--- title: "Egypt EDA - Cybersecurity Submission Playbook" description: "How to submit a medical device to EDA in Egypt: step-by-step route, evidence checklist, common rejections, and typical review timeline. Compared with FDA & gl" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "WebSite", "name": "The Medical Device Cybersecurity Crosswalk", "alternateName": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "description": "Compare FDA, EU MDR, MHRA, PMDA, NMPA, TGA, MFDS and Health Canada medical device cybersecurity requirements across 29 jurisdictions." }, { "@context": "https://schema.org", "@type": "Organization", "name": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "logo": "https://mdccrosswalk.com/favicon.png", "sameAs": [ "https://bluegoatcyber.com" ], "description": "An editorial reference comparing global medical-device cybersecurity regulations. Maintained by Blue Goat Cyber." }, { "@context": "https://schema.org", "@type": "Article", "headline": "Egypt - EDA Medical Device Registration & PDPL Cyber Overlay", "description": "How to submit a medical device to EDA in Egypt: step-by-step route, evidence checklist, common rejections, and typical review timeline. Compared with FDA & gl", "author": { "@type": "Organization", "name": "MDC Crosswalk" }, "publisher": { "@type": "Organization", "name": "MDC Crosswalk" }, "image": "https://mdccrosswalk.lovable.app/favicon.png", "datePublished": "2024", "about": "Egyptian Drug Authority", "dateModified": "2026-07-16", "mainEntityOfPage": "https://mdccrosswalk.lovable.app/standards/eg" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is SBOM required for medical devices in Egypt?", "acceptedAnswer": { "@type": "Answer", "text": "Not specified. Not addressed by EDA today; CE/FDA SBOMs accepted as supporting evidence." } }, { "@type": "Question", "name": "What does EDA require for pre-market cybersecurity?", "acceptedAnswer": { "@type": "Answer", "text": "Registration dossier modelled on GHTF/IMDRF, with reliance on reference-country approvals (FDA, CE, Health Canada). No standalone medical-device cybersecurity guideline yet; cyber posture assessed via SaMD review." } }, { "@type": "Question", "name": "What are the post-market cybersecurity obligations under EDA?", "acceptedAnswer": { "@type": "Answer", "text": "Vigilance reporting to EDA; PDPC handles data-breach notifications under PDPL." } }, { "@type": "Question", "name": "What is the penalty for non-compliance with EDA cybersecurity rules?", "acceptedAnswer": { "@type": "Answer", "text": "Registration cancellation, market withdrawal, fines under Law 151/2019." } }, { "@type": "Question", "name": "How much of my FDA cybersecurity package is reusable in Egypt?", "acceptedAnswer": { "@type": "Answer", "text": "Roughly 75% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report)." } }, { "@type": "Question", "name": "Why do EDA submissions get rejected for \"no scientific office appointed\"?", "acceptedAnswer": { "@type": "Answer", "text": "Contract a licensed Egyptian scientific office before filing." } } ] }, { "@context": "https://schema.org", "@type": "HowTo", "name": "How to submit a medical device to EDA", "description": "EDA accepts GHTF and CE evidence. Local scientific office representation is required for foreign manufacturers.", "totalTime": "6-12 months", "step": [ { "@type": "HowToStep", "position": 1, "name": "Appoint local representation", "text": "Most jurisdictions require a locally-established entity to hold the registration or act as authorised representative before submission." }, { "@type": "HowToStep", "position": 2, "name": "Reuse FDA or CE package as baseline", "text": "Adapt the cybersecurity subsection you already prepared for FDA or CE; regulators here typically accept the structure and ask for local labeling additions." }, { "@type": "HowToStep", "position": 3, "name": "Translate and localise", "text": "Local-language technical summary and labeling are usually mandatory; certified translation is safest." }, { "@type": "HowToStep", "position": 4, "name": "Submit + track queries", "text": "Respond to clarification rounds promptly; each unanswered question can add 30-90 days to the clock." } ] }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://mdccrosswalk.lovable.app/" }, { "@type": "ListItem", "position": 2, "name": "Standards" }, { "@type": "ListItem", "position": 3, "name": "Egypt" } ] } ] --- [ The Crosswalk ](/) [Overview](/)[Playbook](/playbook)CompareReference [New Per-page social previews and this changelog ](/changelog "Per-page social previews and this changelog") Search⌘K 1. [Home ](/) 2. Standards 3. Egypt EDA # ![Flag of Egypt](/flags/eg.svg)Egypt - EDA Guidance Last updated · 2024 Verified · 2026-07-16 EDA Medical Device Registration & PDPL Cyber Overlay Share Copy link X LinkedIn Email Sources verified · 2026-07-16 Cross-checked against Law 151/2019, PDPL 151/2020, and current EDA medical device registration circulars. Authority Egyptian Drug Authority Enforced 2019 (Law 151/2019 - EDA establishment) Legal framework Law 151/2019 establishing the EDA + EDA medical device registration decrees; Personal Data Protection Law 151/2020 (PDPL) for connected-device data handling. FDA package reuse ~75% [Editorial estimate · how →](/methodology#fda-reuse) ## Scope All medical devices