Brazil MDSAP CBPF Validity of 4 Years under RDC 850/2024

1. Key takeaways

RDC 850/2024 amends Article 8 of RDC 497/2021 to provide that a good manufacturing practice certificate for medical devices (CBPF) granted through the Medical Device Single Audit Program (MDSAP) is valid for 4 years — double the 2 years of the general pathway. Article 8(2) ties this 4-year term expressly to the condition of remaining continuously within the MDSAP system. GRZAN’s judgment: this is not a simple extension of a deadline but a conditional benefit. As the certificate term lengthens, exiting MDSAP becomes a trigger for the benefit to lapse actively, and companies must treat it as a standing commitment rather than a one-off gain.

2. Legal basis

• CBPF procedure (as amended by RDC nº 850/2024) — RDC nº 497/2021: Article 8 caput (the general CBPF validity is 2 years, counted from the DOU publication date) and its paragraphs 1 and 2; the amending RDC nº 850/2024 was resolved on March 20, 2024 and took effect April 1, 2024 (Article 2) (the current wording of the paragraphs of Article 8 of RDC nº 497/2021 follows ANVISA’s consolidated legislative database; verify before scheduling)
• Granting and renewal of the CBPF — RDC nº 687/2022, effective June 1, 2022 (Article 17): Article 3
• Health risk management and compliance monitoring of the CBPF/CBPDA — RDC nº 982/2025, resolution of July 28, 2025: Article 6 and its paragraph 2, and Article 10

3. Expert insights

Why is ANVISA willing to grant 4 years? GRZAN’s reading: MDSAP is itself an audit program mutually recognized by several regulators, and its audit depth and frequency already cover the full chain that Brazilian GMP (BGMP, RDC 665/2022) cares about — design, purchasing, production, packaging, labeling, storage and transport, installation, and technical assistance. Substituting one MDSAP audit report for repeated on-site inspections is a rational exchange of regulatory resources, and the extended term is the price tag of that exchange.

Companies commonly fall into three traps. The first is reading 4 years as four years of no oversight. Article 6 of RDC 982/2025 places the CBPF/CBPDA under ongoing compliance monitoring, and paragraph 2 makes clear that ANVISA may open an investigation or revoke the certificate at any time — a longer validity does not mean lighter supervision; the two run in parallel.

The second is overlooking the conditional clause. Article 8(2) requires continuous presence in the MDSAP system; once a company exits MDSAP for cost or market reasons, the premise of the extended term disappears and the certificate reverts to the ordinary 2-year track of Article 8 caput. GRZAN emphasizes: the 4-year term is not a general raise — it is a specific consideration for the MDSAP pathway, standing in a twofold, not substitutive, relationship to the regular 2-year term. MDSAP seat fees, audit scheduling, and Brazilian certificate expiry should be managed on the same table.

The third is a mismatch of scope. The mandatory scope of the CBPF is confined by Article 3 of RDC 687/2022 to the production units of Class III (high-risk) and Class IV (maximum-risk) devices; Classes I/II are outside it. Investing in MDSAP for a low-risk-only portfolio does not pay off, and GRZAN generally does not recommend a standalone project for that purpose.

GRZAN also observes a recurring decision error: companies compare the 4-year term with the regular certificate term, then decide to join MDSAP on that basis alone, ignoring that MDSAP is itself a system requiring continuous maintenance — audit scheduling, closure of nonconformities, and multi-jurisdiction coordination all consume quality-system resources. The real test is not the length of the term but whether the company is already inside MDSAP because of other markets. If the answer is yes, the Brazilian benefit is a free rider; if Brazil alone would justify joining, GRZAN recommends running the full cost calculation first.

One more confusion to clear: the CBPDA (certificate of good distribution and storage practices) under Article 9 of RDC nº 497/2021 is itself valid for 4 years. It is a different certificate from the CBPF, the terms differ, and the two must not be compared horizontally — whenever a 4-year figure appears, the first step is to confirm which certificate class and which pathway it belongs to.

4. Practical recommendations

First, determine whether the CBPF is mandatory at all. If the portfolio contains only Class I/II devices, the benefit of an MDSAP-driven CBPF is limited; the GRZAN regulatory team recommends preparing for ordinary BGMP conformity first and putting resources into the product documentation.

Second, build conditional monitoring points. Link the MDSAP certificate validity, the next audit window, and the Brazilian CBPF expiry into one ledger; any item approaching its date triggers a review, and the review conclusion must be signed off by the head of quality.

Third, treat ongoing compliance monitoring as the normal state. The at-any-time investigation and revocation risk under Article 6 of RDC 982/2025 requires the quality system to remain inspection-ready at all times, not to be patched up just before an announced inspection.

Fourth, mind the transitional application. Article 8 of RDC 982/2025 applies to applications whose decisions had not been published in the DOU when the resolution took effect, including those filed earlier; pending projects should not assume the old rules still govern them.

Fifth, put the CBPF and product registration on the same timeline. Article 14(V) of RDC 751/2022 and its paragraphs 2 and 3 allow an acceptance receipt as an interim, but approval depends on the CBPF being published in the DOU, so any wobble on the certificate side transmits directly to the product approval date.

5. Verification checklist

• □ The product is Class III or IV, and the production unit falls within the mandatory CBPF scope
• □ The MDSAP seat and audit plan can cover the entire 4-year certificate term
• □ A linked ledger connects MDSAP status, audit windows, and the CBPF expiry date
• □ The quality system stays inspection-ready per the ongoing monitoring requirement of Article 6 of RDC 982/2025
• □ The transitional application of Article 8 of RDC 982/2025 to existing applications has been checked
• □ The CBPF and the product registration approval dates are scheduled on one timeline

Regulatory information verified as of October 29, 2026

GRZAN Regulatory Affairs Team

GRZAN supports manufacturers entering the Brazilian market with ANVISA registration pathway and classification strategy services, including CBPF strategy under RDC 497/2021 and RDC 850/2024, MDSAP-to-Brazil linkage planning, and compliance-monitoring readiness under RDC 982/2025. If you need to decide whether MDSAP pays for your Brazil portfolio, the GRZAN regulatory team can run the numbers with you — contact info@grzanglobal.com.