Changing Device Distributors: Who Keeps Complaint and Traceability Files?

Copy the files; the outgoing party still keeps them

When a medical device manufacturer terminates an exclusive or wholesale distributor agreement, operating leadership frequently approaches the transition as a conventional commercial handoff: revoke software portal access, ship remaining inventory to a third-party logistics hub, and demand that the outgoing partner transfer its complaint logs and customer rosters before purging its servers. That dump-and-delete model leaves the manufacturer without an independent copy of the files it needs for PMS, vigilance, and recall, and it asks the outgoing operator to destroy records that U.S., EU, and Canadian post-market rules still require that operator to keep.

The definitive answer to the custody question is grounded in statutory law: Both parties keep the files. Distributor termination is legally a copy-plus-retain event, never a dump-and-delete transfer. Regulatory authorities—including the U.S. Food and Drug Administration (FDA), European Union national Competent Authorities, and Health Canada—place non-delegable record-keeping and vigilance obligations directly on economic operators that make devices available within their borders. A commercial termination, breach of contract, or territory non-renewal dissolves the business relationship, but it does not extinguish statutory post-market accountability for units distributed during the active contractual term.

For medical device regulatory affairs and quality assurance (RA/QA) teams, successful channel transition requires executing a dual-track custody protocol. First, the manufacturer must obtain a complete, retrievable electronic copy of the outgoing partner's complaint registers, consignee logs, and unique device identification mappings before cutover, with a documented lawful basis for any complainant or patient identifiers. Second, the manufacturer's quality agreement must instruct the outgoing distributor to keep its own historical archives for the applicable statutory retention clocks at its principal business establishment. An incoming distributor's newly initialized enterprise resource planning (ERP) system or electronic quality management system (eQMS) does not satisfy the manufacturer's 21 CFR 820.35 / ISO 13485:2016 8.2.2 file or the outgoing party's own retention duty.

This guide maps those custody rules for device manufacturers, distributors, and importers facing a commercial transition. It details statutory requirements under 21 CFR Parts 803, 806, 820, and 821; EU MDR 2017/745 Articles 10, 12, 13, 14, 25, and 27; and Canadian Medical Devices Regulations (SOR/98-282) sections 52 to 58. It outlines the copy-plus-retain pack, flags privacy limits on patient and complainant identifiers, and describes an operational mock-recall retrieval test before cutover. For foundational frameworks on complaint handling and surveillance systems, review our guides on Medical Device Complaint Handling: FDA, ISO 13485 & EU MDR Requirements and Post-Market Surveillance for Medical Devices: The Complete Guide. This guidance addresses regulatory quality compliance and does not constitute individualized legal advice or an Authorised Representative transfer agreement.

flowchart TD
    subgraph Transition["Channel Transition Trigger"]
        A["Commercial Termination of Distributor"]
    end

    subgraph DualCustody["Statutory Dual Custody (Copy-Plus-Retain)"]
        B["Manufacturer Independent Central Custody
- 21 CFR 820.35(a) & ISO 13485:2016 8.2.2
- EU MDR Art 10(8) & Art 25(1)
- Canada SOR/98-282 s. 52 & s. 57"]
        C["Outgoing Distributor Archival Custody
- 21 CFR 803.18(d) Principal Establishment
- EU MDR Art 14(5) & Art 25(2) (10/15-Yr Clock)
- Canada SOR/98-282 s. 55 Useful-Life or 2-Year Clock"]
    end

    subgraph CutoverPackage["Pre-Cutover Handover Package"]
        D["Open & Closed Incident Dossiers"]
        E["Lot / Serial / UDI-to-Consignee Maps"]
        F["Class III Implant UDI Stores & Tracking Records"]
        G["Documented Post-Exit Forwarding Protocol"]
    end

    subgraph Verification["Cutover Verification Gate"]
        H["Mock Recall Retrieval Test (Copied Files; Firm Recall Clock)"]
        I["Incoming Distributor Starts Fresh Register (New Units Only)"]
    end

    Transition --> CutoverPackage
    CutoverPackage --> B
    CutoverPackage --> C
    CutoverPackage --> H
    H --> I

Name the outgoing party’s legal role before you name the file owner

Before assigning document custody or drafting transition schedules, manufacturers must establish the exact statutory classification of the outgoing counterparty in each target market. In international device commercialization, the colloquial term 'distributor' frequently masks complex, overlapping regulatory roles. A commercial entity operating under an 'exclusive distribution agreement' may simultaneously function as an importer of record, a licensed establishment holder, an authorized repackager, or a contracted logistics provider. Conflating these distinct legal identities creates severe regulatory non-compliance.

