Annual Compliance Self-Check: Twelve Checkpoints for Listed Devices

1. Key takeaways

A listing certificate is valid for five years, but compliance status changes year by year: certificates expire, standards are amended, products are modified and post-market records accumulate. GRZAN recommends treating the annual self-check as a fixed action covering 12 checkpoints. The value of the checklist lies in what it changes: it converts a scramble shortly before expiry into ten minutes a year, and it exposes problems before the Medical Device Division (MDD) finds them.

• The dated items are the easy ones. Certificates, reference approval documents, certification body certificates and business registration certificates all carry expiry dates that can be placed in a single table.
• The undated items cause the losses: standard amendments, product changes and vigilance signals have no expiry date and therefore no reminder.
• Drift is the real target. Material substitution, supplier changes, software updates and label revisions accumulate quietly, and surface together at renewal or at inspection.
• Additional conditions in the approval letter are the most frequently forgotten compliance item, although non-compliance can lead to delisting.
• Public list data is part of compliance. Purchasers rely on the published entry, and a stale entry affects their decisions.

2. Legal basis

The self-check draws on six instruments: the published overview for the certificate validity and renewal framework, the general guideline for certificate verification and additional conditions, the change guideline for product modifications, the recognised standards list, the labelling technical reference and the code of practice for LRPs. Regulatory information was verified as of 29 October 2026; if an official document has since been updated, the latest published version prevails.

The spread of instruments is itself the argument for a consolidated check. A single product file touches all six, and each instrument is updated on its own cycle. GN-01 was updated on 1 September 2026, and the standards list changes when standards are revised. A file that was correct at the point of listing is not evidence that it is correct today.

3. Expert insights

Insight one: certificate expiry is the only checkpoint with a definite date, and the easiest to manage. System certificates, reference approval documents, certification body certificates and business registration certificates each have an expiry date, and collecting them into one table solves the problem. The difficult items are the ones without a date: a standard that has been revised, a product that has changed, a vigilance signal that has arrived. Those require a review process rather than a calendar entry, which is why the annual check is designed as a review and not simply as a date sweep.

Insight two: the value of the self-check is in finding undeclared drift. Over the course of a year a product may have undergone material substitution, a supplier change, a software update and a label revision. If those movements did not go through the GN-10 channel, they surface in concentrated form at renewal or at an inspection. The self-check works because it asks a different question from the project file: not what was approved, but what is different from what was approved. Answering that question requires the manufacturing and quality functions, not only the regulatory function.

Insight three: additional conditions are the compliance item most easily forgotten. Paragraph 5.10 of GN-01 makes clear that additional conditions are set out in the approval letter, and that failure to comply may lead to delisting. The approval letter is usually archived once approval is granted, and the conditions are forgotten with it. This is precisely why the self-check must include a separate item for them. A condition is an obligation with a date attached to the listing itself, and it does not appear in any certificate or register entry, so nothing will remind the company of its existence except its own list.

Insight four: public list information also needs verification. Information on listed devices is uploaded to the MDD website, and information that is out of date or incorrect affects what a purchaser finds when searching. The practical consequence is commercial rather than administrative: a hospital procurement officer who cannot find the device on the list has no reason to look further. Checking the entry is therefore part of the annual review, alongside the certificates and the technical file.

Insight five: the check should be able to survive its own audit. A self-check that produces a ticked list but no conclusions is of limited use. What makes it defensible is a short written conclusion for each of the twelve items, a named person responsible for any corrective action, and a date by which the action will be complete. Signed by both the LRP and the manufacturer, that document becomes the input to the renewal file and the first thing produced when the MDD asks how compliance is maintained between inspections.

4. Practical recommendations

• Fix the timing. Run the check in the same month each year, and combine it with the internal audit of the quality management system so that evidence is gathered once.
• Produce a self-check report. Give a conclusion and a remediation plan for each of the twelve items, signed by both the LRP and the manufacturer.
• Grade the findings. Start reporting or recall action immediately for safety-related findings; place formal findings into the remediation plan with an owner and a date.
• Link the check to renewal planning. Use the self-check report directly as the input for preparing renewal materials, so that the same work is not repeated.
• Keep the approval letter in the compliance file, with the conditions transcribed into the register so that they are visible without opening the letter.

5. Verification checklist

• □ 1. The validity period and expiry date of the listing certificate have been verified
• □ 2. The renewal window (12 weeks to 1 year) has been scheduled
• □ 3. The ISO 13485 certificate is valid and its scope covers the listed product
• □ 4. The reference approval document or certification body certificate is valid
• □ 5. The business registration certificates of the LRP and the traders are valid
• □ 6. The standards applied have been checked against the current version of RS-01
• □ 7. Labels and instructions comply with TR-005 and the Chinese and English warnings are compliant
• □ 8. Product changes over the past year have been classified and notified under GN-10
• □ 9. All additional conditions in the approval letter have been fulfilled
• □ 10. Complaint, adverse event and recall records are complete and retrievable
• □ 11. The company and product information on the public MDD list is accurate
• □ 12. The self-check report is signed by both parties and accompanied by a remediation plan

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for Hong Kong, China. Our team manages adverse incident reporting and recall coordination with the Department of Health, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com