Who We Serve: Business Model
Distributors and Importers
Distributors and importers sit between the manufacturer and the user, and both FDA and the EU give them duties of their own. Those duties are narrower than a manufacturer's, but they are easy to miss, and they change quickly if you relabel, repackage or put your own name on a device. We help distributors and importers understand where they stand and build records to match.
Standards and Regulations to Know
- 21 CFR Part 807Establishment Registration, Device Listing and Premarket Notification (510(k))
- 21 CFR Part 803Medical Device Reporting
- 21 CFR Part 806Reports of Corrections and Removals
- 21 CFR Part 830Unique Device Identification
- EU MDR (Regulation (EU) 2017/745)European Union Medical Device Regulation
- ISO 13485Quality Management Systems for Medical Devices
- 21 CFR Part 820 (QMSR)Quality Management System Regulation
Typical Regulatory Exposure
Under FDA's rules, a wholesale distributor that does not manufacture, repackage, process or relabel a device does not register or list (21 CFR 807.20(c)). An initial importer does register, and can meet its listing obligation for devices it did not specify, repackage or relabel by identifying the foreign manufacturer (807.20(a)(5)). Once a distributor or importer relabels, repackages or develops specifications, it takes on manufacturer duties for those activities, so registration and quality system obligations depend on what you actually do. Confirm your position against 21 CFR 807.
Medical device reporting differs by role. Under 21 CFR 803, importers report deaths and serious injuries to FDA and the manufacturer, report certain malfunctions to the manufacturer, and keep written MDR procedures and event files. Distributors are not required to report, but must keep records of the complaints and incidents they receive. Under 21 CFR 806, importers also report certain corrections and removals they initiate. Private-label distributors should check whether their activities make them a specification developer or relabeler.
In the EU, MDR Article 13 sets importer obligations, including checking the CE marking, declaration of conformity, labeling and UDI, adding the importer's name and address, keeping a register of complaints, nonconforming devices, recalls and withdrawals, and forwarding incident reports to the manufacturer. Article 14 sets similar checks for distributors, which may use representative sampling, and Article 16 explains when either one takes on manufacturer obligations. Many distributors also choose ISO 13485 certification, which is written to cover organizations involved in any stage of the device life cycle, including storage and distribution.
Where Audits Find Gaps
- 01
Complaints Handled as Customer Service
Complaints about device quality or performance are settled as returns or credits, with no incident record and no evaluation of whether the manufacturer or FDA needs to know.
- 02
No Written MDR Procedure for Imports
An importer has no written procedure for identifying, evaluating and forwarding reportable events, or no event files showing how each decision was made.
- 03
Lot Traceability Ends at the Warehouse
Records show which lots arrived but not which customers received them, so a recall cannot be scoped quickly.
- 04
Storage Conditions Not Monitored
Temperature or humidity limits set by the manufacturer are not monitored or recorded while devices are in your warehouse or in transit.
- 05
Regulatory Role Changed Without Review
Labels were covered, translated or repackaged for convenience, which can change the firm's regulatory role, without a review of what that change requires.
- 06
Manufacturer Agreements Silent on Recalls
Agreements with manufacturers do not say how recall notices, field safety notices and complaint information move in each direction.
Relevant Standards and Regulations
- 21 CFR Part 807Establishment Registration, Device Listing and Premarket Notification (510(k))
- 21 CFR Part 803Medical Device Reporting
- 21 CFR Part 806Reports of Corrections and Removals
- 21 CFR Part 830Unique Device Identification
- EU MDR (Regulation (EU) 2017/745)European Union Medical Device Regulation
- ISO 13485Quality Management Systems for Medical Devices
- 21 CFR Part 820 (QMSR)Quality Management System Regulation
Relevant Services
ISO 13485 Certification Readiness
Prepare your QMS, records and people for a certification body's Stage 1 and Stage 2 audits.
AI-Assisted QMS Gap Assessment
An AI-assisted first pass over the QMS documents you already have, with every result reviewed by an advisor.
EU MDR and IVDR Readiness
Prepare your QMS and technical documentation for notified body audits under the EU MDR or IVDR.
Internal Audit Program
A risk-based internal audit program, run by your team or our advisors, with reports written for FDA to read.
Ongoing Advisory and Continuous Readiness
Periodic re-assessments, a live action plan and yearly mock inspections that keep readiness from decaying.
Audits and Inspections You May Face
ISO 13485 Certification Audit (Stage 1 and Stage 2)
The Stage 1 and Stage 2 audits a certification body runs before granting ISO 13485 certification.
ISO 13485 Surveillance Audit
The periodic audits, at least annually, that support continued ISO 13485 certification between renewals.
Customer Audit
A customer's audit of your quality system, often a device maker auditing a supplier or contract manufacturer.
Questions
Does a device distributor have to register with FDA?
A wholesale distributor that only distributes, without manufacturing, repackaging, processing or relabeling, does not register or list under 21 CFR 807.20(c). Initial importers do register. If you do any of those other activities, your obligations change, so confirm your position against 21 CFR 807 and your actual operations.
Do importers have to report adverse events to FDA?
Under 21 CFR 803, importers report deaths and serious injuries to FDA and to the manufacturer, and report certain malfunctions to the manufacturer. They also need written MDR procedures and event files. Distributors are not required to report, but must keep records of the incidents they receive.
We are a private-label distributor. Are we the manufacturer?
It depends on your activities. If you develop or control the specifications, or change the labeling beyond adding your name and contact details as distributor, you may be a specification developer or relabeler with manufacturer duties. In the EU, selling a device under your own name generally makes you the manufacturer unless an agreement under MDR Article 16(1)(a) keeps the original manufacturer identified and responsible. Confirm against 21 CFR 807 and 803 with your regulatory team or counsel.
Is ISO 13485 certification worth it for a distributor?
FDA does not require it of a distributor that does not manufacture, but many distributors certify because customers and manufacturers ask for it, and the EU MDR expects a certified quality management system from importers and distributors that translate or repackage. The decision depends on your customers and your activities.
Distributors and Importers
Get an Advisor's View of Your Quality System
Tell us about your devices and the audit or inspection ahead, and an advisor will scope an assessment for your kind of product. Please don't send confidential documents yet: secure upload is set up after onboarding.
