Risk Management: ISO 14971 and the FEUM Medical Device Supplement

1. Key takeaways

Mexico draws its risk management requirements from two lines of sources. NOM-241-SSA1-2025 requires risk management to be established at the level of the quality system and expressly references the chapter of the FEUM medical device supplement on the application of risk management to medical devices. NOM-137-SSA1-2025 goes further and requires that the design of the labelling itself be supported by the manufacturer’s documented risk management process. ISO 14971 serves as the universal evidence base for both, but what is distinctive about Mexico is that risk management is pushed all the way down to the labelling layer. A risk management file written only for the device as a whole, without traceability into symbols, warnings and contact details on the label, will not cover the second of the two lines.

• NOM-241-SSA1-2025 establishes risk management at system level and references the FEUM supplement.
• NOM-137-SSA1-2025 requires labelling design to be supported by a documented risk management process.
• ISO 14971 is the common evidence base across both requirements.
• Risk management files must be living documents that receive post-market signals and are updated accordingly.

2. Legal basis

Four sources define the framework. NOM-241-SSA1-2025, published in the Diario Oficial de la Federacion on 4 April 2025, treats risk management as broader than quality risk management, gives it wider system coverage, and references the relevant chapters of the FEUM supplement. The FEUM Suplemento para Dispositivos Medicos, edition 5.0 (2023), contains the chapter on the application of risk management to medical devices. NOM-137-SSA1-2025, published on 19 May 2026, requires any labelling design to be supported by a documented risk management process. Finally, Article 179 of the Reglamento de Insumos para la Salud, as amended by the order published on 24 April 2026, requires the dossier to contain scientific and technical information demonstrating safety and efficacy. The table below consolidates these sources.

3. Expert insights

Insight 1: Mexico has written risk management into the labelling requirements. NOM-137-SSA1-2025 requires labelling design to be supported by a documented risk management process, a requirement that most markets do not impose. Which symbols appear on the label, which warnings are included and which contact details are provided must all be traceable back to the risk management documentation. Companies whose label artwork historically evolved through marketing decisions rather than documented risk decisions will need to reconstruct that traceability for the Mexican file, and this reconstruction is best started early because it touches artwork, documentation and review cycles simultaneously.

Insight 2: the wording of the 2025 edition is broader than the 2021 edition. The 2021 edition leaned towards the language of quality risk management, while the 2025 edition is no longer limited to quality risk management, allows broader system coverage, and expressly references the FEUM supplement. In practical terms this means a risk management file aligned only with the narrower 2021 language may under-describe the scope of activities now expected, and the broader framing should be reflected in the procedures and records that the quality system maintains.

Insight 3: risk management and post-market surveillance form a closed loop. Article 262 Bis of the Ley General de Salud, added through the amendment order published in the Diario Oficial de la Federacion on 15 January 2026, elevates post-market surveillance to a statutory requirement. Risk management documentation must be able to receive post-market signals and be updated in response, rather than standing as a static file prepared once for the dossier. Building the update mechanism into the document control procedure, with defined triggers and owners, is what turns the closed loop from a principle into a practice.

Insight 4: the simplified pathway also requires a risk analysis summary. Although the simplified pathway exempts applicants from submitting the full clinical report and the underlying raw data, the risk analysis summary remains on the submission list and must be consistent with the reference version. A summary that diverges from the reference product’s risk analysis, even where the underlying device is equivalent, invites questions about the comparability of the two, so consistency should be checked line by line before filing.

Insight 5: adverse event reporting guidance enters the label. NOM-137-SSA1-2025 requires the labelling to provide contact details for users who experience an adverse event, including the contact details of the competent authority, which connects the package directly to the manufacturer’s internal post-market surveillance unit. The label therefore functions as the entry point of the vigilance chain, and the information printed on it must match the surveillance organisation behind it, not merely exist.

4. Practical recommendations

• Structure the risk management documentation along ISO 14971 and add a dedicated section mapping the file against the relevant chapters of the FEUM supplement.
• Create risk management records for labelling design, so that every symbol, warning and contact detail has a corresponding documented risk decision behind it.
• Give the risk management file a versioning and update mechanism, so that vigilance signals feed into revisions on a defined schedule.
• For simplified pathway applications, prepare a one-page risk analysis summary that stays consistent with the reference version.
• Keep the adverse event reporting contact details on the label consistent with the technical vigilance unit information of the registration holder.

5. Verification checklist

• □ The risk management documentation follows the ISO 14971 structure.
• □ A mapping against the risk management chapters of the FEUM supplement is included.
• □ Labelling design is supported by documented risk management records.
• □ The risk management file has a versioning and update mechanism.
• □ A risk analysis summary has been prepared for the simplified pathway.
• □ The adverse event contact details on the label are consistent with the technical vigilance unit.

Legal information verified as of 28 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Mexican market. Our team manages COFEPRIS registrations and equivalence (equivalencia) reviews, coordinates third-party authorised centre routes, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com