Regulated Establishments and BPM Requirements under Article 5.3

1. Key takeaways

Article 5.3.1 of RTS 11.03.02:21 requires the manufacture, import, export, storage, acondicionamiento (packaging and repackaging), distribution and commercialisation of devices to be carried out through establishments that are registered under the law and meet the requirements of the regulation for each activity. Article 5.3.2 requires every establishment engaged in research, manufacture, import, acondicionamiento, export, distribution or storage, and any body within the national integrated health system performing equivalent functions, to demonstrate a quality management system covering any of those activities and conforming to the current version of RTS 11.03.03:22, the good manufacturing practice regulation and its verification guide. Article 5.3.3 adds that regulated establishments must follow the regulatory procedures set by the authority, and Article 6.5.1 a) places BPM inspection at the establishment.

The three provisions describe one obligation from three angles: a premises that is authorised, a system that is documented, and an inspection that tests both.

• Seven activity categories must run through a lawfully registered establishment.
• The quality system must cover the activities actually performed, not the company as a whole.
• Conformity is measured against the current version of RTS 11.03.03:22.
• Public sector bodies performing equivalent functions are within the same duty.
• Registration files must include a BPM certificate under Article 6.3.2.1 d).

2. Legal basis

The obligation is structured in Article 5.3 and enforced through the inspection powers and the dossier requirements. The table records the provisions that an establishment compliance file has to address.

3. Expert insights

Insight one: the system obligation is sliced by activity, not applied to the company as a whole. Article 5.3.2 requires the quality system to cover, within its scope, any of the listed activities. An establishment that only imports and stores does not need a system covering manufacture, but once it extends into acondicionamiento it must obtain prior approval under Article 6.2.3 and widen the scope of the system accordingly. The most common mismatch seen in practice is a certificate that states manufacture while the premises in fact only distributes, which reads as an overstatement to an inspector and as an unverified activity to a reviewer.

Insight two: BPM carries two meanings, the system document and the inspection outcome. Article 5.3.2 points to the system requirements of RTS 11.03.03:22, Article 6.3.2.1 d) requires a BPM certificate at registration, and Article 6.5.1 a) provides for BPM inspection of establishments in process and already authorised. These are three facets of one thing: building the system, evidencing it with a certificate, and having it tested on site. A file that treats the certificate as the whole obligation tends to be thin at the inspection stage.

Insight three: ISO 13485 and MDSAP are accepted as equivalent evidence of BPM. Section 6.8 of the SRS reliance policy (01.01.02.POL.20250508.01), under the device registration unit (URDM), expressly recognises BPM certificates issued by foreign regulators, ISO 13485 certificates issued by accredited bodies, MDSAP certificates, and conformity certificates issued under EU 2017/745 and 2017/746. For a Chinese manufacturer this can remove the cost of a duplicate audit. The condition is that the scope of the certificate covers the activities declared, so a narrow certificate cannot be stretched to a wider operation.

Insight four: public bodies are inside the system obligation. Article 5.3.2 also captures establishments that form part of the national integrated health system and perform activities matching the listed functions. A central pharmacy or an equipment department within a hospital that stores and distributes devices therefore has to build a system conforming to RTS 11.03.03:22. For suppliers working with public institutions, that changes the nature of the support required: the counterpart needs a device quality system, not a medicines GMP structure.

Insight five: Article 5.3.3 is a separate duty from holding a system. The requirement that regulated establishments comply with the regulatory procedures set by the authority stands as its own provision, distinct from the quality system obligation in Article 5.3.2 and from the registration requirements. The distinction matters because the two fail differently: a system gap is usually visible in documentation and can be corrected over time, whereas a procedural gap appears as a missed step in a live application or an inspection that the establishment was not ready to receive. An establishment can therefore hold an unblemished certificate and still be non-compliant under Article 5.3.3, which is why the procedures should be written into operating instructions rather than left with the regulatory affairs team alone.

4. Practical recommendations

• Define the scope of the quality system by actual activity (import, storage, distribution, acondicionamiento or manufacture) so that the certificate and the operation match.
• Before registration, confirm that the BPM, ISO 13485 or MDSAP certificate is valid and that its scope covers the declared activities.
• Before extending into acondicionamiento or manufacture, apply for approval under Article 6.2.3 and extend the system scope at the same time.
• Prepare for BPM inspection under Article 6.5.1 a) by keeping system documents, records, training files and deviation handling retrievable on request.
• Where ISO 13485 or MDSAP is used as equivalent evidence, cite Section 6.8 of the reliance policy in the application and quote the certificate number.
• When advising a public institution client, draft the system against RTS 11.03.03:22 rather than against a medicines GMP template.

5. Verification checklist

• □ The quality system scope matches the activities actually performed
• □ BPM, ISO 13485 or MDSAP certificates are valid
• □ Approval under Article 6.2.3 was obtained before any extension of activity
• □ Documents required for BPM inspection are retrievable on request
• □ An equivalence claim cites Section 6.8 of the reliance policy
• □ Public institution systems are drafted against RTS 11.03.03:22

Instruments cited: RTS 11.03.02:21, Dispositivos Médicos. Requisitos para la Regulación Sanitaria de Dispositivos Médicos (Acuerdo No. 14-2022, Diario Oficial No. 156, Tomo No. 436, 2022-08-23), Articles 5.3.1, 5.3.2, 5.3.3, 6.3.2.1 d) and 6.5.1 a); RTS 11.03.03:22, Dispositivos Médicos. Buenas Prácticas de Manufactura y su Guía de Verificación (Acuerdo No. 13-2022, Diario Oficial No. 156, Tomo No. 436, 2022-08-23); Política de Aplicación de Reliance (01.01.02.POL.20250508.01, Version No. 01, SRS website, 2025-05-08), Section 6.8.

Regulatory information verified as at 29 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Salvadoran market. Our team manages Ministry of Health (MINSAL) sanitary registration applications, prepares Spanish-language dossiers, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com