Devices and medicines · quoted by scope

The file you have is not the file they read

A technical file built for the EU and a dossier built for the MHRA are both perfectly good documents. They are also built around a certificate that four of these six markets do not name, and they are missing documents that have to be obtained abroad, translated, and legalised through a consulate. That gap is the work.

WHERE A CERTIFICATE OF PHARMACEUTICAL PRODUCT COMES FROM Your MHRA authorisation not where the certificate comes from The site that makes it Ireland, India, wherever it actually is That country's authority issues the CPP and GMP certificate The mission in that country legalises them, not the one in London A UK holder manufacturing abroad has a queue in a third country that nobody put in the project plan.
Nigeria's guideline is explicit that the certificate must come from the authority in the country of manufacture. It is the single most common reason a dossier we are asked to rescue is three months behind.
1 of 6markets that names UKCA in its device document list
4 of 6still require a certificate of pharmaceutical product — one has just dropped it
3markets with no apostille route at all, so documents go through a consulate
Yoursto keep — a file another provider can submit, if you prefer
The finding

Brexit did not change your mark. It removed the document your file was built around

A manufacturer who moved from CE to UKCA did not simply swap one certificate for another. In markets whose document lists were written to rely on a CE certificate, they deleted the item the whole file was designed to sit on — and most of those lists have not been rewritten since.

The Emirates ask for a quality conformity certificate and name three: EC, 510(k), PMA. UKCA is not among them, and we have found no published instrument saying it will do. Türkiye's device regulations contain the string "UKCA" zero times — we searched the consolidated texts. Saudi Arabia shortens nothing for any foreign approval, so the question does not arise there. Egypt is the exception, and a striking one: it names the United Kingdom on its reference-country list and publishes a dedicated instrument for devices marketed in Great Britain and not required to be marketed in the EU.

On the medicines side the same thing happens to a different document

Saudi Arabia has stopped asking for a certificate of pharmaceutical product — in SFDA's own words, it "is optional and no longer required for new Marketing Authorization applications within all regulatory pathways". Egypt, Türkiye, Nigeria and the UAE all still require one, and Nigeria wants it authenticated by its own High Commission.

Which means a dossier assembled for one of these markets is not portable to the next, and the item you can safely delete in one is the item that blocks you in another.

This is why we do this work as its own service rather than only as part of a registration. Quite often the file is the project, and everything else is waiting on it.

Twelve document sets

What each regulator asks for — and what it will not accept

The left column is what goes in. The right column is what is conspicuously absent from the published list, which is usually the more useful half.

—

—
What goes in
    What is not on the list
      The critical path nobody plans

      Legalisation is a queue, not a task

      A document that has to be authenticated by a foreign mission is not a line item you tick in an afternoon. It is a third party's calendar, in a third country, and it sits on the critical path of everything downstream. Three of these six markets have no apostille route at all.

      Egypt
      Consular
      Not a contracting party to the Apostille Convention. Chamber of Commerce, then the Egyptian Embassy in the country of origin; mandates additionally need bank signature verification. The relief that matters: quality certificates issued by reference countries — an FDA CFG, a CE certificate, ISO 13485:2016, a free sale certificate — escape that legalisation where EDA verifies authenticity directly with the issuing body. The UK is on the reference list, so a UK manufacturer is inside the relief. Where verification fails, legalisation comes back.
      Nigeria
      Consular
      Not a contracting party. Three medicines documents must each be authenticated by the Nigerian Embassy or High Commission in the country of origin: the certificate of pharmaceutical product, the current GMP certificate and the foreign manufacturing licence. Where there is no Nigerian mission, any Commonwealth or ECOWAS country's will do. An apostille will not.
      Türkiye
      Split
      The asymmetry here costs people a fortnight. The CE certificate needs an apostille. The mandate between a manufacturer established outside Türkiye and its EU authorised representative expressly does not — and it does need a sworn Turkish translation. One document must be apostilled and the other must not.
      United Arab Emirates
      Consular
      The certificate of pharmaceutical product is required original and legalised at the UAE embassy, as is the foreign manufacturing licence. Documents of Gulf origin are exempt from that legalisation. The free sale certificate for a device is legalised on the same route.
      Saudi Arabia
      Not traced
      We have not traced a legalisation requirement for the device file to an SFDA publication, and we are not going to infer one from the Kingdom's general treaty position. On the medicines side SFDA has removed the certificate of pharmaceutical product entirely, which removes the document most often legalised. We establish the position per project rather than quoting it here.
      South Africa
      Not traced
      SAHPRA's device licensing pack — covering letter, forms, curriculum vitae, quality manual or site master file, proof of payment, product list — carries no legalisation requirement we have traced to a published document. Same treatment: established per project, not asserted here.

