What Does the MAH Do? Legal and Practical Duties of the Philippine Holder

1. Key takeaways

The MAH (Marketing Authorization Holder) is the named holder of the registration certificate and the entity that carries the full weight of regulatory responsibility. Under AO No. 2025-0030 (effective 6 May 2026), the MAH must operate systems to receive, record, assess and investigate complaints and adverse events, must judge reportability against the regulatory definitions, and must submit reports to the FDA within three statutory tiers of 48 hours, 10 days and 30 days. The same order obliges the MAH to maintain import and distribution records and to execute field safety corrective actions (FSCA) when a product must be corrected or withdrawn from the market.

• Registration certificate holder: the MAH is named on the CMDN or CMDR and is the party the FDA addresses in all regulatory correspondence.
• Pharmacovigilance operator: complaint intake, causality assessment, reportability decisions and submission within the three tiers are MAH duties, not manufacturer courtesies.
• Record keeper: import and distribution records must be maintained and produced on inspection.
• Recall executor: the FSCA obligation sits with the MAH, including notification, retrieval and reconciliation.
• Time pressure: the 48 hour, 10 day and 30 day clocks are measured from the moment of awareness, not from the completion of the investigation.

2. Legal basis

The governing instrument is a Department of Health administrative order that consolidates the responsibilities of manufacturers, MAHs, importers, distributors and traders of medical devices, including in vitro diagnostics. The table below sets out the elements that determine when the obligations bite and who is answerable for them.

3. Expert insights

First insight: the MAH is the end point of accountability, not a filing agent. Many overseas manufacturers still treat the MAH as a local company that lodges paperwork on their behalf. Since AO No. 2025-0030 that reading is obsolete. The MAH is the operating entity of the product safety system: it has to be able to receive a complaint, assess an event, initiate a recall, retain records and report to the FDA. Failure at any one of those points is the MAH compliance gap, and the consequence lands on the MAH. A holder that can submit a dossier but cannot run a vigilance workflow is not a compliant holder; it is a filing service with a certificate attached to its name.

Second insight: responsibility is layered, and distributors carry a 14 day handover duty. AO No. 2025-0030 splits the obligations between two groups of actors. The MAH assesses and reports. The distributors, meaning manufacturers, traders, wholesalers and retailers, must transmit the relevant information to the MAH within 14 calendar days of receiving a product complaint or learning of an adverse event. The design of that 14 day window matters more than it first appears: the MAH clocks of 48 hours, 10 days and 30 days effectively start counting when the distributor becomes aware. If a distributor uses the full 14 days before handing the case over, the MAH reporting deadline may already have expired by the time the file arrives. Manufacturers therefore need to control distributor response time contractually, because it directly determines whether the MAH can meet its own statutory deadlines.

Third insight: IVDs are expressly covered, and indirect harm counts as a reportable event. The scope of AO No. 2025-0030 explicitly includes in vitro diagnostics. For IVDs, indirect harm arising from a wrong reading that leads to delayed or incorrect treatment is a clearly reportable adverse event. This concept has no direct counterpart in the general device framework, where harm is usually assessed against the patient who physically contacts the product. An IVD result reaches the clinician, and the harm materialises later in a treatment decision. IVD companies therefore have to build a separate assessment standard, train their intake staff on it, and document the reasoning that supports each reportability decision, because the reasoning is what an inspector will ask to see.

Fourth insight: the administrative consequences are concrete. Under AO No. 2025-0030 and the accompanying draft circular, failure to report and to keep records as required, in particular deliberate non-reporting, deliberate concealment of information and repeated failure to submit reports, attracts regulatory measures including warning, administrative sanctions, and suspension or revocation of authorisation where necessary, on the basis of RA No. 9711 and its IRR. Compliance inspections are carried out by the FDA Field Regulatory Operations Office (FROO) together with CDRRHR. The aggravating character of deliberate conduct is the point to note: an incomplete file can be corrected, but a pattern of concealment changes the character of the case and the range of sanctions available.

4. Practical recommendations

• Select the MAH on capability, not on price. Look for a written vigilance SOP, a functioning record system, a qualified person and dedicated regulatory staff, and evidence of at least one FSCA exercise or simulation.
• Put every obligation into the holding agreement. Attach the four pillars of AO 2025-0030, namely records, complaints, adverse events and FSCA, as an annex to the agreement, and state the response time for each party at each step.
• Write the 14 day distributor handover duty into distribution agreements. Specify the trigger event, the information set to be transmitted, and liquidated damages for late handover.
• Keep a clock management log. Record the awareness date for every event, whether the party that became aware was the MAH or a distributor, and record it in a form that can be shown to an inspector.
• Test the system before the transition period ends. Run one mock complaint and one mock adverse event through the full workflow, from intake to submission, and fix whatever breaks.

5. Verification checklist

• □ AO 2025-0030 obligation list mapped against the four pillars of records, complaints, adverse events and FSCA
• □ MAH vigilance SOP available for document review, with defined intake, assessment and reporting steps
• □ Distributor 14 day handover clause present in every distribution agreement
• □ IVD indirect harm assessment standard written into the SOP where IVDs are in scope
• □ Record retention period defined and traceable to the applicable rule
• □ Reporting tiers of 48 hours, 10 days and 30 days reflected in the working instruction
• □ Transition period end date calculated as 6 May 2026 plus 1 year and entered in the compliance calendar

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including the Philippines. Our team prepares CMDN/CMDR dossiers to ASEAN CSDT structure, manages submissions and deficiency responses with the FDA Philippines, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com