Implant Card and Post-Market Traceability Under Article 40

1. Key takeaways

Article 40 of Decreto 4725 de 2005 establishes the patient implant card (tarjeta de implante) requirement for implantable devices. This is a provision that extends the traceability obligation directly to the individual patient: once implantation is complete, a carrier must record the identity of the product for use in follow-up, recall and adverse event handling.

The GRZAN judgment is that the value of the implant card lies not in the card itself but in whether it can be searched. Under the national device vigilance program established by Resolución 4816 de 2008, serious adverse events must be reported to INVIMA within 72 hours of awareness, and periodic reports are filed quarterly. If the fields on the implant card cannot be mapped to the lot, the UDI-DI and the healthcare institution’s records, that 72-hour reporting window is operationally impossible to meet, and the failure will surface exactly when the stakes are highest.

2. Legal basis

3. Expert insights

#### 1. Article 40 is a backward-looking obligation

Most technical documentation provisions serve the question of whether the product can reach the market; Article 40 serves the question of whether the product can be found again after it reaches the market. Its constraint applies to traceability across the entire product life cycle, not to a one-time deliverable at registration. GRZAN therefore treats the implant card as the front-end entry point of the vigilance system rather than as a packaging accessory. Every field printed on that card either enables or blocks the vigilance workflow that follows, and a card that cannot be queried against a database is decoration, not traceability infrastructure.

#### 2. Three segments of information must close into a loop: lot, institution, patient

The effectiveness of the traceability chain depends on whether three segments of information can index one another. The lot segment comes from the manufacturer’s production records and the UDI-DI; the institution segment comes from the implant registry of the healthcare institution; the patient segment comes from the implant card itself. If any one segment breaks, recall can only be executed through broad public announcements. GRZAN’s design principle for implant card fields is that every identifier appearing on the card must be directly queryable in the manufacturer’s or the importer’s systems, so the loop from patient to lot closes within hours rather than days when an event forces it to close.

#### 3. UDI upgrades the implant card from a paper record to a searchable record

The semantic standards established by Resolución 1405 de 2022 brought the UDI-DI into the basic attributes. Class III devices had a transition period of 12 months, until February 8, 2025, and Class IIb devices 18 months, until August 8, 2025; the transition periods have all expired, and INVIMA confirmed on March 12, 2026 that semantic reporting is fully mandatory. Implantable devices mostly sit in the higher risk classes, so the combination of the UDI-DI with the implant card gives the chain between the lot segment and the patient segment a machine-readable index key, which is precisely what quarterly reporting and rapid recall both require.

#### 4. The 72-hour and quarterly reporting regimes decide which fields the card must carry in advance

Serious adverse event reporting within 72 hours, periodic reports filed quarterly, and recalls executed on INVIMA instruction together back-calculate the minimum field set of the implant card: product identification, model and lot, UDI-DI, manufacturer and titular names, implantation date, healthcare institution name, implanting physician, patient identifier and follow-up prompts. The direct consequence of a missing field is not a deficiency notice at registration but the inability to complete a legally required report within the deadline when a vigilance event actually occurs, which is the most expensive moment to discover a missing field.

4. Practical recommendations

1. Have GRZAN design the Spanish implant card layout under the requirements of Article 40, with fields covering product identification, lot, UDI-DI, manufacturer and titular, implantation date, institution and physician, and patient identifier.
2. Have the foreign manufacturer establish a lot-to-UDI-DI master data ledger, ensuring that every identifier on the card can be traced to the production record directly.
3. Have the importer agree the implant registry workflow with healthcare institutions, specifying who fills the record, who keeps the copy and for how long it is retained.
4. Have the local legal representative establish the 72-hour serious adverse event reporting channel, embedding the implant card fields as fixed items of the report template.
5. Have the quality lead consolidate implant registry and vigilance data quarterly into the working draft of the periodic report.
6. Have GRZAN test the traceability chain in recall drills, locating the lot segment backwards from the patient segment and measuring the loop closure time.

5. Verification checklist

• □ The implant card is in Spanish and its fields meet the requirements of Article 40
• □ The card carries the UDI-DI and lot identification, queryable directly in the manufacturer’s systems
• □ The titular and manufacturer information on the card matches the items required under Art. 20
• □ The implant registry workflow with healthcare institutions defines the filler, the retained copy and the retention period
• □ The 72-hour serious adverse event reporting channel is established and includes the implant card fields
• □ The quarterly periodic report working draft incorporates the implant registry data
• □ Recall drills can locate the lot segment backwards from the patient segment with controlled loop closure time

Regulatory information verified as of October 29, 2026

All conclusions for external use are based on the current regulatory texts published by the competent authorities and are verified item by item before delivery.

GRZAN supports manufacturers entering the Colombian market with registration dossiers and conformity documentation, including implant card design under Article 40, UDI-DI integration, vigilance reporting channel setup and recall drill support for INVIMA submissions. For inquiries, contact info@grzanglobal.com.