Medical Device Recall and MAH Coordination in Sri Lanka

1. Key takeaways

Medical device recalls in Sri Lanka are managed by the Market Control Division of NMRA and cover both the public and the private sector; the statutory obligations of the marketing authorisation holder (MAH) are to report adverse events and quality problems to NMRA, to maintain complete distribution records, to assist investigations, and to coordinate mandatory recalls under NMRA instruction — four obligations in total. The combined effect of these provisions is unambiguous: the MAH is the executing party of a recall, not a bystander. When the regulator decides that a product must leave the market, it is the MAH’s records that locate the goods, the MAH’s channels that reach the customers, and the MAH’s procedures that close the loop.

The four obligations also work as a set. Reporting keeps the regulator informed; distribution records make the product findable; investigation assistance supplies the technical facts; and recall coordination converts the decision into recovered stock. Weakness in any single obligation undermines the other three — a report filed without records cannot be acted upon, and records without a willingness to assist investigations turn the recall into a confrontation. The checklist in section five is therefore built around the four duties rather than around product characteristics.

2. Legal basis

The recall framework as published on the NMRA website is summarised below. Each MAH obligation is listed separately because each one is examined independently when a recall event is reviewed. The final row on public communication is included deliberately: it shows that the regulator addresses the market directly, which is precisely why the MAH’s own notifications must stay consistent with the official ones.

3. Expert insights

Insight one: distribution records are the execution foundation of a recall. The rule elevates the maintenance of accurate, detailed distribution records enabling full traceability into an independent obligation of the MAH, stated alongside the recall duty itself. This shows that without a ledger, a recall cannot be executed in practice: a recall instruction that arrives from the regulator must be answered with batch numbers, quantities, customers and delivery dates, and every one of those answers comes from the distribution records. A company that cannot produce them within hours has, functionally, already failed the recall before it begins. Record-keeping is therefore not an administrative afterthought; it is the pre-condition on which the other three obligations depend.

Insight two: mandatory recall is an action taken under NMRA instruction. This signals that the power to initiate a recall rests with the regulator, while the MAH’s role is coordination and execution. The distinction matters for internal planning. Companies familiar with markets where voluntary recalls dominate sometimes build procedures that begin with an internal risk committee and end with a self-initiated notification. In Sri Lanka the published model is the reverse: the instruction arrives from NMRA, and everything the MAH does afterwards — tracing, notifying, retrieving, reporting completion — happens within that instruction. Procedures should be written to receive and execute an external directive efficiently, not only to originate one internally.

Insight three: both public and private sectors are covered. This means that wherever the goods flow — public hospitals or private channels — they fall within the recall scope, and the traceability ledger must cover every channel in which the product circulates. A distribution record that captures only the direct distributor, but not onward sales to private clinics or sub-dealers, is incomplete in exactly the direction most likely to be probed during an investigation. Full traceability is the stated standard, and the obligation belongs to the MAH even where the physical customers sit two or three steps down the chain. Distribution agreements should therefore include an explicit duty on the distributor to pass traceability data back to the MAH.

4. Practical recommendations

The recall plan GRZAN prepares for clients contains four parts: classification criteria (which situations trigger a recall and which call only for a field correction), notification templates (addressed to NMRA, to distributors and to healthcare institutions separately), a traceability procedure (locating the flow of goods by batch), and closing criteria (how completed correction is confirmed). This documentation is not needed on ordinary days, but it must be finalised before the first shipment leaves the warehouse. Drafting it after a problem arises means drafting it under regulatory pressure, with real batches outstanding and no time to verify contact lists or template wording. The four parts should be reviewed whenever the distribution network changes, and the contact details inside the notification templates should be revalidated at least annually so that a recall instruction received today can be answered today. In our experience the companies that manage recalls well are not those with the longest procedures, but those whose batch-level records, template texts and contact lists are current on the day the instruction arrives.

5. Verification checklist

• □ Recall classification and trigger criteria have been defined
• □ Three sets of notification templates are ready: for NMRA, for distributors and for healthcare institutions
• □ A batch-level, all-channel traceability mechanism has been established
• □ Criteria for completion of correction and closure have been defined
• □ The party bearing recall costs has been agreed in writing
• □ A person responsible for public communication has been designated

Regulatory information verified as of 28 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across South Asia, including Sri Lanka. Our team prepares dossiers to NMRA expectations, manages submissions and deficiency responses, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com