Medical Device Kits: Who Assembles, Labels, and Takes Responsibility?

Three firms can be responsible for one kit

When finished medical devices are assembled, packaged, or sterilized into a single procedural tray or commercial kit for United States distribution, regulatory responsibilities do not merge into whichever company owns the brand. Commercial contracts, quality agreements, and private-label distribution agreements frequently assign financial liability or customer-facing warranties, but they cannot reassign statutory duties under the Federal Food, Drug, and Cosmetic Act (FD&C Act). Under current Food and Drug Administration (FDA) regulations, three completely separate questions determine which entity bears each regulatory burden:

• Who must register and list? Under 21 CFR 807.20, registration and listing follow assembly, specification development for a second party, sterilizing or otherwise making a device for another person, and repackaging or relabeling. When one establishment assembles, packs, or sterilizes the kit and a different establishment initiates or develops its specifications, each of those establishments registers, lists, and pays the annual establishment registration fee.

• Whose name must appear on the label? Under 21 CFR 801.1, the label of a device in package form must conspicuously state the name and place of business of the manufacturer, packer, or distributor. If the named firm did not manufacture the kit, the name must be qualified by a phrase that states the connection, such as Manufactured for or Distributed by, or other wording that expresses the facts.

• Who is the Unique Device Identification (UDI) labeler? Under 21 CFR 801.3, the labeler is the person who causes a label to be applied to a device, or who causes that label to be replaced or modified, with the intent that the device will be commercially distributed without a later intended replacement or modification of the label. The labeler of a kit that must bear a UDI submits the kit information to the Global Unique Device Identification Database (GUDID) under 21 CFR 830.300.

Printing Manufactured for on the carton does not make the named firm the only establishment that must register, and it does not take a contract packager out of 21 CFR 807.20. FDA's chart places a kit assembler with manufacturers. A specification developer that contracts out the physical assembly remains subject to registration and listing under 807.20(a)(1). A quality agreement can set audit rights, complaint routing, and technical-data exchange. It does not replace the registration and listing that follow from the activity each firm performs.

Furthermore, the question of whether individual devices inside a sealed kit must bear their own UDI carriers is an entirely separate legal test governed by 21 CFR 801.30(a)(11) and FDA's April 26, 2019 guidance, Unique Device Identification: Convenience Kits. FDA expressly declared in the 2019 guidance that its interpretation of convenience kits for UDI purposes does not apply to the 1997 510(k) guidance, does not apply to in vitro diagnostic (IVD) kits subject to 21 CFR Part 809, and does not apply to combination products. Regulatory teams must evaluate registration, labeling, 510(k) status, and UDI marking as four distinct analyses.

flowchart TD
  Q["One kit raises three separate questions"]
  Q --> R["Registration and listing under 21 CFR 807"]
  Q --> N["Name on the label under 21 CFR 801.1"]
  Q --> U["UDI labeler under 21 CFR 801.3"]
  R --> R1["The assembler, contract maker, or sterilizer registers, lists, and pays the fee"]
  R --> R2["A different specification developer also registers, lists, and pays the fee"]
  R --> R3["A distributor that does not manufacture, repackage, or relabel does not register"]
  N --> N1["An unqualified name is allowed only when that firm manufactured the kit"]
  N --> N2["Otherwise the name is qualified so the connection is explicit"]
  U --> U1["The labeler is the person who causes the commercial label to be applied or modified"]
  U --> U2["Adding only a distributor name and contact information does not transfer the labeler duty"]

Match the contract to the registration row

Under 21 CFR 807.20(a), an owner or operator engaged in the manufacture, preparation, propagation, compounding, assembly, or processing of a device intended for human use must register its establishment and submit a device listing for each device entering commercial distribution. FDA's operational guidance chart, Who Must Register, List and Pay the Fee, establishes specific activity categories that trigger mandatory compliance. Kit assembly is explicitly classified under manufacturing operations, placing kit assemblers in the same operational category as finished-device manufacturers.

The activities are spelled out in the current text of 21 CFR 807.20(a). Paragraph (a)(1) is a person who initiates or develops specifications for a device that is to be manufactured by a second party. Paragraph (a)(2) is a person who sterilizes or otherwise makes a device for or on behalf of a specifications developer or any other person. Paragraph (a)(3) is a person who repackages or relabels a device. Assembly is named in the opening sentence of 807.20(a). FDA's Who Must Register, List and Pay the Fee chart places domestic kit assemblers on the manufacturer row under 807.20(a), and it places contract packagers on the contract-manufacturer row under 807.20(a)(2).

