Traceability Requirements in Morocco: Article 23 of Law 84-12

1. Key takeaways

Article 23 of Law No. 84-12 requires the heads of manufacturing, import, export and distribution establishments, healthcare institutions and health professionals to apply, within their respective areas of responsibility, the traceability rules for certain devices according to their degree of dangerousness (degré de dangerosité); the list of devices subject to traceability and the traceability rules themselves are set by separate regulatory text. This is a delegated-legislation clause, drafted with the same technique as Article 18 (second-hand devices), Article 19 (radiation) and Article 10 (the mandatory maintenance list). The practical consequence is that the law fixes only the principle — graded traceability across the whole chain — while the operational detail lives in companion texts that companies must monitor continuously rather than read once. Traceability should also be understood as an investment with a return: the same batch and distribution data that satisfy Article 23 are the data that make a 48-hour vigilance report and an Article 29 recall executable under time pressure.

2. Legal basis

Verification note: the “list of devices subject to traceability and the traceability rules” referred to in the second paragraph of Article 23 is set by regulatory text; GRZAN did not obtain a single reference number for that companion text in this verification, so no number is invented here and the text is referred to as “the Moroccan traceability rules text currently in force”.

3. Expert insights

Insight 1: traceability obligations are graded by dangerousness, not one-size-fits-all. The provision ties the intensity of traceability to the “degré de dangerosité”, which is precisely the core dimension of the classification system in Article 4. The correct reading is: the higher the class, the finer the traceability requirements. When designing a traceability system, companies should build it in tiers by class rather than imposing a single uniform standard across the entire product line. A tiered design also keeps costs proportionate: the deep serial-level architecture that a Class III implant justifies would be disproportionate overhead for a Class I consumable.

Insight 2: the duty holders extend to healthcare institutions and health professionals. Like the vigilance reporting of Article 25, Article 23 places healthcare institutions and professionals among the obligated parties (“within their respective areas of responsibility”). This means the traceability chain runs from the manufacturer all the way to the clinical side: a hospital’s device register is a component of the national traceability system, and suppliers who make registration easy for hospitals are supporting the chain rather than merely serving a customer. It also means a traceability gap anywhere along the chain — at an importer, a distributor or a hospital — weakens the evidence available to every other participant.

Insight 3: traceability is the technical precondition of recall capability. Article 29 requires the certificate holder to execute recalls and disposal within deadlines set by the competent authority. Without usable traceability data, a recall cannot locate affected batches precisely and can only proceed as a full-sweep recovery. The real value of a traceability system is cashed in at the moment of recall — build it before that moment arrives. The difference is measurable: a targeted recall touches one batch and its known destinations, while a blind recall touches the whole installed base and the entire distribution history.

Insight 4: traceability and vigilance share the same data flow. Article 25 requires incidents or risks to be reported within 48 hours, and such reports necessarily involve batch identification and distribution destinations. Connecting traceability data to the vigilance workflow significantly shortens the preparation time for a report, which matters when the statutory window is measured in hours. In concrete terms, the batch number, the quantities distributed and the delivery destinations needed for a report should be retrievable from the traceability system in a single query, not assembled by hand from scattered records.

Insight 5: delegated legislation means the rules will change. As with Article 18, Article 23 leaves the concrete rules to regulatory text. Companies should establish a standing mechanism to track that companion text instead of building the system once and leaving it untouched, because a rule update can change what must be recorded, at which level, and for which devices. The uncertainty also has a contract dimension: since the exact rules are not yet fixed in a numbered text known to this verification, distribution agreements should be drafted so that traceability obligations can track whatever form the rules ultimately take.

4. Practical recommendations

1. Design traceability depth by class. For Class I, batch-level traceability is sufficient; for Class IIB and Class III, the practical estimate is that serial-number-level traceability reaching the end user is advisable.
2. Connect traceability and vigilance data. Make batch and distribution data directly usable for the 48-hour reports under Article 25, cutting preparation time when an event occurs.
3. Write traceability requirements into distribution authorization letters. When issuing authorizations under item 11 of Article 1, agree on the data-flowback obligations of distribution establishments.
4. Support the register needs of healthcare institutions. Provide customers (exploitants) with device identification information formatted for easy entry into their registers, helping them meet their Article 23 duties.
5. Track the traceability companion text. Add it to the regulatory watch list and adjust the traceability system whenever the rules are updated.

5. Verification checklist

• □ Traceability depth has been designed in tiers according to device class
• □ Traceability data directly supports the 48-hour reports under Article 25
• □ Distribution authorization letters include data-flowback obligations
• □ Device identification information has been provided to customers for their registers
• □ The traceability system covers the full chain from manufacturing, import and distribution to the end user
• □ The traceability companion rules text is on the regulatory watch list
• □ A recall drill has validated the usability of the traceability data

Regulatory information verified as of October 30, 2026

Post-market support from GRZAN. GRZAN provides post-market compliance support for medical device manufacturers and importers serving the Moroccan market, covering traceability system design, materiovigilance reporting, recall and withdrawal execution, and inspection readiness. If you need a graded traceability architecture aligned with Article 23 and connected to your vigilance workflow, contact info@grzanglobal.com.