In the United States, 21 CFR 803.3 establishes rigorous boundaries between distributors, importers, and manufacturers:

• Distributor: Defined under 21 CFR 803.3 as any person other than the manufacturer or importer who furthers the marketing of a device from the original place of manufacture to the person who makes final delivery or sale to the ultimate user, but who does not repackage or otherwise change the container, wrapper, or labeling of the device or device package.

• Importer: Defined under 21 CFR 803.3 as any person who imports a device into the United States and who furthers the marketing of a device from the original place of manufacture to the person who makes final delivery or sale to the ultimate user, but who does not repackage or otherwise change the container, wrapper, or labeling.

• Manufacturer by Relabeling: 21 CFR 803.3 specifies that if an entity repackages or otherwise changes the container, wrapper, or labeling of the device or device package, that entity is considered a manufacturer as defined in Part 803. That sentence does not, by itself, make the same person a manufacturer under 21 CFR Part 820. An outgoing partner that relabeled or re-boxed devices cannot treat its files as records-only 803.18(d) distributor incident files; it has manufacturer MDR duties under Part 803. QMSR complaint-record duties in 21 CFR 820.35 apply only if that person is a manufacturer within Part 820's scope.

Within the European Union, Regulation (EU) 2017/745 (MDR) strictly delineates economic operator categories under Article 2:

• Importer (Article 2(33)): Any natural or legal person established within the Union that places a device from a third country on the Union market.

• Distributor (Article 2(34)): Any natural or legal person in the supply chain, other than the manufacturer or the importer, that makes a device available on the market, up to the point of putting into service.

A common operational error in European channel transitions is attempting to delegate an outgoing importer's legal obligations to an incoming partner. The Medical Device Coordination Group guidance MDCG 2021-27 Rev.1 (Questions and Answers on Articles 13 & 14 of MDR/IVDR) eliminates any ambiguity on this point: while operational activities (such as physical storage or transport) may be subcontracted, legal responsibilities cannot be delegated to another importer, distributor, or upstream operator. An outgoing EU importer remains legally responsible for the compliance of devices it introduced to the Union market, including holding copies of the EU Declaration of Conformity and relevant CE certificates under Article 13(9).

In Canada, the Medical Devices Regulations (SOR/98-282) establish a parallel regulatory triad. Manufacturers, importers, and distributors each have independent obligations under sections 52 through 58, and each may require a Medical Device Establishment Licence (MDEL) for their establishment activities. For detailed comparative analyses of economic operator statutory mandates and distribution agreements, consult our specialized overviews on Medical Device Economic Operator Duties Compared: EU MDR, NZ, Singapore, Canada, SFDA, EU MDR Importer & Distributor Obligations: Complete Guide to Articles 13, 14, and 16, and Medical Device Distribution Agreements: Regulatory Clause Guide.

US complaint files: 803.18(d) for distributors, 820.35 for manufacturers

In the United States, managing complaint files during channel termination requires uncoupling the distributor's statutory incident-file duty from the manufacturer's central quality system obligations. Many regulatory professionals falsely assume that 21 CFR Part 803 applies only to manufacturers and user facilities, or that a terminated distributor may destroy its records once it ceases commercial operations. The codified text of 21 CFR 803.18(d) refutes this assumption entirely.

Under 21 CFR 803.18(d)(1), a medical device distributor must establish and maintain device complaint records, identified as device incident records, containing:

• Any written, electronic, or oral communication received or generated by the distributor that alleges deficiencies related to the identity (including labeling), quality, durability, reliability, safety, effectiveness, or performance of a device.

• Any evaluation of those allegations that the distributor actually performed, if any. 21 CFR 803.18(d)(1) does not require the distributor to decide FDA reportability or to file MDRs.

The regulation mandates that incident records must be filed by device name and backed up securely if maintained electronically. Most importantly, 21 CFR 803.18(d)(2) establishes an unyielding statutory retention clock:

• You must retain copies of the records for a period of two years from the date of inclusion of the record in the file or for a period of time equivalent to the expected life of the device, whichever is greater, even if you no longer distribute the device.

