PHMB Foam Dressing Private Label Compliance Documents: A Distributor's Checklist

This checklist covers private-label PHMB foam dressings for the US and EU markets, written for the evaluation stage: you are assembling or auditing a document pack, not deciding whether compliance matters. It maps each document family to the role that owns it, then walks the sequence from product definition through labeling, UDI, instructions for use, post-market surveillance and vigilance.

Two currency traps invalidate most older checklists. ISO 20417:2021 is superseded by ISO 20417:2026 (second edition), published 17 March 2026 (ISO, 2026), though the 2021 edition stays usable for FDA declarations of conformity through 1 July 2029. And the label symbol is now EU REP, not EC REP: Amendment 1:2025 to ISO 15223-1 generalised the symbol to XX REP (adopted March 2025, harmonised via OJEU on 17 June 2026), which reads as EU REP for the European Union (MDCG 2021-5 rev.1, 2026). Both changes hit the PHMB foam dressing private label compliance documents a distributor signs off, so an older pack needs a currency pass, not a rewrite.

Treat this as a planning aid, not legal or regulatory advice. Confirm your specific device, classification and market obligations with the applicable competent authority or notified body before you rely on any item below.

About this checklist and who wrote it. SLK Medical is an OEM/ODM wound dressing manufacturer and supplies private-label dressings to distributors, so we have a commercial interest here. The checklist was compiled by our regulatory and quality team from the primary sources cited throughout and reflects the packs we assemble for distributors. It is a manufacturer’s operational view, not an authority or notified body ruling. Our regulatory footprint is ISO 13485, FDA establishment registration and device listing (non-510(k) pathway), and CE marking under EU MDR. We do not hold a notified body review role or a formal regulatory affairs credential, which is why every item below points back to the primary source you should verify.

Last reviewed: 12 October 2026. Change log: the two corrections in this version are the ISO 20417 edition and the EC REP to EU REP symbol change, both described below. Re-check the ISO catalogue and the OJEU reference before you rely on any edition number.

Key Takeaways

• Ownership is settled before documents are drafted: Article 16 of Regulation (EU) 2017/745 turns a distributor into the legal manufacturer when it puts a device on the market under its own name, unless the actual manufacturer is identified on the label and remains contractually responsible.

• Two currency checks invalidate older checklists: ISO 20417:2021 is withdrawn in favour of ISO 20417:2026, and the label symbol is EU REP, not EC REP.

• UDI is a field-level obligation, not one line of artwork: the DI identifies the labeler and model, the PI carries lot and expiry, and GUDID stores flags rather than actual lot values.

• Post-market surveillance and vigilance are separate document families with separate clocks, and the US and EU deadlines are not interchangeable.

Standards currency table

Pin every edition below in the pack, and re-check it against the ISO catalogue and the OJEU before each print release, because edition numbers move independently of the regulation.

Who is legally responsible for which document in a private-label PHMB foam dressing program?

Responsibility splits by role, and the split differs between the EU and the US. Before reading the table, walk the Article 16 test: it is the fastest way to know whether you are the manufacturer or a distributor, and everything downstream depends on the answer.

Article 16 manufacturer-status decision path (EU):

1. Does your name or trademark appear on the label instead of the OEM’s?

   • Yes and the actual manufacturer is not identified on the label: you are the manufacturer for MDR purposes.

   • Yes but the actual manufacturer is identified on the label and remains contractually responsible for compliance: manufacturer obligations stay with the OEM.

   • No: continue.

2. Have you changed the device’s intended purpose?

   • Yes: you assume manufacturer obligations for the changed purpose.

   • No: continue.

3. Have you modified the device so it may affect conformity with the applicable requirements?

   • Yes: you assume manufacturer obligations for the modification.

   • No: you remain a distributor, and maintain importer and distributor duties instead.

