Sri Lanka Essential Principles Checklist Requirements and Evidence

1. Key takeaways

The Sri Lankan PRD requires submission of an Essential Principles Checklist compiled according to the GHTF specification, accompanied by quality management system evidence (generally ISO 13485) and risk management documentation (ISO 14971). The three documents together form a complete structure of item-by-item reconciliation, system endorsement, and risk argumentation. The checklist demonstrates point by point that the product satisfies the applicable essential principles; the quality system certificate demonstrates that the manufacturer operates under a controlled production environment; and the risk management report demonstrates that hazards have been identified, evaluated, and controlled. Removing any one of the three leaves the argument visibly incomplete, which is why reviewers examine them as a set rather than in isolation. It also means the three documents share a responsibility chain: a claim made in one must be provable in the others, so changes in any one of them propagate to the remaining two. Companies that prepare the three documents together, with deliberate cross-references between them, consistently experience fewer assessment queries than companies that prepare them independently and only try to align them at the end. Planning the three as one work package, with a single owner and a common revision cycle, is the simplest structural safeguard available.

• The Essential Principles Checklist must follow the GHTF specification and is a core element of the PRD, required under GL-034.
• NMRA generally expects ISO 13485 as quality system evidence, with ISO 9001:2015 accepted only in limited situations (practical estimate).
• An ISO 14971 risk analysis report is required alongside the checklist, and a finished-product COA test report is also part of the dossier under the same guidance.
• Technical assessment is performed by MDEC, which evaluates quality, safety, effectiveness, need, and cost — five dimensions, not three.

2. Legal basis

The requirements for the Essential Principles Checklist and the risk management report are anchored in GL-034, which took effect on 2025-07-23. The quality system expectation and the scope of ISO 9001:2015 acceptance are summarised as a practical estimate based on NMRA guidance, and the composition of the assessment dimensions comes from the NMRA website.

3. Expert insights

Insight one: among the five assessment dimensions of MDEC, need and cost are the two most easily overlooked. Beyond quality, safety, and effectiveness, Sri Lanka has written clinical need and cost-effectiveness into its assessment criteria — a direct consequence of the market structure, in which public procurement dominates. A technically excellent dossier that says nothing about why the product is needed in the Sri Lankan health system, or what it costs relative to alternatives, leaves two of the five evaluation dimensions unaddressed. Companies accustomed to purely technical reviews elsewhere should adjust their cover narrative and dossier summary accordingly.

Insight two: the Essential Principles Checklist is an index document, not an argumentation document. It states which technical file supports each essential principle, while the real technical content lives in the STED and the product-specific reports. The value of the checklist is that it allows the reviewer to locate evidence quickly. This means the checklist must never be allowed to drift out of sync with the underlying documents: a citation to a section number that has changed, or to a report that was revised, is enough to break the index function and trigger queries.

Insight three: quality system evidence and product technical documentation are two different things. ISO 13485 demonstrates that the manufacturer is capable of producing consistently; the STED demonstrates that this specific product is safe and effective. Neither can substitute for the other. A strong ISO 13485 certificate does not compensate for thin product-level evidence, and an excellent technical dossier does not compensate for a missing or expired quality system certificate. Budget and timeline planning should treat the two evidence streams as parallel work packages with separate owners. In practice, the quality certificate also needs a validity check before every submission and renewal, because a certificate that lapses during assessment weakens the whole dossier even if the technical content was flawless at filing.

A closing observation on the COA requirement: the finished-product certificate of analysis is frequently treated as an afterthought because it is a short document, yet it sits in the same GL-034 list as the checklist and the risk report. Obtaining it early, from the batch intended for the market, avoids the last-minute scramble that otherwise occurs when the review clock is already running.

4. Practical recommendations

• GRZAN requires clients to apply a three-element rule to every entry of the Essential Principles Checklist: for each essential principle, state whether it is applicable or not applicable, give the name and section number of the supporting document, and record the compliance conclusion.
• Entries that claim compliance without a documented source are the most frequent targets of deficiency notices — do not submit any entry that lacks a citation.
• For entries marked not applicable, record the rationale as well, so the reviewer can distinguish a considered exclusion from an omission.
• Update the checklist whenever any cited document is revised, and re-run the cross-check against the STED and the special reports before resubmission.

5. Verification checklist

• □ Essential Principles Checklist compiled according to the GHTF specification
• □ Applicability and compliance conclusions recorded for every entry
• □ Supporting document name and section number stated for every entry
• □ Quality system certificate (ISO 13485 / ISO 9001:2015) within its validity period
• □ Consistency between the checklist, the STED, and the special reports cross-checked

Regulatory information verified as of 28 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across South Asia, including Sri Lanka. Our team prepares dossiers to NMRA expectations, manages submissions and deficiency responses, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com