ISO 13485, BPM, CCAA and MDSAP Evidence for Colombia Registration

1. Key takeaways

The current Decreto 4725 de 2005 does not write any specific quality system standard into its articles as a mandatory gate; quality system evidence is reviewed as part of the technical documentation under Article 18. The published draft decree direction explicitly designates ISO 13485 as the device GMP standard, but as of the verification date that draft has not been signed and published. The present reality is therefore that ISO 13485 is the de facto common language, not a mandatory citation in the statute.

The GRZAN position is that MDSAP has no official acceptance basis in Colombia, and filing it as the principal evidence is a misallocation of resources. What must be secured in parallel is the importer-side CCAA: under Resolución 4002 de 2007 the certificate is valid for 5 years, the importer must employ a technical director (director técnico), and a re-inspection must be requested at least 5 working days before expiry (INVIMA public guidance). However polished the manufacturer’s system certificates are, without a valid CCAA the importer cannot complete customs clearance.

2. Legal basis

3. Expert insights

#### 1. ISO 13485 is the common language, but its name appears nowhere in the current statute

This creates a peculiar situation: an application without an ISO 13485 certificate is not rejected for violating any specific article, but when the reviewer lacks a handle on how controlled the manufacturing process is, the review drifts toward the verification sections of the technical documentation to infer it indirectly. GRZAN’s strategy is to submit the certificate proactively and organize it along the draft’s direction, because that direction is already explicit. A dossier whose system evidence is structured around ISO 13485 will not need to be rebuilt when the institutional switch eventually happens, and in the meantime it answers the reviewer’s implicit question about process control before it is asked.

#### 2. The awkward position of MDSAP: international recognition is not local acceptance

MDSAP is promoted by the regulatory authorities of IMDRF members, and INVIMA was approved as an affiliate member at the 28th IMDRF Management Committee meeting in Sapporo on September 18-19, 2025. This is easily stretched into the assumption that INVIMA will therefore accept MDSAP. GRZAN rejects that stretch: affiliate membership and acceptance of MDSAP audit reports are two different things, and current law contains no provision on the matter (practical estimate). The reasonable placement of an MDSAP report is as supplementary material supporting the maturity of the quality system’s operation; it cannot substitute for an ISO 13485 certificate, and filing it as the primary evidence wastes effort that could have gone into the technical file.

#### 3. BPM in Colombia runs on two tracks, and the manufacturer track and the importer track must not be mixed

BPM, Buenas Prácticas de Manufactura, refers in the Latin American context both to manufacturing standards and, by extension, to storage and adaptation practices. What is written into law and enforced in Colombia is the latter: Resolución 4002 de 2007 governs the CCAA, requiring importers to hold storage and adaptation capacity and to employ a technical director. The consequence of mixing the two tracks is a manufacturer that files a full set of system documents while the importer stalls at customs because its CCAA has expired, leaving a granted registration certificate unusable in the market it was obtained for.

#### 4. Once the draft fixes the GMP standard, how should the transition cost be planned

The draft direction is a wholesale update of Decreto 4725/2005 together with Decreto 3770/2004, with a self-proposed transition period of 18 months. GRZAN’s judgment is that after the transition closes, manufacturers without ISO 13485 will face a substantive gate, while certification from kickoff to issuance normally takes several quarters. Starting certification in the middle of the transition period collides exactly with the renewal peak, when notified bodies are busiest and lead times stretch. The sensible plan is to treat the draft as a schedule signal and align system work with it early, so the certificate exists before the gate becomes mandatory.

4. Practical recommendations

1. Have the foreign manufacturer provide the ISO 13485 certificate with its scope annex, confirming that the scope explicitly covers the manufacturing activities of the device under application.
2. Have GRZAN verify that the manufacturer name and address on the certificate match the Art. 19 legal documents exactly, initiating a certificate change first where the name differs.
3. Have the applicant position the MDSAP audit report as supplementary material filed alongside the ISO 13485 certificate, never as a standalone substitute.
4. Have the importer confirm before submission that the CCAA is within its validity period and verify the employment status of the technical director (director técnico).
5. Have the importer initiate the CCAA re-inspection with the 5 working days lead time, avoiding an expiry gap that blocks customs clearance.
6. Have GRZAN maintain a draft-tracking ledger and, once ISO 13485 becomes mandatory, back-calculate the system remediation schedule from the 18-month transition period.

5. Verification checklist

• □ The ISO 13485 certificate is valid and its scope explicitly covers the manufacturing activities of the device under application
• □ The manufacturer name and address on the certificate match the legal documents exactly
• □ The MDSAP report is positioned as supplementary material and does not substitute for the ISO 13485 certificate
• □ The importer’s CCAA is within its 5-year validity period
• □ The importer has employed a technical director (director técnico)
• □ The CCAA re-inspection has been initiated with the 5 working days lead time
• □ The system remediation schedule for after the draft enters into force is tracked in the ledger

Regulatory information verified as of October 29, 2026

All conclusions for external use are based on the current regulatory texts published by the competent authorities and are verified item by item before delivery.

GRZAN supports manufacturers entering the Colombian market with registration dossiers and conformity documentation, including quality system evidence structuring, CCAA coordination with importers, MDSAP positioning and draft-regulation tracking for INVIMA submissions. For inquiries, contact info@grzanglobal.com.