Sri Lanka Medical Device Registration Roles and Responsibilities

1. Key takeaways

Four roles appear in the Sri Lankan device chain: the foreign manufacturer (the producer and the source of the technical files), the Marketing Authorization Holder (MAH) (the statutory submitter and responsible entity, which must be a Sri Lankan local entity), the importer (which handles the import licence and customs clearance) and the distributor (which handles movement in the market). The MAH is the only role that is mandatory under the rules; the other three can in practice be combined in a single entity or separated. How these roles are arranged is a structural decision with regulatory consequences: it affects who answers to NMRA, who holds the registration certificate, who bears the GDP obligations attached to storage and distribution, and what happens to the registration when a commercial relationship ends. The arrangement should therefore be designed deliberately at project start, documented in the role map, and reflected consistently in the authorisation letter, the application forms and the commercial agreements, so that the regulatory picture and the contractual picture never diverge.

• The foreign manufacturer produces the product and issues the authorisation letter and technical files.
• The MAH must be a local Sri Lankan entity and is the mandatory submitter and responsible party.
• Importers operate under NMRA import licence control; distributors are subject to GDP checks.
• The Market Control Division supervises imports, inspections, counterfeit enforcement, advertising, recalls, post-market sampling and GDP.
• Separating the MAH from the distributor preserves the registration when channels change.

2. Legal basis

The table below records the legal position of each role in the chain and the supervisory functions that run across all of them.

3. Expert insights

Insight 1: the MAH and the distributor can be the same entity or can be separated. The rules mandate only the MAH and do not require it to be the distributor. The value of a separated structure is that when the distribution channel is changed, the registration stays untouched. If registration and exclusive distribution sit with the same partner, a commercial dispute can hold the registration hostage, and transferring the registration to a new MAH becomes a project of its own. Companies that expect to change distributors, or that operate through several channels, should weigh the separation option at the structuring stage rather than discovering its value during the first conflict. The choice should be revisited whenever the channel strategy changes, because a structure that suited a single-channel launch may no longer suit a multi-channel expansion.

Insight 2: because the MAH carries quality incident handling and recall coordination, it is in substance tied to the distribution chain. Even where the MAH does not distribute directly, it will impose requirements on the warehouse and traceability records of the distributor, because without those records it cannot satisfy its own vigilance obligations. The consequence is that the MAH role reaches into operational matters that appear commercial: storage conditions, batch traceability and complaint forwarding all become part of the MAH’s compliance toolkit. Agreements between the manufacturer, the MAH and the distributor should anticipate this and give the MAH the contractual rights it needs to obtain the information it must report, including access to complaint records and batch documentation held by other parties in the chain.

Insight 3: GDP inspection falls on the storage, handling and distribution facilities. This means that whoever actually controls the warehouse, whether named as the MAH, the importer or the distributor, is the party that will be inspected and that bears the compliance responsibility for what the inspectors find. A paper allocation of duties that leaves the physical custodian without GDP obligations creates a gap that an inspection will expose. The role map for the project should therefore be drawn around the physical flow of the goods, not only around the contractual titles of the parties, and it should be checked against the layout of the actual storage and distribution arrangements before the first inspection takes place.

4. Practical recommendations

• Prepare for the client a three-column table of role, qualification and obligation: list every participant, the qualifications it must hold, and what it is responsible for in vigilance, recall and GDP respectively.
• Once the table is settled, the clause list for the contracts follows from it directly, because each allocated obligation needs a matching contractual term.
• Where the MAH and the distributor are separated, fix firmly in writing who notifies NMRA, who keeps the original of the registration certificate and how the parties cooperate in transferring the registration when cooperation ends.
• Identify the party that physically controls the warehouse and attach the GDP obligations to that party, whoever holds which title.
• Review the role map whenever the channel structure changes, so that the regulatory arrangements track the commercial reality.

5. Verification checklist

• □ The four roles involved in the project have been identified.
• □ It has been confirmed that the MAH is a Sri Lankan local entity.
• □ The party that actually controls the warehouse and its GDP obligations have been identified.
• □ The division of vigilance and recall responsibilities has been agreed.
• □ The custody of the original registration certificate and cooperation in transfer of the registration have been agreed.

Regulatory information verified as of 28 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across South Asia, including Sri Lanka. Our team prepares dossiers to NMRA expectations, manages submissions and deficiency responses, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com