SFDA Serialisation Requirements for Industrial Packaging in Saudi Arabia: The 2026 Compliance Breakdown

A shipment of pharmaceuticals arrives at a Saudi distributor's warehouse. The cartons look fine. The product inside is legitimate. But the secondary industrial packaging is missing a compliant GS1 DataMatrix barcode, and the SFDA's RSD system has no record of those serial numbers. The consignment sits. It can't move. The distributor can't sell it. And the manufacturer, who thought they'd ticked every box, is now facing a potential market block and a line shutdown while they figure out what went wrong.

This is not a hypothetical. It's the reality for pharma companies that treat SFDA serialisation as an afterthought. In 2026, with the Kingdom's Vision 2030 traceability roadmap advancing and OTC product categories expanding in scope, the rules are tighter, the enforcement posture is more confident, and the window for "we're working on it" compliance excuses is closed. This article breaks down exactly what the SFDA requires for industrial packaging at every level — what the GS1 DataMatrix barcode must carry, how the RSD system works, and where most manufacturers still fall short.

01 What SFDA Serialisation Actually Requires on Your Industrial Packaging

Let's be precise here, because vague summaries are what get teams into trouble. The Saudi Food and Drug Authority requires all human drugs sold on the Saudi market to carry a GS1 DataMatrix barcode on their secondary industrial packaging. This has been mandatory at the serialisation level since March 2017. What that barcode must contain, at minimum, is non-negotiable:

• GTIN-14: a 14-digit Global Trade Item Number that uniquely identifies the product. Local manufacturers must register with GS1 Saudi Arabia to obtain a Company Prefix and generate compliant GTINs.
• Serial Number (SN): an alphanumeric, randomised serial number, variable in length, up to 20 characters. This is the individual unit identifier; each box gets its own.
• Expiry Date: required both inside the DataMatrix code and in human-readable form on the outer packaging surface.
• Batch/Lot Number: the production lot, included in the DataMatrix barcode and printed legibly on the pack.

Each element must be accompanied by its GS1 Application Identifier (AI): a two- to four-digit prefix code that tells the scanner exactly what it's reading. Without the correct AIs, a barcode that looks correct to the human eye can be rejected outright by verification systems.

The barcode itself must be a GS1 DataMatrix code. Not a standard Code 128. Not a QR code. DataMatrix. Positioned on the secondary industrial packaging (the individual saleable carton), printed at sufficient size and contrast to be scannable under a range of lighting and handling conditions. And in KSA's 45–50°C warehouse environments, print permanence and label adhesion become a real operational concern, not a footnote.

02 The Six Packaging Levels SFDA Defines (And Which Ones Are Mandatory)

This is where most industrial packaging teams get confused. The SFDA defines six distinct packaging levels, and compliance obligations differ across them. Understanding which levels require what is not optional reading; it's the difference between a compliant aggregation hierarchy and one that falls apart the first time your distribution partner tries to verify a shipment.

Level 1 — Primary Packaging

The innermost layer that contacts the product: blister packs, ampules, vials. Not required to carry a unique serial number under SFDA regulations. However, manufacturers may optionally apply a GTIN-14, expiry date, and batch number at this level.

Level 2 — Secondary Packaging (The Compliance-Critical Level)

The individual saleable unit: the carton or box. This is where compliance lives. A mandatory GS1 DataMatrix barcode with all four data elements (GTIN-14, SN, expiry, batch) is required on every secondary pack. Required since March 2017. No exceptions for human drugs.

Levels 3 and 4 — Homogeneous Bundle / Sub-Carton / Inner Pack

These intermediate configurations are used for commercial groupings of the same product. They're not required for aggregation purposes, but manufacturers may optionally apply a GTIN-14, expiry date, batch number, and SSCC at these levels.

Level 5 — Case / Carton / Outer Pack

This is where aggregation becomes mandatory. An 18-digit Serial Shipping Container Code (SSCC) is required by SFDA on cases, whether they contain homogeneous (same product type) or heterogeneous (mixed) content. For homogeneous cases, the GTIN-14, expiry date, and batch number may optionally be added alongside the SSCC.

Level 6 — Pallet

Same logic applies. SSCCs are required at the pallet level for both homogeneous and heterogeneous pallet configurations. The pallet is the top of the aggregation hierarchy and when the parent-child data is structured correctly, scanning the pallet-level SSCC infers the contents all the way down to individual secondary-pack serial numbers. That inference chain is exactly what the SFDA's RSD system depends on.

“ Without the correct Application Identifiers, a barcode that looks correct to the human eye can be rejected outright by verification systems. — Section 01

03 The RSD System: How Saudi Pharma Traceability Actually Works

The RSD (Reporting and Stakeholder Data) system is the SFDA's central track-and-trace infrastructure. Every movement of registered drugs through the Saudi supply chain must be reported to it. Understanding its two portals and three reporting methods is fundamental to operating legally in KSA.

