Safety monitoring in New Zealand: Medsafe channels and the compliance loop

1. Key takeaways

Medsafe’s main channel for publishing device risk information is Safety Communications (https://www.medsafe.govt.nz/safety/SafetyCommunications.asp), the alerts archive (https://www.medsafe.govt.nz/safety/AlertsArchive.asp), device pages https://www.medsafe.govt.nz/regulatory/DevicesNew/safety-monitoring.asp, recall history in MORD (https://www.medsafe.govt.nz/hot/Recalls/RecallSearch.asp), and the quarterly Prescriber Update. With the mailbox devices@health.govt.nz, these form the complete external monitoring chain.

Safety communications come in two forms: Monitoring communications (safety information, generally not recommending product discontinuation) and Alert communications (serious risks requiring immediate action).

The Sponsor (New Zealand sponsor) must build a closed loop connecting this external chain into internal operations: monitor → assess (against own products and the three adverse event criteria) → decide (report? recall?) → communicate (consult Medsafe, review the recall letter) → execute (return / correct / dispose or destroy) → report (2 weeks / 6 weeks / 3 months) → review. Every node has an official basis: recall execution follows the Recall Code (in force 1 December 2015); withdrawal and disposal follow reg 50 (SR 1984/143); non-cooperation lands on the reg 64 chain with a NZ$500 cap.

There is also a judicial exit: s 86, all five subsections preconditioned on a prior criminal conviction — (1) recall only on a s 61 conviction; (2) mandatory Gazette publication of the order and offence details; (3) recovery of returned goods; (4) withdrawal of containers and advertising materials on s 57, s 58 or s 61 convictions; (5) discretionary publication. On a practitioner conviction the court must notify the professional body under s 87 (article 42).

Finally, one provision often misread: s 98 lets the Director-General make qualified-privilege-protected public statements on any class of device or advertising content. The distinction: s 98 is a public warning and information power, not an enforceable enforcement tool — no duty, no order, no offence; qualified privilege removes defamation liability. Medsafe’s compulsory instruments are s 63 and s 66 (s 66(3) makes refusal an offence), with differing s 63(2) thresholds: device seizure (i) and photographing (k) need reasonable belief of an offence, unavailable for provisions such as reg 12(4), reg 10 and reg 25 that are not on the reg 64 offence list; label or advertising seizure (j) needs only breach of or non-compliance with a requirement. In one sentence: Medsafe’s real leverage over device companies is not fines but public naming.

2. Legal basis

The sources below combine the official channels with the statutory provisions behind each node of the loop.

3. Expert insights

Insight 1: safety communications are not legal instruments, but they arrive earlier and are harder to fight. The asymmetry runs both ways: reg 10 forbids the Sponsor from implying official endorsement, while s 98 immunises the Director-General’s statements against defamation. When a company is named, publicity usually reaches customer inboxes before any fine would.

Insight 2: why the Recall Code drives action despite having no penalties. Its self-description is “It is a technical document”; its demand uses “should”; and section 1 defines “should” as compliance in all cases unless otherwise agreed with Medsafe (quotations in article 42): a self-declared technical document, a soft verb, a hard constraint

Insight 3: monitoring must include overseas markets, not just Medsafe pages. The Code expressly requires that overseas recalls be notified to Medsafe as soon as practicable, with the measures proposed in New Zealand. The radius must cover every market the Sponsor touches — head office may have judged a batch risky, and the New Zealand Sponsor was never told.

Insight 4: the passage between voluntary reporting and compulsory withdrawal. Device adverse event reporting is voluntary (article 43), yet withdrawal has statutory backing (article 42). The channel is this loop: the same event can reach Medsafe through a Sponsor submission, an overseas recall, media coverage or a healthcare provider report; once a risk is established, the exit is the Recall Code procedure, and the worst case is a reg 50 order — reporting or not determines whether the Sponsor enters that conversation as the active or the passive party.

Insight 5: Medsafe’s own pages may still be stuck before 2015. The IVD page (7InVitro.asp) and exempt devices page (3-8MDExempt.asp) still cite the Uniform Recall Procedure — superseded on 1 December 2015. The discipline: distinguish an outdated document reference from law still current; the current Recall Code is the version procedures must follow.

4. Practical recommendations

• Build an external monitoring list covering safety communications, the alerts archive, the device safety pages, MORD and major overseas regulator feeds; assign a named role and keep patrol records (frequency is a practical estimate), as an annex to the compliance procedure.
• GRZAN lays a dual-timeline ledger: one axis runs the Code’s 2 weeks / 6 weeks / 3 months milestones (the default baseline, exceptions agreed with Medsafe in advance), the other the s 38 45-day window and reg 50 milestones — missing the latter faces NZ$5,000 or 6 months imprisonment.
• Make an applicability decision for every incoming item and keep the trace: SKUs in supply, batch / serial / software versions affected, whether consignees must be notified — the record is also “all reasonable steps” evidence under s 80 (defence notice within 7 days of the summons).
• Obtain Medsafe agreement before triggering any recall (except out-of-hours emergencies), and issue the letter only after Medsafe review — the Sponsor performs both nodes in person.
• Build a three-way link with WAND records and the distribution ledger: safety information → affected batches → destination tiers → consignee list; without it, a Class I recall cannot demonstrate full coverage.
• Consolidate events, decisions, submissions, recalls and corrective actions into a trend report feeding the 45-day evidence pack for the next s 38 response.

5. Verification checklist

• □ Are the safety communications page, alerts archive, device safety pages, Prescriber Update and MORD on the fixed monitoring list with a named owner?
• □ Does the procedure distinguish response levels for Monitoring communications and Alert communications?
• □ Does the monitoring scope cover overseas regulatory actions (overseas recalls notified to Medsafe as soon as practicable)?
• □ Has every incoming item been through an applicability decision with a trace, linkable to batch / serial / software versions?
• □ Is a dual-timeline ledger running the Recall Code (2 weeks / 6 weeks / 3 months) alongside s 38 (45 days)?
• □ Are Medsafe consultation before initiation and Medsafe review of the recall letter in the procedure, performed by the Sponsor in person?
• □ Is a three-way link in place between safety information, WAND and the distribution ledger, producing a consignee list directly?
• □ Is it known that the compulsory instruments are s 63 and s 66 (s 66(3) refusal an offence), while s 98 is a public warning power protected by qualified privilege?
• □ Is it known that s 86(2) requires Gazette publication, s 87 requires conviction notifications, and breaching reg 50(1) caps at NZ$500 while breaching s 38(8) carries up to NZ$5,000 and imprisonment?

Regulatory information verified as of 29 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the New Zealand market. Our team manages adverse event reporting and recall coordination with Medsafe, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com