Furthermore, 21 CFR 803.18(d)(3) dictates that these incident files must be maintained at the distributor's principal business establishment and made promptly available to FDA investigators during establishment inspections. An outgoing distributor that purges its local file storage or hands over its sole hard drive to an incoming distributor commits a direct regulatory violation. However, this record-retention duty is balanced by 21 CFR 803.1(a), which expressly provides that a medical device distributor must maintain incident files but is not required to report those incidents directly to FDA. The distributor's regulatory exposure is archival and cooperative, whereas reporting liability rests with the manufacturer and importer.

In parallel, the manufacturer's central complaint-handling obligations operate under a completely separate statutory standard. On 2 February 2024, FDA published its final rule amending the Quality System Regulation into the Quality Management System Regulation (QMSR), which became effective on 2 February 2026 (89 FR 7496). Codified under 21 CFR 820.7, FDA formally incorporated by reference the international standard ISO 13485:2016 (Medical devices — Quality management systems — Requirements for regulatory purposes).

While ISO 13485:2016 Clause 8.2.2 establishes global requirements for complaint handling—including timely evaluation, justification for non-investigation, and correction—FDA enacted 21 CFR 820.35(a) to impose explicit record-content requirements on top of the standard. For every complaint that is reportable under Part 803, investigated, or manufacturer-evaluated, the manufacturer's file must record:

1. The device name;

2. The date the complaint was received;

3. Any unique device identifier (UDI) or universal product code (UPC) and other device identification;

4. The complainant's name, address, and telephone number;

5. The nature and details of the complaint;

6. Any correction or corrective action taken; and

7. Any reply provided to the complainant.

Additionally, ISO 13485:2016 Clause 8.2.2 requires the exchange of relevant information with external parties whose activities contributed to the complaint. When changing distributors, the manufacturer cannot rely on an incoming territory partner's newly initiated register to satisfy 21 CFR 820.35(a) or Clause 8.2.2 for legacy units. The manufacturer must actively extract the outgoing distributor's raw complaint intake records, complainant contact details, and technical failure observations to complete its own central investigation dossiers. To review how QMSR requirements interface with post-market CAPA programs, see our technical gap analyses on QMSR Gap Analysis for ISO 13485 Companies: 50+ Item Checklist and CAPA for Medical Devices: Corrective and Preventive Action Complete Guide.

US traceability: consignees, UDI, tracked devices, and the 806.20 trap

Traceability at distributor exit represents the primary operational safeguard against catastrophic failure during product recalls and safety alerts. In U.S. distribution networks, device traceability is anchored by general QMSR distribution controls, statutory tracking orders under 21 CFR Part 821, and the distinct rules governing corrections and removals under 21 CFR Part 806.

Under the QMSR framework, 21 CFR 820.35(c) expands upon ISO 13485:2016 Clauses 7.5.1, 7.5.8, and 7.5.9 by requiring manufacturers to maintain distribution records that capture the Unique Device Identifier (UDI) for each individual medical device or batch. Complementing this, ISO 13485:2016 Clause 7.5.9.2 mandates that the organization require distributors of implantable medical devices to maintain distribution records to permit traceability and make those records available for inspection, including the specific name and address of the shipping-package consignee. Manufacturers must have direct, verifiable access to these consignee rosters to execute timely field corrections.

For devices subject to formal FDA tracking orders under section 519(e) of the FD&C Act, statutory custody rules become exceptionally rigid. Under 21 CFR 821.1(b), legal responsibility for complying with Part 821 rests solely with the manufacturer subject to the tracking order, and this responsibility cannot be altered, modified, or abrogated by contracts. However, when a distributor ceases commercial distribution of a tracked device, 21 CFR 821.1(d) defines the only explicit statutory assumption mechanism recognized in U.S. device regulations:

• A person who ceases distribution of a tracked device but continues other business operations remains legally responsible for continuing tracking of devices previously distributed, unless another person, affirmatively and in writing, assumes responsibility for continuing tracking of those devices.

• A person who permanently discontinues doing business must formally notify FDA and provide the agency with a complete set of tracking records.

• If an entity goes out of business entirely and another person acquires the right to distribute the tracked devices, that successor entity is deemed legally responsible for maintaining tracking records.

