SAHPRA Five-Phase ISO 13485 Roadmap for Establishment Licence Holders

1. Key takeaways

Through its communication titled ISO 13485 Certificate as a Prerequisite for Medical Device Establishment Licence Approval, SAHPRA has established a five-phase mandatory roadmap. Phase 1 is the communication period (until April 2025). From 1 June 2025 (Phase 2), licence renewal applications must include a valid ISO 13485:2016 certificate. From 1 April 2026 (Phase 3), all existing licence holders must submit their certificate for verification. From 1 June 2027 (Phase 4), licence amendments and product list updates must be accompanied by the certificate. From 1 April 2028 (Phase 5), all new applications must include the certificate. The obligations fall on manufacturers and distributors (importers), and the certificate must be issued by a SAHPRA-recognised Conformity Assessment Body (CAB).

The sequencing matters as much as the dates: the roadmap reaches renewals first, then existing holders, then amendments, and only at the end new applications. Established companies therefore face their heaviest compliance pressure in 2025 and 2026, before any new entrant does, and the practical estimate is that certificate readiness becomes a live issue well before each statutory date.

2. Legal basis

The table below lists the official sources relied upon.

3. Expert insights

Insight 1: The five phases are designed backwards from renewals to new applications, not ranked by the importance of the certificate. Phase 2 first captures renewals — the gate every established holder must eventually pass. Phase 3 extends the duty to all existing licence holders, Phase 4 covers amendments and product list updates, and only Phase 5 reaches new applications. This means the compliance burden on incumbent companies arrives before the burden on new entrants, which explains why 2025 and 2026 are the most demanding years for existing holders. Companies should map each product family and each licence to its earliest triggering phase rather than reading the roadmap as a single distant deadline.

Insight 2: Phase 3 is the hurdle with the widest coverage. From 1 April 2026, even a company that does not need to apply for a new licence, a renewal or an amendment must still submit its valid ISO 13485 certificate to SAHPRA for verification if it holds one. The verification scenarios are expressly listed as: information updates, application review, investigations, and post-market vigilance activities (for example, following a product complaint or a patient harm event). This provision converts the ISO 13485 certificate from an attachment filed once at application into a foundational record that can be called for at any time.

Insight 3: A transitional arrangement exists for companies still obtaining certification, but on strict conditions. Companies in the process of obtaining a certificate may provide proof of an agreement signed with a SAHPRA-recognised CAB; once the certificate is obtained it must be submitted to SAHPRA for verification immediately. This is a time-limited buffer, not an exemption — a company cannot indefinitely defer the obligation by stating that its certification process is underway. The agreement must be genuine, dated and specific to the South African licensed entity, and the internal target date for certificate issuance should be tracked against the phase dates.

Insight 4: Phases 3 and 4 may run concurrently. SAHPRA expressly states that Phases 3 and 4 may run concurrently. This means that after June 2027, the requirements for amendment applications and for verification of existing holders apply at the same time. Companies should avoid treating completion of Phase 3 submission as closing the matter: an amendment filed in 2027 or later will itself require the certificate, and the verification duty continues in parallel for every licensed entity regardless of whether any change is being filed.

Insight 5: The three matching requirements of the certificate are the most common failure point. The certificate must be: issued in the name of the South African licensed establishment, identical in address to the licensed address, and issued by a SAHPRA-recognised CAB. A group-level ISO 13485 certificate whose holder name or address does not match the South African licensed entity will not be accepted — this is the obstacle multinational companies encounter most often, and correcting it requires time because recertification or scope extension runs in months. It must be addressed well before the relevant phase date, not when the renewal file is being assembled.

4. Practical recommendations

The following actions align certification planning with the five-phase roadmap.

1. Determine first which phase applies to the company: map the situation to renewal, existing holder verification, amendment, or new application.
2. Check the three certificate elements immediately — holder, address and CAB: where any element fails, start reissuance early.
3. Companies still in certification should secure the CAB agreement proof: and submit the certificate for verification immediately once issued.
4. Treat Phase 3 as a standing obligation: the certificate can be called for at any time and must remain valid and retrievable.
5. Build budgets and schedules around the June 2027 and April 2028 milestones: both affect amendment and new application pipelines.
6. Manage certificate validity in alignment with the 5-year licence cycle: avoid expiry mismatches between the two documents.

5. Verification checklist

Confirm every item below against the phase that applies to the company.

• □ The phase applicable to the company has been confirmed (renewal, existing holder, amendment, or new application)
• □ The ISO 13485 certificate has been issued by a SAHPRA-recognised CAB
• □ The certificate holder name matches the South African licensed establishment
• □ The certificate address matches the licensed address
• □ Companies in certification hold the CAB agreement proof (applicable from 2025-06)
• □ Existing holders are prepared to submit for verification per the 2026-04 requirement
• □ Amendments and product list updates are planned against the 2027-06 milestone
• □ New applications are planned against the 2028-04 milestone

Regulatory information verified as of 29 October 2026. The regulations, guidance and effective dates described in this article are limited to the official sources listed in the legal basis section above, as published on that date. Where official documents are subsequently updated, the latest published version prevails.

• South Africa local resources: GRZAN assists manufacturers from the Chinese mainland and overseas with SAHPRA medical device Establishment Licence (MDEL) applications and product registration preparation, including Authorised Representative (AR) scheme design, ISO 13485 certification pathway planning and CAB selection, GMDN coding and classification determination, technical documentation preparation, and the establishment of vigilance and adverse event reporting mechanisms.
• Service capabilities: product attribute determination and risk classification (Class A/B/C/D), establishment licence application and renewal, reliance pathway justification, technical documentation and Essential Principles conformity argumentation, labelling and instructions-for-use localisation (English), and post-market vigilance and annual compliance information submission support.
• Contact: hito.lin@grzan.cn; website www.grzan.cn.