FDA Device Establishment Registration: The Federal Map of the Medical-Device Supply Chain

A single pacemaker may pass through five separately registered facilities before it reaches a patient: the firm that designed it, the contract plant that builds it, the company that sterilizes and repackages it, the relabeler that puts a hospital chain's name on the box, and the importer that brings it across the border. Each of those facilities, wherever on earth it sits, must tell the FDA every year that it exists and what it does. The device establishment registry is that worldwide ledger—roughly 324,000 registered establishments, each keyed to a permanent FDA establishment identifier and tied to the device product codes it handles—the federal map of the medical-device supply chain.

This article covers what the device establishment registration dataset is and the statutory duty that creates it; the crucial distinction between registration and FDA approval or clearance, a line that some firms deliberately blur in marketing; the FDA establishment identifier and registration number that key every row; the owner-operator structure that sits above the physical establishment; the operation types that separate a manufacturer from a contract manufacturer, a specification developer, a repackager, a relabeler, and an importer; the large foreign share of the supply chain and the US-agent requirement that governs it; how the registry joins to the 510(k), PMA, and device-classification datasets through the product code; a Python workflow that pulls establishments from the openFDA device/registrationlisting endpoint and splits domestic from foreign while tallying countries and operation types; and the caveats—self-reporting, annual churn, and the listing-is-not-approval trap—that every analyst must internalize.

What the dataset is

The FDA maintains a single combined system for two related obligations that fall on medical-device firms: establishment registration and device listing. Registration is the firm telling the FDA that a particular facility exists, where it is, and who operates it. Listing is the firm telling the FDA which devices that facility handles, identified by the FDA's device product codes. The two are bundled because they answer complementary questions—where are devices made and handled, and what devices are made and handled there—and together they constitute the agency's inventory of the establishments subject to its device oversight. Published through the openFDA device/registrationlisting endpoint and the FDA's public establishment-registration database, the registry comprises roughly 324,000 registered establishments worldwide.

In our database this record is stored as the table fda_device_establishments, with the grain of one row per registered establishment. A firm that operates three plants registers three establishments and contributes three rows; a single plant that both manufactures and repackages still registers once but declares multiple operations. The columns capture the facility's identity, location, the owner-operator above it, the operations it performs, and the products it lists:

fei_number                  -- FDA establishment identifier (the durable key)
registration_number         -- annual device registration number
owner_operator_number       -- the firm that owns/operates the establishment
firm_name                   -- the establishment / facility name
iso_country_code            -- country of the establishment (US = domestic)
state_code                  -- state, for US establishments
city                        -- establishment city
establishment_type          -- operation(s): manufacturer, repackager, etc.
us_agent_name               -- required US agent for foreign establishments
-- nested products[] (one entry per listed device):
product_code                -- FDA device product code (joins classification)
device_name                 -- the listed device proprietary/common name
device_class                -- regulatory class (1, 2, or 3) of the product code
k_number / pma_number       -- the clearance/approval tied to the product

The fei_number is the load-bearing column. The FDA establishment identifier (FEI) is a durable, facility-level number the agency assigns to a physical establishment and keeps stable across years and across FDA programs, including inspections. The annual registration number, by contrast, is tied to the yearly registration cycle. The two play different roles: the FEI is what lets an analyst follow the same plant over time and across the inspection, recall, and import-refusal records, while the registration number ties a row to a specific registration year. The establishment_type field is the substantive payload—it declares what the facility does to the devices it handles—and the nested products array is what makes the registry a supply-chain map rather than a bare address book: it ties each establishment to the specific device product codes it manufactures, repackages, relabels, or imports, and those product codes are the join key out to the classification, clearance, and approval datasets.