Article 16 is the provision that turns a distributor into a manufacturer: a distributor or importer assumes all manufacturer obligations if it places the device on the market under its own name or trademark, unless the actual manufacturer is identified on the label and remains contractually responsible for compliance (Regulation (EU) 2017/745, Article 16, 2017).

A frequent drafting error attributes importer duties to Article 19. Article 19 concerns the EU declaration of conformity, not importer duties; importer obligations sit principally in Articles 13, 16 and 27 (MDCG 2021-27 Rev.1, 2023). Article 13 requires the importer to place its own name and address on the device, packaging or accompanying documentation, may sub-contract the task but stays responsible, and must replace a previous importer’s details when it is the correct importer, which voids the earlier label.

On the EU side, the authorised representative must verify the declaration of conformity and technical documentation, keep copies available to authorities and verify EUDAMED registration, and is jointly liable with the manufacturer for defective devices where the manufacturer has not complied and is not established in the EU (European Commission guidance on authorised representatives, importers and distributors, retrieved 2026).

In the US, your contract manufacturer must register and list even if it never distributes the device, and a foreign establishment must appoint a U.S. agent with a U.S. place of business FDA staff can visit (FDA registration and listing FAQ, 2023). The labeler may be a specification developer, repackager or relabeler, not only the manufacturer (FDA UDI Basics, 2023).

One limit applies to every row above: a quality management certificate covers a defined scope, not every SKU or market. Check that your ISO 13485 scope names the dressing types and processes your program actually uses before you treat the certificate as evidence of compliance.

What this looks like in an actual pack index

The ownership table above is abstract until you see the folder it produces. A redacted index from a private-label PHMB foam dressing program we assembled looked like this: 01 Product definition and classification memo; 02 Intended purpose statement; 03 Variant and SKU matrix; 04 Technical file index with the ISO 20417 information set; 05 Risk-management file; 06 Label master and approved artwork; 07 UDI and GUDID submission records; 08 IFU with revision identifier and issue date; 09 PMS plan and report or PSUR; 10 Vigilance procedure and awareness-date log; 11 ISO 13485 certificate with scope; 12 Distributor and importer identification records; 13 Change-control log. The two folders that most often came back incomplete in distributor audits were 07 and 10: UDI records where the DI and PI had been treated as one entry, and vigilance files where the awareness-date log was missing so the clock could not be evidenced. Build those two first rather than last.

What must be settled about the product before any document is drafted?

Intended purpose, device classification, variant list and the SKU matrix must be frozen first, because every downstream document inherits them. A private-label PHMB foam dressing line typically covers three variants: a bordered PHMB silicone foam dressing, a non-border version, and a PHMB non-adhesive foam dressing. Reference numbers follow a size pattern, for example S10018001 at 10×10 cm, S10018002 at 15×15 cm and S10018003 at 20×50 cm. The construction behind those variants, such as the layered build of a 5-layer silicone foam dressing, is what the technical file has to describe.

The antimicrobial wording is the item most often drafted carelessly. The foam contains polyhexamethylene biguanide, also written polihexanide, and the distinction that matters is between describing an antimicrobial device feature and making a medicinal claim. Keep the wording conservative and non-claim-bearing; the intended purpose statement, not the marketing copy, is what regulators read.

Pin standard editions here. ISO 20417:2026 replaced the 2021 edition, which is superseded but remains usable for FDA declarations of conformity through 1 July 2029 (ISO, 2026). The label symbol standard moved too: since Amendment 1:2025 the label shows EU REP, not EC REP, purely an editorial change with no shift to the representative’s role or location (MDCG 2021-5 rev.1, 2026). Both symbols may be used during transition, and from 17 June 2031 only the harmonised amended standard route applies.

What has to appear on the label and artwork, and how is it controlled?

Label content is a fixed list; artwork control is a documented process, not a proofreading habit. Annex I section 23 separates label content, sterile packaging content and instructions for use, and section 23.1(d) exempts many Class I and Class IIa dressings from an IFU where the device is safe to use without one (Regulation (EU) 2017/745, Annex I, 2017). Sterile packaging must still carry the sterilisation method, the month and year of manufacture, and an unambiguous use-by limit expressed at least in year and month.

