Distributor control for MDR / ISO 13485 / MDSAP

evan_kim90

Involved In Discussions
Hi All,

I have a question regarding distributor control under MDR, ISO 13485, and MDSAP.

During a recent discussion with my auditor, it was mentioned that under MDR, distributors may need to be treated as critical suppliers. Could you please confirm if there is a specific regulatory section addressing this requirement?

Additionally, how do other standards like ISO 13485 and MDSAP view the control and management of distributors? I would appreciate any insights or practices on how you manage distributor relationships and compliance within your organizations.

Thanks in advance!
 

Nichole F

Involved In Discussions
I have not heard of a requirement to treat Distributors as critical suppliers for MDR, but you will likely want to have supplier controls of some sort. At minimum, a quality agreement outlining roles and responsibilities is appropriate in most cases.

For ISO 13485, the standard leaves that part open to the manufacturer. MDSAP (at least for Canada) you will want a minimum of a quality agreement on file. Additionally, your distributors for Canada are to be listed on your approved supplier list and controls as suppliers (you determine appropriate risk level). See MDSAP Chapter 1, Task 5-Extent of Outsourcing

"Roles and responsibilities of regulatory correspondents, importers, and distributors shall be clearly documented in the QMS and qualified as suppliers and controlled as appropriate."
 

evan_kim90

Involved In Discussions
I have not heard of a requirement to treat Distributors as critical suppliers for MDR, but you will likely want to have supplier controls of some sort. At minimum, a quality agreement outlining roles and responsibilities is appropriate in most cases.

For ISO 13485, the standard leaves that part open to the manufacturer. MDSAP (at least for Canada) you will want a minimum of a quality agreement on file. Additionally, your distributors for Canada are to be listed on your approved supplier list and controls as suppliers (you determine appropriate risk level). See MDSAP Chapter 1, Task 5-Extent of Outsourcing

"Roles and responsibilities of regulatory correspondents, importers, and distributors shall be clearly documented in the QMS and qualified as suppliers and controlled as appropriate."
Thanks for the great information. I do not know why auditor said it but he said it has to be critical supplier but I cannot find any resource for that.
 

Ronen E

Problem Solver
Moderator
Is a distributor even a supplier?...
A supplier is getting paid to supply a product or a service.
Are you paying your distributors?
Typically, a distributor buys products from you, and on-sells them. They pay you.
If they don't pay you for the products they help you sell, and instead you pay them for that service, they are not distributors but agents. If they also help you with logistics (e.g. store shipped product for further distribution, while not owning that product) they provide a service (in that example logistics/storage), and in that case they are also suppliers. But not distributors.
A distributor is IN the supply chain, in terms of product ownership. So logically they are customers, not suppliers.

Nothing in the above is to say that standards / schemes are necessarily consistent and that auditors will always follow a consistent rationale or apply logically-independent thinking. The opposite is definitely possible.
 

yodon

Leader
Super Moderator
Is a distributor even a supplier?...
IMO, yes, in the sense that they need to be qualified, approved, and managed. They handle product, field feedback, deal with nonconforming product, etc. I always execute a quality agreement with them. Whether or not they are "critical" is I guess still up for debate.
 

Ed Panek

QA RA Small Med Dev Company
Leader
Super Moderator
Distributors are in the direct workflow of...

Distributors that have received complaints or reports from healthcare professionals, patients or users about suspected incidents related to a device they have made available, shall immediately forward this information to the manufacturer and, where applicable, the manufacturer's authorised representative, and the importer. They shall keep a register of complaints, of non-conforming devices and of recalls and withdrawals, and keep the manufacturer and, where available, the authorised representative and the importer informed of such monitoring and provide them with any information upon their request

6.Distributors shall, upon request by a competent authority, provide it with all the information and documentation that is at their disposal and is necessary to demonstrate the conformity of a device.

Because distributors are in the direct pathway of complaints and recalls and are reportable to competent authorities directly I think they arent a low risk supplier. IOW a failure at a distributor to log complaints and control NC materials is a risk to patients. I don't know if they qualify as high risk but I think low risk is questionable.
 
Last edited:

Ronen E

Problem Solver
Moderator
IMO, yes, in the sense that they need to be qualified, approved, and managed. They handle product, field feedback, deal with nonconforming product, etc. I always execute a quality agreement with them. Whether or not they are "critical" is I guess still up for debate.
I have zero qualms with your description of what they do or your statements regarding how to go about them, but if we wish to be consistent with our definitions, they are not suppliers (unless you have a different definition for that), hence the are definitely not "critical suppliers" (a subset of suppliers).

One certainly can (and maybe should) manage distributors similar to the way suppliers are managed, and if that makes good business/quality sense - all the better. But to me regulatory affairs (certainly official regulatory auditing) should be about consistent application of definitions and rules.
 

Ronen E

Problem Solver
Moderator
Distributors are in the direct workflow of...

Distributors that have received complaints or reports from healthcare professionals, patients or users about suspected incidents related to a device they have made available, shall immediately forward this information to the manufacturer and, where applicable, the manufacturer's authorised representative, and the importer. They shall keep a register of complaints, of non-conforming devices and of recalls and withdrawals, and keep the manufacturer and, where available, the authorised representative and the importer informed of such monitoring and provide them with any information upon their request

6.Distributors shall, upon request by a competent authority, provide it with all the information and documentation that is at their disposal and is necessary to demonstrate the conformity of a device.

Because distributors are in the direct pathway of complaints and recalls and are reportable to competent authorities directly I think they arent a low risk supplier. IOW a failure at a distributor to log complaints and control NC materials is a risk to patients. I don't know if they qualify as high risk but I think low risk is questionable.
Distributors certainly have a very important role in PMS, no argument there. But that still doesn't make them "suppliers".

Personally I dislike the use of terms such as "critical" or "high/low risk" unless they are accompanied by crystal-clear definitions and categorization rules - which is sadly not usually the case!

I have already written countless posts in various threads here about "critical", in all sorts of contexts, so I feel a bit like a broken record.

:deadhorse:
 

Ed Panek

QA RA Small Med Dev Company
Leader
Super Moderator
Distributors certainly have a very important role in PMS, no argument there. But that still doesn't make them "suppliers".

Personally I dislike the use of terms such as "critical" or "high/low risk" unless they are accompanied by crystal-clear definitions and categorization rules - which is sadly not usually the case!

I have already written countless posts in various threads here about "critical", in all sorts of contexts, so I feel a bit like a broken record.

:deadhorse:
In terms “what system do we have to assure our distributors are compliant with MDR” the supplier control part of a QMS is an option. Its not the only one but it might make sense in some cases.
 

Ronen E

Problem Solver
Moderator
In terms “what system do we have to assure our distributors are compliant with MDR” the supplier control part of a QMS is an option. Its not the only one but it might make sense in some cases.
Which MDR clause obliges a Manufacturer to "assure their distributors are compliant with the MDR"?
 
Top Bottom