AED Program Management: Registration, Maintenance, and Compliance Requirements

Buying the right AED is a one-time decision. Keeping it legally compliant and actually rescue-ready is not — it is an ongoing program with its own recurring obligations: registering the unit where your state requires it, tracking two independent consumable-expiration clocks, keeping a rotating roster of staff currently certified to use it, and knowing exactly what has to be reported, to whom, after the device is ever actually deployed. This guide is written for the hospital patient-safety officers, quality directors, risk managers, clinic administrators, and facilities/safety managers who own that ongoing program — not the purchasing decision itself, which CASRAI’s AED buying guide already covers (waveform, pediatric readiness, total cost of ownership, and the initial regulatory baseline). This page picks up exactly where that one leaves off: what happens after the device is on the wall.

State PAD Registration and Notification: Why “Check Your State” Is the Correct Answer, Not a Cop-Out

Public Access Defibrillation (PAD) is regulated almost entirely at the state level in the U.S. There is no single federal registration requirement for where an AED is physically located. The federal Cardiac Arrest Survival Act of 2000 extended Good Samaritan liability protection to AED use on federal property and encouraged states to pass their own PAD statutes, but it did not create a national registry or a uniform set of obligations — each state built its own PAD law independently, and the details genuinely diverge.

Even though the specifics vary, most state PAD statutes converge on the same handful of program elements, which is why they are worth planning for as a set rather than researching from zero in each state you operate in:

• Location registration or notification. Many states require (or strongly encourage) registering the AED’s physical location with local EMS or the 9-1-1 dispatch center, so a dispatcher can direct a caller to the nearest unit during an actual event. Some states route this through the state health department instead of, or in addition to, EMS. A small but growing number of jurisdictions tie registration to a specific public database (e.g., a state-run or PulsePoint-style AED locator) rather than a one-time filing.
• Physician or medical director involvement. Several states’ PAD statutes require some form of physician oversight of the program — historically inherited from the era when AEDs were prescription devices, and still present in many state statutes even after the FDA’s 2019 rule made most AEDs non-prescription at the federal level. Where a state still requires medical direction, it typically covers program design, training oversight, and post-event review, not day-to-day operation.
• Maintenance and inspection expectations. Some states write manufacturer-recommended maintenance into the statute directly; others leave it implicit and enforce it through the Good Samaritan protection itself (protection can be conditioned on the device having been properly maintained at the time of use).
• Good Samaritan protection, and what voids it. Every state provides some form of civil liability protection for a person who uses an AED in good faith during an emergency. What is not uniform is whether that protection is unconditional or contingent on the facility having met its own registration/maintenance/training obligations — in some states, a poorly maintained or unregistered unit can weaken the facility’s (though rarely the rescuer’s) liability position.

Because this genuinely varies by state and changes as legislatures amend PAD statutes, the operationally correct move is to confirm your specific state’s current requirements directly with your state health department or EMS office — the same guidance CASRAI’s buying guide gives for the purchase decision applies with even more force to the ongoing program, since registration and reporting obligations are exactly the kind of detail that gets missed once the initial purchase excitement is over. Build state-specific confirmation into your program’s annual review cycle, not just its initial setup.

Tracking Two Independent Expiration Clocks, Not One

An AED program’s most common compliance failure isn’t a missing registration — it’s an expired pad or battery on a device nobody noticed had gone stale, because the tracking system treated “check the AED” as one task instead of at least two independent dated ones:

• Electrode pads ship pre-gelled and have their own shelf-life expiration date, typically printed directly on the pad packaging, independent of whether the unit has ever been deployed.
• The battery has a separate expiration or service-life date, and most current-generation AEDs run a daily or weekly automated self-test that will flag battery failure — but a self-test indicator is not a substitute for a documented, dated inspection log; it’s a supplementary signal, and self-test failures still need a human response loop, not just a blinking light nobody is assigned to check.
• Facilities with pediatric exposure are tracking a third and fourth date if they stock a separate pediatric pad/attenuator set, which is a lower-volume SKU that expires on its own schedule and is the single easiest item to let lapse unnoticed, as CASRAI’s buying guide notes.