      Where a cell says "not traced", that is a statement about our research, not about the market. It means we have not found the rule in a regulator's own publication and will not repeat one from a secondary source.

      The one decision here that is not ours

      Whether to hand over the unredacted assessment report

      Reliance pathways run on the report your home regulator wrote about you. Two of these markets make the commercial consequence explicit, and the choice belongs to you rather than to your regulatory adviser.

      What sharing it buys

      • Nigeria categorises every dossier by risk, and the unredacted report is what puts you in the low category rather than the medium one
      • A thinner review, and fewer of the questions that stop the regulator's clock and start yours
      • Egypt's reliance routes require the same dossier you filed with the reference agency, the unredacted report, and a certificate of pharmaceutical product — without it you are not on the route at all
      • South Africa's abridged review substitutes the reference authority's full assessment report for the complete module 2 to 5 data package

      What it costs

      • The report contains your regulator's unfiltered view of your own file, including what it was unhappy about
      • Once released to a foreign authority you do not control onward handling
      • Some holders have contractual constraints with partners or licensors that make release a legal question, not a regulatory one
      • Declining is a legitimate answer with a known, priceable consequence — a heavier review, not a refusal

      How we handle it. We put the trade-off in writing with the clause that creates it, we price both paths, and then you decide. We do not release an assessment report on your behalf without a written instruction, and we do not treat the decision as a formality because it is the one item in a dossier that is a business judgement rather than a regulatory one.

      The work

      Four stages, and you can stop after the first

      The gap analysis is sold on its own and is frequently all anyone needs. Nobody is obliged to buy the rebuild from the people who found the gaps.

      1. 01

        Gap analysis against the target market

        Your file, line by line, against the published requirement for that market and that class or pathway. Three columns: accepted as it stands, needs reformatting or translating, does not exist yet. Delivered as a document you can hand to your QA lead or to another provider.

        Us · sold separately
      2. 02

        Obtain what has to come from elsewhere

        Certificates of free sale, certificates of pharmaceutical product, GMP certificates, manufacturing licences — requested from the right authority, which for a medicine is the authority where the product is made rather than where it is authorised. This is where the legalisation queue starts, so it starts first.

        Us, with your QA
      3. 03

        Rebuild and reformat

        For a device: conformity against the applicable essential principles, the risk management file, post-market surveillance plan, clinical or performance evidence summary, labelling and instructions for use, and the UDI carrier where one is required. For a medicine: module 1 rebuilt to that market's own regional specification, and the quality, non-clinical and clinical modules checked for what that regulator adds to what your home authority accepted.

        Us
      4. 04

        Translate, legalise, and hand over

        Sworn translation where the market requires it — Türkiye requires it for the representative's mandate and for the instructions for use loaded into ÜTS. Legalisation coordinated through the right mission. You receive a submittable file, whether or not we are the ones who submit it.

        Us, coordinated

      Available without the registration. You do not have to hire us for the project to have us fix the file. A file we build is a file another provider can submit, and we write it to be readable by someone who was not in the room.