The statutory duty and the SDWA-style frame

Device establishment registration is not optional, and it is not new. The Federal Food, Drug, and Cosmetic Act, as amended by the Medical Device Amendments of 1976—the landmark statute that brought medical devices under a comprehensive FDA premarket and postmarket regime—requires firms engaged in the manufacture, preparation, propagation, compounding, assembly, or processing of devices intended for commercial distribution in the United States to register their establishments with the FDA. The requirement reaches beyond manufacturers to the rest of the chain: repackagers, relabelers, specification developers, and the importers who bring foreign-made devices into the country all carry registration duties. The implementing regulations live in the device quality and registration parts of Title 21 of the Code of Federal Regulations, principally 21 CFR Part 807, which sets out who must register, what they must list, and the annual cycle.

Two features of that regime define the dataset's shape. The first is that registration is an annual obligation: establishments must register, and pay an annual establishment registration fee, each fiscal year, and re-list the devices they handle. This annual cadence is why the registry is best read as a current-year snapshot of the active supply chain rather than a permanent historical archive—a firm that stops paying and re-registering drops out of the active set. The second is the worldwide reach: the duty applies to a facility because of where its devices are sold, not where the facility sits. A contract manufacturer in Shenzhen or a finishing plant in Costa Rica that makes devices destined for the US market must register with the FDA exactly as a plant in Ohio must. The registry is therefore not a map of American factories; it is a map of the global supply chain that feeds the American patient, which is the single most important thing to understand about its contents.

Registration is not approval or clearance

The most consequential misconception about this dataset—and one the FDA goes out of its way to rebut—is that a registered establishment, or a listed device, has been approved or endorsed by the agency. It has not. Registration is a notification: the firm has told the FDA that the establishment exists and what it does. Listing is a disclosure: the firm has told the FDA which devices the establishment handles. Neither is a finding by the FDA about the safety, effectiveness, or quality of the firm or its devices. The agency states the point flatly: registration and listing do not denote approval of the establishment or its devices.

This distinction is not academic, because it is routinely exploited. Some firms— particularly importers and sellers of lower-tier devices—market themselves as “FDA Registered” or display an “FDA Registration Number” in a way designed to suggest the FDA has vetted and blessed the product. The FDA explicitly warns that it does not issue registration certificates and that firms may not use their registration to imply FDA approval; the agency considers such marketing misleading. The analytic consequence is precise: the existence of a row in fda_device_establishments, and even the listing of a device against a product code, tells you the firm fulfilled a notification duty and is on the FDA's radar for inspection—it tells you nothing about whether any device was cleared under a 510(k), approved under a PMA, or merely exempt or unreviewed. Regulatory standing must be read from the clearance and approval datasets joined in by product code and application number, never inferred from the bare fact of registration.

The FEI key and the owner-operator structure

The registry has a deliberate two-level structure that mirrors how device businesses are actually organized, and getting it right is essential to any honest count. At the bottom is the establishment: a physical facility, identified by its FEI number and, for the current cycle, its registration number. Above it sits the owner-operator: the corporate entity that owns or operates the establishment, identified by an owner-operator number. The relationship is one-to-many—a single owner-operator can own many establishments—and it is the distinction between a company and its plants. A large device maker may be one owner-operator with a dozen registered establishments scattered across several countries.

This structure is why naive counts mislead. Counting distinct firm names overstates the number of independent businesses, because the same corporate group appears under slightly different establishment names; counting registration numbers conflates the annual cycle with facility identity; and counting owner-operators understates the physical footprint, because it collapses many plants into one. The disciplined approach is to count distinct FEI numbers when the question is about facilities—how many plants make a given device, how many are foreign, how many have never been inspected—and to roll up to the owner-operator only when the question is genuinely about firms. Because the FEI is stable across the FDA's inspection and compliance systems, it is also the key that turns the registry from a static directory into something dynamic: the same FEI that registers a plant this year is the FEI on the inspection record, the warning letter, and the import refusal, so the registry can be joined to the agency's enforcement history one facility at a time.

Operation types: who does what to the device

The reason the registry is a supply-chain map and not just a list of buildings is the establishment_type field, which records the operations a facility performs on the devices it handles. A single device flows through several distinct kinds of establishment, each of which registers in its own right, and the operation types name those roles. Understanding them is the difference between reading the registry as a flat census and reading it as a description of how a device is actually produced and brought to market.

