Distributor requirements (that also affect the manufacturers)

The medical device regulations have significantly increased the requirements for distributors. You need to understand these requirements to avoid multi-year custodial sentences threatened in the event of infringement.

This article also considers extensive guidance issued by the Irish regulator.

1. What a “distributor” is (and what it isn’t)

a) Definition

The Medical Device Regulation (MDR) has many roles, under which the economic operators are listed. These economic operators include the distributors as well as the manufacturers, the EU representatives, and the importers (see Fig. 1).

b) Typical activities

The typical activities of a distributor include:

• Purchase of products from manufacturers or other (interim) distributors
• Marketing and sale of products to end-customers or other distributors
• Storage and transport of products
• Possibly attaching own labels (be careful here! More on this later).
• Instruction of users
• Support in installation and putting into service
• Answering user questions
• Handling customer complaints, feedback to manufacturer

Some distributors also deal with the service and repair of products or organize these.

c) Differentiation of the role of distributor from the importer

If a distributor purchases the products from a manufacturer or another distributor that is not based in the EU, this distributor also assumes the role of the importer. The MDR defines importers as follows:

The MDR imposes additional requirements on importers.

d) Differentiation of the role of distributor from the manufacturer

Many distributors may sell the products under their own name and not name the actual manufacturer. Thus the distributor becomes the manufacturer. The Medical Device Regulation defines manufacturers as follows:

With the MDR, the PLM-OEM constructs are also a thing of the past. For this, the MDR, under Article 2 (16) (2) offers distributor new options: It no longer sees the following activities as a product change that has an effect on the conformity of the product:

1. Provision of information for a product. This also applies to translations.
2. Changes to the external packaging

Naturally, it is also possible that the manufacturer markets the product in the distributor’s “design”. The manufacturer must, however, always (also) be visible on the label. This is required by Article 16, Paragraph 3.

2. The obligations that distributors must fulfil

a) Background / History

The requirements set for the distributor by the Medical Device Regulation MDR are derived from a superordinate framework for marketing of products. This is also called the “Goods Package” and is based on:

• EU directive 765/2008 “on the regulations for accreditation and market surveillance within the context of marketing of products”
• Resolution no. 768/2008/EU “on a common legal framework for the marketing of products”

b) Obligations of the distributors as a testing authority in the delivery chain (from the viewpoint of the MDR)

The thought of the MDR is that every economic operator ensures, if possible, that the economic operator has fulfilled the regulatory requirements one step previous in the delivery chain.

The reviews required by the MDR for distributors include:

• Does the product bear a CE mark?
• Has a declaration of conformity been issued for the product?
• Has the importer listed its name and address on the product, packaging or a document?
• Has the importer not covered the labels of the manufacturer with its own additional(!) labels?
• Has the manufacturer issued a UDI?
• Does the product appear to conform to the legal requirements?

If one of these conditions is not fulfilled, the distributor may not sell the product and must inform the manufacturer, importer and the EU representatives.

c) Obligations of the distributors as a testing authority in the delivery chain (from the viewpoint of the MDG)

The MDR allows distributors to perform random testing in Article 14 Paragraph 2. They should be able to review whether the products actually have a CE mark, a declaration of conformity and a UDI.

The German MPDG (Medical Device Implementation Act) appears to be more rigid: There is a threat of a custodial sentence in § 92 Para. 1 No. 3 in conjunction with § 13 MPDG if someone offers falsified products, stores them, or puts them into operation. This affects the distributors directly.

The prohibition in § 13 MPDG and the associated threat of punishment must be seen in the context of Art. 14 (2) subparagraph 3 MDR: According to this, there is a ban on distribution and an additional obligation to notify the competent authority if a distributor “believes or has reason to believe” that a device is falsified and therefore non-compliant.

However, in our view, neither this nor § 92 (1) No. 3 and § 13 MPDG impose a regulatory obligation on a distributor to go beyond random inspections to check for possible counterfeits, i.e., to be suspicious by default and to determine a 100% inspection based on this. For the penalty provision, we believe it also depends on whether the unauthorized offering or stockpiling of actual counterfeit goods was negligent or even intentional. It thus becomes critical if a distributor shows further indications or suspicions of distributing counterfeits.

Possible inconsistencies:

If the distributor discovers a falsified product and keeps it in the warehouse, they are liable. However, according to §13 MPDG, returning the product is also problematic, because then it falls “out of the scope of validity of this law”. This is then also punishable.

