Future readiness in New Zealand: approvals reserve, sponsor governance, SaMD

1. Key takeaways

The current New Zealand device regime has no pre-market approval, and a future Medical Products Bill may introduce risk-tiered approval — but as of the verification date of 29 October 2026 the bill has not been introduced into Parliament and remains a policy draft, with multiple conflicting official timelines, none confirmed. The right posture now is building three main lines: an overseas approval reserve, Sponsor (New Zealand sponsor) and responsible-entity governance, and SaMD and data compliance.

Whatever the future regime looks like, the investment will not be wasted: the approvals are portable across major markets, and the governance and data capabilities are cross-market.

The medicines side indicates the regime’s likely direction: the 7 recognised regulatory authorities in Gazette 2026-sl772 (11 February 2026) and the “2 or more” overseas full marketing authorisations threshold in the Medicines Amendment Act 2025 (2025 No 66) show a path of recognising overseas approvals over duplicate domestic review. If the device side introduces an approval regime, the same fulcrum is highly likely (policy judgement; practical estimate).

2. Legal basis

The table organises the legal basis by main line.

3. Expert insights

Insight 1: the overseas approval reserve — secure early what may become an access condition. The Ministry of Health’s February 2026 briefing (paragraph 6) states that suppliers “are not required to demonstrate approval by any overseas regulator”. If the device side adopts the recognition logic, existing approvals convert into leverage; if the regime never changes, they still support the s 38 window and hospital procurement scoring.

Insight 2: Sponsor governance — the only accountable entity in New Zealand, and the first hit at any regime switch. The Sponsor bears the regime’s notification, correction, procedural and recall coordination duties — reg 9 procedures, reg 8’s 10 working days correction, reg 14’s NZ$500 cap. Authorisation agreements often cover only notification as agent, without correction triggers, recall coordination workflows or review rights over promotional wording.

Insight 3: SaMD — a field where a statutory provision has already lapsed once. Medsafe’s device definition page (revision 15 January 2015) does not contain the word software, and Medsafe has no SaMD-specific guidance; qualification, classification and clinical evidence requirements are all practical estimates.

A legislative fact worth recording: s 26 of the Therapeutic Products Act 2023 (2023 No 37) was titled “Software as a medical device” — New Zealand’s first statutory SaMD provision — but the Act was repealed on 18 December 2024 by the Therapeutic Products Act Repeal Act 2024 (2024 No 55), and s 26 lapsed with it. If the future Medical Products Bill covers devices, SaMD will very likely re-enter the text (practical estimate).

Insight 4: data compliance — the hard constraint device companies most easily overlook. Health information collected by wearables, implantables, connected devices and SaMD is doubly bound by the Privacy Act 2020 and HIPC 2020. Breach notification sits in s 114 (“as soon as practicable”) and s 115, with a fine of up to NZ$10,000 under s 118 for failure to notify. Cross-border transfer under IPP 12 and Part 8 s 197 is a hard constraint for companies sending service data back to a China headquarters.

4. Practical recommendations

• Main line 1 — overseas approval reserve. Use the 7 authorities recognised on the medicines side as the reference for global registration prioritisation, planning those pathways first, rather than low-threshold markets that may not be recognised in future (practical estimate).
• Organise each overseas approval into a five-element card (approving authority, product scope, classification rationale, clinical evaluation summary, validity period) serving the s 38 45-day window.
• Record each approval date and product configuration version; these may determine reapplication under a future transition period.
• Main line 2 — Sponsor and responsible-entity governance. Write four clause families into the Sponsor authorisation agreement: correction triggers (reg 8’s 10 working days), recall coordination and Medsafe communication duties, review and takedown rights over promotional wording (reg 10 and ss 56–58), and data and privacy responsibilities (Privacy Act 2020).
• Establish written procedures under reg 9 with operating records retained — reg 9 is a standalone duty and breach triggers reg 14.
• Review Sponsor entity qualification against WAND records annually, covering name, certification and address changes — all reg 8 correction triggers. The device side has no GMP licensing or audit system (Medsafe audits medicines only), so quality and records rest entirely on the company — the hardest gap to close if an approval regime arrives.
• Main line 3 — SaMD and data compliance. Qualify every software product under s 3A first, then confirm classification against reg 13(5); standalone SaMD has no official guidance, so treat it as a practical estimate and retain the reasoning.
• Build a data mapping table of collected fields, storage locations, cross-border paths, recipients and legal bases, verified against IPP 12 and Part 8 s 197.
• Establish a privacy breach notification plan under s 114 / s 115 with owners and timelines (fine cap NZ$10,000).
• Review the impact of HIPC 2020 Amendment 2 and IPP 3A (both in force 1 May 2026) on implant registries, remote monitoring and manufacturer service data.

5. Verification checklist

• □ The Medical Products Bill is noted as a policy draft, not yet introduced into Parliament (adjournment 24 September 2026, dissolution 1 October 2026, election 7 November 2026)
• □ The overseas approval reserve follows the 7-authority list, with five-element evidence cards supporting the s 38 45-day window
• □ The Sponsor agreement contains the four clause families: correction, recall coordination, promotional wording review and data responsibility
• □ Reg 9 written procedures are established, with operating records retained
• □ WAND consistency is reviewed annually (reg 8, 10 working days)
• □ Every software product has s 3A qualification and reg 13(5) classification records (practical estimate)
• □ The data mapping table is complete, with IPP 12 and s 197 verified item by item
• □ A breach notification plan defines owners and timelines (s 114 / s 118, fine up to NZ$10,000)
• □ HIPC 2020 Amendment 2 and IPP 3A impacts (in force 1 May 2026) are reviewed

Regulatory information verified as of 29 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the New Zealand market. Our team manages adverse event reporting and recall coordination with Medsafe, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com