US Medical Device Distributors: FDA Expectations for Distributors and Manufacturers

By Sarah Fitzgerald

Medical device distributors play an important role in the healthcare supply chain by delivering medical devices from manufacturers to end users like healthcare providers and patients. Distributors should understand the U.S. Food and Drug Administration (FDA) requirements, and manufacturers should evaluate distributors as suppliers of distribution services before working with them in alignment with FDA expectations. This article discusses both perspectives. 

Overview of medical device distributors: Standard distributors, private-label distributors and distributors that are also initial importers

Medical device distributors are companies that are responsible for the storage and distribution of medical devices but do not perform regulated activities such as relabeling or complaint review. There are three main types of medical device distributors: 

• Standard distributors that only store and distribute a device
• Private-label distributors that work with the manufacturer to apply private branding to the device labeling 
• Distributors that also are the initial importers of medical devices brought into the U.S. 

All medical devices imported into the U.S., except software as a medical device (SaMD) downloaded directly by the user, must be associated with an initial importer. All distributors must meet certain general requirements, and those conducting additional activities may need to comply with additional requirements. This article discusses direct and indirect U.S. FDA expectations. Additional requirements, such as those from individual states, may also apply and should be considered. 

Requirements for medical device distributors

A medical device distributor is generally not regulated directly as a manufacturer by the FDA because it does not modify a device or its labeling, but instead receives, stores and ships medical devices. This means that distributors do not need to meet the same FDA requirements that apply to manufacturers. However, as part of the medical device supply chain, distributors should still maintain documentation controls, record retention controls, handling and storage controls, a process for adequately handling nonconforming products, and a process for handling customer feedback. If a distributor is distributing devices that are implants or intended to support or sustain life and therefore subject to special tracking requirements, more detailed device distribution tracking requirements may apply. These requirements are generally applied indirectly. Rather than working directly with the FDA, distributors generally are held to FDA requirements through manufacturers’ supplier controls.

Because this regulation is indirect, some distributor responsibilities are often handled in a relatively minimal way. For example, distributors often forward complaints to the manufacturer rather than evaluating them in detail. Nonetheless, it is critically important that relevant adverse events are reported to the FDA in a timely manner. 

A private-label distributor works with a manufacturer to include the distributor’s branding information while the manufacturer is responsible for including all required information and excluding inappropriate (off-label) information. The manufacturer is ultimately responsible for what is acceptable, and any such content must align with the manufacturer’s authorization, such as a 510(k) clearance. In other words, the private-label distributor may request that something be included, but the manufacturer may not be able to allow it under its current FDA authorization. A private-label distributor must comply with the same requirements as a standard medical device distributor. 

It is important to note that a company that physically conducts relabeling or repackaging operations is considered a relabeler/repackager in addition to being a distributor. A company with ultimate responsibility for labeling is either a specification developer or manufacturer. Additionally, a company that maintains complaint files per FDA requirements, including review of complaints for reportable adverse events and recalls, is considered a complaint file establishment. Companies conducting these additional operations are not considered only private-label distributors; they are also considered types of manufacturers and must comply with various additional FDA requirements. Most of these requirements are similar to those for an initial importer, as described in the following paragraphs, but in many cases these companies have additional obligations. Further details are outside the scope of this article. 

Requirements for initial importers

An initial importer is a facility located in the U.S. that is responsible for the imported device’s compliance with regulatory requirements. Initial importers are usually also distributors, but they are not required to serve as distributors when medical devices are drop-shipped. For the purposes of this article, the discussion related to initial importers assumes that they are also distributors. An initial importer must comply with significant FDA requirements beyond those that apply to standard distributors or private-label distributors. Requirements include implementing a quality management system (QMS) that covers the activities performed in compliance with Title 21 of the Code of Federal Regulations (CFR), particularly 21 CFR 820, as well as ISO 13485:2016. The QMS must cover:

• Medical device adverse event reporting (21 CFR 803 and ISO 13485:2016 Section 8.2.3) 
  • An initial importer only needs to report when a device caused or contributed to a serious adverse event (including a death) and does not need to report malfunctions. It may discuss with the manufacturer whether an event is reportable but ultimately must make its own determination.
  • An initial importer must report both to the FDA and to the manufacturer. 
• Medical device recalls (21 CFR 806)
• Establishment registration (21 CFR 807)
  • This includes paying an annual fee to the FDA. For 2027, the fee is $13,785 (USD).
  • An initial importer does not need to list the devices it imports; instead, a link to the device manufacturer is established through the FDA system.
• Documentation and records retention (ISO 13485:2016 Section 4.2 and 21 CFR 820.35)
  • This should include records of distribution identifying customers, product identities (including lot number, serial number and/or unique device identifier (UDI), as appropriate), shipment dates and quantities. 
• Management responsibility establishment (ISO 13485:2016 Section 5)
• Resource management (ISO 13485:2016 Section 6)
• Customer communication (ISO 13485:2016 Section 7.2.3)
• Purchasing controls (ISO 13485:2016 Section 7.4)
• Service provision (ISO 13485:2016 Section 7.5)
  • This includes preserving the product and maintaining appropriate storage conditions. 
• Control of monitoring and measuring equipment (ISO 13485:2016 Section 7.6)
• Monitoring, analysis and improvement (ISO 13485:2016 Section 8.1)
• Monitoring and measurement, including feedback analysis and internal audits (ISO 13485:2016 Section 8.2)
• Control of nonconforming product (ISO 13485:2016 Section 8.3)
• Analysis of data (ISO 13485:2016 Section 8.4)
• Improvements/corrective and preventive actions (CAPA) (ISO 13485:2016 Section 8.5)

For certain devices, there may be additional requirements. It is important to recognize that the FDA holds an initial importer responsible for medical devices, so these companies should have a procedure for evaluating and documenting compliance. 