The practical fix is the same discipline CASRAI’s biomedical equipment inventory management guide describes for any dated medical device: one inventory record per physical unit, per consumable, with its own expiration field, reviewed on a fixed cadence rather than “whenever someone remembers.” A monthly physical/visual check — confirming the ready indicator, verifying both expiration dates are still current, and confirming the cabinet/case and any wall-mounted alarm are intact — is the operational minimum most programs run, and it maps directly onto the routine walkthrough cadence covered in CASRAI’s Environment of Care rounds checklist. Document the check itself, not just the outcome: a signed/dated log line (“checked, both dates current, self-test passed”) is what a surveyor or an internal auditor can actually verify months later; a device that merely “gets looked at” leaves no evidence trail.

Keeping Staff Training Current, Not Just Initially Certified

An AED program’s staffing plan has to answer two separate questions: who is trained, and how do you know their training is still current. American Heart Association (AHA) and American Red Cross CPR/AED certification cards are issued on a two-year cycle — a card that was valid at initial hire or initial rollout is not evidence of current competency two years later, and a program that tracks “staff completed AED training” as a one-time checkbox rather than a recurring, expiring credential will accumulate lapsed certifications quietly, exactly the way pad/battery dates lapse quietly.

Two design decisions shape how much of this burden a program carries:

• Designated-responder vs. universal-access training. Some facilities train a specific, smaller roster of designated responders (front-desk staff, security, a facilities team) and rely on that roster during an event. Others train broadly across all staff, on the reasoning that most real-world AED use is by whichever bystander happens to be nearest, not necessarily a designated responder — AED interfaces are specifically designed with voice/visual prompting for exactly this reason. The broader the trained population, the larger the recurring recertification workload, but the shorter the realistic response time to a witnessed collapse anywhere in the facility.
• A tracked roster with expiration dates, not a training log. A spreadsheet or LMS record showing who is certified and through what date — reviewed on the same cadence as the device inventory check — is what turns “we trained people once” into an actual program. This is the same record a state medical-director-oversight requirement (where one applies) and an accreditation survey both expect to see produced on request, not reconstructed after the fact.

After an Actual Use: Medical Review and Regulatory Device Reporting

An AED deployment triggers obligations that are easy to overlook in the adrenaline of the event itself, because they happen after the emergency is over and the patient has been transferred to EMS or a receiving facility.

Medical direction review. Where a state PAD statute (or internal policy) assigns a medical director to the program, that person’s role includes a post-event review of what happened — not to second-guess the rescuer, but to confirm the device performed as expected, capture any device-recorded event data for the clinical record, and identify whether anything in the program (training gap, device issue, access delay) needs correcting before the next event.

FDA device reporting, if your facility is a “user facility” under federal law. Hospitals, nursing homes, and ambulatory surgical/outpatient treatment facilities are device user facilities under FDA’s Medical Device Reporting regulation, 21 CFR Part 803 — a category that generally does not extend to a workplace, gym, school, or house of worship that owns an AED purely for public-access use, but squarely applies to the hospitals and clinics CASRAI’s audience typically operates. For a covered user facility, the reporting obligations that can be triggered by an AED-related death or serious injury are:

• A death reasonably suggested to be device-related must be reported to both FDA and the device manufacturer within 10 working days of the facility becoming aware of it.
• A serious injury reasonably suggested to be device-related must be reported to the manufacturer within 10 working days (and to FDA as well only if the manufacturer is unknown).
• User facilities must maintain an MDR event file documenting their own reportability determination for each event, retained for two years from the date of the event (21 CFR 803.18).
• A user facility that filed one or more MDR reports in a given year must also submit an annual report to FDA by January 1 on Form FDA 3419, summarizing the reports filed that year (21 CFR 803.33); a facility that filed zero reports in the period is not required to submit the annual report at all.

This device-reporting obligation is separate from, and in addition to, any state-level post-use reporting a PAD statute may require (some states ask for a post-use report to the state EMS office or health department specifically because AED events feed public-health cardiac-arrest surveillance, independent of the federal MDR framework). Build both into the same post-event checklist so neither gets missed while the other is being handled — a program that only tracks the state PAD report, or only tracks the FDA MDR obligation, will eventually miss the one it wasn’t watching.