      The boundary

      What we will not do to a file

      We do

      • Read what you have and say plainly what is missing
      • Rebuild documentation to the target market's format and language
      • Obtain and legalise the certificates that must come from third parties
      • Write the conformity argument against the essential principles, and the regional module 1
      • Prepare the reliance package, with the clause that admits you cited
      • Hand you a file you own outright, including if you take it elsewhere

      We do not

      • Generate clinical or performance evidence that does not exist — no dossier writing can substitute for a study
      • Run bioequivalence studies, or commission them without your instruction
      • Sign a declaration of conformity or a certificate on your behalf
      • Present a document as satisfying a requirement where the regulator has not said it does
      • Submit a file we know to be incomplete to meet a date

      The uncomfortable one

      Sometimes the gap analysis finds that the evidence a market requires was never generated, and that no amount of formatting will close it. When that happens we say so in the gap analysis rather than building three months of documentation around an absence. It is the shortest version of this engagement and the one clients thank us for later.

      Questions

      Asked before we quote

      Can you quote from the index alone?

      Usually yes, and it is the fastest way to start. A table of contents plus the class or dosage form tells us most of what drives the scope.

      Our file is in a consultant's system and they are slow to release it.

      Common, and worth saying at the first call. We plan around it rather than promising a date we cannot hold, and the gap analysis can often start from the index and the certificates while the rest arrives.

      We hold UKCA only. Is that fatal?

      In one of these six it is an advantage, because Egypt publishes an instrument specifically for devices marketed in Great Britain. Elsewhere it ranges from neutral to a problem that needs establishing in writing with the regulator before you spend money. That answer is per market, and it is the first thing a gap analysis resolves.

      Will you work alongside our existing regulatory consultant?

      Yes, and we do it often. The deliverable is a document, not a relationship, and we are happy for it to land on someone else's desk.

      How long does the gap analysis take?

      Usually one to two weeks depending on how many markets and how much of the file exists. The obtaining and legalising stage is the long one, and its length is not ours to set.

      Do you keep a copy?

      We keep what we need to support you, under the NDA, and we delete on request. You own the output outright.

      Start

      Send the index, not the file

      Do not send us three hundred megabytes to begin with. The table of contents, the certificates you hold and the market you are aiming at are enough to scope the work and quote it.

      • Product name, and whether it is a device or a medicine
      • For a device: class and the rules you classified under. For a medicine: dosage form, strengths, and originator, generic or biological
      • Target market or markets
      • Certificates held — CE, UKCA, FDA, ISO 13485 for a device; MHRA or EU marketing authorisation, GMP certificate for a medicine
      • Where the product is actually manufactured, which is not always where it is authorised
      • The technical file or CTD index
      • Whether an assessment report exists and whether you are willing to release it unredacted
      • Anything a regulator has already queried

      Mutual NDA signed before you send anything. If your legal team prefers its own template, send that instead.

      Find out what is missing before someone else does

      A gap analysis costs a fraction of a registration project and occasionally replaces one. It is also the only part of this work that gets cheaper the earlier you do it.

      mail@bcabusiness.co.uk · +44 7342 901002 · WhatsApp

      Every document requirement on this page traced
      to the regulator that published it · 18 September 2026

