Change Notification and Variation Process in Sri Lanka

1. Key takeaways

Sri Lanka manages changes through a dual track of notification obligation plus procedural acceptance. The MAH must notify five categories of change in a timely manner: (1) product information; (2) the manufacturing process; (3) safety, quality and effectiveness data; (4) the regulatory status in other countries (for example rejection or withdrawal); and (5) cGMP compliance status. On the submission side, changes follow the same procedural requirement of an online form plus physical submission at the Tuesday window that governs original applications. The dual track means that substance and procedure both matter: The dual track means that substance and procedure both matter: a correctly identified change that is submitted through the wrong channel is as defective as a missed change that is submitted perfectly. Neither half can compensate for the other.

Change control is where the registration certificate and the manufacturer’s daily operations meet. The five categories reach into design, production, quality systems and even the commercial situation of the product in other markets, so the notification duty cannot be discharged by the regulatory affairs function alone. The pages below break the published rules into their components, read the practical consequences of each category, and end with a checklist for building the internal machinery that keeps notifications complete over the life of the certificate.

2. Legal basis

The notification obligations and the procedural requirements, as published on the medical device pages of the NMRA website, are consolidated in the table below. The table follows the order in which the five obligations are published, then adds the response obligation during review and the submission channel, so that the complete procedural picture sits in one place.

3. Expert insights

Insight one: the notification obligation is continuous, not something owed only at the time of application. The rule lists notification among the obligations of the applicant, which means that any significant change occurring while the certificate remains valid must be reported. This is a materially different posture from markets where variations are handled only when the holder chooses to modify the dossier. In Sri Lanka the trigger is the change itself, wherever and whenever it happens inside the life of the certificate. Compliance therefore cannot be organised around submission events; it has to be organised around detection events inside the company — the moment a specification, a process or a status changes, someone must know that a notification duty has been engaged.

Insight two: the fourth category requires the company to maintain a global view. Rejection or withdrawal in another country must be notified, which requires the manufacturer to operate a mechanism for tracking regulatory status worldwide; without such tracking the MAH cannot perform the obligation at all. This is the category most dependent on information the Sri Lankan MAH does not itself generate. The facts originate in other agencies, in other languages, and often in other corporate entities. Until a structured feed of those decisions reaches the MAH, the obligation exists only on paper — which is why we treat tracking as a system requirement rather than a personnel instruction.

Insight three: the fifth category brings quality system compliance inside the notification scope. Changes to cGMP status must be reported, showing that Sri Lanka treats the quality system as a dynamic object of regulation rather than a static certificate filed once. A certificate suspension, a downgrade or a lapse in another market’s cGMP assessment is thus a notifiable event here. Manufacturers should connect their quality management system to the notification process so that any change affecting cGMP status automatically raises the question of whether a notification to NMRA is required. In practice this means adding the question to the management review agenda and to the change-control form itself, so that the connection does not depend on any individual remembering it.

4. Practical recommendations

GRZAN requires clients to establish a change ledger that breaks the five categories down into checkable items, each with an assigned chain of responsibility: who detects → who confirms → who notifies → who archives. A full review of the ledger is performed before every renewal, to ensure that changes over the 5-year validity period have not been missed. We particularly recommend treating the item on regulatory status in other countries as a quarterly inspection item, because it is the one most easily overlooked: unlike process or product changes, nothing inside the local organisation signals that it has occurred. The ledger also serves the response obligation — when NMRA requests supplementary data or clarification during a review, the history recorded in the ledger is usually the fastest source of an accurate answer. Over time the ledger doubles as renewal evidence, showing the regulator a documented, self-monitored change record rather than a blank sheet.

5. Verification checklist

• □ A change ledger covering the five categories has been established
• □ Responsible persons for detection, confirmation, notification and archiving are defined for each category
• □ Changes in regulatory status in other countries are set as a quarterly inspection item
• □ A full review of the change ledger has been completed before renewal
• □ It has been confirmed that change submissions follow the same online form plus Tuesday window procedure

Where any doubt exists about whether a given change falls into one of the five categories, the conservative course is to notify: the cost of a redundant notification is minor, while the cost of a missed one is borne at renewal and inspection.

Regulatory information verified as of 28 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across South Asia, including Sri Lanka. Our team prepares dossiers to NMRA expectations, manages submissions and deficiency responses, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com