Supply chain data: how to handle disclosure requests under TPA Art. 47c

This article is the 48th instalment of Volume 5, Post-market Compliance and Regulatory Developments, of the 50-part series on medical device registration in Switzerland. Together with the remaining nine articles of this volume it forms the complete deliverable on this topic. The publication timestamp, article number, title and unique URL are set out in the table below.

1. Key takeaways

TPA Art. 47c turns the question of where a device comes from and through whose hands it has passed into a statutory duty, not a cooperation request from the purchasing department. Compliance therefore does not consist of digging through contracts when a request arrives. It consists of maintaining, in ordinary course, a supply chain ledger that shares its source data with the swissdamed registration data and can be broken down by the type of requester. The difference between the two postures is measurable: a company with a derived, object-sorted ledger answers a disclosure request from its master data in days, while a company that assembles answers ad hoc produces inconsistencies, because different departments remember the same facts differently, and each inconsistency becomes a fresh question from the authority.

2. Legal basis

3. Expert insights

1. The legal level of the disclosure duty means it cannot be excluded by contract. Art. 47c sits in the Therapeutic Products Act itself (SR 812.21, adopted 15 December 2000), not at the level of a subordinate ordinance. The judgement that follows is: confidentiality agreements or restrictions on information transfer between supply chain parties cannot override a statutory disclosure request. The counterpoint is equally concrete. Upstream suppliers often refuse to provide information about critical process steps on trade-secret grounds, and if a company has not agreed cooperation duties in its procurement contracts in advance, it will find itself in passive breach at the worst possible moment, namely when the authority is waiting for an answer.

2. A three-category view of disclosure recipients is the working way to organise the ledger, as a practical estimate. As a practical estimate, when a disclosure request arrives a company can organise its data by three recipient classes. The first is regulatory authorities, whose requests typically target device origins, supply chain stages and the identities of economic operators. The second is commercial counterparties, suppliers and purchasers, whose requests mostly concern compliance evidence and the allocation of responsibilities. The third is patients and the public, whose requests typically involve implant traceability information. It must be noted that this three-category division is a summary of industry experience; the actual disclosure recipients and scope are governed by the official text of TPA Art. 47c and the current explanations of Swissmedic. The trade-off is that sorting by recipient shortens response times significantly, but it also requires the ledger to share its source with the swissdamed registration data; otherwise the same facts exist in two versions, which adds risk instead of reducing it.

3. Disclosure requests and registration duties should run on one set of master data. MedDO Art. 55 para. 1 requires the manufacturer or its authorised representative, and the importer, to register with Swissmedic the information set out in Section 1 of Part A of Annex VI to the EU MDR within 3 months of the first placing on the market, and para. 2 requires changes to be reported within 1 week. The judgement is that most fields needed for supply chain disclosure overlap heavily with the registration fields, so maintaining two independent data sources is duplicated work that inevitably drifts. As a practical estimate, treat the swissdamed registration data as the single master data source and derive the disclosure ledger from it as object-specific views, so every view is current by construction.

4. Practical recommendations

1. Use the swissdamed device registration data as the supply chain master data, and build a disclosure ledger of derived views by recipient (practical estimate: the three views for regulatory authorities, commercial counterparties, and patients and the public).
2. Write cooperation duties for statutory disclosure, response deadlines and information granularity into procurement contracts and distribution agreements in advance.
3. Designate an owner and a sign-off process for disclosure requests, so business departments never hand out unreviewed data externally.
4. Build a change-synchronisation mechanism consistent with Art. 55 para. 2: once the master data is updated, the derived disclosure views are synchronised within 1 week.
5. For information involving upstream trade secrets, prepare alternative descriptions that can be provided externally, balancing the disclosure duty against confidentiality arrangements.

5. Verification checklist

• □ The supply chain master data shares its source with the swissdamed registration data, with consistent field definitions.
• □ A disclosure ledger sorted by recipient is in place, using the three views of the practical estimate.
• □ Procurement and distribution contracts contain clauses on cooperation with statutory disclosure.
• □ The owner and sign-off process for disclosure requests are defined.
• □ The synchronisation between master data changes and the disclosure ledger meets the 1-week requirement.
• □ Spot-check records comparing the ledger with actual goods movements are retained.

Legal information verified as of 29 October 2026.

GRZAN supports manufacturers entering or operating in the Swiss market with post-market compliance services, covering vigilance reporting, field safety corrective actions and Swissmedic inspection readiness. Our team builds swissdamed-aligned supply chain ledgers, handles TPA Art. 47c disclosure requests end to end and aligns contract templates with statutory cooperation duties. For support with your Swiss post-market obligations, contact info@grzanglobal.com.