FDA's chart describes a specification developer as a firm that develops specifications for a device distributed under the establishment's own name but performs no manufacturing. The same definition includes a firm that also arranges for a contract manufacturer to make devices labeled with another establishment's name. That description is narrower than 807.20(a)(1). It is not an exemption for a private-label project. A firm that initiates or develops the kit specifications for a second party to manufacture registers and lists under (a)(1). Developing those specifications includes deciding which finished devices the kit contains and how they are configured. Printing another firm's name on the label does not remove the duty.

A contract packager or contract sterilizer that makes or sterilizes the kit for another person is in 807.20(a)(2). FDA's chart requires that establishment to register, list, and pay the fee. When the specification developer and the contract assembler are different establishments, each one registers and lists. The assembler cannot treat the other firm's listing as its own. The filing steps are in FDA Establishment Registration and Device Listing, and the activity rows are summarized in the FDA Establishment Registration Roles Lookup.

Read the chart beside the current section, because several of its subsection pins do not match the eCFR text checked for this article. The eCFR issue dated September 25, 2026 is a continuously updated unofficial edition, not the official legal edition of the CFR. In that text, the wholesale-distributor exemption is 807.20(c). There is no paragraph (c)(3). The chart's domestic-distributor row still cites 807.20(c)(3). Finished components and accessories packaged or labeled for commercial distribution for a health-related purpose are 807.20(a)(6). The chart's foreign-establishment row for that activity still cites 807.20(a)(5), which is the initial-importer paragraph. The same chart still cites complaint files to 21 CFR 820.198. That section is not in the current eCFR.

A foreign establishment that manufactures, prepares, propagates, compounds, or processes a kit imported or offered for import into the United States registers and lists electronically under 21 CFR 807.40(a). It names one US agent under 807.40(b). The agent resides or maintains a place of business in the United States and assists FDA communication and inspection scheduling. Naming the agent, or contracting with a US distributor, does not move the foreign establishment's registration to that agent or distributor. Under 807.40(c), a device may not be imported or offered for import unless it is listed and was manufactured, prepared, propagated, compounded, or processed at a registered foreign establishment. The exception stated in that paragraph is a device imported or offered for import under the investigational-device provisions of 21 CFR part 812. FDA's chart also assigns the establishment registration fee to foreign manufacturers, including kit assemblers. The import condition in 807.40(c) is registration and listing, not a separate fee receipt.

21 CFR 807.65(a) exempts a manufacturer of raw materials or components to be used in the manufacture or assembly of a device, when that manufacturer would not otherwise have to register. FDA's chart applies the exemption to components that are not otherwise finished devices and are distributed only to a finished-device manufacturer. The exemption stops at 807.20(a)(6). That paragraph covers components or accessories that are ready for a health-related purpose and are packaged or labeled for commercial distribution for that purpose. The regulation's examples include blood filters, hemodialysis tubing, and ophthalmic lens blanks. A supplier of unlabeled tubing, gaskets, or fittings sold only to a kit assembler for incorporation into the pack can remain inside 807.65(a). A supplier that packages and labels a finished device for commercial distribution to an end user is a finished-device establishment under 807.20(a)(6) and registers and lists that device.

Put the right name on the label and name the UDI labeler

The physical label of a medical device kit involves two regulatory regimes that are often conflated: general label identification under 21 CFR 801.1 and Unique Device Identification (UDI) labeler status under 21 CFR 801.3. Each regulation serves a distinct purpose and applies different legal tests.

21 CFR 801.1(c) states the qualifier in these words: "Where a device is not manufactured by the person whose name appears on the label, the name shall be qualified by a phrase that reveals the connection such person has with such device; such as, 'Manufactured for ___', 'Distributed by _____', or any other wording that expresses the facts."

If one firm develops the kit specifications and a contract packager assembles the kit, the label cannot show only the developer's name and address as if that firm manufactured the kit. Manufactured for and Distributed by are the examples in 801.1(c). Other wording that expresses the facts, including wording that identifies the assembler, can also satisfy the section. Omitting the qualifier does not satisfy 801.1. The name-and-place requirement is the device rule that implements section 502(b) of the FD&C Act.

Complying with 21 CFR 801.1 does not identify the UDI labeler. Section 801.3 defines the labeler in two clauses. One is any person who causes a label to be applied to a device with the intent that the device will be commercially distributed without any intended subsequent replacement or modification of the label. The other is any person who causes the label to be replaced or modified with the intent that the device will be commercially distributed without any subsequent replacement or modification of the label. The second clause then excludes one change: adding the name and contact information of a person who distributes the device, without any other label change, is not a modification for deciding whether that person is a labeler.

