ISO 13485 and Quality Management Evidence for Medical Devices in Morocco

1. Key takeaways

Quality system evidence in Morocco operates on two levels, and the two levels bind different subjects. Article 11 of Law No. 84-12 requires the establishments referred to in Article 7 and their mandataries to comply with good practice rules (règles de bonnes pratiques) covering manufacturing, transport, storage, distribution, and performance evaluation. Separately, Arrêté n° 2855-15 and the current AMMPS checklist require imported devices of Class IIA and above to be accompanied by the manufacturer’s ISO 13485 certificate or equivalent documentation. The first level constrains the Moroccan establishment; the second level constrains the foreign manufacturer.

Keeping the two levels apart is the main analytical point of this topic. A manufacturer’s ISO 13485 certificate, however strong, does not cure deficiencies in the establishment’s own storage, transport, and distribution conditions, and the establishment’s compliance with good practice rules does not reduce the evidence the manufacturer must file for Class IIA and above. Both obligations must be evidenced independently, by the party to whom they apply.

The consequences of neglecting either level are concrete. Failure to comply with the good practice rules is an independent ground for penalties under Article 43, and a defective ISO 13485 certificate, one whose scope, validity, or holder name does not match the dossier, is one of the most frequent documentation defects GRZAN encounters in practice. Both failure modes are cheap to prevent and expensive to discover at review.

2. Legal basis

3. Expert insights

Insight one: the obligation holder under Article 11 is the Moroccan establishment, not the manufacturer. The provision states that the establishments referred to in Article 7 and their mandataries must comply with the good practice rules. This means the licensed establishment needs storage, transport, and distribution conditions appropriate to the devices it holds, and it will be checked on those conditions during the periodic inspections conducted under Article 38. A manufacturer’s system certificate cannot solve the establishment’s own compliance obligations, so manufacturer and establishment must each be assessed on their own merits when a registration project is scoped.

Insight two: the specific content of the good practice rules is set by regulation after consultation. Article 11 provides that these rules are established in a regulatory text adopted after seeking the opinion of the representative bodies of health professionals. This procedural clause signals that the good practice text is a negotiated product that may be revised as industry circumstances change. Companies should monitor updates to the rules rather than reviewing them once and filing the matter away.

Insight three: breach of the good practice rules is an independent penalty ground. Article 43 places failure to comply with the good practice rules referred to in Article 11 within the penalty range of MAD 200,000 to MAD 500,000 for Class I and Class IIA establishments, and 2% to 5% of turnover (with a floor of MAD 500,000) for Class IIB and Class III establishments. This is a high-frequency risk that is easy to overlook because it attaches to the establishment’s operations rather than to the registration file itself.

Insight four: the common failure points of ISO 13485 certificates are scope and validity. The three defects GRZAN encounters most often are a certification scope that does not cover the product category being declared, a certificate past its validity period, and a certificate holder name that does not match the other documents in the dossier. A system certificate is not acceptable merely because it exists; it has to match. Each of these defects is detectable in a five-minute check of the certificate face, which is why a documented check beats an informal one.

Insight five: subcontracting does not transfer system responsibility. Article 10 permits establishments referred to in Article 7 to subcontract manufacturing, export, distribution, or maintenance operations to other establishments, but the subcontract must be based on a written assignment and must comply with the good practice rules of Article 11, and the arrangement must be notified to the competent authority in the prescribed manner. Delegating work to a subcontractor does not delegate the obligation to notify, nor the duty to ensure good practice is observed throughout.

4. Practical recommendations

1. Audit the licensed establishment’s good practice conditions. Verify on site or through documents that its storage, transport, and distribution capabilities match the characteristics of the product, including cold chain, sterility, and expiry management where relevant.
2. Run three checks on the ISO 13485 certificate. Confirm that the certification scope covers the product, that the validity period covers the expected review period, and that the certificate holder name matches the other documents in the dossier.
3. Prepare equivalent documentation as a fallback. Where no ISO 13485 certificate exists, prepare alternative documentation demonstrating an equivalent quality management level, together with the reasoning, in line with the checklist requirements.
4. Complete notification before subcontracting. Notify the competent authority of any subcontracting arrangement in the prescribed manner under Article 10, and retain the receipt of notification in the project file.
5. Bring system certificates into the annual review cycle. Manage certificate renewals in step with registration certificate renewals, so there is never a gap in which operations continue without valid system coverage.

5. Verification checklist

• □ Confirmed whether the device class triggers the ISO 13485 submission requirement (Class IIA and above)
• □ ISO 13485 certification scope covers the declared product
• □ Certificate validity period covers the expected review period
• □ Certificate holder name consistent with the other documents in the dossier
• □ Storage and transport conditions of the licensed establishment verified
• □ Subcontracting arrangements, if any, notified to the competent authority under Article 10
• □ System certificates included in the annual review register

GRZAN supports manufacturers and Moroccan establishments with quality system evidence for medical device registration, including ISO 13485 certificate reviews, equivalent documentation strategies, good practice condition audits, and subcontracting notification workflows. For assistance with registration documentation and conformity files for the Moroccan market, contact GRZAN at info@grzanglobal.com.

Regulatory information verified as of 30 October 2026