NOM-241-SSA1-2025 versus 2021: Six Key Changes to Mexican GMP

1. Key takeaways

NOM-241-SSA1-2025 was published in the Diario Oficial de la Federacion on 4 April 2025 and enters into force 240 calendar days after publication, replacing the 2021 edition. Relative to that earlier edition it makes six substantive adjustments: it clarifies that the standard applies only to devices for human use; it narrows the scope of application back to establishments that sell health inputs within the national territory; it updates terminology and definitions; it deletes the former section 5 on risk classification; it adds dedicated subsections for remanufactured and refurbished products and for software as a medical device; and it widens risk management from quality risk management to broader system coverage. Each of the six adjustments changes where a company must look, or what it must document, so the transition from the 2021 edition is not a formatting exercise but a re-mapping of obligations, and it should be planned accordingly.

• Application limited to devices for human use, and scope narrowed to establishments selling health inputs within Mexico.
• Terminology and definitions updated across the standard.
• The former section 5 on risk classification is deleted; classification returns to the RIS.
• New subsections for remanufactured and refurbished products and for software as a medical device, and broader risk management coverage.

2. Legal basis

The transition is defined by four sources. NOM-241-SSA1-2025, published on 4 April 2025 and in force 240 calendar days after publication, is the current edition. NOM-241-SSA1-2021, published on 20 December 2021 and in force from 20 June 2023, has been superseded. Articles 83 and 83 Bis of the Reglamento de Insumos para la Salud, as amended by the order published on 24 April 2026, are where risk classification now resides. The FEUM Suplemento para Dispositivos Medicos, edition 5.0 (2023), contains the chapters relevant to risk management. The table below consolidates these sources.

3. Expert insights

Insight 1: the entry-into-force date has two circulating versions. The official formulation is 240 calendar days after publication, while practical sources record the resulting date variously as 30 November 2025 and 1 December 2025. Formal documents should cite the formulation of 240 calendar days and note that the specific date is subject to two practical renderings, treating the unresolved difference as pending verification until an authoritative text settles it. Citing the regulation itself, rather than one of the derived dates, keeps filings accurate regardless of which rendering a reviewer prefers.

Insight 2: the terminology update moves responsibility boundaries. The 2025 edition adds terms such as device performance, risk, and relabelling (contraetiquetado or contraetiquetar); modifies the definitions of complaint, quality management system, software as a medical device and holder of the sanitary registration; and deletes the term legal file (expediente legal). Among these, the adjustment to the definition of holder of the sanitary registration runs in the same direction as the standard’s broader emphasis on the responsibilities of the holder, so the definitions chapter should be read as part of the responsibility architecture rather than as editorial housekeeping.

Insight 3: deleting the risk classification chapter is a relocation of duties. The subject of classification returns to Article 83 of the RIS, and NOM-241 no longer carries classification rules. Companies should support their classification arguments by citing the regulation and the FEUM supplement. This relocation simplifies maintenance in one respect, since classification logic no longer needs to be tracked across two documents, but it also means that any classification text written against the old edition must be re-anchored to the new sources.

Insight 4: the chapter structure corresponds partly to the IMDRF framework. The 2025 edition contains dedicated chapters on stability studies (chapter 14), product recalls (chapter 15), subcontracted activities (chapter 16) and good practices for storage and distribution (chapter 18), and chapter 18 adds detailed provisions on relabelling. The correspondence eases the comparison of a Mexican quality system with systems documented against international guidance, though the mapping is partial and the standard’s own chapter numbering remains the operative reference inside Mexico.

Insight 5: the standard intersects with the recall regime. Chapter 15 of the standard, on product recalls, operates in parallel with the technical vigilance system of NOM-240-SSA1-2012, and a single field action can trigger obligations on both tracks simultaneously. Recall planning should therefore be written once but mapped against both sources, so that the notification, execution and closure steps of an action satisfy the requirements of each instrument without duplication or omission.

4. Practical recommendations

• Reorganise system documentation against the chapter structure of the 2025 edition, prioritising the glossary and the sections on remanufactured and refurbished products and on software.
• Re-anchor classification arguments to Articles 83 and 83 Bis of the RIS and the FEUM supplement, and stop citing NOM-241 for classification.
• Prepare risk management documentation for the broader system coverage, using the relevant chapters of the FEUM supplement as the reference.
• For establishments located within Mexico, map the relabelling (contraetiquetado) process against chapter 18.
• Cover both tracks in the recall plan: chapter 15 of NOM-241 and NOM-240-SSA1-2012.

5. Verification checklist

• □ System documentation has been reorganised against the chapters of NOM-241-SSA1-2025.
• □ The glossary has been updated for the added, modified and deleted terms.
• □ Classification arguments no longer cite NOM-241.
• □ The sections on remanufactured and refurbished products and on software have been completed.
• □ The relabelling process has been mapped against chapter 18.
• □ The recall plan covers chapter 15 of NOM-241 and NOM-240-SSA1-2012.

Legal information verified as of 28 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Mexican market. Our team manages COFEPRIS registrations and equivalence (equivalencia) reviews, coordinates third-party authorised centre routes, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com