And the distributor can also not destroy it. Because then they are also culpable, because they must “provide free samples of the product at the request of the authorities”, or, “if this is not practical, allow access to the product” (MDR Article 14(6)).

A reader who brought our attention to this conflict (thank you for that), writes:

“I’m curious about the assistance of the legislators about how these contradictions should be solved by a distributor, e.g. by Aldi, which offers medical devices once or twice a year (e.g. blood pressure monitors) within the framework of any special offers.”

d) Requirements for the activities of the distributors

The MDR obligates the distributors to additional activities:

• Storage and transportation pursuant to manufacturer specifications
• Collecting complaints and incident reports and forwarding them to manufacturers and possibly importers. This also applies to products for which the distributor itself has doubts about the conformity.
• Keeping a “register” of non-conforming products, recalls and withdrawals
• Informing authorities (in Germany the BfArM pursuant to article 44 of the MPDG) about unsafe and falsified products and about corrective actions and provide information and documentation upon request.

e) Registration of distributors

In Article 30, the MDR mentions the “Electronic System for the Registration of Economic Operators”. In it, it only obligates the manufacturers, authorized representatives and distributors. The MDR leaves it to the member states to issue conditions for the registration of distributors.

And that’s just what member states such as Germany appear to be doing: In the Medical Device Implementation Act MPDG it states:

The Federal Ministry of Health is empowered to require through a statutory regulation, that distributors providing products on the German market report this to the responsible authorities before starting their activities. In the statutory regulation under section 1, the content and form of the notification may also be proscribed.

MDG §55(10)

Thus a national ordinance is to be expected, that describes this obligation to register.

f) Special cases for the quality management system

As described above, manufacturers may repackage products and provide and translate the legally required information (Annex I, Section 23). Thus resulting not only in the previously mentioned obligation of indicating the name of the distributor on the label (see Fig. 2). Much more, the distributors must have a quality management system.

This QM system must regulate all relevant actions:

• Repackaging of the product (and checking that this repackaging does not affect the conformity)
• Creation / provision of information (and checking that these fulfil the legal requirements)
• Translating the information
• Receive / order (?) information about the manufacturer’s corrective actions

According to the Irish authority, the QM system does not have to be certified: “It is not a requirement that a quality system is officially accredited to any specific standard.” However, this contradicts the requirement of the MDR.

Within the same period of 28 days, the distributor or importer shall submit to the competent authority a certificate, issued by a notified body designated for the type of devices that are subject to activities mentioned in points (a) and (b) of paragraph 2, attesting that the quality management system of the distributer or importer complies with the requirements laid down in paragraph 3.“

MDR Article 16, Paragraph 4

Whether this QM system must meet a specific standard and be audited to a particular standard appears unclear. According to the Irish authority, this QM system must be relatively comprehensive and also guide other activities such as:

• Personnel, Training
• Managing documents and diagrams
• Receipt, storage and provision of medical devices
• Handling returned products
• Handling falsified products
• Recall of products
• Contracted processes
• Transport
• Audits
• Supplier management
• Management review
• CAPA
• Waste management
• Internal and external audits
• Validation including Computerized Systems Validation (CSV)
• etc.

So that the manufacturers can test the QM system, the MDR requires the distributors to notify “its” manufacturers and the responsible authorities(!) 28 days before the provision of the product. The MDR mentions “notification”, not “asking for approval”.

g) Obligations not (?) imposed on the distributors by the MDR

The distributors are not obligated to register the products. This is the task of the manufacturers or importers. The distributors also do not require “Person Responsible for Regulatory Compliance”.

It is unclear whether the distributor is responsible for the storage and transport if the manufacturer delivers directly to the distributor’s customers. The question of whether the importer or the distributor is responsible for the transport from the importer to them, the distributor also leads to discussion.

h) Transition periods

The so-called sell-through provision of MDR Article 120(4) primarily concerns distributors. It is intended to limit the “period during which AIMDD/MDD-compliant devices that have already been placed on the market (for the first time) may be made available, e.g., by a distributor. (either before the date of application or through Article 120(3) MDR after the date of application).”

After May 27, 2025, these devices may no longer be made available/put into service (= end date). Such devices still in the commercial chain on this date – i.e., have not yet been made available to the end user (e.g., hospital) as a ready-to-use device – are no longer “tradable.”

Art. 120(4) MDR essentially addresses the “making available” on the market of AIMDD/MDD compliant devices after they have been placed on the market (for the first time), e.g., in the chain of commerce. It does not regulate the “(initial) placing on the market” of these devices by the manufacturer.