A manufacturer makes a finished device—the archetypal producer. A contract manufacturer makes devices to another firm's specifications under contract; in the device world a great deal of physical production is outsourced this way, so the contract manufacturer is often the facility where the device is actually built while a different firm's name appears on the label. A specification developer designs a device and develops its specifications but does not itself manufacture it—the “brand owner” that owns the design and hires a contract manufacturer to build it. A repackager takes a finished device and packages it into different containers, often for distribution or institutional use, while a relabeler changes the labeling without changing the device—putting a distributor's or hospital system's name on the box. A contract sterilizer sterilizes devices made by others. And the initial importer is the US-based party that first receives a foreign-made device for import into the country—the entry point in the chain and a registration duty distinct from the foreign manufacturer's own. Many establishments declare more than one operation, and the combinations are themselves informative: a facility that is both a contract manufacturer and a contract sterilizer occupies a different node in the chain than a pure relabeler. Aggregating these operation types is how an analyst sizes each layer of the supply chain—how much of the registry is genuine manufacturing versus repackaging, relabeling, and importing.

The foreign supply chain and the US-agent rule

The most striking fact the registry reveals is how much of the US medical-device supply chain is foreign. Because the registration duty follows the market rather than the geography of the plant, a large share of registered establishments sit outside the United States—heavily concentrated across Asia, with substantial numbers in Europe and in the nearshore manufacturing corridors—reflecting decades of offshoring and contract manufacturing in the device industry. Splitting the registry into domestic and foreign establishments, and then ranking foreign establishments by country, produces one of the cleanest available pictures of where the devices Americans use are actually made and handled, independent of whose brand is on the label.

Foreign registration carries an additional structural requirement that shows up in the data: the US agent. Every foreign establishment that registers must designate a US agent—a person or entity physically located in the United States—who serves as the FDA's point of contact for that foreign facility: answering questions, assisting with communications, and, importantly, helping to schedule inspections. The US agent is not the importer and not the regulatory submitter; it is a liaison. For analysts, the US-agent field has a secondary, less obvious use: because a single US agent often represents many foreign establishments, the agent record can cluster otherwise-unrelated foreign facilities that share a common consulting or representation relationship, which can be a useful lens on how foreign device firms enter the US market. The foreign share, combined with the US-agent and initial-importer structure, is exactly the information a supply-chain or import-risk analysis needs: it identifies which facilities, in which countries, are subject to FDA inspection and through which US-side parties their devices actually cross the border.

Joining to classification, 510(k), and PMA data

The registry is most valuable not in isolation but as the supply-chain layer of the FDA's integrated device data, and the product codein the nested products array is the universal join key. Three joins matter most.

The first is to the device-classification database. Every device product code maps to a generic device type with a regulatory class (Class I, II, or III), a device panel (the medical specialty), and the regulatory controls that apply. Joining fda_device_establishments to the classification data by product code is what lets an analyst interpret a listing in regulatory context: it is the classification database that says whether a product code is a low-risk Class I device exempt from premarket review or a high-risk Class III device requiring a PMA, the medical area it belongs to, and the premarket pathway it should have travelled. Without that join, a listed product code is an opaque alphanumeric; with it, every establishment's product mix can be characterized by risk class and clinical area.

The second and third joins are to the clearance and approval records—the 510(k) premarket notification database and the PMA premarket approval database—which share the same product codes and frequently the application numbers that the listing carries. Joining establishments to 510(k) and PMA records lets an analyst connect the facility that makes or handles a device to the regulatory decision that authorized that type of device to market, and to ask the questions the registry alone cannot: for a given device type, which establishments handle it and where are they; for a given country, what risk classes of device flow from it; and, paired with the recall and inspection records keyed by the same FEI, which facilities making higher-risk devices have the most troubled compliance histories. The registry supplies the who and where; the classification, 510(k), and PMA datasets supply the what and the under what authority; and the product code is the thread that stitches them together.

