--- title: "New Zealand Medsafe - Cybersecurity Submission Playbook" description: "How to submit a medical device to Medsafe in New Zealand: step-by-step route, evidence checklist, common rejections, and typical review timeline. Compared wit" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "WebSite", "name": "The Medical Device Cybersecurity Crosswalk", "alternateName": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "description": "Compare FDA, EU MDR, MHRA, PMDA, NMPA, TGA, MFDS and Health Canada medical device cybersecurity requirements across 29 jurisdictions." }, { "@context": "https://schema.org", "@type": "Organization", "name": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "logo": "https://mdccrosswalk.com/favicon.png", "sameAs": [ "https://bluegoatcyber.com" ], "description": "An editorial reference comparing global medical-device cybersecurity regulations. Maintained by Blue Goat Cyber." }, { "@context": "https://schema.org", "@type": "Article", "headline": "New Zealand - Medicines Act 1981 + WAND notification + therapeutic products reform", "description": "How to submit a medical device to Medsafe in New Zealand: step-by-step route, evidence checklist, common rejections, and typical review timeline. Compared wit", "author": { "@type": "Organization", "name": "MDC Crosswalk" }, "publisher": { "@type": "Organization", "name": "MDC Crosswalk" }, "image": "https://mdccrosswalk.lovable.app/favicon.png", "datePublished": "Dec 2024 (Therapeutic Products Act 2023 repealed; Medical Products Bill announced as replacement)", "about": "New Zealand Medicines and Medical Devices Safety Authority", "dateModified": "2026-07-16", "mainEntityOfPage": "https://mdccrosswalk.lovable.app/standards/nz" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is SBOM required for medical devices in New Zealand?", "acceptedAnswer": { "@type": "Answer", "text": "Recommended. Encouraged via FDA / TGA alignment for trans-Tasman manufacturers." } }, { "@type": "Question", "name": "What does Medsafe require for pre-market cybersecurity?", "acceptedAnswer": { "@type": "Answer", "text": "Notification only at present; full pre-market regime awaits the new Medical Products Bill (planned ~2026) after repeal of the Therapeutic Products Act 2023." } }, { "@type": "Question", "name": "What are the post-market cybersecurity obligations under Medsafe?", "acceptedAnswer": { "@type": "Answer", "text": "Adverse-event reporting to Medsafe; CERT NZ coordination for incidents." } }, { "@type": "Question", "name": "What is the penalty for non-compliance with Medsafe cybersecurity rules?", "acceptedAnswer": { "@type": "Answer", "text": "Withdrawal from WAND, sanctions under incoming Therapeutic Products Act." } }, { "@type": "Question", "name": "How much of my FDA cybersecurity package is reusable in New Zealand?", "acceptedAnswer": { "@type": "Answer", "text": "Roughly 90% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report)." } }, { "@type": "Question", "name": "Why do Medsafe submissions get rejected for \"no new zealand sponsor listed on wand\"?", "acceptedAnswer": { "@type": "Answer", "text": "Appoint an NZ sponsor before lodgement." } } ] }, { "@context": "https://schema.org", "@type": "HowTo", "name": "How to submit a medical device to Medsafe", "description": "New Zealand operates a notification (not pre-market approval) regime. Sponsors bear the burden of ensuring cybersecurity evidence exists and can be produced on request.", "totalTime": "1-2 months (notification)", "step": [ { "@type": "HowToStep", "position": 1, "name": "Appoint local representation", "text": "Most jurisdictions require a locally-established entity to hold the registration or act as authorised representative before submission." }, { "@type": "HowToStep", "position": 2, "name": "Reuse FDA or CE package as baseline", "text": "Adapt the cybersecurity subsection you already prepared for FDA or CE; regulators here typically accept the structure and ask for local labeling additions." }, { "@type": "HowToStep", "position": 3, "name": "Translate and localise", "text": "Local-language technical summary and labeling are usually mandatory; certified translation is safest." }, { "@type": "HowToStep", "position": 4, "name": "Submit + track queries", "text": "Respond to clarification rounds promptly; each unanswered question can add 30-90 days to the clock." } ] }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://mdccrosswalk.lovable.app/" }, { "@type": "ListItem", "position": 2, "name": "Standards" }, { "@type": "ListItem", "position": 3, "name": "New Zealand" } ] } ] --- [ The Crosswalk ](/) [Overview](/)[Playbook](/playbook)CompareReference [New Per-page social previews and this changelog ](/changelog "Per-page social previews and this changelog") Search⌘K 1. [Home ](/) 2. Standards 3. New Zealand Medsafe # ![Flag of New Zealand](/flags/nz.svg)New Zealand - Medsafe Guidance Last updated · Dec 2024 (Therapeutic Products Act 2023 repealed; Medical Products Bill announced as replacement) Verified · 2026-07-16 Medicines Act 1981 + WAND notification + therapeutic products reform Share Copy link X LinkedIn Email Sources verified · 2026-07-16 Medsafe relies on TGA / FDA recognition; standalone cyber rule awaiting SME review. Authority New Zealand Medicines and Medical Devices Safety Authority Enforced WAND active; reform Bill repealed Dec 2024; replacement Medical Products Bill planned ~2026 Legal framework Medicines Act 1981 + WAND database (Therapeutic Products Act 2023 REPEALED Dec 2024; Medical Products Bill planned ~2026 as replacement) FDA package reuse ~90% [Editorial estimate · how →](/methodology#fda-reuse) ## Scope All medical devices supplied in NZ require WAND notification within 30 days. Cybersecurity addressed via CERT NZ guidance pending new Medical Products Bill. Pre-market Notification only at present; full pre-market regime awaits the new Medical Products Bill (planned ~2026) after repeal of the Therapeutic Products Act 2023. Post-market Adverse-event reporting to Medsafe; CERT NZ coordination for incidents. SBOM Recommended Encouraged via FDA / TGA alignment for trans-Tasman manufacturers. Vulnerability disclosure Encouraged via CERT NZ coordinated disclosure. Penalty Withdrawal from WAND, sanctions under incoming Therapeutic Products Act. ## Unique requirements - 01 WAND notification within 30 days of supply - 02 NZ Sponsor required - 03 TPA 2023 repealed Dec 2024; awaiting new Medical Products Bill (planned ~2026) ## Highlights - Light-touch regime, reform incoming - Trans-Tasman alignment with TGA - FDA / CE / TGA approvals widely accepted ## Aligns with TGA Guidance IMDRF N60 ISO 13485 ## Timeline 1. 2003 Medical Devices Regulations enacted 2. Jul 2023 Therapeutic Products Act passed (subsequently repealed Dec 2024) 3. Dec 2024 Therapeutic Products Act 2023 repealed; Medical Products Bill announced as replacement (passage expected ~2026) ## Key documents [ Medsafe Medical Devices https://www.medsafe.govt.nz/regulatory/DevicesNew/ ](https://www.medsafe.govt.nz/regulatory/DevicesNew/)[ Medsafe Safety Communications https://www.medsafe.govt.nz/safety/SafetyCommunications.asp ](https://www.medsafe.govt.nz/safety/SafetyCommunications.asp)[ WAND Database (Web-Assisted Notification of Devices) https://www.medsafe.govt.nz/regulatory/DevicesNew/3WANDIntro.asp ](https://www.medsafe.govt.nz/regulatory/DevicesNew/3WANDIntro.asp) ## How to submit in New Zealand Playbook reviewed · 2026-07-16 Submission route WAND notification with Medsafe (New Zealand) New Zealand operates a notification (not pre-market approval) regime. Sponsors bear the burden of ensuring cybersecurity evidence exists and can be produced on request. [Authority portal](https://medsafe.govt.nz/regulatory/DevicesNew/) ### Step-by-step 1. Step 01 Appoint local representation Most jurisdictions require a locally-established entity to hold the registration or act as authorised representative before submission. 2. Step 02 Reuse FDA or CE package as baseline Adapt the cybersecurity subsection you already prepared for FDA or CE; regulators here typically accept the structure and ask for local labeling additions. 3. Step 03 Translate and localise Local-language technical summary and labeling are usually mandatory; certified translation is safest. 4. Step 04 Submit + track queries Respond to clarification rounds promptly; each unanswered question can add 30-90 days to the clock. ### Evidence checklist Item Level FDA equivalent Notes Cybersecurity documentation (baseline FDA or CE) Required SPDF Local authorised representative agreement Required — Local-language labeling and IFU Required — SBOM Recommended — Not mandatory but reduces clarification rounds. ### Common Medsafe rejections No New Zealand sponsor listed on WAND Common Fix · Appoint an NZ sponsor before lodgement. ### Typical timeline End-to-end window: 1-2 months (notification) Phase 01 Local rep + dossier prep 2-4 months Phase 02 Regulatory review 1-2 months (notification) Phase 03 Approval + market entry 1-3 months [Previous ![Flag of Argentina](/flags/ar.svg)Argentina ](/standards/ar)[Next ![Flag of Turkey](/flags/tr.svg)Turkey ](/standards/tr) ## Related markets [![Flag of Singapore](/flags/sg.svg) Singapore ~90% FDA reuse ](/standards/sg)[![Flag of Mexico](/flags/mx.svg) Mexico ~90% FDA reuse ](/standards/mx)[![Flag of Hong Kong](/flags/hk.svg) Hong Kong ~90% FDA reuse ](/standards/hk)[![Flag of Australia](/flags/au.svg) Australia ~85% FDA reuse ](/standards/au) ## Frequently asked about New Zealand ### Is SBOM required for medical devices in New Zealand? Recommended. Encouraged via FDA / TGA alignment for trans-Tasman manufacturers. ### What does Medsafe require for pre-market cybersecurity? Notification only at present; full pre-market regime awaits the new Medical Products Bill (planned ~2026) after repeal of the Therapeutic Products Act 2023. ### What are the post-market cybersecurity obligations under Medsafe? Adverse-event reporting to Medsafe; CERT NZ coordination for incidents. ### What is the penalty for non-compliance with Medsafe cybersecurity rules? Withdrawal from WAND, sanctions under incoming Therapeutic Products Act. ### How much of my FDA cybersecurity package is reusable in New Zealand? Roughly 90% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report). Sponsored note · Blue Goat Cyber Submitting to Medsafe? Get a second pair of eyes before you file. Blue Goat Cyber has packaged cybersecurity evidence for New Zealand alongside 37 other markets. We'll tell you what to keep, what to rework, and what's missing, in 30 minutes. [Talk through your Medsafe submission](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) The Crosswalk An independent reference for global medical device cybersecurity standards. A field guide for MedTech innovators and RA/QA teams charting an international path. Resource - [Comparison matrix](/compare) - [Global playbook](/playbook) - [Glossary](/glossary) - [FAQ](/faq) Sponsored by [Blue Goat Cyber ↗](https://bluegoatcyber.com) Editorially independent. Sponsorship keeps it free. © 2026 The Crosswalk. Not legal advice. Validate every requirement against current regulator publications.