To enforce compliance during active and terminating engagements, 21 CFR 821.30(d) grants the device manufacturer the explicit legal authority to audit the tracking records of distributors, final distributors, and multiple distributors upon written request. Under 21 CFR 821.60, all tracked-device records must be preserved for the entire useful life of each tracked unit. For comprehensive guidance on FDA recall procedures and distributor data quality, consult our analyses on FDA Medical Device Recalls: Corrections, Removals, and Classification and GUDID Data-Quality Checklist: What Distributors Should Verify Before a Contract.

A widespread and dangerous misunderstanding among regulatory counsel involves the misapplication of 21 CFR 806.20. Section 806.20 governs records of corrections and removals that are not required to be reported to FDA under 806.10. Subsection 806.20(c) requires a manufacturer or importer who ceases manufacturing or importing to retain records for two years beyond expected device life, and states that if a new manufacturer or importer assumes responsibility, the records must be transferred to that new entity.

Industry operators frequently misquote 21 CFR 806.20(c) as legal authority that an outgoing wholesale distributor may transfer its complaint and distribution archives to an incoming distributor and purge its internal servers. This is a severe compliance error. The record-transfer rule in 806.20(c) applies strictly to changes in the legal identity of the manufacturer or importer of record (such as during a corporate acquisition or transfer of 510(k) ownership). It does not apply to a substitution of commercial distributors where the manufacturer remains unchanged. An outgoing wholesale distributor cannot invoke 806.20(c) to justify destroying its 803.18(d) incident archives or its distribution registers.

EU registers last 10 or 15 years; Article 12 is not the distributor exit rule

Under the European Union Medical Device Regulation (EU) 2017/745 (MDR), the regulatory regime governing distributor exits is characterized by strict economic-operator accountability, extended archival clocks, and a complete absence of distributor document-transfer mechanisms. Operating in the European internal market requires RA/QA leaders to discard assumptions borrowed from commercial contract law.

The post-market obligations of EU distributors are codified in Article 14(5) MDR. When a distributor receives complaints or reports from healthcare professionals, patients, or users regarding suspected incidents related to a device it has made available, it must:

• Immediately forward that information to the manufacturer and, where applicable, the manufacturer's authorised representative and the importer.

• Establish and maintain a formal register of complaints, of non-conforming devices, and of recalls and withdrawals.

• Keep the manufacturer, authorised representative, and importer informed of such post-market monitoring, and provide any requested information to enable comprehensive investigations.

In parallel, Article 13(6) MDR requires EU importers to maintain an independent register of complaints, non-conforming devices, recalls, and withdrawals, and to provide the manufacturer, authorised representative, and distributors with any information requested to facilitate investigation. Under Article 13(8), importers must immediately forward suspected-incident reports upstream. Under Article 13(9), importers are mandated to keep a copy of the EU Declaration of Conformity and relevant conformity certificates for the entire retention period defined in Article 10(8).

The duration of these post-market obligations is governed by the sweeping supply-chain identification requirements of Article 25 MDR. Article 25(1) compels distributors and importers to cooperate with manufacturers and authorised representatives to achieve an appropriate level of traceability. Under Article 25(2), economic operators must be able to identify to competent authorities:

1. Any economic operator to whom they have directly supplied a device;

2. Any economic operator who has directly supplied them with a device; and

3. Any health institution or healthcare professional to which they have directly supplied a device.

The retention clock for this supply-chain identification is explicitly tied to Article 10(8) MDR: economic operators must retain these records for at least 10 years after the last device covered by the EU Declaration of Conformity has been placed on the market. For implantable devices, the retention period is extended to at least 15 years. As clarified in MDCG 2021-27 Rev.1, distributor traceability must be sufficiently detailed to enable the immediate identification and contact of customers who received devices affected by a Field Safety Corrective Action (FSCA).

Traceability expectations are further refined by Article 27(8) MDR, which mandates that economic operators store and keep, preferably electronically, the UDI of devices they have supplied or received if those devices belong to Class III implantable devices (or device categories determined by Commission acts under Article 27(11)(a)). The coordination guidance MDCG 2022-7 (Questions and Answers on the UDI System, Question 3) provides crucial clarification: storing every UDI for all device classifications is not required by Union law, although storing UDIs remains a highly recommended operational tool for traceability. An outgoing distributor must preserve its Article 27(8) Class III implant UDI store for the full Article 10(8) duration; commercial cutover does not erase that statutory obligation.

