Distribution records in New Zealand: fields, retention and traceability

1. Key takeaways

Medsafe lists retention of distribution records among the duties of the Sponsor (New Zealand sponsor), but clause-by-clause verification by GRZAN establishes one fact: current New Zealand legislation specifies neither a retention period for distribution records nor their required fields. Neither the 2003 Regulations, the Medicines Act 1981 (1981 No 118) nor the Medicines Regulations 1984 (SR 1984/143) requires distribution records to be kept for a set number of years. The field design and retention periods proposed here are entirely practical estimates; no item should enter internal procedures as an official statutory requirement.

Where does the compulsion come from? Three supports, not a direct fine for non-retention. First, recall execution capability: the Recall Code (in force 1 December 2015) divides the supply chain into Consumer, Pharmacy-Retail, Hospital-Laboratory, Healthcare Professional and Wholesale — 5 tiers — and requires a written recall procedure; without distribution records there is no way to show a recall covered the tiers it should have. Second, compliance with recall orders: reg 50(2) of the 1984 Regulations requires the recipient to tell the Director-General how and when the order will be met and to give written notice afterwards — both documents depend on complete destination records. Third, the procedural duty: reg 9 of the 2003 Regulations requires procedures securing compliance with regs 5, 6 and 8, breach fined up to NZ$500 under reg 14.

A hidden enforcement point is easily missed: s 66 of the Medicines Act 1981 allows the Director-General to require production of books and records on importation, purchase, manufacture, packing, storage, transport, delivery, sale or supply, and s 66(3) makes refusal an offence. The retention period may have no statutory number, but being unable to produce records on demand is another matter. The combination: records may carry no statutory retention period, but the business cannot function without records.

2. Legal basis

The instruments below frame the distribution records question: none sets a retention period, yet each supplies a mechanism that makes records indispensable.

3. Expert insights

Insight 1: traceability is risk-tiered — and limited. Reg 5(2) of the 2003 Regulations requires only Class III and AIMD non-exempt devices to be entered in the database with a Unique Product Identifier (UPI); Class I, IIa and IIb need not. At the database level New Zealand imposes unit-level traceability only on the highest risk classes. Traceability for the remaining classes rests on the Sponsor’s own distribution records, and that is exactly where no statutory fields exist — the ground on which practical estimates must operate.

Insight 2: the minimum usable field set for distribution records. Working backwards from the Code’s tiers and real counting needs, a record set capable of executing a recall needs at least (practical estimate): device name and model, GMDN code, risk classification, batch or serial number, software version (essential for SaMD), quantity and shipping date, consignee name, address and contact details, the consignee’s supply chain tier (Consumer / Pharmacy-Retail / Hospital-Laboratory / Healthcare Professional / Wholesale), dispatch note and receipt confirmation, physical flow records for returns, replacements and destruction, and the WAND record number. Without the tier column, a recall letter’s distribution cannot be shown complete; without receipt confirmation, Class I recall effectiveness cannot be evidenced.

Insight 3: how to set a retention period. With no statutory number, the Sponsor must set one and be able to explain why. A common pattern: a floor at the device’s expected service life plus several years; longer for implantables keyed to clinical follow-up cycles; several years after version decommissioning for SaMD (all practical estimates). The logic is defensible — within the 45-day s 38 window the Sponsor must explain why the traceability scope is adequate, and a service-life-derived period is harder to challenge than an arbitrary three years.

Insight 4: where records live determines whether they can be produced. The s 63 and s 66 powers operate on New Zealand premises and books. If distribution records exist only in the overseas manufacturer’s head-office ERP, retrieval when a s 66 demand arrives becomes a real problem. GRZAN recommends writing an immediately retrievable New Zealand copy into the Sponsor service agreement.

4. Practical recommendations

• Build a tier inventory before building records: at project start GRZAN asks the client to place every SKU into its tiers within the Code’s 5 tiers and set granularity accordingly — Hospital-Laboratory-tier devices must be traceable to the department (practical estimate), Consumer-tier devices at least to the retail channel and shipping batch.
• Missing fields are more dangerous than untidy formats. GRZAN recommends auditing the existing ledger column by column against the field set above, closing batch/serial number, tier and receipt confirmation first — without these three, recall effectiveness verification cannot pass, and the reg 50(2) report cannot be written.
• Write the retention period into a written policy, mark it as a practical estimate and state the derivation (expected service life + follow-up cycle + version decommissioning cycle) rather than an arbitrary number of years.
• Run a desktop recall exercise once, issuing a simulated progress report within 2 weeks (a rhythm suggested by the Recall Code; practical estimate), to test whether the records support counting and reconciliation.
• Put the location of distribution records into the Sponsor agreement — who maintains the immediately retrievable New Zealand copy and how often it updates — so a s 66 demand never depends on an overseas system.
• Maintain the UPI field in parallel for Class III and AIMD records and build a two-way index with serial numbers in the distribution ledger, merging the reg 5(2) database requirement and recall practice into one chain.

5. Verification checklist

• □ Is it confirmed that New Zealand has no statutory distribution record retention period, and that no retention years are stated as official requirements?
• □ Does the distribution records policy mark its field design and retention period as practical estimates and state the derivation?
• □ Is the minimum field set complete: name and model, GMDN code, risk classification, batch/serial number, software version, quantities and dates, consignee details, supply chain tier, dispatch note and receipt confirmation, returns and destruction records, WAND record number?
• □ Has every SKU been mapped to its specific tier within the Code’s 5-tier supply chain?
• □ Is a two-way index in place between UPI for Class III and AIMD devices and the distribution ledger?
• □ Is an immediately retrievable copy held in New Zealand, without reliance on cross-border queries into overseas ERP systems?
• □ Is a desktop recall exercise run at least every 12 months with the simulated progress report retained (frequency is a practical estimate)?
• □ Can the reg 50 how-and-when notification and the post-compliance written notice be generated from existing records within a reasonable time?
• □ Is it understood that s 66(3) makes refusal or failure to comply with a production demand an offence, and that the thresholds of s 63(2)(i), (j) and (k) for seizure and photographing differ?

Regulatory information verified as of 29 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the New Zealand market. Our team manages adverse event reporting and recall coordination with Medsafe, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com