FDA's UDI Basics page states the same activity test in operational language. In most instances the labeler is the device manufacturer. The labeler may instead be a specification developer, a single-use device reprocessor, a convenience-kit assembler, a repackager, or a relabeler. When both a specification developer and a contract packager cause labeling activity, 801.3 still has to be applied to what the contract actually has each firm do. The page does not pick one of them for every private-label arrangement.

That exclusion matters when a distributor adds only its own contact line. If a contract packager applies the kit label that will go to commercial distribution, and a wholesale distributor later adds only its name and telephone number, the distributor does not become the UDI labeler. The person who caused that commercial label to be applied remains the labeler.

Under 21 CFR 830.300(a), the labeler submits the information required by part 830 for each version or model required to bear a UDI. Under 830.300(b), a labeler that voluntarily places a UDI on a device label under 21 CFR 801.40 may voluntarily submit information for that device. A voluntary identifier on a device inside the kit does not, by itself, create a mandatory GUDID record for that inner device. FDA may also reject a submission for a device that requires, and does not have, premarket approval, licensure, or clearance, so a GUDID record is not evidence that 1997 discretion was available. How public GUDID records differ from establishment listing is covered in AccessGUDID vs FDA Listing. Which package levels need a carrier is covered in Which Device Packaging Levels Need Their Own UDI Carrier?.

Decide whether 510(k) discretion is even available

The next decision is whether the packaged kit requires its own 510(k), or whether FDA's May 20, 1997 Convenience Kits Interim Regulatory Guidance describes enforcement discretion for that kit. The guidance is a policy for when FDA does not intend to require premarket clearance. It is available only when the kit meets the limits below. The document says it does not operate to bind FDA or the public, and that an alternative approach may be used if it satisfies the applicable statute, regulations, or both.

The 1997 guidance describes enforcement discretion, and says FDA will not require premarket notification, for a convenience kit that meets the limits below. The assembler documents those determinations in its quality-system files:

1. The kit type is on the 1997 list. The guidance's intended-use limit is a generic kit type on the list attached to the May 20, 1997 document. The list is organized by medical specialty. For that document, kit, set, and tray are synonymous names. A kit that is not a type on the list is outside the discretion the guidance describes. Similarity to a listed type is not a substitute for being on the list, and this article does not reproduce the specialty catalog.

2. The components meet the guidance's component conditions, including both of its sentences. The components paragraph says kits subject to the guidance should include only legally marketed preamendments devices, devices exempt from premarket notification, or devices found substantially equivalent through premarket notification. Those components should be purchased in finished form, packaged and labeled consistent with their marketing authorization. The summary sentence in the same guidance is narrower. It describes discretion for kits on the list "consisting of components that have been cleared through the 510(k) process," where the assembler can reasonably conclude that further processing does not significantly affect safety or effectiveness. Keep both sentences in the file. Do not rely on the broader components paragraph alone, and do not treat the summary sentence as if it had deleted preamendments devices and 510(k)-exempt devices from the earlier paragraph.

3. Further processing is documented. The guidance applies where the assembler concludes that further processing, if any, does not significantly affect the safety or effectiveness of any component. It tells the assembler to use FDA's Deciding When to Submit a 510(k) for a Change to an Existing Device for that judgment. Sterilization is the processing impact the 1997 document specifically calls out. Where components may be sensitive to further processing, the guidance's example is surgical sutures, and the assembler takes the measures needed so those components are not adversely affected. This article does not turn that change guidance into a pass-fail list.

If the assembler cannot reasonably conclude that further processing leaves the safety and effectiveness of the components unaffected, the discretion described in the guidance does not apply. The kit is then on the ordinary question of whether a 510(k) is required. Registration, listing, the prohibition on misbranding, and the quality-system duty remain either way. The guidance says discretion on premarket notification does not remove those general controls.

Decide whether devices inside the kit need their own UDI

The UDI rule in 21 CFR 801.20 requires a UDI on the device label and on each device package unless an exception or alternative applies. Section 801.30(a)(11) is one of those exceptions. It covers a device packaged within the immediate container of a combination product or convenience kit, provided the label of the combination product or convenience kit bears a UDI. The exception does not decide which collections count as convenience kits, and it does not remove the kit's own UDI or the GUDID submission for a kit that must bear a UDI.

