Establishment Registration & Licensing
Product approval is the permission most attention goes to. The permissions that actually keep supply moving are quieter: establishment registrations, manufacturing and wholesale-distribution authorisations, importer and responsible-person designations, and the renewals that keep each current in every market served. A registration that expired because a renewal was missed stops supply as effectively as a failed batch, and unlike a failed batch it generates no quality signal on the way.
What an explainer is not
A topic explainer is SPEQ’s synthesis of what a practice involves, cited to the standards that govern it. It does not reproduce their text, and it does not determine which of them apply to your product or process.
[ POSITION IN THE FRAMEWORK ]
7 DIMENSIONS · 24 LINKSRegistration is what makes a site lawful to operate, and its risk is quiet: an inaccurate listing means the authority believes the site does something other than what it does, until an inspection arrives expecting that.
06 · QUALITY MATURITY — ESTABLISHMENT REGISTRATION & LICENSING, REACTIVE TO ADAPTIVE
Registrations were made when the site opened. Renewals happen; accuracy is assumed.
A register of licences and registrations exists with renewal dates, and renewals are made on the details already on file.
Registered activities are reconciled against what the site actually performs, per market, and a change of activity or scope updates the registration rather than waiting for renewal.
Registration is inside change control, so adding a dosage form, a storage condition or a contracted activity triggers the filing it requires.
The regulatory footprint is maintained as a live picture, so the organisation can state what it is permitted to do everywhere it operates without assembling it.
SPEQ’s shared five-stage progression, labelled synthesis — not the FDA QMM rating scale. Where does your organization sit? Score your quality system →
07 · REGULATORY & EVIDENCE
GOVERNING STANDARDS · 5
Derived from the 5 standards SPEQ maps to this subject, across 2 regulatory bodies: FDA, EC.
RECORDS & OBJECTIVE EVIDENCE
- The register of establishment registrations, licences and authorisations by market
- Registered activities and product listings, reconciled against actual operations
- Renewal records with their evidence, and the dates they were due
- Change records where a site activity change triggered a registration update
- Records of authorised contracted activities performed on behalf of others
COMMON INSPECTION FINDINGS
- A site performing an activity its registration does not cover
- Product listings that no longer match what is manufactured or distributed
- Renewals filed on unreviewed details carried forward each cycle
- A new dosage form or storage condition added with no registration assessment
- Contracted activities performed for other parties without the required authorisation
Registration is what makes a site visible
In the US, 21 CFR Part 207 requires drug establishments — domestic and foreign, including contract manufacturers and API sites — to register with FDA and list the drugs they handle, with annual renewal and defined update cycles for listing data. Foreign establishments must also designate a US agent. 21 CFR Part 807 imposes the parallel obligation on device establishments, alongside the premarket notification provisions in its Subpart E.
These are separate from product approval and serve a different purpose: they are how a site becomes visible to the agency for inspection scheduling and import screening. That is why a lapse usually surfaces as a detained shipment rather than as a compliance finding — the first party to notice is the border, not the quality unit.
The EU runs on authorisations, and they are separate from each other
Directive 2001/83/EC builds the EU regime on distinct authorisations that are easy to conflate. Article 6 makes marketing authorisation the precondition for placing a product on the market. Article 40 makes manufacture — including importation from third countries — subject to a manufacturing authorisation, with Article 46 setting the holder’s obligations including the Qualified Person. Title VII governs wholesale distribution as a further, separate authorisation.
An organisation can hold a valid marketing authorisation and still be unable to supply, because the site making the product lost or never held the right manufacturing authorisation, or because the entity moving it lacks a wholesale-distribution authorisation for that territory. As a Directive it binds through national transposition, so the operative text an inspector cites is Member State law — read it as transposed, because the detail differs.
The roles nobody owns
Market-specific obligations are where this fails most often, because they are structural rather than technical. A local representative, an importer of record, an EU responsible person, a US agent for a foreign establishment — each is a defined role with defined duties, and each is routinely assumed to be the distributor’s problem. It is not, unless a written agreement says so and someone verifies the party is actually performing it.
The other structural gap is 21 CFR Part 807’s two independent obligations. Registration and listing is the licence to operate; Subpart E premarket notification is the route to market. A 510(k)-exempt device still registers, still lists, and still runs a quality system — exemption from one obligation is regularly read as exemption from all three.
Change control is the only thing that catches this
Authorisations describe a state of the world: this site, this process, this equipment, this scope. When the state changes and the authorisation does not, the organisation is operating outside what it was granted — usually without anyone deciding to. The control is a question inside change control, asked before implementation: which registrations, licences and authorisations describe the thing being changed?
That has to be paired with an inventory that can answer it. A register with an entry per authorisation, its expiry, its renewal lead time and a named owner is unglamorous and is the difference between a planned variation and a customs hold. Renewal dates living in individual calendars or an unowned spreadsheet is the state that produces the lapse.
SPEQ interpretation — this is supply-chain risk wearing a regulatory label
Registrations and licences are filed under regulatory affairs and are almost never on the supply-risk register, which is where their failure mode belongs. A lapsed establishment registration, a manufacturing authorisation that no longer describes the site, or an unassigned importer role each stop product moving — the same outcome as a single-source supplier failure, with the same lead time to fix and none of the monitoring.
The practical recommendation is to put authorisation status on the same review as supply continuity, with the same owner reading both. The regulatory group maintains the register; the risk that it lapses is a business-continuity risk, and it should be reported where continuity risks are read.
FREQUENTLY ASKED
Is establishment registration the same as product approval?
No. Registration and listing make a site and its products visible to the agency for inspection scheduling and import screening; approval authorises a specific product for marketing. They are independent obligations with independent failure modes — a company can hold a valid approval and still be unable to import because a registration lapsed.
Does a 510(k)-exempt device still have to register?
Yes. 21 CFR Part 807 carries two independent obligations: registration and listing, and premarket notification in Subpart E. Exemption from the 510(k) requirement does not exempt a device establishment from registering, from listing, or from operating a quality system.
What is the difference between a marketing authorisation and a manufacturing authorisation in the EU?
A marketing authorisation (Directive 2001/83/EC Article 6) permits a product to be placed on the market. A manufacturing authorisation (Article 40) permits a site to make it — or to import it from a third country — and brings the holder obligations of Article 46, including the Qualified Person. Wholesale distribution requires a further authorisation under Title VII. Holding one does not imply the others.
Who is responsible for the importer or local-representative role?
Whoever the written agreement says, and nobody by default. These are defined roles with defined duties in each market, and the recurring failure is that they are assumed to sit with a distributor without that being agreed or verified. Allocate each explicitly in writing and confirm the party is actually performing the duties.