CAB Recognition and ISO 13485 Certificate Matching Requirements in South Africa

1. Key takeaways

South Africa’s requirement for proof of a quality management system originates in Notice 1515 Regulation 5(1)(c)(iii): a licence applicant must provide acceptable written proof of quality management system certification for medical devices and IVDs. Through its communication titled ISO 13485 Certificate as a Prerequisite for Medical Device Establishment Licence Approval, SAHPRA has made this requirement concrete in the form of an ISO 13485:2016 certificate, subject to three hard matching conditions: the certificate must be issued by a SAHPRA-recognised Conformity Assessment Body (CAB), must be issued in the name of the South African licensed medical device establishment, and must bear the same address as the licence. SAHPRA will verify the authenticity of certificates directly with the issuing body.

The practical estimate that follows from these conditions is sobering: for multinational groups, a certificate issued in the name of a factory outside South Africa cannot simply be translated or re-labeled. Bringing the certificate into conformity may require a separate or extended certification audit of the South African entity, a process normally counted in months, and SAHPRA’s direct verification with CABs removes any room for optimistic self-assessment.

2. Legal basis

The table below lists the official sources relied upon.

3. Expert insights

Insight 1: Regulation 15 contains a dedicated provision for conformity assessment bodies, which shows that CAB recognition is itself part of the system. The 2016 Regulations already include Regulation 15 (Conformity assessment body), empowering SAHPRA to recognise bodies with the capability to carry out conformity assessment. This means whether a CAB is recognised is not a question for companies to judge by themselves; it is a factual question answerable against an official list. Before signing any certification contract, the recognised list published by SAHPRA should be checked, and the confirmation retained in the regulatory file so that the choice of certification body is defensible at review.

Insight 2: The requirement for a certificate in the name of the South African licensed establishment hits multinational groups hardest. Many Chinese manufacturers hold ISO 13485 certificates issued in the name of factories on the Chinese mainland, while the South African licensed entity is a local importer or subsidiary. Under SAHPRA’s requirements, the certificate must be issued in the name of the South African licensed establishment. This is not a simple translation issue — it may require a separate quality system certification, or an extension of certification scope, for the South African entity, with a timeline normally counted in months. A company that discovers this only at the renewal milestone faces the risk of an interruption in its licence.

Insight 3: Address consistency is an independent second check. The certificate address must be the same as the licensed address. Multi-site companies that list only the head office on the certificate while the licence covers several warehouses will produce a mismatch. The practical estimate here is straightforward: multi-site companies should include all South African licensed premises in the certification scope at the planning stage, because adding sites later means a scope extension audit, additional cost, and a window during which the certificate on file does not match the licence.

Insight 4: SAHPRA verifies directly with the CAB, bypassing company self-declaration. The authorities state expressly that the authenticity of certificates will be verified by SAHPRA directly with the issuing body. This removes the comfortable assumption that a submitted document will simply sit unread until someone asks. It also means that if a certificate is withdrawn or suspended, SAHPRA may learn of it before the company does. Maintaining a live channel with the certification body — including prompt notification obligations in the certification contract — is therefore part of licence hygiene, not a commercial nicety.

Insight 5: The practical test of CAB acceptability is the recognised status of the certifier. The prevailing industry understanding is that certificates issued by certification bodies accredited under ISO 17021 (for example, bodies accredited by SANAS or members of the IAF) are more readily accepted. The practical estimate remains that the SAHPRA published recognition scope and the outcome of case-by-case verification prevail: companies should confirm that a candidate certification body falls within SAHPRA’s recognition scope before engagement, and should not assume that international accreditation alone settles the question.

4. Practical recommendations

The following actions align certification planning with the three matching requirements.

1. Check first whether the CAB is within SAHPRA’s recognised scope before signing any certification service contract.
2. Have the certificate issued in the name of the South African licensed establishment: never substitute a certificate held in the name of an overseas factory.
3. Ensure the certificate covers all licensed premises addresses: multi-site companies must pay particular attention.
4. Choose a certification body accredited under ISO 17021 to reduce the risk of rejection.
5. Keep the certificate status synchronised with SAHPRA: withdrawal or suspension must be notified proactively.
6. Schedule certification 6 to 12 months ahead of the renewal milestone to avoid any interruption of the licence.

5. Verification checklist

Confirm every item below before and after certification is completed.

• □ The issuing body has been confirmed as within SAHPRA’s recognised CAB scope
• □ The certification body holds ISO 17021 accreditation (practical estimate)
• □ The certificate is issued in the name of the South African licensed establishment
• □ The certificate address is fully identical to the licensed address
• □ For multi-site companies, all licensed premises are included in the certificate scope
• □ The certificate is currently valid, with no suspension or withdrawal
• □ A mechanism for proactively notifying changes in certificate status has been established
• □ Certification completion is scheduled 6 to 12 months ahead of the renewal milestone

Regulatory information verified as of 29 October 2026. The regulations, guidance and effective dates described in this article are limited to the official sources listed in the legal basis section above, as published on that date. Where official documents are subsequently updated, the latest published version prevails.

• South Africa local resources: GRZAN assists manufacturers from the Chinese mainland and overseas with SAHPRA medical device Establishment Licence (MDEL) applications and product registration preparation, including Authorised Representative (AR) scheme design, ISO 13485 certification pathway planning and CAB selection, GMDN coding and classification determination, technical documentation preparation, and the establishment of vigilance and adverse event reporting mechanisms.
• Service capabilities: product attribute determination and risk classification (Class A/B/C/D), establishment licence application and renewal, reliance pathway justification, technical documentation and Essential Principles conformity argumentation, labelling and instructions-for-use localisation (English), and post-market vigilance and annual compliance information submission support.
• Contact: hito.lin@grzan.cn; website www.grzan.cn.