      Where the requirements come from

      1. Saudi Arabia, devices. MDS-REQ 1, Requirements for Medical Devices Marketing Authorization, version 6 — Essential Principles conformity, ISO 13485:2016 quality system, declaration of conformity, risk management file, post-market surveillance plan, summary of safety and clinical performance, labelling and instructions for use. MDS-REQ 7 version 4 — unique device identification. SFDA circulars of August and December 2020 discontinuing the GHTF reliance route.
      2. Saudi Arabia, medicines. SFDA Regulatory Framework for Drugs Approval version 6.4 — "CPP / free-sales submission is optional and no longer required for new Marketing Authorization applications (MAA) within all regulatory pathways". SFDA dossier guidance, updated August 2025, which on the United Kingdom does not read the same way as the framework; we set both out on the market page rather than choosing for you.
      3. United Arab Emirates. EDE service pages — the quality conformity certificate named as EC, 510(k) or PMA, with no mention of UKCA; the legalised free sale certificate. For medicines: a legalised current GMP certificate from the competent authority in the country of origin, a manufacturing licence legalised and attested at the UAE embassy, a site master file, the product list and a company profile; the certificate of pharmaceutical product original and legalised, with Gulf-origin documents exempt; registration status in the country of origin as a mandatory dossier field where the product does not belong to the marketing authorisation holder in the UAE. Federal Decree-Law 38 of 2024.
      4. Egypt, devices. GL.CAMD.002 version 02, 09/2025 — the three certificate routes and the reference-country list including the United Kingdom, and the legalisation relief where the administration verifies authenticity directly with the issuing body. GL.CAMD.010 version 2 — the dedicated instrument for devices marketed in Great Britain and not required to be marketed in the European Union, recording the decision of 11 May 2022 to continue recognising the United Kingdom as a reference country.
      5. Egypt, medicines. EDA dossier requirements version 4, 14 December 2023 — the legalised agency agreement or authorisation letter between licence holder and applicant, and the legalised certificate of pharmaceutical product. The reliance routes requiring the same dossier filed with the reference agency, an unredacted assessment report and a certificate of pharmaceutical product.
      6. Türkiye, devices. Tıbbi Cihaz Yönetmeliği and the ÜTS guidance of 13 May 2026 — registration streams, document requirements, apostille rules for certificates, and the Turkish instructions for use. The mandate between a manufacturer established outside Türkiye and its EU authorised representative: sworn translation required, apostille expressly excluded. We searched the consolidated texts of the Medical Device Regulation and the IVD Regulation: "UKCA" appears zero times.
      7. Türkiye, medicines. Beşeri Tıbbi Ürünler Ruhsatlandırma Yönetmeliği article 8(1)(n) — the yetkili tek temsilci sole authorised representative instrument required in the dossier; article 7 — the qualified person.
      8. Nigeria. Guidelines for Registration of Medical Devices in Nigeria, VBM-R&RA-GDL-001-00, effective 4 November 2024 — the local agent and Corporate Affairs Commission incorporation evidence, the notarised power of attorney valid at least five years naming brand ownership, the Certificate of Manufacture and Free Sale authenticated by the Nigerian High Commission, and trademark registration in the name of the trademark owner. For medicines: DRR-GDL-005-03, effective 20 March 2025 — the three documents each authenticated by the Nigerian Embassy or High Commission in the country of origin, and the requirement that the certificate come from the authority in the country of manufacture. DRR-GDL-033-01, effective 7 December 2024 — the low, medium and high risk categories and the unredacted-report distinction. S.I. 42 of 2024, Gazette 176 volume 111, 16 October 2024 — labelling in English carrying the NAFDAC number, batch, lot, serial number and barcode.
      9. South Africa, devices. SAHPGL-MD-07 version 4, 21 May 2025 — the application pack: covering letter, application form in both spreadsheet and PDF, the representative's curriculum vitae, a quality manual for manufacturers and distributors or a site master file for wholesalers, proof of payment, the product list with international nomenclature codes, and evidence of pre-market approval from one of six recognised jurisdictions. SAHPRA communication MD01-2025/2026 version 2, 18 September 2025 — the ISO 13485 phase-in to 2028.
      10. South Africa, medicines. SAHPGL-BAU-01 version 5, 6 August 2025 — abridged review substituting the reference authority's full assessment report for the complete module 2 to 5 data package, with electronic dossier conversion attached as a condition. SAHPGL-HPA-07 version 12 — the pharmacist dossier signatory and the person-specific letter of authorisation.
      11. Legalisation. HCCH status table for the Apostille Convention, current to 30 June 2026 — Egypt and Nigeria are not contracting parties. MHRA guidance on certificates of free sale for exporting medical devices, including the FCDO authentication position, updated 1 April 2026.

      What we could not confirm. We have not traced a legalisation requirement for the Saudi device file or the South African device licensing pack to a regulator's own publication, and we do not infer one from either country's treaty position — the table above says "not traced" rather than "none required". We have also found no published instrument confirming that a UKCA certificate satisfies the Emirati quality conformity certificate requirement, and we will not state that it does on the strength of a secondary source.

      Each document list sits in fuller context on the market page it comes from: all twelve are here.

      ```