Licence Requirements for Outsourced and Contracted Activities: SAHPRA MD02-2026/27 Overview

1. Key takeaways

On 10 April 2026 SAHPRA published the communication Licence Requirements for Outsourced or Contracted Activities of Medical Device Establishments (MD02-2026/27, version 1), providing guidance and requirements for medical device (including IVD) manufacturers, distributors and wholesalers that appoint or contract third parties to perform manufacturing, distribution or wholesaling activities and place the products on the market under their own establishment’s name. The core principle is that activities may be outsourced but responsibility cannot: the licence holder remains responsible for compliance across the outsourced scope.

2. Legal basis

3. Expert insights

Insight 1: MD02-2026/27 fills the regulatory gap created by the separation of name and performance. The communication addresses the situation in which products are placed on the market under the establishment’s own name while manufacturing or distribution is performed by a third party. This is extremely common in the South African market — overseas manufacturers appoint local importers, and local licence holders contract third-party warehousing and logistics. The significance of the communication is that such arrangements are permitted, provided the licence requirements are met. In practice, the same importer that holds stock for a foreign principal is often the very entity performing the distribution, which is why SAHPRA addresses the arrangement directly instead of leaving it to contract law.

Insight 2: Outsourcing does not change the licence holder’s position as the responsible party. The official wording is that products are placed on the market under the establishment’s own name. This means that, facing SAHPRA, responsibility always rests with the licence holder and the authorised representative, while the third party is merely the performer. Indemnity clauses negotiated in outsourcing contracts cannot be set up against regulatory requirements, however carefully they are drafted between the commercial parties. In practical terms this also means that complaints, recalls and vigilance obligations follow the name on the label, not the hands on the product.

Insight 3: Outsourced activities must fall within the licensed scope of activities. Because licences are classified by manufacturing, distribution and wholesaling, any activity that is contracted out must belong to the scope for which the contracting party already holds a licence. If an establishment outsources activities that its own licence does not cover, it still constitutes operating beyond the licensed scope, even though a competent third party performs the work on the ground. The contracting party must therefore map each outsourced activity to a specific line in its own licence before the contract is signed.

Insight 4: Quality system responsibility extends outward with the outsourcing. Under the five-phase ISO 13485 requirements, the licence holder must hold a system certificate in its own name and at its own address. After manufacturing is outsourced, the licence holder must still demonstrate that its quality system covers control over the outsourced party — this is precisely where the outsourcing-process-control clauses of ISO 13485 land in the South African regulatory context, and auditors will look for documented supplier controls. Supplier audits, agreed specifications and periodic performance reviews will form the evidence base that SAHPRA expects to see.

Insight 5: Changes in the contracting relationship may trigger an amendment. Replacing a contracted party or changing the contracted scope may both constitute substantive changes to the licence content. Practical estimate: before signing or amending an outsourcing contract, assess against MD02-2026/27 whether a notification to SAHPRA is required, so as to avoid the arrangement later being characterised as one made without approval. A signed contract that creates a new outsourced relationship is, for these purposes, a change to the establishment’s operations even if the product list itself is untouched.

4. Practical recommendations

1. Review MD02-2026/27 before signing any outsourcing contract: confirm the documentation and notification requirements.
2. Define quality responsibilities and information-sharing mechanisms in the contract: responsibility cannot be outsourced.
3. Confirm that contracted activities fall within your own licensed scope: avoid operating beyond it.
4. Cover outsourced process control in the quality system documentation: satisfy ISO 13485 expectations.
5. Assess amendment triggers before replacing a contracted party.
6. Retain outsourcing contracts and contractor qualification files: available for retrieval at inspections.

5. Verification checklist

• □ Current text of MD02-2026/27 v1 (2026-04-10) obtained
• □ Contracted activities confirmed to fall within the establishment’s licensed scope
• □ Outsourcing contract defines quality responsibilities and information-sharing mechanisms
• □ Quality system documentation covers control of outsourced processes
• □ Contractor qualification files established and retained
• □ Amendment trigger assessed before replacing a contractor or changing the contracted scope
• □ Responsibility allocation confirmed for products placed on the market under the establishment’s own name
• □ Outsourcing arrangements cross-checked against the ISO 13485 quality system documentation

Regulatory information verified as at 29 October 2026. The regulations, guidance and effective dates described in this article are limited to the content published by the official sources listed under Legal basis as at that date; where official documents have been updated, the latest published version prevails.

• South Africa local resource: GRZAN can assist manufacturers from the Chinese mainland and overseas in engaging the South African Health Products Regulatory Authority (SAHPRA) on medical device establishment licence (MDEL) applications and product registration preparation, including authorised representative (AR) scheme design, ISO 13485 certification route planning and CAB selection, GMDN coding and classification determination, technical documentation preparation, and the establishment of vigilance and adverse event reporting mechanisms.
• Service capabilities: product attribute determination and risk classification (Class A/B/C/D), establishment licence application and renewal, reliance pathway justification, technical documentation and essential principles conformity argumentation, labelling and instructions-for-use localisation in English, and post-market vigilance and annual compliance information submission support.
• Contact: hito.lin@grzan.cn; website www.grzan.cn.