The regulatory text of that exception still uses the 21 CFR 801.3 definition. A convenience kit is "two or more different medical devices packaged together for the convenience of the user." The section's amendment history includes the December 4, 2025 technical amendments. Those amendments did not replace the convenience-kit exception. The current text still states it.

FDA's April 26, 2019 guidance, Unique Device Identification: Convenience Kits, interprets that definition for UDI use. For this purpose, FDA reads a convenience kit as two or more different medical devices packaged together and intended to remain packaged together, and not to be replaced, substituted, repackaged, sterilized, or otherwise processed or modified before an end user uses them. A question-and-answer in the same guidance says the devices in the container should be finished devices, not components. Finished device, in 21 CFR 801.3, means any device or accessory to any device that is suitable for use or capable of functioning. The guidance also says it does not consider every medical procedure kit, or every collection of two or more devices, to be a convenience kit for UDI.

The 2019 examples apply that reading to a sealed single-use procedure kit, a non-sterile orthopedic set that is sterilized and replenished before later use, and a suture kit that contains reusable instruments:

• Sealed single-use procedure kit. The 2019 guidance's single-use example is a sterile procedure kit, such as the anterior cruciate ligament kit it describes, packaged and sealed in one container, supplied sterile, and intended to stay sealed until the contents are about to be used. The contents are used for one procedure on one patient, or discarded if sterility is compromised. That kit can be a UDI convenience kit. The label of each device inside the container is not required to bear a UDI if a UDI is on the label of the kit's immediate container. Section 801.30(a)(11) is an available exception, not a requirement. The labeler may still place UDIs on devices inside the kit.

• Non-sterile orthopedic set. The guidance's non-sterile orthopedic set is not a convenience kit. Implants and reusable instruments are removed from their packaging, placed in a sterilization tray, cleaned and sterilized before use, and later replenished and sterilized again. Because the devices are not intended to remain packaged together without sterilization before an end user uses them, each device keeps the UDI labeling, data-submission, and direct-mark duties that apply to that device. Direct marking under 21 CFR 801.45 applies to a device intended to be used more than once and intended to be reprocessed before each use. It does not attach to every implant or pouch in the set.

• Suture kit with reusable instruments. The guidance's suture-kit example can still be a UDI convenience kit: single-use sutures and reusable stainless-steel instruments, supplied sterile and not intended to be replaced, substituted, repackaged, sterilized, or otherwise modified before the first use. Inner labels then need not bear a UDI if the kit label does. Reusable instruments that the labeler intends to reprocess and reuse remain subject to direct marking under 21 CFR 801.45.

• Class I production identifier. Under 21 CFR 801.30(d), the UDI of a class I device is not required to include a production identifier. The 2019 guidance cites that paragraph for the kit as well. The kit is itself a device. Its UDI must include the production identifiers required on the kit label unless an exception or alternative applies. A labeler may request an alternative under 21 CFR 801.55.

Stop at IVD kits and kits that contain a drug

An IVD kit and a kit that contains a drug sit outside the two device-kit tests above. Labeling, registration, and the UDI interpretation each stop at a different boundary.

An in vitro diagnostic product is labeled under 21 CFR 809.10. The label has to include the information that section requires, including the name and place of business of the manufacturer, packer, or distributor. This article does not restate the rest of 809.10. The establishment that manufactures the finished IVD kit registers and lists that kit under part 807 when 807.20 applies. A supplier that only provides raw materials or components for someone else to assemble, and that would not otherwise have to register, remains on the 807.65(a) side of the boundary.

The 2013 UDI final-rule preamble says 801.30(a)(11) provides that devices packaged within the immediate container of a convenience kit do not have to bear a UDI as long as the kit label bears a UDI, and that labelers do not have to change the way they label convenience kits, including in vitro diagnostic kits, except for including a UDI on the kit label. The April 26, 2019 guidance later says its convenience-kit interpretation does not apply to IVDs subject to 21 CFR part 809. Read both. The 2019 document does not amend 801.30, and the regulation's text does not exclude IVD kits. The 2019 reading is not the interpretation to use for a part 809 IVD. A procedure-tray example from that guidance does not become the UDI rule for a reagent kit.

A supplier that only provides bulk enzymes, primers, probes, or buffers to an IVD kit manufacturer, and that would not otherwise have to register, is in the 807.65(a) component exemption. 21 CFR 809.30 restricts the sale, distribution, labeling, and promotion of analyte specific reagents. It does not attach merely because a finished reagent is sold to a clinical laboratory. Finished-IVD registration and the ASR sale restriction are different questions. The ASR boundary is covered in Analyte Specific Reagents (ASR 809.30) vs Finished IVDs, enzyme components in Enzyme Supplier Qualification for PCR and RT-qPCR IVD Kits, and primers and probes in Oligonucleotide, Primer, and Probe Supplier Qualification for IVD Molecular Diagnostics.

