ISO 13485, MDSAP and NOM-241-SSA1-2025: Quality System Evidence in Mexico

1. Key takeaways

Quality system evidence for Mexico has a three-layer structure. The first layer is the certificate of good manufacturing practice issued by the competent authority of the country of origin, required by item III of Article 180 of the RIS. The second layer is the company’s own ISO 13485 or MDSAP system certificate, which is accepted as system-level evidence supporting the GMP position. The third layer is the conformity assessment under NOM-241-SSA1-2025, which is mandatory for establishments located in Mexico that market products domestically, and for which it must be remembered that holding a system certificate is not the same as Mexican conformity certification. Keeping the three layers separate in both mind and dossier is the foundation of a clean quality-system story in a Mexican submission.

• Layer 1: statutory GMP certificate issued by the competent authority of the country of origin.
• Layer 2: ISO 13485 or MDSAP system certificates accepted as system evidence.
• Layer 3: conformity assessment under NOM-241-SSA1-2025 for establishments located in Mexico.
• A system certificate does not replace Mexican conformity certification.

2. Legal basis

Four sources frame the three layers. Item III of Article 180 of the RIS, introduced by the amendment order published in the Diario Oficial de la Federacion on 24 April 2026, requires the GMP certificate issued by the health authority of the country of origin. NOM-241-SSA1-2025, published in the Diario Oficial de la Federacion on 4 April 2025 and entering into force 240 calendar days after publication, sets out good manufacturing practice for medical devices. The COFEPRIS question-and-answer guide issued together with NOM-241-SSA1-2025 states expressly that other related certifications do not substitute for conformity with the standard. Finally, the guidelines for the simplified pathway, published on 18 July 2025, accept the GMP certificate of MDSAP participants for application purposes. The table below consolidates these sources.

3. Expert insights

Insight 1: holding ISO 13485 does not mean the Mexican requirements are met. The question-and-answer guide that COFEPRIS published alongside NOM-241-SSA1-2025 states expressly that other related certifications in the industry do not substitute for conformity with the standard, nor for the corresponding certification of the manufacturing establishment. Treating ISO 13485 as a pass-through credential is the most common misjudgement in this area. The system certificate retains real value, but as supporting system evidence; it does not discharge the obligation that NOM-241-SSA1-2025 itself imposes.

Insight 2: the value of MDSAP lies in equivalence, not exemption. The guidelines for the simplified pathway accept GMP certificates issued to MDSAP participants. According to the practical estimate, COFEPRIS confirmed further on 2025-11-11 that the clauses of ISO 13485, the MDSAP audit process and the GMP requirements of reference authorities are equivalent to the system requirements of NOM-241-SSA1-2025; this position is handled as a practical estimate because no official source text has been obtained. Even where the equivalence position is relied upon, the local conformity certification step remains in place for establishments established within Mexico, so the equivalence argument does not erase the third layer of the structure.

Insight 3: the scope of application of NOM-241-SSA1-2025 is clearly defined. The standard applies to the commercialisation or supply of medical devices within Mexico and covers design, development, manufacturing, storage, including conditioning and warehousing, and distribution. The 2025 edition expressly limits its scope of application to establishments that sell health inputs within the national territory. Sites that only manufacture for export, without selling health inputs in Mexico, fall outside this stated scope, which is why the domestic-establishment trigger is assessed separately from the export plant picture.

Insight 4: the 2025 edition removed the risk classification chapter. The content of the former section 5 on the risk classification of devices was deleted, on the grounds that Article 83 of the RIS already covers the subject. Classification and the quality system now live in two separate documents, and classification rules should not be sought inside the new NOM-241. Dossiers that argue classification by reference to NOM-241 in its current edition are arguing against the structure of the sources, and the correct anchor is the RIS provision.

Insight 5: MDSAP spreads its cost across multiple market submissions. Companies that already hold MDSAP participation because of other markets, including Canada where it has been mandatory since 1 January 2019, and the United States among others, can reuse their audit reports in Mexico as system evidence, and do not need to build a separate system for Mexico. The audit effort is incurred once and harvested in each market, which is precisely why MDSAP is best understood as an efficiency instrument rather than a substitute for any local obligation.

4. Practical recommendations

• Place the three classes of documents in separate positions in the dossier: the statutory GMP certificate, the system certificates (ISO 13485 or MDSAP), and the evidence of establishment conformity.
• Where manufacturing or warehousing sites exist within Mexico, arrange the NOM-241-SSA1-2025 conformity assessment for those sites separately.
• Check system certificates against the standard version (ISO 13485:2016) and the accreditation status of the issuing body.
• When citing the MDSAP equivalence position, note that it is a practical estimate, and verify before formal submission whether the authority has issued its own text on the point.
• Support classification arguments by citing Article 83 and Article 83 Bis of the RIS together with the FEUM supplement, and do not cite NOM-241 for classification.

5. Verification checklist

• □ The statutory GMP certificate (competent authority of the country of origin) has been obtained.
• □ The system certificates (ISO 13485:2016 or MDSAP) are within their validity periods.
• □ The NOM-241-SSA1-2025 conformity assessment has been arranged for sites within Mexico.
• □ No system certificate has been used as a substitute for local conformity certification.
• □ Classification arguments do not rely on the risk classification chapter of NOM-241.
• □ The MDSAP equivalence position has been flagged as a practical estimate.

Legal information verified as of 28 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Mexican market. Our team manages COFEPRIS registrations and equivalence (equivalencia) reviews, coordinates third-party authorised centre routes, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com