Post-Market Surveillance and Market Control of Medical Devices in Sri Lanka

1. Key takeaways

Post-market surveillance of medical devices in Sri Lanka is administered by the Market Control Division of the National Medicines Regulatory Authority (NMRA). The Division’s remit spans the entire product life cycle and comprises nine functions in total: import control, market surveillance programmes, interception of substandard and counterfeit products, data collection, advertising and promotion control, product recall, post-market sampling, Good Distribution Practice (GDP) inspection, and public communication and transparency — nine functions in all. For any manufacturer or marketing authorisation holder (MAH) active in the Sri Lankan market, this list effectively defines the compliance perimeter: every one of these functions is a checkpoint where a product, a document, or a company can be examined by the regulator, and every one of them therefore deserves a corresponding internal control.

Two features of this structure deserve emphasis at the outset. First, all nine functions sit inside a single division, so the same authority that inspects a warehouse may also review an advertisement or trace a batch. Second, the functions are published openly on the NMRA website, which means the compliance expectations are visible in advance and can be planned for rather than discovered during an inspection. Both points are developed further below.

2. Legal basis

The nine functions below are as published in the description of the Market Control Division’s responsibilities on the official NMRA website. The table preserves the wording of each function and its stated source.

3. Expert insights

Insight one: of the nine functions, only a minority relate directly to the product itself. Product-focused work — sampling and, to a degree, interception of substandard goods — sits alongside six functions that point squarely at the distribution and information chain: imports, data, advertising, recalls, GDP and public communication. This indicates that the centre of gravity of Sri Lankan post-market control lies in supply-chain and information compliance, not in re-testing the device on the bench. A company that invests mainly in technical documentation while neglecting its distribution records, its promotional materials and its communication channels has misread where the regulator is actually looking. The practical implication is that compliance readiness in this market should be measured against the flow of goods and the flow of information, in roughly equal measure.

Insight two: sampling is executed jointly with NMQAL. Laboratory testing is carried out by NMQAL, which means that post-market sampling is backed by a real laboratory capability rather than being a purely documentary or formalistic exercise. If a sampled product fails or shows an anomaly, there is a technical basis on which the regulator can act. Manufacturers should therefore treat any sampling event as a genuine quality gate: the batch presented for sampling must be representative, traceable to its production records, and consistent with the approved specifications, because the results will not remain on a shelf — they feed directly into a regulatory framework that also covers recalls and market surveillance.

Insight three: GDP inspection targets facilities. The published rule is framed as inspection of storage, handling and distribution facilities. Consequently, whoever actually controls the warehouse is necessarily among the inspection subjects — not only the licence holder named on paper. Where a distributor or a third-party logistics provider operates the storage site, that operator’s premises, records and equipment will be what the inspector sees. The MAH should therefore never assume that its own compliance posture is sufficient; the physical sites in the distribution chain must be assessed and managed as part of the MAH’s own obligations, since deficiencies found at an outsourced facility will still reflect on the product and its holder.

4. Practical recommendations

GRZAN advises clients to run a self-assessment against each of the nine Market Control Division functions, one by one: are import documents complete → is supply-chain quality monitoring documented → is there a mechanism for screening counterfeit risks → can import and sales data be traced backwards → has advertising been reviewed → is the recall plan usable → is the response to sampling ready → does GDP compliance hold → are public communication channels in place. These nine items should be converted into a single checklist and walked through once every year, with the responsible owner and the evidence for each item recorded. The value of the exercise lies in its completeness: because the Division’s nine functions are published in one list, the same list can be used as a definitive, regulator-aligned audit framework, and any gap identified in the self-assessment corresponds directly to a function where the authority may examine the company in practice.

5. Verification checklist

• □ Import compliance documentation is recorded in a maintained register
• □ Supply-chain quality monitoring records are retained
• □ A mechanism for screening counterfeit risks has been established
• □ Import and sales data can be traced backwards
• □ Advertising materials have passed review
• □ The recall plan has been finalised and rehearsed
• □ A response plan for NMQAL sampling is ready
• □ A GDP compliance self-check has been completed
• □ Public communication channels have been designated

Regulatory information verified as of 28 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across South Asia, including Sri Lanka. Our team prepares dossiers to NMRA expectations, manages submissions and deficiency responses, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com