Where This Sits in Your Broader Equipment Management Program

For hospitals and other accredited facilities, an AED program doesn’t stand alone — it’s one specific, high-stakes instance of the equipment-risk management obligation covered generally in CASRAI’s medical equipment management plan guide, which walks through what Joint Commission standard EC.02.04.01 requires the written plan itself to specify: inventory scope, maintenance-interval assignment, and the incident-investigation process. An AED-specific program should be traceable back into that same document rather than run as an informal side process that a surveyor’s tracer methodology can’t connect to the facility’s stated equipment-management plan. In practice that means the AED inventory, its maintenance/inspection log, its training roster, and its post-use reporting procedure should all be things a reviewer can locate by following the equipment plan’s own stated process — not a parallel system that exists only because whoever set up the AEDs happened to also run point on this specific device.

A Practical AED Program Compliance Checklist

• Confirm your state’s current PAD registration/notification requirement directly with the state health department or EMS office, and re-confirm annually — statutes change.
• Register the unit’s location wherever your state requires it (EMS/9-1-1 dispatch, a state health department filing, or a public locator database), and keep that registration current if the unit is ever relocated.
• Identify whether your state’s PAD statute still requires physician/medical-director oversight, and if so, name that person formally in your program documentation.
• Maintain one inventory record per physical unit tracking pad expiration, battery expiration, and (if applicable) pediatric pad/attenuator expiration as three separate dated fields, not one.
• Run a documented monthly visual/self-test check per unit, logged with a signature and date — not just a passive reliance on the device’s own self-test indicator.
• Track staff AED/CPR certification on a roster with expiration dates (AHA/ARC cards are valid two years), reviewed on the same cadence as the device inventory.
• Decide deliberately between a designated-responder model and universal-access training, and size your recertification workload accordingly.
• Build a single post-use checklist covering medical-director review, any state-required post-use report, and federal MDR reporting (21 CFR Part 803) if your facility is a device user facility.
• Retain the MDR event file for each reportable event for two years, and confirm whether your facility’s annual FDA report (Form 3419, due January 1) is required for the period.
• Fold the AED program into your facility’s broader medical equipment management plan documentation so it’s traceable during an accreditation survey, not run as a standalone process.

Frequently Asked Questions

Does my state require me to register an AED?

Many states do, typically through local EMS/9-1-1 dispatch or a state health department filing, as part of a Public Access Defibrillation (PAD) statute — but requirements vary significantly by state and there is no federal registration requirement. Confirm directly with your state health department or EMS office rather than assuming a national standard applies.

How often do AED pads and batteries need to be replaced?

On the manufacturer’s stated shelf-life schedule for each consumable, which is not a single date — pads and batteries expire independently, and a facility with pediatric pad/attenuator sets is tracking a third expiration date on a lower-volume item that’s easy to let lapse unnoticed. Track each as a separate dated inventory field and check monthly.

How often does AED/CPR certification need to be renewed?

AHA and American Red Cross CPR/AED certification cards are valid for two years. A program should track certification as an expiring credential on a reviewed roster, not a one-time training record, since a card valid at initial training is not evidence of current competency two years later.

Do we have to report it if an AED is actually used?

Possibly on two separate tracks. Some state PAD statutes require a post-use report to a state EMS or health office. Separately, if your facility is an FDA device “user facility” (hospitals, nursing homes, ambulatory surgical/outpatient treatment facilities), a device-related death must be reported to FDA and the manufacturer within 10 working days, and a device-related serious injury to the manufacturer within 10 working days, under 21 CFR Part 803. Confirm both obligations rather than assuming one covers the other.

Who is responsible for AED maintenance in a facility?

Ownership varies, but the program should name a specific accountable role — often the same function responsible for the facility’s broader medical equipment management plan under Joint Commission standard EC.02.04.01 — rather than leaving inspection and expiration tracking to whoever happens to notice the device.