The Role of ISO 13485 and Risk Management Documentation in Guatemala

1. Key takeaways

The current technical standards in Guatemala do not list ISO 13485 or ISO 14971 as mandatory submission items. Across the document lists of Article 5 of NT-37 and Article 4.1 of NT-40, the only system-related items are the good manufacturing practices certificate or other equivalent sanitary standard (Article 5.1.6 of NT-37) and the certificate of manufacturing assurance issued by the health authority (Article 6.12.6 of NT-37; Article 4.1.5 of NT-40, which lists BPM, ISO 9001, FDA, DGKC and IFCC). ISO-type certificates serve as one form of evidence of manufacturing assurance, not as an independent compliance credential in their own right. Reading the two lists carefully is therefore the first step for any quality team, because the role an ISO 13485 certificate actually plays in Guatemala is narrower than its role in jurisdictions where the standard is written into the registration requirement itself.

• Neither ISO 13485 nor ISO 14971 appears among the mandatory dossier items.
• The system-related entry for new registrations is the GMP certificate or other equivalent sanitary standard.
• The certificate of manufacturing assurance must be issued by the health authority.
• ISO 9001 is expressly named among the accepted manufacturing assurance options.
• Risk management documents operate as underlying support material, not as filed items.
• The new regulation notified as G/TBT/N/GTM/106, with a proposed effective date of 2026-12-01, may change this landscape.

2. Legal basis

The table below sets out the clauses that show where system certificates fit on the device and reagent sides, and what the document lists omit. Together they demonstrate that the acceptance of ISO-type evidence rests on the wording of specific clauses rather than on a general recognition of the standard.

3. Expert insights

Insight one: the clause turns on who issued the certificate, not on the certificate number. The common wording of Article 6.12.6 and Article 4.1.5 is “emitido por la autoridad sanitaria” — issued by the health authority. An ISO 13485 certificate issued purely by a commercial certification body has no corresponding acceptance clause in the text; what corresponds is a manufacturing assurance document that reflects endorsement by, or a recognised relationship with, the health authority. Treating an ISO 13485 certificate as an automatic passport into the dossier is therefore a planning error, and the certificate strategy should be built around which authority stands behind the document rather than around the standard it is audited against.

Insight two: the equivalent-sanitary-standard wording of Article 5.1.6 is the broadest entry point. For new device registrations the wording reads BPM or other equivalent sanitary standards, which is broader than the item-by-item enumeration of Article 6.12.6. A manufacturer can first argue that its system documentation falls within the equivalent sanitary standard wording, and then map the document to the enumerated options of Article 6.12.6 where needed. The two clauses differ in breadth and are used at different stages — the broad wording for the initial registration, the enumeration for the addition of an alternate manufacturing site — and recognising which clause governs which stage prevents a mismatch between the evidence offered and the clause invoked.

Insight three: risk management documents are an indirect obligation, not a direct one. Neither the NT-37 nor the NT-40 document list includes ISO 14971 or a risk management report. But the finished product specifications of Article 5.1.3 and the quality control certificate of Article 5.1.9 form a quality loop, and the note to Article 7 requires insert information to be verifiable — risk management documentation is the underlying material that supports that verifiability at both points. Although it is not filed separately, it is the basis on which review queries about safety and performance can be answered with substance, so it belongs in the retained file even though it never appears in the submitted dossier.

Insight four: the 2026 new regulation may change this landscape. The summary of notification G/TBT/N/GTM/106 states that the regulation covers the full product lifecycle and establishes principles of quality and performance, with a proposed effective date of 2026-12-01. Whether system and risk management requirements become explicit under the new regulation must be judged from the official gazette; the old reading should not simply be carried forward. A monitoring item on the new regulation belongs in every regulatory plan that spans that date, so that the documentation strategy can be adjusted before, rather than after, the rules take effect.

4. Practical recommendations

• Position ISO 13485 as one form of evidence of manufacturing assurance, and do not treat it as a substitute for any mandatory item.
• When obtaining system documentation, prefer forms that show endorsement by, or a recognised relationship with, the health authority.
• For new device registrations invoke the equivalent-sanitary-standard path of Article 5.1.6, and map to Article 6.12.6 for the addition of an alternate site.
• Retain risk management documentation as support material for responding to the verifiability demands of Articles 5.1.3 and 5.1.9 and the note to Article 7.
• Establish a monitoring item on the 2026 new regulation and track whether system and risk management requirements become explicit.

5. Verification checklist

• □ It has been confirmed that NT-37 and NT-40 do not mandate ISO 13485 or ISO 14971
• □ The certificate of manufacturing assurance has been prepared under Article 5.1.6 or Article 6.12.6
• □ The form of the certificate reflects endorsement by, or a recognised relationship with, the health authority
• □ Risk management documentation has been retained as support material
• □ Changes under the 2026 new regulation have been placed under monitoring

Regulatory information verified as of October 29, 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Guatemalan market. Our team manages Ministry of Public Health and Social Assistance (MSPAS) registrations, coordinates import and distributor requirements, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com