A critical analytical contribution of this guide is resolving The Article 12 Fallacy. Many legal teams attempt to structure distributor terminations by analogy to Article 12 MDR, which establishes formal requirements for a change of Authorised Representative. Article 12 and its accompanying guidance, MDCG 2022-16, mandate a defined tripartite agreement addressing the mandate termination date, the run-out of the outgoing AR's name on labeling, the formal transfer of technical documentation, and the outgoing AR's post-mandate duty to forward incoming complaints.

There is no equivalent statutory transfer provision in the MDR for distributors or importers. Article 12 applies strictly to Authorised Representatives who act on behalf of non-EU manufacturers. A private contract cannot treat Article 12 as a distributor analogue, and it cannot extinguish Article 14(5) register duties or Article 25(2) identification duties as against a competent authority. The outgoing distributor remains the person who must keep its Article 14(5) register for units it made available, and must still identify Article 25(2) counterparties for the Article 10(8) period of 10 years after last placement (15 years for implants). To explore how FSCA procedures intersect with European distribution channels and how Authorised Representative transfers operate in parallel jurisdictions, see our guides on Field Safety Corrective Action (FSCA): EU MDR Vigilance Guide, Recall vs FSCA Compared: FDA 21 CFR 806, EU MDR, Brazil & Thailand, and Saudi SFDA MDMA Authorized Representative Transfer Playbook.

Canada: three parallel files, not one transferable MDEL binder

In Canada, medical device channel management is governed by the federal Medical Devices Regulations (SOR/98-282), overseen by Health Canada. Canadian post-market requirements are structured around a tripartite compliance model that places direct, non-fungible duties on manufacturers, importers, and distributors holding Medical Device Establishment Licences (MDELs).

The distribution record framework is codified in sections 52 through 56 of SOR/98-282:

• Section 52(1): The manufacturer, importer, and distributor shall each maintain a distribution record in respect of each device.

• Section 53: The distribution record shall contain sufficient information to permit complete and rapid recall of the device from the market.

• Section 55: The distribution record shall be retained for the longer of the projected useful life of the device or two years after the date the device is shipped.

• Section 56: Distribution records shall be maintained in a manner that will permit their timely retrieval.

Parallel to distribution logs, section 57 establishes complaint and problem-handling custody: the manufacturer, importer, and distributor shall each maintain records of reported problems relating to the performance or safety of a device, including all consumer complaints received after first sale in Canada, and all actions taken in response. Under section 58, each of these three parties must establish and implement documented procedures for effective and timely investigation of problems and for effective and timely recall.

Crucially, sections 52(2) and 57(2) provide explicit statutory carve-outs: distribution and complaint record obligations do not apply to retailers or to healthcare facilities distributing devices for use within their own facilities. Wholesale commercial distributors, however, remain fully bound. There is no statutory 'send-the-file-and-delete' mechanism in the Canadian regulations. An outgoing Canadian distributor that cancels its MDEL cannot transfer its historical section 52 and 57 custody to an incoming licensee and discard its archives.

This framework is reinforced by amendments registered 4 June 2026 and published in the Canada Gazette, Part II on 17 June 2026: SOR/2026-110 (Regulations Amending the Medical Devices Regulations (Establishment Licences)), which come into force on the 180th day after registration (1 December 2026). Until that date the pre-amendment attestation model still applies. After coming into force, manufacturers, importers, and distributors must establish, implement, and maintain documented procedures for distribution records (new s. 52(3)) and for investigation and recall (amended s. 58). Manufacturers and importers also receive explicit incident-reporting procedure duties under new s. 59(3)–(4).

The Regulatory Impact Analysis Statement explains that the amendments remove the requirement for a Canadian MDEL importer to import only from a foreign distributor that also holds an MDEL. Retailers and healthcare facilities without an MDEL still must import from a foreign distributor that holds an MDEL. That licensing change is not a records-transfer-on-exit rule and does not relieve an outgoing distributor of historical custody under sections 52 to 58. For detailed analysis of the Canadian licensing overhaul, see our comprehensive guide on Health Canada MDEL Phase 2: Foreign Distributor Exemption, Supplier Lists & GUI-0016.