The US format is stricter on dates, and it governs a dual-market label. The UDI must appear in both plain-text and AIDC form, and dates must be in YYYY-MM-DD (FDA UDI Basics, content current 2023-08-16). Where the EU rule accepts month-and-year granularity, US day-level format satisfies both, so one artwork set built to the stricter format serves both markets.

Symbols are versioned, not permanent. ISO 15223-1:2021 defines 20 symbols in its Table 1, and the 2025 amendment generalised the representative-authorised-representative symbol rather than adding a pictogram (ISO 15223-1:2021, 2021-07-06). Check every symbol on the master against the current edition before print release.

Pro Tip: Build the master to the stricter US date format (YYYY-MM-DD). It satisfies EU month-and-year granularity, so one artwork set serves both markets.

Control artwork through phased change control with cross-functional approval before print release, covering regulatory affairs, quality assurance and packaging engineering, plus clinical review where claims appear and distributor regulatory review per market. A two-person pre-print proof redline against the approved master should confirm text match, barcode scan and GS1 compliance, quiet zone, die-line safe zones, colour accuracy, current symbol versions, and that the UDI-DI matches the registered device identifier. Retain the result as a controlled record.

Verify the printed result against the master in the manufacturing and QC records: what to verify in the manufacturing and QC records.

How is UDI assigned, placed and registered per market?

UDI is a field-level obligation with two components, and the database does not hold what many distributors assume it holds. The DI is the mandatory, fixed portion identifying the labeler and the specific version or model; the PI is the conditional, variable portion identifying lot or batch, serial number, expiration date and manufacture date (FDA UDI Basics, 2023).

GUDID does not store the actual lot or expiry values. It records flags indicating whether those PIs appear on the label, and device size is non-mandatory but encouraged where clinically relevant. That distinction matters when you promise a customer lot-level traceability from a database lookup: the registry is a device-identity registry, and lot traceability comes from your own records.

Assignment mechanics differ by market. GS1 maps the UDI-DI to your GTIN and the Basic UDI-DI to a GMN with no Application Identifier, and the Basic UDI-DI is not the identifier affixed to the product (GS1, retrieved 2026). In the US, UDIs come from an FDA-accredited issuing agency, and the labeler is the party that causes the label to be applied or modified with intent that the device be commercially distributed.

Compliance dates are historical for foam dressings but worth confirming in the pack. Class III devices had to bear a UDI from 24 September 2014, implantable, life-supporting and life-sustaining devices from 24 September 2015, and Class II devices from 24 September 2016 (78 FR 58786, 2013). If you relabel a device required to bear a UDI, keep a record showing the relationship of the original device identifier to the new one.

What belongs in the IFU, including PHMB-specific wording?

Annex I section 23.1(d) exempts many Class I and Class IIa dressings from an IFU, so confirm whether your classification triggers the obligation before drafting one. Where it does, the IFU must carry the intended purpose with a clear specification of indications, contra-indications, the patient target group and the intended users, plus residual risks and undesirable side-effects, and a notice directing the user to report any serious incident to the manufacturer and the competent authority (Regulation (EU) 2017/745, Annex I, 2017).

For a PHMB foam dressing, describe the antimicrobial substance as a device feature and keep the wording inside what the technical documentation supports. The silicone contact layer properties belong in the same description: suitable for sensitive skin, designed not to adhere to the skin, and hydrophobic to reduce pain at dressing changes and avoid secondary damage. Handling instructions should cover cutting to shape, single use, and the sterile barrier damage instruction. Where the format is a sacral dressing, the intended-use wording for a specific dressing format shows the level of specificity a notified body expects.

One limit worth stating plainly: treat the content above as categories to verify against the current annex text rather than a counted checklist.

