Medsafe
New Zealand - Medsafe
Medicines Act 1981 + WAND notification + therapeutic products reform
Authority
New Zealand Medicines and Medical Devices Safety Authority
Enforced
WAND active; reform Bill repealed Dec 2024; replacement Medical Products Bill planned ~2026
Legal framework
Medicines Act 1981 + WAND database (Therapeutic Products Act 2023 REPEALED Dec 2024; Medical Products Bill planned ~2026 as replacement)
Scope
All medical devices supplied in NZ require WAND notification within 30 days. Cybersecurity addressed via CERT NZ guidance pending new Medical Products Bill.
Pre-market
Notification only at present; full pre-market regime awaits the new Medical Products Bill (planned ~2026) after repeal of the Therapeutic Products Act 2023.
Post-market
Adverse-event reporting to Medsafe; CERT NZ coordination for incidents.
SBOM
RecommendedEncouraged via FDA / TGA alignment for trans-Tasman manufacturers.
Vulnerability disclosure
Encouraged via CERT NZ coordinated disclosure.
Penalty
Withdrawal from WAND, sanctions under incoming Therapeutic Products Act.
Unique requirements
- 01WAND notification within 30 days of supply
- 02NZ Sponsor required
- 03TPA 2023 repealed Dec 2024; awaiting new Medical Products Bill (planned ~2026)
Highlights
- Light-touch regime, reform incoming
- Trans-Tasman alignment with TGA
- FDA / CE / TGA approvals widely accepted
Aligns with
Timeline
-
2003
Medical Devices Regulations enacted
-
Jul 2023
Therapeutic Products Act passed (subsequently repealed Dec 2024)
-
Dec 2024
Therapeutic Products Act 2023 repealed; Medical Products Bill announced as replacement (passage expected ~2026)
Key documents
How to submit in New Zealand
Playbook reviewed · 2026-07-16
Submission route
WAND notification with Medsafe (New Zealand)
New Zealand operates a notification (not pre-market approval) regime. Sponsors bear the burden of ensuring cybersecurity evidence exists and can be produced on request.
Authority portalStep-by-step
-
Step 01
Appoint local representation
Most jurisdictions require a locally-established entity to hold the registration or act as authorised representative before submission.
-
Step 02
Reuse FDA or CE package as baseline
Adapt the cybersecurity subsection you already prepared for FDA or CE; regulators here typically accept the structure and ask for local labeling additions.
-
Step 03
Translate and localise
Local-language technical summary and labeling are usually mandatory; certified translation is safest.
-
Step 04
Submit + track queries
Respond to clarification rounds promptly; each unanswered question can add 30-90 days to the clock.
Evidence checklist
| Item | Level | FDA equivalent | Notes |
|---|---|---|---|
| Cybersecurity documentation (baseline FDA or CE) | Required | SPDF | |
| Local authorised representative agreement | Required | — | |
| Local-language labeling and IFU | Required | — | |
| SBOM | Recommended | — | Not mandatory but reduces clarification rounds. |
Common Medsafe rejections
No New Zealand sponsor listed on WAND
CommonFix · Appoint an NZ sponsor before lodgement.
Typical timeline
End-to-end window: 1-2 months (notification)
Phase 01
Local rep + dossier prep
2-4 months
Phase 02
Regulatory review
1-2 months (notification)
Phase 03
Approval + market entry
1-3 months
Related markets
Frequently asked about New Zealand
Is SBOM required for medical devices in New Zealand?
Recommended. Encouraged via FDA / TGA alignment for trans-Tasman manufacturers.
What does Medsafe require for pre-market cybersecurity?
Notification only at present; full pre-market regime awaits the new Medical Products Bill (planned ~2026) after repeal of the Therapeutic Products Act 2023.
What are the post-market cybersecurity obligations under Medsafe?
Adverse-event reporting to Medsafe; CERT NZ coordination for incidents.
What is the penalty for non-compliance with Medsafe cybersecurity rules?
Withdrawal from WAND, sanctions under incoming Therapeutic Products Act.
How much of my FDA cybersecurity package is reusable in New Zealand?
Roughly 90% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report).