Software as a Medical Device and Digital Health Regulation in Mexico

1. Key takeaways

Mexico regulates software as a medical device through three instruments. The FEUM Suplemento para Dispositivos Medicos, edition 5.0 (2023), brought standalone software into the definition of a device for the first time and set out the classification rules. NOM-137-SSA1-2025 established labelling rules for software as a medical device for the first time, requiring that the version identification or release date be accessible on the digital interface. And the Ley General de Salud, amended by the order published in the Diario Oficial de la Federacion on 15 January 2026, added the digital health and telemedicine provisions, Articles 71 Bis through 71 Octies. Together the three instruments cover what a SaMD is, how it is classified, how it must be labelled, and where algorithms and platforms sit in the health system, so a Mexican SaMD project touches all three from the outset.

• Standalone software is within the device definition under FEUM supplement edition 5.0 and is classified under its Article 16 rules, landing in Class I, II or III.
• NOM-137-SSA1-2025 requires version identification or release date to be accessible on the digital interface.
• Electronic labelling may supplement but never replace or contradict the approved labelling information.
• Articles 71 Bis to 71 Octies of the LGS bring algorithms and platforms into the statute.

2. Legal basis

Four sources carry the framework. The FEUM Suplemento para Dispositivos Medicos, edition 5.0 (2023), incorporates standalone software into the device definition and classifies software under the rules of its Article 16, which can place it in Class I, II or III. NOM-137-SSA1-2025, published on 19 May 2026, governs SaMD labelling: the version identification or release date must be accessible on the digital interface, and the electronic label may only supplement the approved information. The Ley General de Salud, as amended by the order published on 15 January 2026, adds Articles 71 Bis through 71 Octies on digital health and telemedicine and Article 262 Bis on post-market surveillance. Finally, NOM-241-SSA1-2021, in its term 3.31 (published on 20 December 2021), defines devices to include the computer programs necessary for their proper use or application. The table below consolidates these sources.

3. Expert insights

Insight 1: the definition and the classification live in two different places. The definition of standalone software sits in edition 5.0 of the FEUM supplement, and the classification rules are its Article 16. Software can land in Class I, II or III depending on its intended use, which means the classification argument must be built product by product rather than assumed category-wide. Reading the two provisions together, before any development claim is drafted, prevents the common error of describing a product as low risk when the intended use claimed in the marketing material would place it higher.

Insight 2: the first standalone software device has already been approved through the equivalence procedure. According to the practical estimate, COFEPRIS approved the first standalone software device through the equivalence procedure in May 2024, which shows that the route has been exercised rather than existing only on paper. This information is handled as a practical estimate. For applicants, the significance is that the equivalence pathway is available in principle for software, and the approval can be cited as precedent support when building an equivalence argument for a comparable product.

Insight 3: version identification is the compliance pivot for SaMD. NOM-137-SSA1-2025 requires the version identification or release date to be easily accessible on the digital interface. This connects directly with the requirement of the simplified pathway that the product be fully identical to the reference: a different version means a different product. Version governance therefore sits at the intersection of labelling compliance and registration strategy, and the version shown to the user, the version recorded in the dossier and the version tested by the laboratory must all be one and the same.

Insight 4: the electronic label may supplement but not substitute. The new standard permits technologies such as QR codes, barcodes or RFID to supplement sanitary information, but they cannot replace or contradict the labelling information approved in the registration. The registration number, batch number, expiry date and warnings must be presented physically. The design rule is easy to state and easy to get wrong in practice, so every electronic element should be reviewed against the question of whether the approved information would still be complete if the electronic layer failed.

Insight 5: the digital health provisions bring algorithms and platforms into the statute. Articles 71 Bis through 71 Octies of the LGS, added through the amendment order published on 15 January 2026, set rules for the use of algorithms and platforms in health services. Diagnostic applications and telemedicine platforms accordingly enter the scope of scrutiny of COFEPRIS. Companies operating at the boundary between a wellness product and a diagnostic tool should assess these provisions at the same time as the device classification, since the two analyses inform each other and the statutory layer now reaches further than the device-specific rules alone.

4. Practical recommendations

• Determine first whether the software product is a device under edition 5.0 of the FEUM supplement, then classify it under the rules of Article 16, and record the reasoning in the classification argument.
• Explain the operating platform and the data interface protocols in the dossier, and include the human factors and cybersecurity assessment records.
• Present the version identification consistently in the labelling and on the digital interface, and lock the version number when filing through the simplified pathway.
• Design the electronic label on the principle of supplementing without replacing, keeping the critical information physically presented.
• Where telemedicine or diagnostic algorithms are involved, assess the applicability of Articles 71 Bis to 71 Octies of the LGS at the same time.

5. Verification checklist

• □ The product has been qualified as a device under edition 5.0 (2023) of the FEUM supplement.
• □ The product has been classified under the rules of Article 16.
• □ The version identification is accessible both in the labelling and on the digital interface.
• □ The dossier contains the operating platform and data interface descriptions.
• □ The electronic label design complies with the supplement-without-replacing principle.
• □ The applicability of Articles 71 Bis to 71 Octies of the LGS has been assessed.

Legal information verified as of 28 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Mexican market. Our team manages COFEPRIS registrations and equivalence (equivalencia) reviews, coordinates third-party authorised centre routes, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com