The RSD Stakeholder Management Portal

This portal handles initial registration. Manufacturers, importers, distributors, and warehouses register their organisations, products (by GTIN-14), and physical locations (by Global Location Number, or GLN) here. Every licensed manufacturer must have a GLN. Every product must have a corresponding GTIN registration in the system before it moves anywhere.

The RSD Stakeholder Operation Portal

This is where supply chain events are reported. There are three methods available:

• Automated integration — a direct system-to-system API connection between the manufacturer's serialisation platform and RSD. Once integrated, all drug movement events are logged automatically with no manual touchpoints.
• CSV upload — batch-level product data uploaded as a structured file through the portal. Common for smaller operations or lower-volume markets.
• Manual data entry — transaction-by-transaction input directly into the portal. Functional but not scalable, and generally a sign of a serialisation operation that's still catching up.

Most companies running serious pharma volumes on KSA lines are targeting automated integration. The payoff is significant: once your system talks to RSD, the reporting load disappears from your team's daily operations. But getting to that integration point requires a serialisation engine that can generate compliant events in the correct format and that starts at the industrial packaging line itself.

Each product also requires a Saudi Drug Code (SDC); an SFDA-assigned identifier with a fixed prefix, year, a drug-type letter, and a serial suffix (format: SFDA##X###). The SDC is separate from the GTIN-14 and is issued upon drug registration with the SFDA. Both are required for market access.

04 Aggregation: The Compliance Layer Most Lines Are Still Getting Wrong

Aggregation has been mandatory in Saudi Arabia since 2020. Despite that, in our experience talking to manufacturers and distributors across the region, aggregation remains the most common compliance gap we see, especially at the case and pallet level.

Here's the thing: the SFDA does not require you to report aggregation events through the RSD. Aggregation is handled via the Saudi Package Transfer System (PTS), which the SFDA treats as a service layer, not a reporting system. That distinction matters, but it doesn't make aggregation optional. What the PTS enables is bulk transfer of aggregated product identifiers between supply chain partners so that the parent-child relationships are known by all stakeholders before product moves.

Because SFDA hasn't defined a fixed data format standard for the PTS, individual trade partners must establish their own specifications for how aggregation data is structured when exchanged. In practice, this means your serialisation solution and your trading partner's system need to agree on data exchange formats before first shipment. Getting this wrong creates broken aggregation hierarchies, orphaned serial numbers, and distribution partners who can't verify receipt correctly.

The minimum aggregation requirements for your industrial packaging lines:

“ Aggregation has been mandatory since 2020, yet it remains the most common compliance gap we see, especially at the case and pallet level. — Section 04

05 Secondary Packaging Label Specs: Bilingual, Precise, and Auditable

The SFDA's labeling requirements for secondary industrial packaging go beyond the DataMatrix barcode. The outer carton must carry a significant amount of human-readable information, and it must do so in both English and Arabic. This bilingual mandate is strictly enforced and applies to all pharmaceutical products, whether manufactured locally or imported into the Kingdom.

Key labeling elements required on the secondary pack include:

• Generic and trade names, with the generic name sized at a minimum of 50% of the trade name's font size
• Product name displayed on at least three non-opposing faces of the carton
• Active ingredient(s) and dosage strength
• Dosage form (tablet, capsule, syrup, etc.)
• Manufacturing date and expiry date, formatted as either a three-letter month abbreviation (e.g. OCT 2026) or as MM/YYYY
• Batch/lot number in human-readable form
• Storage conditions
• Warnings and precautions in both languages
• Name and address of the marketing authorisation holder

This is not a trivial print job. In practice, managing artwork versions across multiple products, strengths, and packaging configurations; all with Arabic and English content and GS1 DataMatrix serialisation data printed inline, requires a coding and labeling solution that can handle variable data printing at line speed without compromising barcode quality or label legibility.

We keep seeing this at clients' facilities across the Eastern Province: the label artwork is correct, the DataMatrix code passes the initial verification check, but the barcode grade degrades over the production run as print heads wear or ink pressure drops. SFDA doesn't care why the code failed. It just won't scan.

06 The Expanding Scope: OTC Products, Medical Devices, and What's Next for KSA Compliance

If your current compliance posture only covers prescription drugs, pay attention here. The SFDA's serialisation framework was originally built around human registered drugs. But the scope has been expanding deliberately and consistently and the trajectory for 2026 and beyond is clear.

OTC medicines are now within the serialisation mandate in KSA, and the SFDA has signalled an intent to bring veterinary drugs, herbal products, and health supplements into the same GS1-based framework. If your industrial packaging line handles any of these categories, the time to plan for serialisation capability is now; not when the enforcement circular lands.

Medical devices are also now subject to a Unique Device Identification (UDI) system under the Executive Regulation of Medical Devices Law (SFDA Board of Directors Decree No. 3-29-1443). Class B, C, and D devices had a UDI compliance deadline of September 2023; Class A devices followed in September 2024. The SFDA-DI database is the registration repository, and accepted identification standards include GS1, HIBCC, and ICCBBA. Formal enforcement has been gradual, but the regulatory intent is unambiguous.

