Brazil CBPF Continuous Compliance Monitoring under RDC 982/2025

1. Key takeaways

RDC 982/2025 (resolution of 2025-07-28, with Article 1 expressly covering medical devices) is ANVISA’s only new regulation touching devices in 2025. GRZAN’s judgment: Brazil issued no device-specific new rule in 2025, yet device companies — especially foreign manufacturers applying for or renewing GMP certificates — are bound by this resolution all the same, and cannot dismiss it because its title speaks of health risk management and compliance monitoring. The resolution places the grant and renewal of CBPF/CBPDA entirely inside a continuous compliance monitoring framework, and Article 6, §2 expressly allows ANVISA to launch an investigation or cancel a certificate at any time. That at any time refers to procedure: the power is not bounded by application or renewal windows, and ANVISA need not wait for a renewal filing; substantively, however, §3 still requires justified grounds, so cancellation is not arbitrary. CBPF thus shifts from a certificate one obtains to a state of being continuously evaluated. RDC 850/2024, in force since 2024-04-01, sets the validity of a CBPF granted through MDSAP at 4 years; the long validity and the power to cancel at any time form a complementary design, with the most direct impact on Class III and Class IV devices.

2. Legal basis

• Health risk management and compliance monitoring for CBPF/CBPDA — RDC nº 982/2025, ANVISA resolution of July 28, 2025 (signed by acting director Rômison Rodrigues Mota; the official PDF text ends at Article 10 and contains no separate effectiveness article, so no effective date is stated), Article 1 (scope includes medical devices), Article 3 (items I–XVII) and Article 3, §3, Article 4 and §1, Article 5, Article 6 (including §1, §2, §3), Article 8, Article 9 and Article 10
• CBPF procedures and the MDSAP route — RDC nº 850/2024, resolution of March 20, 2024, in force April 1, 2024 (Article 2), amending Article 8 of RDC 497/2021
• Grant and renewal of CBPF — RDC nº 687/2022, in force June 1, 2022 (Article 17), Article 3

3. Expert insights

RDC 982/2025 is often mistaken for a pharmaceutical-sector rule, yet its Article 1 expressly writes medical devices into the scope. GRZAN’s judgment: Brazil issued no device-specific rule in 2025, and this resolution on health risk management and compliance monitoring is the only new law device companies needed to follow that year — foreign manufacturers apply for and renew CBPF under the same set of standards.

Article 6 is a four-layer structure. The body establishes that grant and renewal processes are subject to continuous compliance monitoring, based on the criteria of Article 3; §1 provides that information obtained through monitoring may indicate the need for an inspection, regardless of whether the CBPF or CBPDA is within its validity period; §2 provides that on the basis of compliance monitoring data, ANVISA may decide at any time to open an investigation or cancel a certificate; §3 requires justified grounds for cancellation. GRZAN values most the phrase regardless of validity in §1 together with the at any time in §2 — together they downgrade the certificate validity period from a safe harbor to an administrative term. But §3 draws the substantive boundary: the grounds must relate to violations or risks identified in the site itself or in the products it supplies, so at any time does not mean arbitrarily.

The official PDF text ends at Article 10 and contains no separate effectiveness article, so GRZAN states no effective date and uses only the resolution date of 2025-07-28 as the time anchor.

The second insight is Article 3, §3, in GRZAN’s view the article most worth attention in this piece: the paragraph allows the output of artificial intelligence models to be used as a risk management criterion, provided four technical standards set by ANVISA are met — consistency, data protection, traceability and technical validation. GRZAN’s reading: this does not relax the standards; it brings algorithms inside the auditable scope. The direct implication for companies is that ANVISA’s monitoring prioritization may be performed by algorithms first, and whether your data is traceable and machine-readable can affect the probability of being selected.

