Legal Obligation to Establish a Tecnovigilancia Unit in Mexico

1. Key takeaways

Article 6.7.1 of NOM-240-SSA1-2012 places the statutory obligation to establish and maintain a tecnovigilancia unit (Unidad de Tecnovigilancia) squarely on the registration holder (titular). The holder must establish the unit, appoint a qualified responsible professional, and notify COFEPRIS of that person’s identity in writing. Distributors carry only a secondary obligation to report events to the holder, which means the entire vigilance architecture is anchored in the Mexican holder rather than in the foreign manufacturer. Three consecutive steps define compliance here: the unit must exist as an organisational structure, a named professional must carry responsibility for it, and the authority must be told who that professional is. Any one of the three missing leaves the obligation unmet.

• The duty holder is the registration holder, not the foreign manufacturer.
• The obligation applies to every risk class, with no exemption for Class I devices.
• Three concrete actions are required: establish the unit, appoint the professional, and notify COFEPRIS in writing.
• The 2026 amendment to the General Health Law raised post-market surveillance from guidance to statutory requirement, effective from the date of registration issuance.
• NOM-137-SSA1-2025 connects the vigilance chain to end users through label contact information.

2. Legal basis

The obligations described below derive from a small set of instruments. The key provisions, their publication dates, and their content are summarised in the table that follows, and each entry should be verified against the corresponding official text before it is relied upon in a submission or in an internal procedure. Read together, the four instruments form a single chain: the NOM establishes the unit and its reporting timelines, the amended health law makes the surveillance activity itself statutory from the moment a registration is issued, and the labelling standard carries the reporting channel out to the user.

3. Expert insights

Insight one: the obligated party is the registration holder, not the manufacturer. This allocation determines that a foreign manufacturer cannot assume that vigilance is purely an internal matter belonging to its own quality system. The unit sits within the Mexican registration holder’s organisation, and any retention of data access and reporting decision rights by the manufacturer must be secured through contractual arrangements rather than through the registration itself. In practice this means the manufacturer should map, before signing, exactly which data flows and which reporting decisions it needs to control, and then confirm each of them in writing.

Insight two: the obligation applies to all risk classes, and there is no Class I exemption. Every registered device falls within the scope of the requirement, and there is no circumstance in which a low-risk classification removes the duty to establish and maintain the unit. Companies holding only Class I registrations in Mexico should therefore budget for the same vigilance infrastructure as holders of Class III products, since the statute draws no distinction by class at this point.

Insight three: none of the three specific actions can be omitted. Establishing the unit, appointing the qualified responsible professional, and giving written notice to COFEPRIS of that person’s identity are all required. The third action is the one most frequently missed, and without the written notification the unit is not legally established, no matter how complete the internal procedures may appear on paper.

Insight four: the 2026 amendment writes post-market surveillance into the law itself. Article 262 Bis of the LGS was introduced by the amendment published in the DOF on 2026-01-15. It elevates post-market surveillance from a guidance recommendation to a statutory requirement and makes clear that the activity begins on the date COFEPRIS issues the registration. The tecnovigilancia unit is therefore no longer an item that can be backfilled after registration, and portfolio planning should treat its establishment as a launch condition rather than as a follow-up task.

Insight five: labelling connects the vigilance chain to the end user. NOM-137-SSA1-2025 requires the label to provide contact information that users can rely on when an adverse event occurs, including the contact details of the competent authority. This links the physical package directly to the holder’s post-market surveillance function and closes the loop between field events and the unit that must process them, so the printed details and the unit’s actual monitored channels must be kept identical at every label revision.

4. Practical recommendations

• Have the registration holder establish the tecnovigilancia unit and document a written standard operating procedure covering the four stages of intake, investigation, reporting, and corrective action.
• Appoint the qualified responsible professional, notify COFEPRIS in writing at the time the unit is established, and retain the acknowledgement of receipt.
• Align the start of the unit’s operation with the date of registration issuance rather than deferring it until the first event occurs.
• Write the manufacturer’s and holder’s data access rights, reporting decision rights, and time limits into the agreement between them.
• Ensure that the adverse event reporting contact information on the label is consistent with the vigilance unit’s details.

5. Verification checklist

• □ The tecnovigilancia unit has been established and a written SOP is in place
• □ The responsible professional has been appointed
• □ Written notification has been given to COFEPRIS and the acknowledgement retained
• □ The start date of the unit is aligned with the registration issuance date
• □ Data access rights and reporting decision rights are set out in the agreement
• □ The label contact information is consistent with the vigilance unit

Regulatory information verified as of 28 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Mexican market. Our team manages COFEPRIS registrations and equivalence (equivalencia) reviews, coordinates third-party authorised centre routes, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com