The Provisioning Chain’s Inherited Duties
A companion reading from the logistics / provisioning vendor seat — how sourcing and configuration draw operator and end-of-life duties
REGULATORY OPERATIONSAsk one question before you quote a study: is anything in the kit a medical device? If not, no EU operator role attaches to you; if so, your own operations attach duties.
Sourcing, configuring, kitting and recovering devices are the triggers — and no contract assigns the roles they attach. Record the answer either way: determine the operator role per study before sourcing, document provisioning against intended purpose, and evidence sanitization to a named level.
Each step can attach a duty — once there is a device in the kit
Placing a device from a third country on the Union market: MDR Art. 2(33), duties in Art. 13. Shipping ordinary phones or gateways does not.
Art. 16(1)(b)–(c). Imaging and locking down a handset does not by itself move it out of general purpose — the record evidences the sponsor's intended purpose.
Art. 22(1), where the combination is placed on the market; a pack with a non-CE-marked device is itself a device (Art. 22(4)). EUDAMED registration since 28 May 2026.
Purge level under NIST SP 800-88 Rev. 2 with verification, unbroken chain of custody, WEEE and battery duties on disposal.
Two perimeters turn on device status; two apply to every shipment
Importer (Art. 13), distributor (Art. 14), manufacturer (Art. 16(1)) or pack producer (Art. 22) attach from sourcing and kitting where a device is involved — the duty most often unassigned.
Imaging, lock-down and kitting are documented against the intended use the sponsor has set — evidenced, not assumed.
"Not a factory reset" prohibits the recognized method on a managed iOS fleet. Specify Purge under NIST SP 800-88 Rev. 2, the method appropriate to the media, and the verification.
GDPR Arts 28, 30, 32 and 33 apply: hold the Art. 30 record, Art. 28 processor terms, Art. 32 measures and an Art. 33 path for a device lost in transit.
Four actions turn an inherited duty into a dated record — before sourcing, not after the audit
- 1Answer the threshold question and record your operator role per study — including "none" — dated before sourcing.
- 2Document configuration against intended use so imaging, lock-down and kitting are evidenced, not assumed.
- 3Evidence sanitization and custody to the end: Purge level specified, method fit for the media, verification and custody log on file.
- 4Get the duties named in contract so no role is inherited silently from how you operate.
Regulation (EU) 2017/745 (MDR) Arts 2(33), 13, 14, 16(1)(b)–(c), 22, 13(8), 14(5) · EUDAMED actor registration · NIST SP 800-88 Rev. 2 · GDPR Arts 28, 30, 32, 33 · WEEE, battery and lithium-transport rules
© qointa 2026 – Public – Uncontrolled when printed · Not legal advice; this summary does not classify any device.
sales@qointa.com · qointa.com
More from the library
Digital Health Technologies in Clinical Trials — A Regulatory Position-Paper Series
One device, several perimeters: a framework for assessing the regulatory impact of the technologies a trial relies on.
Read more →Who Is the Manufacturer? Economic-Operator Roles in DHT Supply Chains
How provisioning, importing, kitting and modifying a device assign manufacturer, importer and distributor duties — often by operation of law.
Read more →You Can Delegate the Work, Not the Accountability: Vendor Qualification and Oversight under ICH E6(R3)
The sponsor’s duty to qualify and oversee its DHT vendors — distinct from who holds the economic-operator role.
Read more →Talk to a specialist
Bring one device and one protocol — a wearable, a sensor, an app, anything. We will tell you which regulatory perimeters it opens and what it takes to close them.
Book a 15-minute call