How to read the sourcing in this checklist: statements tied to a cited regulation, MDCG document, FDA source or ISO standard reflect the primary text as published. Statements about how to run a program, sequence documents or assign steps are our operational interpretation from running private-label packs, not regulatory rulings. Where the two could diverge for your device, the primary text wins, and the item is worth a confirmation with your notified body or competent authority.

What PMS documents are required and how do they connect to CAPA?

The output document depends on device class, and the PMS system must connect to CAPA rather than sit beside it. Class I devices produce a PMS report, while Class IIa, IIb and III devices produce a PSUR (MDCG 2025-10, 2025).

The Class I PMS report must contain a summary of the results and conclusions of the analyses of PMS data from executing the PMS plan, plus the rationale and description of any corrective or preventive actions taken in the period (MDCG 2025-10, 2025). That CAPA sentence is the link: the report is where the corrective action record becomes a regulatory document.

PSUR frequency is set by Article 86. A Class IIa PSUR is updated when necessary and at least every two years, while Class IIb and Class III PSURs are updated at least annually (Regulation (EU) 2017/745, Article 86, 2017). PSUR content covers the conclusions of the benefit-risk determination, the main PMCF findings, and sales volume plus an estimate of population size and, where practicable, usage frequency. For Class III and implantable devices, the PSUR must be submitted electronically to the notified body, which reviews it and adds its evaluation. A foam dressing line rarely reaches that class, but the rule matters if your portfolio includes higher-class products under the same QMS.

The PMS plan itself is part of the technical documentation and must describe the methods and protocols to monitor trends, investigate complaints, and trace devices if corrective action is needed (MDCG 2025-10, 2025). One plan can cover a device family with the same manufacturing process, design and intended purpose, the practical route for a multi-SKU private-label range.

What vigilance documents and timelines apply, and how does a distributor escalate?

Vigilance runs on a separate clock from PMS, and the US and EU clocks are not equivalent. Under MDR Article 87, a serious incident that did not involve death or unanticipated serious deterioration must be reported immediately and no later than 15 days after the awareness date; a serious public health threat no later than 2 days; and death or unanticipated serious deterioration in a person’s state of health no later than 10 days (Regulation (EU) 2017/745, Article 87, 2017).

Those are calendar days, not working days. MDCG 2023-3 rev.2 confirms the deadlines run in calendar days, so the periods include weekdays, public holidays, Saturdays and Sundays; the clock begins the day after the awareness date at 00:00:01 and ends at 23:59:59 on day 15, 10 or 2, rolling to the next working day if that last day is a weekend or holiday (MDCG 2023-3 rev.2, 2025).

The awareness date is defined operationally: the date the first employee or representative of the manufacturer’s organisation, including an authorised representative or outsourced complaint handler, receives information about the potentially serious incident (MDCG 2023-3 rev.2, 2025). If your distributor is the first to hear about an event, that date is already running.

Warning: US and EU vigilance obligations are not interchangeable. A US MDR report does not satisfy EU vigilance, and no source in this set states that either authority accepts the other’s filings.

On the US side, 21 CFR 803.50 gives manufacturers 30 calendar days after becoming aware of information reasonably suggesting death, serious injury, or a malfunction likely to cause them (21 CFR Part 803, current edition). A 5-work-day report applies when a reportable event requires remedial action to prevent unreasonable risk of substantial harm to public health, or on FDA written request. Importers report deaths and serious injuries to both FDA and the manufacturer within 30 calendar days, and report malfunctions only to the manufacturer; supplemental reports are due within 30 calendar days of receiving new information.

Write the escalation path before an event occurs: distributor to legal manufacturer within a defined internal window, legal manufacturer to the competent authority or FDA within the regulatory window, with the awareness date logged at first receipt. The EU framework defines a serious incident as a subset of incidents, where incident expressly includes malfunction or deterioration in characteristics or performance, and non-serious incidents are not reportable to authorities but must be documented in the QMS (MDCG 2023-3 rev.2, 2025).

