Sri Lanka MAH Qualification and Responsibilities

1. Key takeaways

The Marketing Authorization Holder (MAH), also referred to as the local agent, must be a legally registered commercial entity in Sri Lanka. The official description of the role is demanding: the MAH is answerable for registration, licensing, import, sale and distribution, quality incident handling, and all other matters related to the device in Sri Lanka. The applicant must also accept full responsibility for the product and for all information submitted, ensuring that the data provided is accurate, complete, and truthful. The registration certificate is valid for 5 years, after which renewal obligations apply. Taken together, these points mean that appointing a Sri Lankan MAH is not a clerical step but a transfer of regulatory accountability to a local entity that must be genuinely capable of carrying it.

• The MAH must be a commercial entity legally registered in Sri Lanka; foreign manufacturers cannot hold the authorization themselves.
• The MAH answers for registration, licensing, import, sale and distribution, quality incident handling, and all related matters concerning the device in Sri Lanka.
• The applicant is fully responsible for the product and for all information supplied with the application.
• Data must be accurate, complete, and truthful at the time of submission and throughout the review.
• The registration certificate is valid for 5 years.

2. Legal basis

The obligations summarised above are published on the NMRA medical device pages, which describe the qualification of the MAH and the scope of its duties. The table below reproduces the key elements in the order given by the source, so that each duty can be traced back to its official statement.

Two features of this framework deserve emphasis. First, the notification duty covers developments that occur outside Sri Lanka, including a rejection or withdrawal of the product by another regulator and changes in cGMP compliance status. Second, the duty to answer requests for supplementary data means the MAH must remain responsive for the entire duration of the review, not only at the moment of submission.

3. Expert insights

Insight one: the responsibility language uses the catch-all phrase of all related matters. This is not rhetoric. It means that the MAH cannot discharge its external obligations by pointing to internal divisions of labour. However the manufacturer and the MAH allocate tasks between themselves in a private agreement, the NMRA’s counterparty is always the MAH. If a quality incident occurs, if a shipment is delayed, or if a document is missing, the authority will look to the entity named on the certificate. Manufacturers should therefore evaluate a proposed MAH on its ability to absorb this breadth of duty, not only on its willingness to sign.

Insight two: the notification duty on regulatory status in other countries is inherently cross-border. If the product is rejected or withdrawn in another market, the MAH must notify. This requires the manufacturer to maintain an internal mechanism that tracks global regulatory status and feeds it to the MAH; without such a mechanism the MAH has no practical way to comply. The obligation therefore reaches into the manufacturer’s own quality and regulatory systems, and it should be reflected in the technical agreement rather than left as a general promise.

Insight three: cGMP compliance status is also within the scope of notifiable changes. This confirms that continuing compliance of the quality system is part of the MAH’s ongoing duty, not something examined only once at the time of application. A manufacturer that upgrades, reorganises, or re-certifies its quality system should treat the event as a notifiable change for the Sri Lankan authorization, and the MAH should be positioned to transmit that notification without delay.

4. Practical recommendations

• When signing the MAH agreement, translate the official responsibility list clause by clause into contract terms: which party collects information, which party signs and submits notifications, what the response period is in working days, and who bears the cost.
• Build a responsibility mapping table covering every duty in the official list, and attach it to the agreement; this table is the basis for all later collaboration and the manufacturer’s main instrument of self-protection.
• Include a warranty that all data submitted is accurate, complete, and truthful, mirroring the applicant’s full responsibility for information.
• Establish a documented process for notifying changes in regulatory status in other countries, with the manufacturer obliged to inform the MAH within an agreed period.
• Extend the same process to cGMP compliance changes, so that quality system events are notified as a matter of routine.
• Agree in advance on response times and cost allocation for supplementary data requests raised during the NMRA review.
• Keep the 5-year certificate validity in view when drafting renewal and exit clauses, so that responsibilities remain clear across the full certificate cycle.

5. Verification checklist

• □ The MAH has provided Sri Lankan business registration documents
• □ The agreement maps the official responsibility list clause by clause
• □ A warranty clause on the truthfulness of data is in place
• □ A notification process for regulatory status in other countries has been established
• □ The obligation to notify cGMP status changes has been agreed
• □ Response times and cost allocation for deficiency responses have been agreed

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across South Asia, including Sri Lanka. Our team prepares dossiers to NMRA expectations, manages submissions and deficiency responses, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com

Regulatory information verified as of 28 October 2026.