Tecnovigilancia in Colombia: Adverse Event Reporting Requirements for Devices

1. Key takeaways

Resolución 4816 de 2008 established the Programa Nacional de Tecnovigilancia, Colombia’s national device vigilance program. The provision that matters most to Chinese manufacturers is this: serious adverse events must be reported to INVIMA within 72 hours of becoming aware. The clock starts on awareness — not on the occurrence of the event, and not on confirmation of causality. In addition, periodic reports are submitted quarterly, and recalls are executed under INVIMA directives.

GRZAN’s judgment is that the hard part of the 72-hour line is not the deadline itself but the information transfer chain. Foreign manufacturers are usually not the first to become aware: the earliest holders of the information are the local Colombian importer, the healthcare facility using the product, or the local legal representative (apoderado / representante legal). If no transfer deadlines have been agreed among these parties in advance, the 72 hours will be half consumed in internal routing. The center of gravity of vigilance system building is therefore not inside China, but at the information interface on the Colombian end. Building that interface is not a one-off task: it must be written into the POA, reflected in written agreements, and rehearsed before any event occurs.

2. Legal basis

3. Expert insights

1. The clock starts on awareness, and the aware party is often not in China

This formulation ties the obligation to the moment the information arrives, not to the date of the event or the completion of an investigation. For a foreign manufacturer it means two things: you must designate a natural person or entity inside Colombia that can immediately start the reporting action, and you must agree with that party on the maximum internal transfer time. When GRZAN helps clients build a vigilance system, it typically splits the 72 hours into two segments — no more than 24 hours for transmission from abroad to the local party, leaving 48 hours locally for verification and form filling. The purpose of this split is to convert uncontrollable internal communication time into an auditable service level.

2. Quarterly periodic reporting is a standing duty, not something to do only when something happens

The absence of serious adverse events does not remove the reporting obligation. The function of the periodic report is to bring even a zero report within the regulator’s view — it is how the authority judges whether a company is genuinely operating a vigilance system. The typical failure pattern GRZAN observes is a company that pours all its energy into sales after obtaining the certificate, leaves the vigilance system blank, and is only found out during a spot check or a follow-up control. The missing quarterly report is itself a verifiable compliance gap.

3. UDI-DI determines tracing precision, and vigilance records will be examined

The direct value of the UDI-DI required by Resolución 1405 de 2022 for vigilance lies in tracing precision: without semantic coding, a report can only describe the product name and model, and the scope of any trace-back is forced wide; once coding is complete, a report can be anchored to a specific device identifier, and the scope of recalls and field handling narrows significantly. At the same time, the follow-up control under Article 57 of Ley 962 de 2005 and the ex-post verification under Decreto 582 de 2017 turn the vigilance ledger from an internal archive into examinable evidence. GRZAN recommends maintaining the vigilance ledger separately from the registration ledger while keeping the two cross-referenceable.

4. Practical recommendations

1. Chinese manufacturers: designate a vigilance responsible person in Colombia and define their vigilance authority in the POA (Art. 29).
2. Chinese manufacturers: sign written information transfer agreements with the local legal representative and importers, setting the maximum time to reach the reporting responsible person (24 hours recommended).
3. Vigilance responsible person: maintain a 72-hour countdown ledger with the starting point recorded as the moment of awareness, and preserve evidence of how awareness was obtained.
4. Vigilance responsible person: submit periodic reports quarterly, including zero reports when there are no events, and retain submission receipts.
5. Quality and compliance leads: implement the patient implant card system for implantable devices under Art. 40, making implant patients traceable.
6. Regulatory affairs leads: after completing semantic reporting, add UDI-DI and GMDN terms as fields in the vigilance ledger.

5. Verification checklist

• □ A vigilance responsible person has been designated within Colombia, with authority defined in the POA
• □ Written transfer deadlines have been agreed with the local legal representative and importers (24 hours recommended)
• □ A 72-hour countdown ledger exists, with the moment of awareness as the starting point
• □ A quarterly periodic reporting mechanism is in place, including a zero-report process and receipt retention
• □ Implantable devices have the patient implant card system implemented under Art. 40
• □ UDI-DI and GMDN terms have been added as fields in the vigilance ledger

Regulatory information verified as of October 29, 2026

All conclusions published here defer to the current regulatory texts as issued by the competent authority, verified item by item before delivery.

— GRZAN Regulatory Team

GRZAN delivers post-market compliance support for the Colombian market: technovigilance system design and adverse event reporting to INVIMA, quarterly periodic reporting, recall execution under INVIMA directives, and readiness for follow-up controls and inspections. If you need to build or audit a Colombia vigilance system, contact the GRZAN regulatory team at info@grzanglobal.com.