From WAND Notification to MDR: EU Authorized Representative for New Zealand Manufacturers

New Zealand does not approve medical devices at all

Every other exporting country arrives at MDR carrying something: a clearance, a licence, a registro, an inclusion in a register. New Zealand manufacturers arrive carrying a database entry. That is not a criticism of the New Zealand system; it is a description of it, and Medsafe states it plainly. There is no approval system for medical devices under the Medicines Act 1981, and there is no mandatory requirement for a medical device to be assessed by any regulator before it is supplied in New Zealand.

This makes New Zealand a genuinely different starting point. For most manufacturers here, MDR will be the first premarket regulatory regime the company has ever had to satisfy, and the European notified body will be the first external party ever to audit the product file. Planning for it as a translation exercise is the standard mistake. It is a construction project.

What WAND is, and what a WAND record proves

The Web Assisted Notification of Devices database was established by the Medicines (Database of Medical Devices) Regulations 2003 to collect information about medical devices supplied in New Zealand. Notification is mandatory for importers, exporters and New Zealand manufacturers, must happen within 30 calendar days of a person or organisation becoming the sponsor of the device, and is free of charge with no ongoing fees.

What it is not, in Medsafe's own framing, is an approval system. Notification to WAND does not mean or imply that a device has been assessed by Medsafe for quality, safety, efficacy or performance. Medsafe uses the database to identify sponsors when a post-market safety issue arises, which is a real and useful function and an entirely different one from conformity assessment. The risk classifications in regulations 11 to 13 exist to organise the database, not to gate market entry.

The evidence MDR demands, against what a WAND sponsor actually holds

It is worth being blunt about the size of the gap, because it is usually underestimated by a factor of two.

MDR obligation	Instrument	What a New Zealand-only manufacturer typically holds
Quality management system covering the elements listed in Art. 10(9)	Art. 10(9); assessed under Annex IX, Chapter I	Working procedures, often uncertified. No ISO 13485 certificate.
Technical documentation	Annexes II and III	Design and test files that exist but are not structured to Annex II.
Conformity with general safety and performance requirements	Annex I, including Chapter III on information supplied	No GSPR checklist, because nothing in New Zealand law required one.
Clinical evaluation	Art. 61 and Annex XIV, with a clinical evaluation plan and PMCF plan	Literature and user feedback, rarely a clinical evaluation report.
Post-market surveillance system, plan and reporting	Arts. 83, 84 and 86	Complaints handling and recall procedures; no PMS plan or PSUR.
Basic UDI-DI, UDI assignment and device registration	Arts. 27 and 29	Nothing. UDI has no New Zealand equivalent obligation.
Person responsible for regulatory compliance	Art. 15	Usually no named role meeting the Art. 15 qualification criteria.

Choosing a classification rule instead of reading a class off a certificate

Because nobody has ever told you what class your device is, classification is a decision you make and defend rather than a fact you inherit. MDR Annex VIII sets the rules, and the inputs are the intended purpose, duration of contact, degree of invasiveness and whether the device is active. Getting this wrong at the start wastes the whole project, because the class determines the conformity assessment route under Art. 52 and therefore whether a notified body is involved at all.

Two categories catch New Zealand exporters in particular. Software is classified by Annex VIII, Rule 11: software providing information used to take diagnostic or therapeutic decisions is class IIa, rising to class III where a wrong decision could cause death or irreversible deterioration of health, or class IIb where it could cause serious deterioration or a surgical intervention. And under Art. 52(7), class I devices supplied sterile, with a measuring function, or as reusable surgical instruments require notified body involvement limited to those aspects — so even a class I product is not always a self-declaration.

Building a quality management system from a standing start

Art. 10(9) requires a documented, maintained and continually improved quality management system, and lists what it must address: a strategy for regulatory compliance, identification of applicable general safety and performance requirements, management responsibility, resource and supplier management, risk management to Annex I Section 3, clinical evaluation, product realisation, UDI verification, post-market surveillance, communication with authorities, vigilance reporting, corrective and preventive action, and monitoring of output.

ISO 13485 is the practical route to most of that, and it is worth starting the certification work before the technical file, because the audit rhythm afterwards is continuous: "Notified bodies shall periodically, at least once every 12 months, carry out appropriate audits and assessments to make sure that the manufacturer in question applies the approved quality management system and the post-market surveillance plan." (MDR Annex IX, Section 3.3) For a manufacturer in Auckland or Christchurch, that means a European auditor on site in New Zealand, annually, plus unannounced visits.

Labelling for markets you have never labelled for

A New Zealand manufacturer has written instructions for use in English only, for a market of five million people. MDR requires the information set out in Annex I, Section 23 in the official Union language or languages determined by each Member State in which the device is made available to the user or patient. The content list in Section 23 is longer than anything New Zealand law requires and includes the UDI carrier, the name and registered place of business of the authorized representative, and specified warnings and handling information. Budget for artwork rework in every destination market, not translation of existing artwork.

The mandate, the PRRC and the liability that comes with them

Designating a representative is not outsourcing risk; it creates a second party who shares it. "Without prejudice to paragraph 4 of this Article, where the manufacturer is not established in a Member State and has not complied with the obligations laid down in Article 10, the authorised representative shall be legally liable for defective devices on the same basis as, and jointly and severally with, the manufacturer." (MDR Art. 11(5)) A representative carrying that exposure will look hard at your file before accepting the mandate, and that scrutiny is the most useful thing a first-time MDR manufacturer can buy.

The Regulation also staffs the role: "Authorised representatives shall have permanently and continuously at their disposal at least one person responsible for regulatory compliance who possesses the requisite expertise regarding the regulatory requirements for medical devices in the Union." (MDR Art. 15(6)) Medex keeps that person in-house, a partner of the firm, with a deputy. We hold EUDAMED SRN TR-AR-000057550 as an authorized representative and are separately registered as a manufacturer under TR-MF-000057496 and as an importer; actor registration and three further EUDAMED modules became mandatory on 28 May 2026. Offices in Ankara, İstanbul and Gdańsk; published class-based pricing from EUR 1000 a year. See pricing and EUDAMED registration.

What New Zealand manufacturers ask us

We are notified to WAND. Is that not the same as being registered in the EU?

No. A WAND notification records that a sponsor supplies a device in New Zealand and carries no assessment of the device. EUDAMED registration under Arts. 29 and 31 sits on top of a completed conformity assessment, a signed declaration of conformity and an assigned Basic UDI-DI. The database entry is the last step in the EU, not the first.

We have no ISO 13485 certificate. Where do we start?

With classification, because it determines whether a notified body is involved and therefore whether the quality system must be certified at all. Then the quality system, then the technical documentation, then the notified body. Running them in the wrong order is the most common cause of a stalled first MDR project.

Does our Australian ARTG inclusion help?

It helps with evidence and not with status. An ARTG inclusion is an Australian market authorisation with no effect in the Union, but if you already hold one you have a risk management file, verification testing and an Essential Principles argument, and all three can be rebuilt into MDR form far faster than they can be created.

Who carries the liability if something goes wrong in Europe?

You do, as manufacturer, under Art. 10. Where you have not complied with those obligations, your authorized representative is legally liable for defective devices jointly and severally with you. That is why the mandate is a considered decision on both sides; start the conversation at contact.