For GCC manufacturers looking beyond Saudi Arabia, the picture is equally active. The UAE's Tatmeen platform operates under MoHAP and requires GS1 DataMatrix codes with live reporting to a national serialisation repository; it's considered one of the most technically advanced real-time serialisation systems in the MENA region. Bahrain's NHRA is in transition, with its previous platform contract terminated as of August 2026 and new technical guidance expected. Qatar is in active exploration of serialisation mandates. The GCC trajectory is clear: if you're not building industrial packaging lines that are serialisation-ready today, you're building them for expensive retrofit tomorrow.

07 What This Means for Your Packaging Line Equipment

SFDA compliance isn't just a software and registration problem; it lives on the production line. Every secondary industrial packaging line destined for the Saudi market needs to be able to do several things: print a GS1 DataMatrix barcode with all four mandatory data elements at production speed with consistent barcode grade; verify each printed code inline before the carton is sealed and casepacked; generate and apply case-level SSCC labels at Level 5; generate and apply pallet-level SSCC labels at Level 6; and capture and communicate serialisation event data to the RSD or via PTS.

The coding and labeling technology at the unit level is particularly critical. Variable data printing on secondary packaging, where the serial number changes with every single carton, requires either thermal inkjet, laser coding, or high-resolution continuous inkjet. Each technology comes with different tradeoffs for speed, print permanence in KSA's heat, and substrate compatibility. There's no one-size-fits-all answer here. It depends on your line speed, carton material, and the number of data fields you're printing simultaneously.

As Mettler Toledo's official partner in Saudi Arabia, Global Scales & Systems Co. Ltd works with pharma manufacturers and industrial packaging operations across the Kingdom and GCC to specify, install, and maintain the marking, coding, and labeling solutions that sit at the heart of SFDA-compliant packaging lines. Getting the hardware right is the foundation. Everything else; the software integration, the RSD reporting, the aggregation hierarchy, depends on a barcode being printed correctly, every single time, at line speed.

“ Getting the hardware right is the foundation. Everything else depends on a barcode being printed correctly, every single time, at line speed. — Section 07

08 FAQ: SFDA Serialisation and Industrial Packaging in Saudi Arabia

The questions we hear most often from operations and compliance teams across KSA answered directly.

What is the minimum data required in the GS1 DataMatrix barcode on pharma secondary packaging in KSA?

The SFDA requires four minimum data elements in the DataMatrix barcode on every secondary pharmaceutical pack sold in Saudi Arabia: the GTIN-14 (14-digit product identifier), a randomised serial number of up to 20 alphanumeric characters, the expiry date, and the batch/lot number. Each element must be preceded by its GS1 Application Identifier code. The expiry date and batch number must also appear in human-readable print on the packaging surface.

Is aggregation mandatory for pharma industrial packaging in Saudi Arabia?

Yes. Aggregation has been mandatory since 2020. An 18-digit SSCC barcode is required on cases (Level 5) and pallets (Level 6). The SFDA does not require aggregation events to be reported through the RSD system, but parent-child relationships must be communicated between supply chain partners via the Saudi Package Transfer System (PTS). Incomplete aggregation data causes traceability failures and can block product movement at the distributor level.

Do OTC pharmaceutical products require SFDA serialisation?

Yes. Serialisation requirements apply to both prescription drugs and OTC medicines sold in Saudi Arabia. The SFDA also intends to extend the same GS1-based framework to veterinary drugs, herbal products, and health supplements; though phased timelines for those additional categories are still being communicated through official SFDA channels.

What happens if a product's serial numbers are not registered in the SFDA RSD system?

Products whose serial numbers are not registered and reported in the RSD cannot legally move through the Saudi supply chain. Distributors have no mechanism to verify receipt, and pharmacies cannot legally dispense unverified products. In practice, non-registered serialisation data means the product is blocked at the point of first distribution event; typically at the importer or warehouse level, with no recourse until the data issue is resolved.

Does the SFDA require bilingual labeling on secondary packaging?

Yes; both Arabic and English are required on pharmaceutical secondary packaging in Saudi Arabia. The generic drug name must appear at a minimum of 50% of the trade name's font size. Product name must be visible on at least three non-opposing faces of the carton. All critical information, including dosage, indications, storage conditions, and warnings, must be present in both languages. This is a hard labeling requirement, not a recommendation.

How often does pharma industrial packaging equipment need to be calibrated for SFDA compliance?

There's no SFDA-prescribed calibration interval for coding and labeling equipment specifically. But barcode verifiers, vision systems, and print heads need regular calibration and preventive maintenance to sustain the barcode quality grades needed for reliable RSD scanning and reporting. In KSA's climate with ambient temperatures regularly exceeding 45°C in warehouse and production environments, thermal drift and ink viscosity changes make quarterly preventive maintenance the practical minimum for compliant line operations.

This article is intended as a practical compliance reference and does not constitute legal or regulatory advice. Always refer to official SFDA guidance and consult your regulatory team for product-specific requirements.