placed on the Egyptian market. SaMD reviewed under EDA's software-as-a-medical-device circulars. Connected devices subject to PDPL when processing patient data. Pre-market Registration dossier modelled on GHTF/IMDRF, with reliance on reference-country approvals (FDA, CE, Health Canada). No standalone medical-device cybersecurity guideline yet; cyber posture assessed via SaMD review. Post-market Vigilance reporting to EDA; PDPC handles data-breach notifications under PDPL. SBOM Not specified Not addressed by EDA today; CE/FDA SBOMs accepted as supporting evidence. Vulnerability disclosure EG-CERT coordination for healthcare ICT incidents; no medical-device-specific CVD requirement. Penalty Registration cancellation, market withdrawal, fines under Law 151/2019. ## Unique requirements - 01 Egyptian authorised representative - 02 Arabic-language labelling - 03 Reliance dossier referencing reference-country approval ## Highlights - Reference-country pathway (FDA, CE, HC, TGA, PMDA) - Largest MENA market by population - PDPL data overlay for connected devices ## Aligns with IMDRF N60 ISO 13485 GHTF SG1 ## Timeline 1. 2019 Law 151/2019 establishes EDA as independent authority 2. 2020 PDPL 151/2020 enacted 3. 2024 EDA reliance-pathway circulars expanded ## Key documents [ EDA - Egyptian Drug Authority https://www.edaegypt.gov.eg/en/ ](https://www.edaegypt.gov.eg/en/)[ Law 151/2020 - Personal Data Protection Law https://www.dataguidance.com/notes/egypt-data-protection-overview ](https://www.dataguidance.com/notes/egypt-data-protection-overview) ## How to submit in Egypt Playbook reviewed · 2026-07-16 Submission route EDA registration under Ministerial Decree 296/2009 and updates EDA accepts GHTF and CE evidence. Local scientific office representation is required for foreign manufacturers. [Authority portal](https://www.edaegypt.gov.eg/) ### Step-by-step 1. Step 01 Appoint local representation Most jurisdictions require a locally-established entity to hold the registration or act as authorised representative before submission. 2. Step 02 Reuse FDA or CE package as baseline Adapt the cybersecurity subsection you already prepared for FDA or CE; regulators here typically accept the structure and ask for local labeling additions. 3. Step 03 Translate and localise Local-language technical summary and labeling are usually mandatory; certified translation is safest. 4. Step 04 Submit + track queries Respond to clarification rounds promptly; each unanswered question can add 30-90 days to the clock. ### Evidence checklist Item Level FDA equivalent Notes Cybersecurity documentation (baseline FDA or CE) Required SPDF Local authorised representative agreement Required — Local-language labeling and IFU Required — SBOM Recommended — Not mandatory but reduces clarification rounds. ### Common EDA rejections No scientific office appointed Common Fix · Contract a licensed Egyptian scientific office before filing. ### Typical timeline End-to-end window: 6-12 months Phase 01 Local rep + dossier prep 2-4 months Phase 02 Regulatory review 6-12 months Phase 03 Approval + market entry 1-3 months [Previous ![Flag of Kazakhstan](/flags/kz.svg)Kazakhstan ](/standards/kz)[Next ![Flag of Hong Kong](/flags/hk.svg)Hong Kong ](/standards/hk) ## Related markets [![Flag of Thailand](/flags/th.svg) Thailand ~75% FDA reuse ](/standards/th)[![Flag of United Kingdom](/flags/gb.svg) United Kingdom ~80% FDA reuse ](/standards/uk)[![Flag of Taiwan](/flags/tw.svg) Taiwan ~80% FDA reuse ](/standards/tw)[![Flag of South Africa](/flags/za.svg) South Africa ~80% FDA reuse ](/standards/za) ## Frequently asked about Egypt ### Is SBOM required for medical devices in Egypt? Not specified. Not addressed by EDA today; CE/FDA SBOMs accepted as supporting evidence. ### What does EDA require for pre-market cybersecurity? Registration dossier modelled on GHTF/IMDRF, with reliance on reference-country approvals (FDA, CE, Health Canada). No standalone medical-device cybersecurity guideline yet; cyber posture assessed via SaMD review. ### What are the post-market cybersecurity obligations under EDA? Vigilance reporting to EDA; PDPC handles data-breach notifications under PDPL. ### What is the penalty for non-compliance with EDA cybersecurity rules? Registration cancellation, market withdrawal, fines under Law 151/2019. ### How much of my FDA cybersecurity package is reusable in Egypt? Roughly 75% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report). Sponsored note · Blue Goat Cyber Submitting to EDA? Get a second pair of eyes before you file. Blue Goat Cyber has packaged cybersecurity evidence for Egypt alongside 37 other markets. We'll tell you what to keep, what to rework, and what's missing, in 30 minutes. [Talk through your EDA submission](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) The Crosswalk An independent reference for global medical device cybersecurity standards. A field guide for MedTech innovators and RA/QA teams charting an international path. Resource - [Comparison matrix](/compare) - [Global playbook](/playbook) - [Glossary](/glossary) - [FAQ](/faq) Sponsored by [Blue Goat Cyber ↗](https://bluegoatcyber.com) Editorially independent. Sponsorship keeps it free. © 2026 The Crosswalk. Not legal advice. Validate every requirement against current regulator publications.