Roles Redefined: Manufacturer, Importer, System Producer — Which Are You? (Part 6/8)

Introduction

If your organization runs clinical trials, integrates digital health technologies (DHTs), or even contracts with wearable or app providers—you may already be a medical device manufacturer.

And you may not know it.

Under the FDA’s Digital Health Technologies (DHT) guidance (2023) and the EU Medical Device Regulation (MDR), accountability in digital health has become function-based, not label-based.

It’s no longer about what your company calls itself—it’s about what you actually do.

This quiet shift has turned many sponsors, CROs, and vendors into unintended regulatory actors, each with specific legal obligations for safety, traceability, and quality oversight.

In other words: if you touch a device, you may be the device.

1 The Global Reframing of Responsibility

The FDA’s 2023 and 2024 guidances place clear responsibility on sponsors to ensure DHTs used in clinical trials are fit-for-purpose, validated, and governed.

Meanwhile, the EU MDR and UK MDR expanded traditional definitions of “manufacturer” to include entities that:

• Modify or rebrand existing devices.
• Combine devices with software or accessories for new clinical purposes.
• Integrate systems that together serve a medical function.

This means sponsors, CROs, or technology integrators who configure or bundle DHT components are no longer just users.

They are system producers—and legally responsible for ensuring the safety, performance, and compliance of the combined system.

2 The Sponsor’s Dilemma: The Manufacturer in Disguise

Sponsors are now seen as de facto manufacturers when they:

• Adapt commercially available DHTs for investigational endpoints.
• Integrate multiple hardware and software components into one system.
• Deploy devices under their own study protocol or branding.

Under FDA 21 CFR 820 and EU MDR Article 10, these activities trigger obligations to:

• Maintain design control and technical documentation.
• Conduct risk management and usability testing.
• Implement corrective and preventive actions (CAPA) for device issues.

A sponsor who combines a CE-marked wearable with a study-specific mobile app has effectively created a new device system—one that regulators expect to be validated, traceable, and under QMS control.

3 CROs and Service Providers: The Overlooked “Operators”

CROs traditionally viewed themselves as service intermediaries.

But under both FDA and MDR frameworks, operational control equals regulatory accountability.

CROs can be considered “operators” or “distributors” when they:

• Configure or preload DHTs before shipment.
• Manage logistics or device inventory across borders.
• Provide participant support or troubleshooting that alters system performance.

These actions may require:

• Documented maintenance and calibration records.
• Incident reporting under device vigilance systems.
• Local registration as distributors in countries with medical device enforcement (EU, India, Brazil).

4 Importers and Distributors: The Hidden Gatekeepers

If your trial involves cross-border deployment of DHTs, importer and distributor roles become unavoidable.

Sponsors often overlook the need for formal importer designation in each study country.

Without it, regulators can halt customs clearance or declare devices “placed on the market without authorization.” 

In one 2023 oncology study, wearable devices were detained for six weeks at EU customs due to missing importer documentation—a $1.2 million delay.

5 The System Producer: The Role Nobody Claims

The “system or procedure pack producer”—defined under MDR Article 22—applies when an entity combines CE-marked devices or software into a unified system for medical use.

This role is often triggered unintentionally when:

• A sponsor integrates a wearable, mobile app, and cloud dashboard.
• A technology vendor creates a data aggregation platform combining multiple sensor types.
• A CRO configures device–app combinations for multiple sites.

System producers must:

• Verify the mutual compatibility of components.
• Prepare and sign an EU Declaration of Conformity for the combined system.
• Maintain post-market surveillance and vigilance reporting mechanisms.

In effect, if you assemble a DHT ecosystem that functions as one device, you become its legal manufacturer for regulatory purposes.

6 Data Controllers and Processors: The Overlapping Digital Roles

Beyond medical device law, DHT deployment intersects with data protection law (GDPR, HIPAA, PDPA).

Here, sponsors and vendors may simultaneously act as:

• Data Controllers: deciding what is collected and why.
• Data Processors: handling, storing, or analyzing data on behalf of another party.

Failure to define and document these roles can result in dual liability.

A 2023 EU privacy audit found that 40% of DHT vendors lacked formal Data Processing Agreements aligned with GDPR Article 28.

Regulators now expect synchronized accountability: your device, your data, your responsibility.

7 Country Deployment: One Trial, Ten Legal Systems

Every deployment jurisdiction interprets device and data roles differently.

A DHT that’s legally deployable in the U.S. may require local importer authorization or labeling adjustments in the EU or India.

Ignoring these subtleties can halt entire global trials at customs or inspection stage.

8 The Compliance Domino Effect

Failing to identify and fulfill these roles has tangible consequences:

• Inspection Findings: FDA and MHRA have cited sponsors for missing device conformity documentation.
• Delays: Customs detention or data suspension pending importer verification.
• Legal Liability: Shared accountability for adverse events, malfunctions, or data breaches.
• Loss of Trust: Partner audits now routinely request role mapping evidence.

Regulators are no longer asking “Who owns the data?”

They’re asking “Who owns the device—and who owns the responsibility?”

9 How to Get Ahead of the Role Revolution

1. Conduct Regulatory Role Mapping – Identify every legal actor (manufacturer, importer, distributor, system producer, data controller/processor).
2. Embed Role Accountability in Contracts – Reflect obligations and documentation expectations explicitly in vendor and CRO agreements.
3. Establish a Device Master File – Centralize CE/UKCA certifications, technical documentation, and declarations of conformity.
4. Coordinate Global Representation – Appoint authorized importers or UK/EU representatives where required.
5. Train Teams – Ensure quality, regulatory, and project managers understand new cross-functional obligations.

This isn’t optional—it’s the infrastructure of modern regulatory survival.

Conclusion

In the digital era, the lines between sponsor, vendor, and manufacturer have disappeared.

A wearable, an app, and a cloud dashboard don’t just create data—they create regulatory obligations.

Every DHT integration reshapes the accountability chain.

The sooner organizations recognize and formalize their roles—manufacturer, importer, distributor, system producer, or data controller—the sooner they move from regulatory exposure to regulatory control.

Because in 2026, the question won’t be “Whose device is it?” It will be “Whose responsibility is it?”

References

1. FDA. Digital health technologies for remote data acquisition in clinical investigations. Silver Spring, MD: FDA; 2023.
2. European Commission. Regulation (EU) 2017/745 on medical devices (MDR). Brussels: EC; 2017.
3. MHRA. Software and AI as a medical device: Change programme roadmap. London: MHRA; 2023.
4. FDA. Investigational device exemptions (IDE) regulations. 21 CFR Part 812; 2023.
5. EFPIA. Reflection paper on integrating medical devices into medicinal product clinical trials. Brussels: EFPIA; 2025.