Assessment

Distributor DHT Readiness Review

The evidence a sponsor's vendor-qualification team asks for — built from the obligations a distributor actually carries, not the sponsor's list.

Request this assessment See the method

Fee quoted on scope

scoped per engagement

2–3 weeks

typical turnaround

perimeters assessed

A sponsor audit is not the moment to find out which obligations are yours.

Distributor and importer are legal roles under EU MDR, and they attach by conduct — you hold them whether or not anyone wrote them down. A sponsor's vendor-qualification questionnaire is built around the sponsor's obligations, so it asks you the wrong questions and you answer them from the wrong side. The review that holds up in vendor qualification is the one written from your side of the table.

What we assess

The seven perimeters of the DHT Readiness Scorecard, evidenced rather than self-reported. Every item is one a distributor owns outright:

Medical device: regulatory status of what you ship. Certificate and clearance verified against each device line before it leaves you, and the Declaration of Conformity on file. EU MDR Art. 14(2), Art. 20.
GxP and computerised systems: your records as study records. Which dispatch, storage and temperature records are GxP records, and whether the systems holding them can show who changed what and when. 21 CFR Part 11, EU GMP Annex 11 §4, §9, §12.
Data protection: participant data. Your processing role, the lawful basis, and a data processing agreement with every sponsor, CRO and manufacturer. GDPR Art. 28, Chapter V.
Human factors: what the participant finds in the box. Instructions and the returns route, tested with someone who has never seen them.
Configuration and change: version and replacement control. Which firmware each dispatched unit carries, and who is told when a replacement ships at a different version.
Economic operator: your role, per jurisdiction. Distributor, importer or both, with the obligations assigned to named people. EU MDR Art. 13, Art. 14, Art. 25.
Endpoint and protocol: arrival condition. What state a device must arrive in for the study to use its data — charged, configured, paired, within calibration — and how you verify it before dispatch.

What you get

The economic-operator determination for every jurisdiction you ship into, with the obligations mapped to named people
A distribution QMS gap assessment against ISO 13485 §7.5 and EU MDR Art. 14(3)
One live shipment traced end to end — receipt, dispatch, participant, return — as the chain-of-custody walkthrough a sponsor will ask for
A temperature and environmental control review across the whole chain, including the last mile
Returns, repair and data-erasure procedures reviewed against EU MDR Art. 14(2), 14(4) and 14(5), Art. 16 where devices are relabelled or repackaged, and GDPR Art. 32
A findings register with owners and dates

The deliverable is a report written to answer a sponsor's vendor-qualification questions. That is what you are buying; the findings are how we get there.

Scope

Two to three weeks. One site visit or remote equivalent; document review; one traced shipment; interviews with quality, operations and the person who packs the box. Findings register handed back with owners and dates. Re-assessment scoped to what changed, not a re-run.

Request this assessment

Tell us about the device and the protocol. We come back with a written scope, price and date — no obligation.

Your name *

Work email *

Organisation *

You are a…

Device or technology *

Name, manufacturer and model if you have it. List every item if there is more than one.

Technology class *

What does the protocol ask it to do? *

The single most important field. Screening, primary endpoint, secondary endpoint, safety monitoring, engagement only?

Endpoints or safety decisions that depend on it

Which specific endpoints, and whether any safety decision is informed by its output.

Jurisdictions *

e.g. EU, US, UK, Japan, Canada, China.

Supplier and economic-operator situation

Who supplies it, whether you relabel, reconfigure or assemble kits, and whether you import into the EU.

Known change triggers

Firmware or app updates expected, protocol amendments planned, algorithm retraining, supplier changes.

Documentation you already hold

Vendor declarations, CE certificates, validation reports, prior assessments, DPIAs.

When do you need this?

A date or a milestone.

We treat everything you send as confidential and handle it in line with our Privacy Policy. Do not include patient-identifiable data — we never need it.