NAKI UG1 (German)

Furthermore, the German National Working Group for the Implementation of the MDR/IVDR (NAKI) clarifies that “trade in second-hand devices should not be covered by the so-called “sell-through” provision (see recital 32). This means that once a device has been made available to the end user (e.g., hospital) as a ready-to-use device, the further availability of that device on the market is not within the scope of the MDR.”

The MDCG clarifies in MDCG 2021-25 that economic operators must also comply with their obligations under MDR for legacy devices (Article 120, valid MDD certificate). For each economic operator, the MDCG lists the relevant articles of the MDR that they must comply with. For distributors, these are:

• Article 14(2), last section: This is about the information obligations in the context of post-market surveillance.
• Article 14(4): Again, this is about the information obligations and cooperation in the corrective actions.
• Article 14(5): This also deals with the cooperation in the context of the post-market surveillance and the related measures.
• Article 14(6): This paragraph concerns the cooperation of manufacturers with the authorities.

3. What the manufacturer must take into account regarding their distributors

a) Problem

Some manufacturers would like to think that all of these regulatory requirements are the distributors’ problems, and not their own. But that’s not the case:

Distributors may even “relabel” products and “repackage” them, e.g. in their own design. They must only “notify” the manufacturer, not ask for approval.

This means that the manufacturers can’t (just) unilaterally inhibit these activities. On the other hand, they are obligated to perform post-market surveillance. This is difficult if distributors sell products in other countries unknown to the manufacturer with translated support materials.

b) Post-market surveillance

Manufacturers should proactively search around the world for information on their own products. Not only in the countries where they know that their products are being sold. Automation such as  Post-Market Radar of Johner Institute helps in this.

It is essential that the manufacturers, together with their distributors, authorized representatives and importers, exactly determine who is responsible for which activities (not only) within the framework of the post-market surveillance.

Naturally, this surveillance should also focus on falsified products and unauthorized distributors even after the product is on the market.

c) Setting the hard line for distributors

Manufacturers should monitor their distributors just like the products themselves.

Distributors who “repackage” or “relabel” the devices must even provide the authority with a certificate from a notified body. This relieves the manufacturers of some of the work.

Still, manufacturers cannot mindlessly rely on this. They must know and monitor their distributors.

Sometimes it is helpful to select the proper use and design of the product (e.g., plugs) so that certain markets are excluded. Thus manufacturers can somewhat dam the “misuse” by undesirable distributors.

In addition, the manufacturers should enter into quality assurance agreements with the distributors. A QAA should include, in particular:

• Affected products or product groups
• Duration of validity of the agreement
• Contacts for both parties
• Form and deadline for feedback from the distributors to the manufacturer
• The right of the manufacturer to audit / inspect the distributor
• Obligation of the distributor to report to authorities
• Obligation of the distributor to trace products (“register”)
• If necessary, prohibition on sale to other distributors
• Obligation of the distributor to inform importers and EU representatives
• Keeping test samples available
• Obligation to provide support materials
• Obligation to only work with a certified translation agency

c) Caution with fulfillment partners

Certain logistics partners offers services far beyond that of a regular package service (like DHL). These so-called “fulfillment centers” or (“fulfillment houses”) store products, package them upon request, take over invoicing, etc.

Then we aren’t talking about “neutral service providers” any more, but distributors in terms of the MDR.

Our tip: Use the specifications of the Blue Guide of the EU.

4. Conclusion and summary

The MDR has significantly increased the requirements for distributors. This is comprehensible, because only all of the entities involved in the logistics chain can, together, trace where these products are located and whether they are compliant.

Only together can the economic operators react to non-conformities and increase patient safety. So the MDR removes the possibility of finger-pointing.

These are essential findings:

1. Distributors should have a (comprehensive) complete quality management system. At least, that is the view of the Irish authority. Processes should be established not only for the feedback system. A distributor must have a QM system if they carry out activities according to Article 16(2). There is (currently) no obligation for certification.
2. Manufacturers should be aware that the obligations of distributors also affect them, at least indirectly.
3. The Irish authority published a guideline for distributors with additional practical tips.

We hope that the MDG does not lead to contradictions with the MDR, and that a higher safety of the patients and not an increase in bureaucracy are not the results of these legal intensification.

---

Change history

• 2021-10-25: In section 2(h), requirements added by MDCG 2021-25 guideline.