The copy-plus-retain pack and a mock recall before cutover

Transitioning medical device distribution channels without a records gap requires turning the copy-plus-retain rule into a structured protocol. Manufacturer RA/QA teams should establish contractual and technical control well before commercial cutover. The protocol consists of assembling the copy-plus-retain pack, enforcing quality-agreement covenants, onboarding the successor partner with a clean register, and running an operational mock-recall retrieval test while the outgoing system is still live.

The Copy-Plus-Retain Pack must be formally delivered and verified prior to revoking system credentials. It encompasses four mandatory technical dossiers:

1. Lot-to-Consignee Traceability Registers: A retrievable electronic map of lot, serial, batch, and UDI to consignee (facility, delivery address, ship date, and a business contact), covering historical shipments and any remaining consignment inventory. Copy patient identifiers from 21 CFR 821 tracking files only where Part 821 requires them and only with a documented lawful basis.

2. Open and Closed Incident Files: Complete dossiers of communications that allege deficiencies related to identity, quality, durability, reliability, safety, effectiveness, or performance, plus any evaluations the outgoing party performed. Warranty returns, service tickets, and inquiries belong in that pack only when they meet that complaint or incident definition.

3. Specialized Tracking Registers: For U.S. tracked devices, the tracking extracts the manufacturer may audit under 21 CFR 821.30(d), including UDI, lot, or serial and, where collected, physician and patient fields, stored with privacy controls. For EU class III implantables, a copy of the Article 27(8) UDI store for units that party supplied or received.

4. Regulatory Certifications & Customs Entries: For outgoing EU importers, copies of the EU declaration of conformity and relevant Article 56 certificates they must keep under Article 13(9) for the Article 10(8) period, plus import-entry records needed for their own importer file.

To govern the post-commercial period, the parties' Quality Agreement or Termination Protocol must incorporate an enforceable Post-Termination Forwarding Obligation. Customers and clinical users often continue reporting device issues to a former distributor for months or years after a channel change. The quality agreement should obligate the outgoing party to forward any incoming complaint, suspected incident, or authority communication about units it previously made available. EU MDR Articles 13(8) and 14(5) already require immediate forwarding of suspected-incident reports to the manufacturer and, where applicable, the authorised representative and importer; do not invent a substitute clock. For other jurisdictions, use the firm's documented complaint-intake timeline, not a generic 48- or 72-hour SLA presented as law. The agreement should also require the outgoing distributor to maintain its archives securely and grant the manufacturer and inspecting authorities access during regulatory audits.

When onboarding the incoming distributor, manufacturers must maintain clean regulatory separation. The successor distributor's registers must be initialized to record only the specific inventory lots and serial numbers that it places on the market or distributes. An incoming distributor must never inherit or adopt the predecessor's historical compliance registers. Blending legacy distribution logs into the new distributor's ERP system compromises data integrity and obfuscates legal chain-of-custody during vigilance audits.

The operational gateway to channel cutover is the Mock Recall Cutover Verification. Before the outgoing distributor's portal access is terminated and final commercial settlements are executed, manufacturer QA should initiate a timed tabletop mock recall. The manufacturer selects random historical lot and serial numbers distributed by the outgoing partner and tests whether the manufacturer's central team can retrieve a complete consignee list, ship dates, and open complaints for those lots within the firm's documented recall timeline without logging into the outgoing distributor's live system. If the manufacturer cannot successfully identify and contact all simulated consignees using its copied records, cutover must be paused until data discrepancies are rectified.

Finally, RA/QA teams must flag data protection and patient privacy boundaries when duplicating records. 21 CFR 821.30 patient fields and 21 CFR 820.35(a) complainant contact fields can engage HIPAA, GDPR, or PIPEDA. This article is not privacy advice: copy only what the named device rules require the manufacturer to hold, record the lawful basis, and keep patient identifiers out of examples and generic ZIP transfers.

By treating distributor exit as a rigorous post-market regulatory control rather than an administrative offboarding, device manufacturers maintain unbroken traceability, protect patient safety, and ensure seamless compliance across all operational jurisdictions. For complementary standards on quality documentation and change control, consult our guide on Document Control for Medical Devices: FDA, ISO 13485, and EU MDR.