Adverse Event Reporting Deadlines for Medical Devices in Mexico

1. Key takeaways

Articles 12.3.1–12.3.3 of NOM-240-SSA1-2012 divide adverse event reporting deadlines for medical devices into three tiers: two working days for events that constitute a serious threat to public health, ten calendar days for death or serious deterioration of health, and thirty calendar days for other reportable adverse events. The clock starts at the moment the responsible party becomes aware of the event, not at the moment the event occurs, which makes internal escalation speed a compliance variable in its own right. Teams that only discover an event after several layers of forwarding have already lost part of the available window before the first report is even drafted.

• Three tiers are defined by the severity of the event, not by the device class.
• The reporting clock runs from awareness by the responsible party in Mexico.
• Follow-up and final investigation reports follow, with a practical estimate of six months after the initial report.
• Tecnovigilancia reports are part of the renewal (Prórroga) dossier, so routine reporting quality feeds directly into renewal files.
• Missing a deadline is itself a violation, independent of the underlying event, and the failure shows up in the file rather than in the device.

2. Legal basis

The deadlines and the allocation of the reporting duty come from the same NOM that establishes the tecnovigilancia unit, together with the amended General Health Law provision on which statutory post-market surveillance now rests. Read as a set, the provisions fix both the speed at which events must be reported and the party in Mexico on whom that duty falls, so the holder’s internal procedures should cite each tier explicitly rather than referencing the deadlines in general terms. The table below lists each provision with its publication reference and content.

3. Expert insights

Insight one: the three tiers are set by severity, not by device class. A public health threat, a death or serious deterioration, and any other reportable event are judged by the consequences of the event, not by whether the product is Class I or Class III. A serious event involving a low-risk product falls just as squarely into the 2 working day and 10 calendar day tiers as the same event involving a high-risk device, and triage criteria should be written around event consequences for precisely this reason.

Insight two: the starting point is awareness, not occurrence. The clock begins when the responsible party in Mexico, normally the registration holder, becomes aware of the event. This converts the speed of internal escalation into a compliance variable, and it means the information path running from distributors, hospitals, and users to the holder must be short, contractually fixed, and rehearsed. Every additional intermediary in that path adds delay exactly where the regulation allows none.

Insight three: follow-up reporting has its own separate arrangement. After the initial report there are follow-up and final investigation reports, and the practical estimate is that they are submitted within 6 months of the initial report, with an extension of equivalent duration available where necessary. Teams should schedule these deliverables at the same time the initial report is filed, since an extension must be requested rather than assumed and the request itself takes preparation time.

Insight four: renewal of the registration requires tecnovigilancia reports. The renewal (Prórroga) dossier includes the tecnovigilancia report covering the corresponding period of commercialisation. The quality of everyday reporting records therefore has a direct and measurable effect on the renewal file, and gaps in routine documentation surface at exactly the moment they are most costly. Treating each routine report as renewal evidence, rather than as a one-off regulatory filing, is the safer operating posture.

Insight five: missing a deadline is a violation in itself. Even where the underlying event would not by itself lead to a sanction, failure to report on time can trigger regulatory action on its own. Managing reporting timeliness is therefore just as important as managing the events themselves, and deserves the same degree of process control, with deadlines tracked in a visible system rather than in individual inboxes.

4. Practical recommendations

• Build an event triage table so that each incoming report is tiered on the day it is received and the corresponding deadline countdown is started immediately, with the tiering decision itself documented.
• Sign information notification agreements with distributors and hospitals that fix the escalation path and internal time limits.
• Set an internal buffer for each of the three tiers, with the 2 working day tier designed for same-day response, and record the buffers in the procedure so that duty staff know them without having to calculate.
• Preset the initial report template with the nine categories of elements, including device identification, event description, patient and user information, causality assessment, and corrective actions already taken or planned.
• Schedule follow-up and final investigation reports against the 6 month mark and keep an extension request channel open.
• Archive routine reporting records on the renewal cycle so they feed directly into the renewal dossier.

5. Verification checklist

• □ The event triage table has been established
• □ Internal buffers are set for the three tiers (2 working days / 10 days / 30 days)
• □ Notification paths with distributors and hospitals have been agreed
• □ The initial report template contains the nine categories of elements
• □ Follow-up and final reports are scheduled against the 6 month mark
• □ Reporting records are archived on the renewal cycle

Regulatory information verified as of 28 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Mexican market. Our team manages COFEPRIS registrations and equivalence (equivalencia) reviews, coordinates third-party authorised centre routes, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com