Common mistakes that invalidate a private-label compliance pack

The failures that invalidate a pack are structural, not clerical. The first is drafting documents before the ownership split is settled. If the private-label distributor’s own brand appears on the label and the actual manufacturer is not identified and contractually responsible, Article 16 obligations transfer, and the vigilance reporting owner changes with them (Regulation (EU) 2017/745, Article 16, 2017).

The second is citing superseded standards. A pack that still references ISO 20417:2021 or shows EC REP on artwork is out of date on two counts (ISO, 2026; ISO, 2025).

The third is treating the UDI as a single line of artwork. The DI and PI are different data elements with different rules, and GUDID stores flags rather than lot and expiry values (FDA UDI Basics, 2023). A pack that promises lot-level traceability from a GUDID lookup will not survive an audit.

The fourth is assuming a certificate covers the SKU. A QMS certificate covers a defined scope, and a scope listing sterile foam dressing production does not name every PHMB variant. Verify the scope text against your product list before presenting the certificate as evidence.

The fifth is conflating PMS and vigilance. A PMS report or PSUR summarises data over a period; a vigilance report is event-driven, with a deadline measured from an awareness date. The sixth is treating US and EU clocks as equivalent: EU periods are calendar days, while the FDA 5-day report is 5 working days (21 CFR Part 803, current edition).

The seventh is leaving the IFU revision identifier blank: without a date of issue and revision identifier, you cannot show which IFU was in force when a complaint was received.

Frequently Asked Questions

Does a Class I PHMB foam dressing need an IFU?

Usually yes. Annex I section 23.1(d) of the EU MDR exempts many Class I and Class IIa dressings from the instruction-for-use requirement, but only where the device is safe to use without instructions and that safety is demonstrated in the technical documentation. Most PHMB foam dressings fail that test, because the user must know how long to leave the dressing in place, when to change it, and what a deteriorating wound looks like. Unless your technical file carries a documented justification, write the IFU.

Does the distributor become the legal manufacturer?

Only in specific circumstances. Article 16 of the EU MDR turns a distributor into a manufacturer when it places the device on the market under its own name or trademark without identifying the actual manufacturer on the label. The same applies if it changes the intended purpose or modifies the device in a way that affects compliance. Put the OEM’s name and address on the label and keep the device unmodified, and the manufacturer obligations stay with the OEM.

How long does the EU REP transition run?

The EU REP transition runs to 17 June 2031. Amendment 1:2025 to ISO 15223-1 replaced the EC REP symbol with a generic XX REP symbol, which reads as EU REP for the European Union, and both symbols may be used during the transition. Plan your artwork change now rather than at the deadline, because a label revision touches every SKU and every market at once.

What happens when a notified body asks for a document refresh during surveillance?

Treat it as a scoped change, not a paperwork exercise. Identify which documents the request touches, check whether it alters the technical file, the risk-management file or the label, and route it through change control with the OEM. If it affects compliance, the notified body expects the updated documentation and the assessment behind it. Answer within the auditor’s deadline, and record the exchange in your QMS so the next audit can trace it.

Conclusion

The document pack holds together when four things are true. Ownership is settled first, so you know whether Article 16 has transferred manufacturer obligations to your entity and who owns vigilance reporting. Standards are current, so the pack cites ISO 20417:2026 and shows EU REP rather than the superseded 2021 edition and symbol. UDI is treated as field-level data, with the DI and PI handled separately and no promise of lot-level traceability from GUDID. And PMS and vigilance are maintained as separate families with separate clocks, the EU running in calendar days and the US 5-day report in working days.

Work the checklist in sequence rather than in parallel. Product definition and classification feed the label, the label and UDI feed the IFU, and the IFU revision identifier makes your change control demonstrable when a complaint arrives. Drafting artwork before the ownership split is settled is the most common way a pack fails review.

The next step is practical: request the standard document template pack, the certifications pack and the sampling plan, then map each document against the owner column for your market before you commit to a print release.