of dirhams. Equipment should be verified as meeting the specification referenced in the municipality's guidance rather than assumed to comply because it is sold as a "workplace first aid box."

On the registration side, the UAE route runs through MOHAP with a local technical representative, as described above — and the UAE has expanded its post-market surveillance expectations in recent years, meaning the representative must have the operational capacity to handle adverse event reporting, field safety corrective actions and label change notifications in a timely way.

Note on scope: emirate-level requirements differ, and Abu Dhabi, Sharjah and the northern emirates operate their own frameworks. Buyers should confirm the current requirements with the relevant authority for each site, and suppliers should be able to supply the documentation that supports that confirmation.

5. The mistake that costs the most: treating the two layers as one

Here is the pattern that goes wrong most often. A supplier registers a product with SFDA or MOHAP, the registration is approved, and the supplier concludes the market is open — quotes against a tender, and wins.

Then the end user's HSE team asks a different set of questions. Which kit size for a 60-worker site? Are the labels in Arabic? Do the contents match the applicable unit specification? What is the refill path? Who signs the monthly inspection?

The supplier has registration and no answers. The order stalls, or ships and gets rejected at the site gate.

The fix is simple but it has to happen before the quotation: treat GCC compliance as two products in one — the registered device, and the workplace-configurable kit.

6. What this means for kit design and supply

Five implications for anyone building a first aid kit range for the Gulf:

Arabic labelling is a specification item, not a translation task. It affects artwork, print runs, version control and lead time. A supplier with multi-language production capability handles it as a production step; a supplier without one handles it as a project, and the project always takes longer than quoted.

Kit ratios are content decisions, not just box-size decisions. A 10-unit and a 36-unit configuration are different bills of materials. Suppliers who quote a single "workplace kit" and size it up or down at order stage produce kits that do not match their own documentation.

Expiry management is a market differentiator. With monthly inspection expectations, a climate that punishes poor storage, and SFDA requiring storage conditions on the label, short-dated stock is a recurring complaint. Batch traceability and honest shelf-life declarations are part of the product.

Refills are the durable business. Every mandated replacement cycle produces a consumables demand that runs for years. A supplier who can supply the kit and the refill programme is a different commercial proposition from one who can only supply the box.

Want to see how a GCC-ready configuration would price against a European or North American build? Request a comparison quote with the target market and site profile, and we will return a configuration, a contents list and a realistic production date.

7. How Kebon supports GCC-bound programmes

Our role in these markets is documentation and manufacturing, and it is worth being precise about the boundary.

Registration sits with your appointed local representative. SFDA and MOHAP registration is submitted by the licensed representative your business appoints, and it is not something a manufacturer can absorb on someone else's behalf. What we control is the quality of what goes into that submission.

In practice:

*ISO 13485 quality management documentation and certificate copies covering the ranges we supply — a requirement SFDA now places on the in-country representative as well

*Technical file material — device descriptions, intended use, materials, manufacturing process information, risk management documentation and test reports — plus free sale certificate support for the dossier

*Component-level content lists in formats that support conformity assessment rather than restating a case specification

*Arabic and English labelling produced as a standard production capability, alongside the other languages our export programmes require

*A broad product matrix across the categories Gulf buyers assemble programmes from: workplace medical first aid kits, industrial first aid kits, advanced wound closure kits, tactical and trauma packs and car emergency rescue kits

And one thing we will not do: quote a configuration without flagging it. If a requested item would change the classification of an assembled kit in your target market, we say so at quotation stage.

Building a Gulf range? Tell us the market and the site profile and we will come back with the configuration, contents list and documentation package your representative will need.

8. Frequently asked questions

Can a foreign manufacturer register a medical device in Saudi Arabia directly?

No. SFDA requires an appointed In-Country Representative holding a valid medical device establishment licence. The representative's name and licence number appear on the product registration.

How many first aid kits does a Saudi worksite need?

Under Saudi Aramco's contractor medical standard GI 150.002, sites with fewer than 50 workers require at least one 10-unit kit, and sites with 50 or more require at least one 36-unit kit, with contents defined in the MMSR manual. Non-Aramco workplaces fall under HRSD requirements, set out at a framework level. Confirm the applicable standard for each site.

What does Dubai require for workplace first aid boxes?

Following Administrative Resolution No. (7) of 2022, workplaces require compliant boxes regardless of headcount: a minimum of one box for 1–50 employees, boxes positioned for three-minute access for 51–250 employees, and a dedicated first aid room at 250+. Monthly inspection and injury records are part of the framework.

The short version

Saudi Arabia and the UAE are two markets with one shared trap. Registration is the door; workplace compliance is the room. Suppliers who understand only the first half win customs clearance and lose the site.

The suppliers who win both are the ones whose contents lists map to a customer's sizing requirement, whose labels are already bilingual, and who can say what changes when a sterile dressing enters the configuration. That is a manufacturing service, not a regulatory one — and it is the reason to choose a supplier before the tender, not after.