Brazil CBPF Certificate under RDC No. 687/2022: Who Must Apply and Inspection Routes

1. Key takeaways

Only the manufacturing units of Class III (high risk) and Class IV (highest risk) devices must obtain the good manufacturing practice certificate (CBPF, Certificado de Boas Práticas de Fabricação). The basis is Article 3 of RDC n° 687/2022, effective June 1, 2022 (Article 17), which simultaneously superseded RDC n° 183/2017 (Article 16).

GRZAN’s judgment: Article 3 limits the certificate, not the obligation — and the practically more significant point is that the scope of Article 3 expressly includes software as a medical device (SaMD) manufacturing units. Pure software vendors must also obtain a CBPF in Brazil; this is the duty domestic software teams most easily overlook.

2. Legal basis

• Grant and renewal of good manufacturing practice certificates — RDC n° 687/2022, Article 3 with §§1–2, Articles 8, 9, 14, 15, 16 and 17 (effective June 1, 2022)
• Brazilian good manufacturing practices — RDC n° 665/2022, published March 30, 2022 (DOU March 31, 2022), Articles 1 and 138
• Classification, notification and registration of medical devices, and labeling and instruction-for-use requirements — RDC n° 751/2022, resolution of September 15, 2022, Article 14, item V with §§2–3, and Article 24
• Health risk management and compliance monitoring for CBPF and CBPDA — RDC n° 982/2025, resolution of July 28, 2025, Articles 3 and 6

3. Expert insights

Article 3 sorts the units that must be certified into three categories: I — units producing the final product; II — units performing final release accompanied by at least one production operation (excluding mere design, distribution, sterilization, packaging or labeling); III — units producing SaMD. §1 further provides that sterile barrier packaging counts as a production operation; §2 provides that impregnation, lamination or cutting of immunochromatography strips for IVDs also triggers certification. The exclusions in category II deserve careful reading: a distributor who only ships boxes stays outside, but a unit that performs final release while touching the product in any production operation is inside — and the assessment must be made unit by unit, not company by company.

GRZAN sees two signals here. The first is proportionality of risk: inspection resources concentrate on Class III/IV, where intervention depth is greatest. The second is that Brazil treats software as an object with production operations, so the team writing code must undergo an audit in the GMP sense. For software vendors accustomed to self-managing under ISO 13485 and IEC 62304, this adds verification beyond the development process. GRZAN’s judgment is that version control of software deliverables, release review and change traceability will be on-site focus points, because these are precisely the evidence of production operations in the Brazilian context.

On the route to certification, Article 8 offers three: first, an audit report under a recognized audit program, which can waive the on-site inspection; second, review through a risk-assessment tool; only when both are exhausted does the case move to on-site inspection. Article 9 requires the audit report to have been issued within 3 years before submission and to cover the risk class and production lines applied for. The ordering is a deliberate incentive: ANVISA would rather rely on recognized third-party audits than spend inspection capacity, so a well-prepared audit package is the fastest and cheapest route to the certificate.

The most easily ignored provisions are Articles 14 and 15. Article 14 makes clear that holding the certificate does not waive unannounced inspection, and refusal of inspection — including a unilateral postponement by the company that is not accepted — can directly cancel the certificate. Article 15 requires a new manufacturing unit to apply for the CBPF within 180 days. A strategy of waiting it out has no room in Brazil.

For product registration, Article 14, item V with §§2–3 of RDC n° 751/2022 lists the CBPF or its proof of submission among the mandatory documents, with approval conditioned on the CBPF being published in the DOU; Article 24 further conditions the addition or change of manufacturing sites on CBPF publication. When switching OEMs or adding production lines, this stage is often left unscheduled.

One frequently misused detail is the proof of submission. Article 14, item V with §§2–3 permits filing registration documents with the CBPF proof of submission, and Article 27, §3 of RDC n° 751/2022 permits starting the revalidation analysis with it — but approval still depends on the CBPF being published in the DOU. GRZAN has seen projects ship early on the strength of the proof of submission, with the entire exposure borne by the company.

4. Practical recommendations

• First determine whether the unit falls in the mandatory scope under Article 3, checking the SaMD unit’s certification duty with special care.
• IVD manufacturers handling impregnation, lamination or cutting of immunochromatography strips should enter certification planning directly under Article 3, §2.
• For foreign plants, prefer the inspection-waived route through recognized audit program reports, watching the 3-year currency and coverage scope of Article 9.
• Count a new unit’s schedule backward from the 180-day window of Article 15, reserving time for remediation.
• Establish an inspection reception process so unilateral postponements never fall into the cancellation risk of Article 14.
• A CBPF granted through MDSAP is valid for 4 years (Article 8, §1 of RDC n° 497/2021, as amended by RDC n° 850/2024), conditional on remaining continuously within the MDSAP system.
• Use the proof of submission for filing and to start revalidation analysis, but treat it as never equivalent to approval; the shipping gate remains CBPF publication in the DOU.

5. Verification checklist

• □ The effective date of June 1, 2022 under Article 17 of RDC n° 687/2022 has been confirmed
• □ The superseded instrument RDC n° 183/2017 has been confirmed
• □ Mandatory certification has been assessed for the three unit categories of Article 3 (including SaMD)
• □ The audit report has been confirmed issued within 3 years and covering the target risk class and lines
• □ The CBPF or proof of submission has been confirmed present in the registration documents

Regulatory information verified as of October 29, 2026.

GRZAN Regulatory Team

GRZAN provides registration and compliance support for medical device and IVD manufacturers entering the Brazilian market, covering CBPF eligibility analysis, audit program strategy, inspection readiness and post-market compliance. For assistance with Brazilian regulatory requirements, contact info@grzanglobal.com.