Discontinuation & Record Retention
Every regulated product eventually stops: superseded, divested, withdrawn for commercial reasons, or removed for safety ones. Discontinuation is a managed project, not an event. Authorities and, in many cases, customers must be notified — several regimes require advance notice of discontinuations that could create shortages, and medicine shortages have made this notification a matter of regulatory attention in its own right. Supply wind-down must be planned against remaining demand and expiry; licences are allowed to lapse or are formally withdrawn market by market; and the obligations that do not stop with sales — complaint handling, adverse-event reporting for product still in use, recall capability for product still in channels — must be explicitly mapped to owners for as long as product remains in the field.
What this page does not claim
Phases are an organising device, not a regulatory mandate — real programmes overlap them, and a medical device, a food product and a small-molecule drug traverse them differently. Each page says where the differences bite.
What happens in this phase
Every regulated product eventually stops: superseded, divested, withdrawn for commercial reasons, or removed for safety ones. Discontinuation is a managed project, not an event. Authorities and, in many cases, customers must be notified — several regimes require advance notice of discontinuations that could create shortages, and medicine shortages have made this notification a matter of regulatory attention in its own right. Supply wind-down must be planned against remaining demand and expiry; licences are allowed to lapse or are formally withdrawn market by market; and the obligations that do not stop with sales — complaint handling, adverse-event reporting for product still in use, recall capability for product still in channels — must be explicitly mapped to owners for as long as product remains in the field.
Then comes the phase's long tail: records. Retention obligations vary by record type and regime — batch records tied to expiry-plus-a-margin under GMP rules like 21 CFR 211, device quality records under the quality-system regulation's own rules, and clinical trial master files held for twenty-five years under the EU Clinical Trials Regulation — and the archive must honour the longest applicable obligation per record, not a blanket average. For electronic records the obligation is harsher than storage: Part 11 and Annex 11 expectations mean records must remain accurate, complete, and retrievable throughout the period — which, across decades, makes system decommissioning the critical craft. Data migrated must be verified complete with metadata and audit trails preserved; data left in an archived system must remain readable as platforms and vendors fall away.
The end state is deliberate destruction, and it too is controlled: destruction only after the retention period verifiably expires, under documented authorisation, with legal holds capable of interrupting it — premature destruction is the one archive error that cannot be remediated. Quality owns the map: which records exist, where, under which obligation, readable by what means, destroyable when. The phase's quiet importance is that it is where an organisation's data-integrity claims are ultimately tested — an audit trail preserved for years means nothing if the decommissioning project dropped it — and where litigation, licence renewals elsewhere, patient queries, and late-arriving safety questions will all send someone looking for a record the organisation promised, long ago, it would keep.
- A documented discontinuation decision with a wind-down plan covering supply, notification, and obligation mapping.
- Regulatory notifications identified per market — including shortage-related advance-notice duties — with owners and dates.
- An inventory of records and systems associated with the product, with each mapped to its retention obligation.
- Continuing-obligation owners assigned for complaints, safety reporting, and recall capability while product remains in the field.
- Licences withdrawn or lapsed in an orderly, documented sequence across markets.
- All records archived under their governing retention periods, retrievable and readable, with electronic records' metadata and audit trails intact.
- Systems decommissioned under controlled, verified migration or preservation — no record orphaned in an unreadable platform.
- Residual obligations formally discharged or transferred (for example, in divestment), with the transfer documented.
- Destruction performed only on verified expiry of retention, under documented authorisation, with legal-hold checks passed.
SPEQ synthesis. Phase boundaries and gate criteria are an organising device for planning and review, not a regulatory mandate. Real programmes overlap phases and re-enter them; treat these as the questions worth answering, not a compliance checklist.
- Own the retention map: every record type tied to its longest applicable obligation, and the archive held to it.
- Approve system decommissioning plans, requiring verified migration completeness and preservation of metadata and audit trails.
- Assure continuity of residual obligations — complaints, safety reporting, recall capability — until the last unit is out of the field.
- Control destruction: authorisation, verification of expiry, and the legal-hold interlock.
- Govern transfer of records and obligations in divestments, so accountability lands somewhere rather than nowhere.
- The discontinuation plan and market-by-market notification records
- The record inventory and retention map across paper and electronic holdings
- System decommissioning packages with migration verification evidence
- The archive itself — indexed, access-controlled, and periodically verified readable
- Residual-obligation register with owners, and transfer agreements where obligations move
- Destruction records with authorisation and retention-expiry verification
- Decommissioning a system before anyone asks what records it holds — the archive gap discovered by the inspection that needed the record.
- Migration verified by row counts while metadata and audit trails are silently dropped, preserving the data and destroying its integrity evidence.
- A blanket retention period applied for convenience, under-retaining the record types whose obligations run longest.
- Residual complaint and safety obligations orphaned at discontinuation, so a late report finds no owner and no process.
- Readability rot: media, formats, or licence dependencies that quietly expire years before the retention obligation does.
Derived from the 6 standards SPEQ maps to this phase, across 3 regulatory bodies: FDA, EMA, MHRA.
FREQUENTLY ASKED
How long must records actually be kept?
As long as the longest obligation attached to each record type — and the spread is wide. GMP batch and distribution records are typically tied to the batch's expiry date plus a defined margin. Device quality records follow the quality-system regulation's lifetime-linked rules. Clinical trial master files under the EU Clinical Trials Regulation are held for twenty-five years after trial end. Pharmacovigilance system records carry their own periods, and national laws, contracts, and litigation holds can extend any of them. The workable approach is a retention map per record type per jurisdiction — a blanket number guarantees over-retention of some records and violation for others.
What does it take to retire a validated system without losing its records?
A controlled project with verification at its centre. First establish what the system holds and which retention obligations attach. Then choose per record set: migrate to a live system, with completeness verified and metadata and audit trails preserved — not just the data values; preserve in a read-only archive with the means of interpretation maintained; or produce verified true copies where a copy can lawfully stand in for the original. The decommissioning report documents the choice, the verification, and where everything went. The recurring defect is migration that moves the record and drops the evidence that made it trustworthy.
Do obligations really continue after a product is discontinued?
Yes — several, and for years. While any product remains in the field or in channels, complaint handling, adverse-event and vigilance reporting, and recall capability must all continue to function, which means owners, procedures, and reachable records. Regulatory notifications must precede discontinuation in several regimes, particularly where shortage is a risk. Records obligations run for their full periods regardless of the product's commercial status, and a divestment transfers obligations only as well as its agreements are written. The discipline of this phase is making each residual duty land on a named owner — obligations without owners are the ones regulators find first.