The 1997 guidance says FDA does not intend to propose regulatory changes relating to drug requirements for convenience kits. For a kit that contains a component regulated as a drug, the assembler still has the drug requirements to address. The 2019 UDI guidance says it does not apply to combination products as defined in 21 CFR 3.2(e). A footnote to its first-aid-kit example says many first aid kits that include a drug together with devices are co-packaged combination products under 3.2(e)(2) and are outside that guidance. Those statements are the stop line for this article.

Do not use the 1997 510(k) discretion, or a 2019 procedure-kit example, to decide a kit that contains a drug. Which center leads, and which quality-system rules apply, is a combination-product question mapped in Combination Products (Drug-Device): Complete FDA & EU MDR Regulatory Guide. The 1997 guidance is also not intended to apply to kit 510(k)s under CBER jurisdiction.

Keep the discretion file under the current quality system

The 1997 guidance places the discretion file in the quality system. Its sentence is: "Documentation to support each of these determinations should be maintained in the assembler's/manufacturer's files in accordance with the Quality System regulation (21 CFR 820) and should be available for FDA review if needed." The determinations are the listed kit type, the component conditions, and the processing conclusion.

For decades, device assemblers maintained this "Convenience Kit Justification File" under the legacy Quality System Regulation (QSR). However, as of February 2, 2026, FDA's modernized Quality Management System Regulation (QMSR) is fully effective. The QMSR comprehensively amends 21 CFR Part 820 by incorporating by reference the international consensus standard ISO 13485:2016 alongside Clause 3 of ISO 9000:2015 and the additional requirements FDA placed in part 820.

An assembler that relies on the 1997 discretion keeps that file, and the rest of its quality documentation, under the current part 820 provisions below.

1. Document the system that applies to the operations the firm performs. 21 CFR 820.10(a) requires a manufacturer subject to part 820 to document a quality management system that complies with the applicable ISO 13485 requirements and the other applicable requirements of part 820. Section 820.1 includes contract sterilization, relabeling, repacking, and specification development among the manufacturers subject to the part, and a firm that performs only some operations meets the requirements applicable to those operations. Packing a kit does not, by itself, assign design-and-development scope. The transition from the former quality-system regulation is covered in FDA's QSR to QMSR Transition.

2. Keep the 1997 determinations in the current record system. The discretion file is a quality-system record because the 1997 guidance requires it to be maintained under part 820. Keep it there. 21 CFR 820.35 adds specified information to complaint records, servicing records, and UDI records, in addition to ISO 13485 clause 4.2.5. The file should show that the kit matches a type on the 1997 list, that the components were purchased in finished form and how they meet both the components paragraph and the narrower summary sentence, and that the assembler can reasonably conclude further processing does not significantly affect safety or effectiveness. Section 820.35 does not turn that file into a complaint record. The UDI of each medical device or batch still has to be recorded under 820.35(c).

3. Assign design and development only where 820.10(c) assigns it. 21 CFR 820.10(c) requires manufacturers of class II and class III devices, devices automated with computer software, and the class I devices listed in that paragraph's table to comply with Design and Development, clause 7.3 and its subclauses, in ISO 13485. A new tray layout does not trigger that clause for a class I device outside the paragraph. The current regulation points to the incorporated design-and-development requirements. It does not use the former quality-system name "design history file" as the name of that record, and an ISO 13485 certificate is not a substitute for part 807 registration and listing.

4. Keep complaint reporting and corrections on the cross-references in 820.10. Section 820.10(b) tells the manufacturer to notify FDA of complaints that meet the reporting criteria of part 803, for the ISO 13485 reporting clause it identifies, and to handle advisory notices under part 806. Those cross-references apply to the manufacturer for the operations it performs and for the complaints that meet those rules. They do not make the kit assembler the only reporter for every component manufacturer's device. Section 820.35(a), in addition to ISO 13485 clause 8.2.2, states the complaint-record content when a complaint says the device, its labeling, or its packaging may have failed to meet specifications.

Meeting these US kit duties does not decide a European procedure pack. Systems and procedure packs under Article 22 of Regulation (EU) 2017/745 are a separate question, already mapped in EU MDR Article 22: Systems and Procedure Packs — Producer Obligations Guide. For the US kit, assign registration, the 801.1 name, and the UDI labeler from the activity each firm performs.