Analytical uses

A worldwide, facility-resolved, product-code-tagged census of the device supply chain supports a distinctive set of analyses that no single regulatory-decision dataset can.

Supply-chain geography is the most immediate use. Splitting establishments into domestic and foreign and ranking countries reveals where devices—and which classes of device—are actually made and handled, a picture independent of brand and far more honest about reliance on offshore manufacturing than any label discloses. Layered with the operation types, it separates genuine manufacturing from the repackaging, relabeling, and importing tiers, sizing each layer of the chain.

The inspection universe is the second. Because the FEI is the same identifier the FDA uses for inspections, the registry defines the population of facilities the agency is responsible for overseeing—the denominator against which inspection coverage is measured. An analyst can ask what fraction of registered establishments, especially foreign ones making higher-risk devices, have ever been inspected, and where the inspection program's reach is thinnest. Firm and product-type mapping is the third: tracing which firms handle which device types, how concentrated the supply of a given device type is among a few establishments, and which specification developers depend on which contract manufacturers—the kind of concentration and single-point-of-failure analysis that device shortages have made urgent. Finally, import-risk profiling brings the foreign, US-agent, and initial-importer structure together to identify which facilities, in which countries, through which US-side parties, feed higher-risk devices into the market—exactly the targeting information a risk-based import and inspection program needs.

Python workflow: domestic vs foreign and operation types

The script below pulls registered establishments from the openFDA device/registrationlisting endpoint and computes the two headline cuts: the domestic-versus-foreign split with the top countries of registration, and a tally of the operation types that distinguish manufacturers from repackagers, relabelers, and importers. It uses the openFDA count parameter for the country split—a fast server-side aggregation that does not download individual records—and pages a bounded sample for the operation-type tally, since those codes live in a per-establishment array. No API key is required for light use; a free key raises the limits, and any national-scale pull should use one and page the full result set.

import requests, pandas as pd
from collections import Counter

# openFDA Device Registration & Listing API
# Endpoint: https://api.fda.gov/device/registrationlisting.json
# No API key required for <= 240 requests/min and 1,000/day.
# Register at https://open.fda.gov/apis/authentication/ for a
# higher ceiling (120,000 requests/day) before any full pull.
#
# This script:
#   1. Splits registered establishments into domestic vs foreign
#   2. Tallies the top countries of registration
#   3. Tallies the operation types (manufacturer, repackager, etc.)
BASE = "https://api.fda.gov/device/registrationlisting.json"


def count_field(field, search=None):
    # The openFDA count parameter returns server-side term
    # frequencies without transferring individual records -- the
    # efficient way to size a field before downloading any rows.
    params = {"count": field}
    if search:
        params["search"] = search
    r = requests.get(BASE, params=params, timeout=60)
    r.raise_for_status()
    return {row["term"]: row["count"] for row in r.json().get("results", [])}


# --- 1. Domestic vs foreign ---------------------------------------
# The establishment address lives under registration.iso_country_code.
# US-coded establishments are domestic; everything else is foreign.
by_country = count_field("registration.iso_country_code")
total = sum(by_country.values())
domestic = by_country.get("US", 0)
foreign = total - domestic
print(f"Establishments tallied: {total:,}")
print(f"  Domestic (US):  {domestic:,} ({domestic / total:.1%})")
print(f"  Foreign:        {foreign:,} ({foreign / total:.1%})")


# --- 2. Top countries of registration -----------------------------
print("\nTop 15 Countries by Registered Establishment Count")
print("-" * 52)
for code, n in Counter(by_country).most_common(15):
    share = n / total
    print(f"{code:<6} {n:>9,}  ({share:6.2%})")