While it is not strictly an FDA requirement, standard distributors and private-label distributors may also consider implementing a quality system aligned with ISO 13485:2016 and 21 CFR 820.

FDA inspection of medical device facilities

The FDA has the authority to inspect any facility that conducts activities within the medical device supply chain. However, the FDA prioritizes inspections based on risk and rarely inspects standard distributors or private-label distributors. Initial importers have additional responsibilities and are more likely to be inspected, but they are still less likely to be inspected than many other establishment types such as specification developers and manufacturers.

Before accepting new responsibilities, a company should determine whether doing so would change its establishment type under FDA definitions. A change in activities conducted by a facility can significantly change regulatory requirements. A company should determine its regulatory requirements based on the activities it performs, not solely on how it describes itself commercially.

Distributors are primarily governed by the supplier controls of their medical device manufacturer partners rather than by direct FDA requirements. Quality agreements and legal contracts between the companies document expectations and help support the safety and effectiveness of devices throughout the supply chain. 

Manufacturer considerations when working with distributors

From the manufacturer’s perspective, a distributor (whether a standard distributor, private-label distributor or initial importer) is a supplier providing distribution-related services. The distributor may also be providing other services. Therefore, the manufacturer must apply appropriate supplier (purchasing) controls to its distributors in alignment with ISO 13485:2016, Section 7.4.1. Specifically, the manufacturer must establish criteria based on the supplier’s ability to provide services that meet the organization’s requirements, supplier performance, the effect of the service on the medical device and the risk associated with the medical device. Additionally, the manufacturer must monitor and reevaluate those suppliers periodically. 

Although the FDA does not dictate specific supplier qualification methods, some considerations may include certification to ISO 13485 or ISO 9001, manufacturer review of relevant procedures, references from other customers working with the distributor, on-site or remote audits, recall readiness assessments, and quality agreements or contracts between the companies. 

Manufacturers should pay particular attention to the distributor’s ability to meet requirements related to documentation and record retention, handling and storage (including controlled storage conditions when necessary), handling nonconforming products and handling customer feedback in a timely manner. Additionally, for an initial importer, manufacturers should assess whether the importer has the capability to meet FDA requirements for establishment registration, complaint review, adverse event reporting and assistance in the case of a device recall or correction. A quality agreement between the companies should address these requirements clearly. 

One of the most important aspects of such agreements is how the distributor will assist with recalls and corrections. While the manufacturer bears primary responsibility for initiating and managing recalls, distributors usually possess distribution records and maintain customer relationships, so their participation is critical to the effective execution of a recall or correction. Distributors may need to help identify affected customers, forward recall communications, facilitate product recovery and support effectiveness checks. How this will be handled should be included in a quality agreement between the companies.

For manufacturers working with a private-label distributor, it is important to keep in mind that the manufacturer must ultimately control the device and its labeling. While the private-label distributor may request modifications, any modifications must align with the manufacturer’s FDA authorization, and the manufacturer must retain ultimate authority to approve or deny those requests. This should be clearly stated in the agreement between the companies. 

For manufacturers working with initial importers, coordination between the manufacturer and initial importer on complaint review and adverse event reporting is very important, especially if one company believes an event is not reportable and the other believes it should be reported. While an initial importer is only required to report a serious injury or death, manufacturers are also required to report when a device malfunctions in a manner that would be likely to cause or contribute to a serious injury or death if it were to recur. Therefore, a manufacturer should understand that it may submit additional reports to the FDA that the initial importer would not. However, there should generally be alignment on reporting events involving a serious injury or death. The FDA may investigate such a discrepancy in greater detail during an inspection, even though each company is responsible for its own evaluation and reporting. Therefore, coordination and a shared understanding of what each establishment is reporting are important, and these expectations should be addressed in a quality agreement between the companies.

Additionally, there are requirements related to device listing that a manufacturer must address. A manufacturer working with a private-label distributor must include the private brand name in its device listings. A manufacturer working with an initial importer must link the devices to the initial importer in the FDA registration system. 

Concluding remarks

Medical device distributors play an important role in the healthcare supply chain by delivering medical devices from manufacturers to end users such as healthcare providers and patients. Some distributors also take on additional responsibilities, such as being an initial importer. FDA requirements for standard distributors and private-label distributors are generally indirect, arising from requirements for manufacturers to establish appropriate supplier controls. Direct FDA requirements apply to distributors that are also initial importers, including having a QMS that covers relevant activities and registering the establishment with the FDA. Distributors play a critical role not only in helping devices reach intended users but also in handling customer feedback and maintaining device traceability for correction and recall activities. 

Emergo by UL supports both distributors and manufacturers with FDA regulatory and quality expectations, including establishing a QMS, conducting supplier audits and triaging complaints to determine whether they may meet reportability requirements. Emergo also supports manufacturers in identifying and establishing relationships with distributors.