Distributor Obligations and Supply Chain Traceability under the Turkish Medical Device Regulation

1. Key takeaways

Distributors in Turkey carry two distinct kinds of duty: a duty to act within the regulation when they make devices available, and a duty to be able to identify every link in their supply chain on demand. This article summarises both, and links the traceability duty to the retention periods that apply to the manufacturers’ own documentation.

• The distributor’s obligations are set out in Madde 14 paragraph 1: when making devices available within the scope of their activities, distributors must act in accordance with the Regulation. The duty attaches to what distributors actually do in the market, within the range of their own activity.
• The supply-chain identifiability duty is set out in Madde 25 paragraph 2: within the period referred to in Madde 10 paragraph 8, economic operators must be able to provide to the Kurum three categories of information: (a) every economic operator that supplied them directly; (b) every economic operator to whom they supplied directly; and (c) every healthcare institution or healthcare professional to whom they supplied directly. The word able matters: the duty is to be capable of producing the lists, not merely to have some records somewhere.
• Madde 25 paragraph 1 adds a cooperation duty: distributors and importers must cooperate with the manufacturer or the authorised representative in order to achieve an appropriate level of traceability. Traceability is therefore a shared exercise, not a solo one, and it cannot be achieved by any single economic operator acting alone.
• The period during which the information must be available follows Madde 10 paragraph 8 (retention of 10 years / 15 years for implantables). This is an ISO-grade evidence retention requirement, not a short-term ledger that can be cleaned out at the end of a financial year. The lists and the records behind them must survive for the whole of that period.

2. Legal basis

The distributor provisions and the traceability provisions sit in the same regulation, with the IVD-side counterpart article carried by the parallel IVD regulation published in the same gazette issue. Reading the three provisions together, Madde 14 defines what a distributor must do, Madde 25 defines what a distributor must be able to show, and Madde 10 paragraph 8 defines how long the underlying records must survive. The table below records both instruments and the exact articles on which each point above relies.

3. Expert insights

Insight one: Madde 25 paragraph 2 elevates the distributor ledger into a statutory list. Companies usually treat upstream and downstream records as ordinary business data. Turkey writes them out instead as a statutory capability: the lists must be able to be provided to the Kurum. This constitutes a hard traceability requirement. It is not enough for a ledger to exist; the test is whether it can be produced immediately when the Kurum makes its request. A ledger buried in old email threads or spread across staff members’ personal files does not pass that test.

Insight two: none of the three lists can be missing. Items (a), (b) and (c) of paragraph 2 point respectively downstream, upstream and to the end of the chain. The ledgers of most companies cover only the first two categories, and omit the list of healthcare institutions or healthcare professionals supplied directly. That omission is particularly dangerous, because the third list is precisely the one that matters most during a recall, when every affected end user must be identified and reached without delay.

Insight three: the period shares its origin with the manufacturer’s documentation retention. Paragraph 2 borrows the period of Madde 10 paragraph 8, namely 10 years, extended to 15 years for implantables. This means the retention cycle for distributor historical data is far longer than that of ordinary commercial archives, and it places substantive demands on the IT and data retention policies of the Chinese headquarters. Systems that auto-purge after a few years will break the statutory capability without anyone noticing until the regulator asks. The retention rule should therefore be treated as a compliance setting, configured deliberately and audited periodically, rather than left to whatever the default archive policy happens to be.

4. Practical recommendations

• Build three lists for the Turkish business (downstream operators, upstream operators, and end healthcare institutions), and bind them to the customer master data in the ERP, so that the statutory lists update themselves as business relationships change rather than decaying into stale snapshots.
• Insert an information-provision clause into the contracts with distributors, defining the time limits for cooperation with Madde 25 paragraph 2, so that the statutory duty is mirrored by contractual obligations running down the chain.
• Set the data retention period at 10 years / 15 years for implantables, and prevent historical data from being cleaned up early, particularly by automated retention policies that were designed for ordinary commercial records.

5. Verification checklist

• □ The distributor has confirmed in writing the obligations within the scope of its activities under Madde 14 paragraph 1.
• □ The three lists required by Madde 25 paragraph 2 have been established (downstream, upstream, and end healthcare institutions).
• □ It has been confirmed that the lists can be produced immediately upon a request from the Kurum.
• □ The distribution contracts contain an information-provision clause with time limits.
• □ The data retention period has been set at 10 years / 15 years for implantables.

Regulatory information verified as of 29 October 2026. The provisions cited in this article were checked against the current texts on the Turkish legislative information system (MevzuatNo 38657, 38658).

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Turkish market. Our team coordinates authorised representative and importer arrangements, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com