# --- 3. Operation types -------------------------------------------
# Each establishment declares one or more operations it performs on
# the devices it handles -- the field that distinguishes a
# manufacturer from a contract manufacturer, repackager, relabeler,
# specification developer, or importer. The count parameter is not
# reliably exposed for establishment_type, so page a bounded sample
# and tally the per-establishment array directly.
def fetch(search=None, page=1000, cap=5000):
    rows, skip = [], 0
    while skip < cap:
        params = {"limit": page, "skip": skip}
        if search:
            params["search"] = search
        r = requests.get(BASE, params=params, timeout=120)
        if r.status_code == 404:            # openFDA 404s on empty pages
            break
        r.raise_for_status()
        batch = r.json().get("results", [])
        if not batch:
            break
        rows.extend(batch)
        if len(batch) < page:
            break
        skip += page
    return rows


sample = fetch(cap=5000)
op_counter = Counter()
for est in sample:
    for op in est.get("establishment_type", []) or []:
        op_counter[op] += 1
print("\nOperation Types (sampled establishments)")
print("-" * 52)
for op, n in op_counter.most_common():
    print(f"{op[:42]:<44} {n:>6,}")

Two practical notes apply. First, the operation-type tally in the script is computed from a bounded sample for illustration; a rigorous count must page the full result set, because the operation mix in the first few thousand establishments is not guaranteed to match the registry as a whole. Where the openFDA count parameter is available for a field, it is the efficient way to get the authoritative full-registry tally without downloading every row—but it is not reliably exposed for the establishment-type field, which is why the script pages the array directly. Second, the country split keys on the establishment's own country code, not the owner-operator's: a US-headquartered firm with a plant abroad registers that plant as foreign, which is the correct supply-chain reading—the question the registry answers best is where the work is physically done, not where the corporate parent is incorporated. For national-scale work, the FDA's downloadable registration-and-listing files are far more efficient than thousands of paginated API calls and ship with the authoritative field definitions.

Limitations and analytical caveats

The device establishment registry is the most comprehensive public map of the medical-device supply chain that exists, but it carries structural limitations that an analyst must internalize before drawing conclusions from it.

Registration is self-reported, and it is not approval.The registry is built from disclosures firms are legally required to make, but it remains a firm-supplied notification, not an FDA verification. The presence of an establishment certifies that a firm fulfilled a registration duty; the listing of a device against a product code certifies that a firm declared it handles that type of device. Neither certifies that the FDA reviewed, cleared, approved, or endorsed anything. Treating “is registered” or “has a listing” as a proxy for “FDA-approved” is the central category error this dataset invites, and the one its own marketing misuse most depends on.

The registry churns annually and is a snapshot, not a ledger.Because registration must be renewed and paid for each fiscal year, the active registry reflects who registered this cycle. Firms enter and leave; an establishment that ceases US distribution, or simply fails to re-register, drops out of the active set even if the physical plant still exists. The dataset is therefore an authoritative picture of the current supply chain and recent years, not a complete historical record of every facility that ever made a device for the US market. Trend work across years must account for this annual cycle, and absence from the current registry is not proof a facility never operated.

Counts depend entirely on the unit you choose. The two-level establishment-versus-owner-operator structure means a careless count will measure the wrong thing. Counting firm-name strings overstates independent businesses because of name variants within a corporate group; counting registration numbers conflates the annual cycle with facilities; counting owner-operators collapses many plants into one. Facility-level questions belong on distinct FEI numbers; firm-level questions belong on owner-operators; and any published number should state which unit it counted, because the three answers can differ by a wide margin.

A listing describes a duty, not a current activity, and the product code is coarse. An establishment's listed operations and product codes describe what it is registered to do, which may lag what it is actively doing in a given month, and the product code identifies a generic device type rather than a specific cleared model—many distinct devices share one product code. The full texture of a facility's regulatory standing—which exact devices were cleared or approved, and its inspection and recall history—lives in the clearance, approval, inspection, and recall datasets, joined in by product code and FEI. Held with these caveats in mind, the fda_device_establishments table is a uniquely valuable resource: a worldwide, facility-resolved, product-code-tagged map of who makes, repackages, relabels, and imports the devices that reach American patients—the supply-chain layer beneath the clearance, approval, and recall records that the rest of the device data only sees device by device.