ISO 13485 and ISO 14971: Quality and Risk Management Evidence in Chile

1. Key takeaways

Exempt Decree No. 25/2026 lists NCh-ISO 13485 (quality management systems) and NCh-ISO 14971 (risk management) as conformity evaluation references. Combined with the class-specific quality system requirements of Article 21 of DS 825/1998 (Class II: NCh-ISO 9002 or GMP; Classes III and IV: NCh-ISO 9001 or GMP), GRZAN’s operating guidance is: the statutory text cites 1998-era designations, but review follows a current ISO 13485 certificate (practical estimate), and sponsors should prepare on a dual track of a written compliance-path explanation plus the current certificate.

Risk management sits one level higher: Classes III and IV must submit a risk management plan and report (ISP technical guidance, ANDID instructivo 001, section 6.6). The two instruments reinforce each other: the quality system shows the machinery exists, and the risk file shows it was applied to this specific product. For Class I and II sponsors, maintaining ISO 14971 documentation is still worthwhile, because the conformity evaluation framework of the decree references it regardless of class.

2. Legal basis

• Decree listing devices under the sanitary control regime of Article 111 | Decreto Exento N° 25, de 2026 | March 19, 2026 | conformity evaluation is benchmarked against NCh-ISO 16142-1 and 16142-2, NCh-ISO 13485, NCh-ISO 14971 and product-specific standards.
• Regulation on the control of pharmaceutical products and medical devices | Decreto Supremo N° 825, de 1998 | August 21, 1999 | Article 21: Class II adds quality system evidence (NCh-ISO 9002 or GMP); Classes III and IV add quality system evidence (NCh-ISO 9001 or GMP).
• Same instrument | Article 21 | Class IV additionally requires studies of all inherent risks of the device.
• ISP technical guidance | ANDID instructivo 001, section 6.6 | Classes III and IV must submit a risk management plan and report.
• Sanitary Code | DFL N° 725, de 1967 | Article 111(c) | the standards hierarchy with Chilean official standards first.

3. Expert insights

Insight one: the ISO 9001/9002 citations in Article 21 are 1998 text; practice has moved on.

The 1994-edition structure of ISO 9001 and ISO 9002 was superseded after 2000 by the unified ISO 9001, and the sector-specific standard for medical devices became ISO 13485. The ISP reviews against current technical guidance, and an ISO 13485 certificate is the accepted industry approach (practical estimate). The correct move is to attach a short compliance-path explanation in the dossier: it states that the company satisfies the quality system requirements of Article 21 through its current ISO 13485 system. This one paragraph reconciles the old statutory wording with modern practice and removes the question before the reviewer asks it. The explanation should be one paragraph, placed at the front of the quality system chapter, and it should name the clause of Article 21 it addresses.

Insight two: an ISO 13485 certificate has four fatal failure points.

GRZAN’s four-element self-check is: does the scope cover the product being registered, was the certificate issued by an accredited body, is it within its validity period, and has the Apostille been completed. The fourth point is the one most often missed — the certificate is a foreign public document and must be legalized for use in Chile. Any one of the four failures can invalidate an otherwise sound quality system submission, and each is entirely preventable with a document-level check done weeks before filing. GRZAN also checks whether the certificate scope names the legal entity and the site that will appear in the Chilean submission, because a mismatch on entity names produces the same failure as a mismatch on products.

Insight three: ISO 14971 in Chile is not satisfied by having a report; it is a layered requirement.

Article 21 adds the study of all inherent risks of the device for Class IV, and ANDID instructivo 001 section 6.6 requires Classes III and IV to submit a risk management plan and report. The plan and the report are two documents: the plan explains the method, and the report explains the conclusions and the acceptability of residual risks. Treating them as one merged document blurs the boundary between methodology and outcome, and reviewers notice the blur immediately. Keeping the numbering of the plan aligned with the clauses of ISO 14971 also helps the reviewer move between the documents without guesswork.

Insight four: the quality system and the risk management file must corroborate each other.

The process records of ISO 13485 and the risk control measures of ISO 14971 should be consistent. A common query in review asks: for the control measures mentioned in the risk report, which procedure in the quality system implements them? Two disconnected sets of documents are the most easily exposed sign of a patched-together submission. A cross-reference table between risk controls and quality system procedures answers the question before it is asked. Building the table takes an hour; answering the query without one can take weeks inside the queue.

4. Practical recommendations

1. Self-check the ISO 13485 certificate on four elements: scope, accreditation of the issuing body, validity period, Apostille.
2. Attach a compliance-path explanation mapping the current ISO 13485 system onto the old designations cited in Article 21.
3. Organize risk management as two documents, plan plus report; do not merge them into one.
4. Build a cross-reference table between risk control measures and quality system procedures to avoid two disconnected document sets.
5. Retain GMP conformity evidence as a supplement, to counter any challenge that the certificate scope does not match the product.

5. Verification checklist

• □ The ISO 13485 certificate scope covers the product being registered
• □ The certificate was issued by an accredited body and is within its validity period
• □ The Apostille for the certificate has been completed
• □ A written explanation maps the dossier to the old designations cited in Article 21
• □ Classes III and IV have submitted the risk management plan and report under ANDID instructivo 001 section 6.6
• □ A cross-reference between risk control measures and quality system procedures is in place

Regulatory information verified as of October 29, 2026.

For a product-specific feasibility assessment of Chile market entry, GRZAN’s regulatory team supports manufacturers and importers with registration dossiers, conformity documentation and ISP submissions. Contact info@grzanglobal.com to discuss your project.