Regulation 8 Updates: Keeping WAND Records Accurate in New Zealand

1. Key takeaways

Regulatory information verified as of 29 October 2026. A WAND notification for a New Zealand medical device is not a one-off act. Under reg 8 of the Medicines (Database of Medical Devices) Regulations 2003 (SR 2003/325), whenever any information in a database record ceases to be accurate or complete, the sponsor must, within 10 working days, procure that the Director-General, or anyone maintaining the database on the Director-General’s behalf, receives correct particulars or complete information. After verifying the official text, the GRZAN regulatory team confirms this is the only time-bound duty in the New Zealand device system spanning the entire product lifecycle: the 30 working days in reg 6 runs once, when a party becomes a sponsor, while the 10 working days in reg 8 can be triggered again and again.

The provision names two typical triggers: a change in the name of a manufacturer or sponsor, and a lapse in any certification relating to the device. The wording also carries “or otherwise” as a catch-all, so the test is not which items are listed but whether the record remains accurate and complete.

Working the triggers back through the mandatory fields of reg 5 yields nine categories of change that must launch a correction: a change of risk classification; manufacturer name; sponsor name; the sponsor’s New Zealand registered office or principal place of business address; the manufacturer’s (New Zealand or overseas) registered office or principal place of business address; either party’s telephone or email contact details; the GMDN product description; the UPI for Class III and AIMD devices; and lapse of any related certification. Beyond the nine, any change making the record inaccurate or incomplete likewise falls within reg 8.

The consequence of failure sits in reg 14: a sponsor who contravenes any of reg 6, reg 8, reg 9 or reg 10 commits an offence and is punishable on conviction by a fine not exceeding NZ$500. The amount is small, but it is a criminal conviction, and liability is pinned precisely on the sponsor.

• Reg 8 requires correction within 10 working days of information ceasing to be accurate or complete.
• The clock runs from the objective event, not from the date the company learns of it.
• Listed triggers: manufacturer or sponsor name changes and lapse of certification, with an “or otherwise” catch-all.
• Nine field-level change categories derived from reg 5 must each launch a correction.
• Breach is an offence under reg 14, punishable by a fine not exceeding NZ$500.

2. Legal basis

The instruments relevant to reg 8 corrections are set out below. Reg 8 has two subsections: subsection (1) defines applicability (information in a record ceases to be accurate or complete, whether through a change in circumstances or otherwise); subsection (2) sets the 10 working-day period and the notification recipients (the Director-General, or anyone maintaining the database on the Director-General’s behalf).

3. Expert insights

Insight 1: the clock starts on the day the information ceases to be accurate, not on the day the company finds out. Reg 8(2) reads “within 10 working days of the information ceasing to be accurate or complete”. The legislator anchored the clock to an objective fact, not corporate awareness. A company that learns of a manufacturer’s name change six months late through slow internal communication has already run out its 10 working days on the statutory reading. This is why reg 9 exists: the sponsor must establish all necessary procedures to ensure continuous capability to comply with reg 5, reg 6 and reg 8. The regulation anticipates that companies will not know, and demands a mechanism that prevents not knowing.

Insight 2: certification lapse is named in the text, exposing what the legislator really cares about. Reg 8(1) specifically names “a lapse in any certification relating to the device”. Devices need no pre-market approval in New Zealand, so external support for compliance rests on overseas market authorisations, ISO 13485 certificates, CE certificates and similar credentials. Once a credential lapses, the database statement that the product is supplied by that manufacturer at that classification loses its footing. What the legislator watches is not administrative housekeeping such as an address move but the breaking of the credential chain.

Insight 3: working days and calendar days are two different counts. Working day in New Zealand legislation excludes weekends and public holidays, so 10 working days usually runs longer than 10 calendar days, but in holiday-dense periods such as Christmas and New Year it can stretch markedly, or come close to two weeks depending on the layout. GRZAN advises scheduling internally on the stricter calendar-day countdown (practical estimate: an experienced judgement, not an official requirement), to avoid missing on changes straddling a month boundary.

Insight 4: two timers run in parallel, and overdue risk is chronically underestimated. The 30 working days of reg 6 is triggered once, when an entity first becomes a sponsor; the 10 working days of reg 8 can be triggered repeatedly across the product’s supply life. What GRZAN encounters most often when reviewing client records: the initial notification was filed on time, after which nobody owned record maintenance, until a merger, manufacturer name change or certificate renewal left a whole batch of records inaccurate simultaneously — which almost always means a one-off surge of correction work.

4. Practical recommendations

• Turn the nine change categories into field-level triggers. GRZAN maps risk classification, manufacturer name, sponsor name and address, manufacturer address, contact details, GMDN, UPI and certification status onto change nodes in the client’s system, so any field modification automatically generates a correction task and starts the clock.
• Appoint a single owner and write it into the job description. Reg 9 requires procedures, and procedures must land on people; GRZAN advises designating a WAND record administrator whose job description cites reg 5, reg 6 and reg 8 directly.
• Obtain quarterly status confirmations from the manufacturer. Manufacturer names, addresses and certificate statuses cannot be controlled by the sponsor alone. A written confirmation request each quarter, archived, is evidence of reg 8 compliance and proof the reg 9 procedures are effective.
• Put certification expiry dates into calendar management. Expiry or lapse of overseas authorisations, ISO 13485 certificates and CE certificates is expressly listed in reg 8(1); set expiry reminders for every certificate and start the correction on the day of lapse.
• Leave a full audit trail of every correction. Keep submission records, timestamps and reply correspondence. Given the strict liability structure of s 80, where intent need not be proved, whether the all-reasonable-steps defence can succeed depends on whether daily records can be retrieved.

5. Verification checklist

• □ Change-trigger list covers every mandatory field of reg 5
• □ WAND record administrator designated; job description cites reg 5, reg 6 and reg 8
• □ Manufacturer name and address changes covered by the quarterly written confirmation mechanism
• □ Expiry dates of related certifications (overseas authorisations, ISO 13485, CE and similar) are in calendar reminders
• □ Corrections scheduled on the 10 working-day period, with a stricter countdown applied (practical estimate)
• □ A separate check item exists for UPI changes on Class III and AIMD devices
• □ Submission records, timestamps and reply correspondence kept for every correction
• □ GMDN product description has not drifted out of accuracy through product iterations
• □ Internal procedures state the reg 14 consequences of breach, up to NZ$500

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the New Zealand market. Our team coordinates New Zealand sponsor arrangements, import requirements, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com