The third insight is the composition of the seventeen criteria in Article 3. Those that can be named directly include: I the risk class and classification of the product; II the complexity and criticality of the site; IV and V the compliance history of the company, the products and the site; VIII the time elapsed since the last inspection; IX inspection reports or CBPF from equivalent foreign regulatory authorities (EFRA); X inspection reports or CBPF from PIC/S members; XI inspection reports from health authorities of IMDRF member countries; XII MDSAP audit reports; XV random inspections; XVI the risk of supply disruption in the Brazilian market; XVII inspection reports from all levels of the SNVS. GRZAN’s reading: foreign compliance assets and the company’s own history are placed on the same scorecard, and neither can substitute for the other.

The criteria of Article 3 are not arranged in order of application, which matters in practice: a company cannot assume that criteria listed first carry more weight, nor prepare evidence for only the first few. GRZAN recommends breaking them item by item into self-check entries, with gaps listed separately in a remediation plan.

The fourth insight is the three mechanisms in Article 4 — analyzing EFRA inspection reports, risk analysis, and inspections supported by risk analysis; its §1 makes clear that adopting any mechanism does not exempt the issuance of a technical opinion. Article 5 further provides that whatever mechanism is used, existing health requirements and technical-administrative guidelines continue to apply. GRZAN’s reading: the route can be optimized but the standard cannot be lowered. Article 9 also sets a procedural precondition — the three mechanisms of Article 4 (EFRA report analysis, risk analysis, risk-based inspection) must be approved by the collegiate board before they apply. GRZAN accordingly makes one point clear: these mechanisms are not channels already in force; companies must not schedule work on the assumption that an EFRA report can be exchanged directly for a certificate, and may treat it only as a pending potential route.

The retroactivity of Article 8 is equally critical: the requirements of this resolution apply to grant or renewal applications whose decisions had not yet been published in the DOU, including those already submitted. Article 10 amends Articles 4, 10, 35 and 36 of RDC 497/2021; Article 35 concerns the differentiated treatment of sites inside and outside MERCOSUR, so companies with production sites in South America must reconfirm the review approach under the new wording.

4. Practical recommendations

• Treat maintaining the CBPF as a continuous activity, not a last-minute effort before renewal.
• Build a self-check log mapped item by item to Article 3, items I–XVII, with gaps listed in a remediation plan and completion dates.
• Organize EFRA, PIC/S, IMDRF and MDSAP audit reports and confirm they remain within their validity periods.
• Run a gap analysis against the new standards under Article 8 for in-flight applications, and record the review date.
• Include post-market vigilance, complaint data and Brazilian supply-disruption risk in your monitoring response materials.
• Organize compliance data to be traceable and machine-readable, in anticipation of algorithmic monitoring under Article 3, §3.

5. Verification checklist

• □ Verify whether the device class triggers a CBPF (only Classes III/IV, Article 3 of RDC 687/2022)
• □ Verify self-check coverage of Article 3, items I–XVII
• □ Verify the validity and retrievability of EFRA/PIC/S inspection reports
• □ Verify whether in-flight applications fall within the retroactive scope of Article 8
• □ Verify that application of the Article 4 mechanisms has completed the collegiate board approval procedure
• □ Verify that the responsible roles and trigger conditions for monitoring response are defined
• □ Verify compliance data against the four standards of consistency, data protection, traceability and technical validation (Article 3, §3)
• □ Verify the published text of the resolution in the DOU (effectiveness article and issue number not obtained; do not hard-code)
• □ Verify the current text of RDC 982/2025 and the Article 10 amendments to RDC 497/2021 against the DOU
• □ Verify the justified-ground cases of Article 6, §3 of RDC 982/2025 against the DOU

Regulatory information verified as of October 29, 2026

GRZAN Regulatory Team

GRZAN keeps foreign manufacturers inspection-ready in Brazil: CBPF self-checks mapped to RDC 982/2025, MDSAP and EFRA documentation management, gap analysis for in-flight applications, and full preparation for ANVISA inspections at any time. Because a CBPF is now a continuously evaluated state rather than a certificate on the wall, we build the monitoring posture that keeps it safe. For GMP certification and inspection response support in the Brazilian market, contact info@grzanglobal.com.