COFEPRIS Authority and Scope for Medical Devices in Mexico

1. Key takeaways

In Mexico, the competent authority for medical devices is the Federal Commission for the Protection against Sanitary Risk (COFEPRIS). COFEPRIS is a body of the Ministry of Health (Secretaría de Salud), not an independent ministry of its own. In day-to-day practice, manufacturers and importers deal with COFEPRIS for essentially every regulatory touchpoint: risk classification determinations, sanitary registration review, Good Manufacturing Practices verification, labeling compliance checks, import permits, and post-market technovigilance. Although the Ministry of Health remains the legal entity that formally issues sanitary authorizations, execution of that authority is carried out at the COFEPRIS level, which receives, reviews and decides on filings. For a foreign manufacturer, this means the practical entry point into the Mexican system is always COFEPRIS, and every procedural expectation — submission formats, requests for clarification, inspection modalities — is shaped by COFEPRIS practice rather than by a separate ministerial process. Understanding where COFEPRIS sits in the institutional structure helps companies route their applications correctly and avoid sending documents to bodies that play no role in device regulation.

2. Legal basis

The legal basis for COFEPRIS authority rests on a short chain of instruments: the General Health Law, the Regulation of Health Supplies, and COFEPRIS internal organizational rules. Each instrument addresses a different layer of the question — who defines the products, who grants the authorization, and who performs the specific functions. The table below summarizes that hierarchy and the provisions most relevant to medical device companies.

Read together, these instruments show a deliberate design: the law defines the universe of regulated products and reserves the authorization power at the ministry level, the regulation converts that power into concrete obligations for manufacturers and importers, and the organizational rules distribute the operational workload inside COFEPRIS. A company that understands this chain can trace any regulatory requirement it receives back to its legal source, which is essential when a reviewer asks for documentation or applies a new interpretation.

3. Expert insights

Insight 1: The authorization chain runs from the Ministry of Health to COFEPRIS. In strict legal terms, the sanitary registration is issued by the Ministry of Health, but every action a company actually performs — submitting the dossier, responding to deficiency requests, receiving the decision — takes place at COFEPRIS. Drafting a regulatory strategy that clearly separates the question of who signs the authorization from the question of who handles the file reduces procedural misalignment. Companies that confuse the two levels sometimes design internal approval flows around the wrong counterparty, which creates friction when correspondence, payment records or powers of attorney do not match the body that actually manages the process. Keeping the distinction explicit in project documentation also helps when training internal teams, because staff quickly learn that correspondence is addressed to COFEPRIS units while the underlying legal authority sits above them.

Insight 2: The 2026 amendment extended verification to electronic means. Article 396, section I of the LGS was adjusted by the amendment decree published in DOF 2026-01-15, so that verification activities are no longer limited to on-site inspection but may be conducted in written or electronic form. This means the regulator can request and review documentation without visiting the facility, and the quality of a company document retention practices converts directly into a compliance risk factor. Files that are complete, indexed and retrievable become a strategic asset; files that are scattered across mailboxes and local drives become a liability the moment an electronic request arrives. Companies should treat this change as a reason to audit their documentation architecture now, before an electronic verification exercise tests it in practice.

Insight 3: A single receiving body does not mean centralized decision-making. Classification, registration, GMP verification, labeling, import permits and technovigilance are distributed across different operating units within COFEPRIS, and the same product may be examined by several of them at different moments of its lifecycle. Managing registration numbers, validity periods and official correspondence in a single unified ledger is more robust than tracking each matter separately, because cross-unit interactions — a labeling observation that affects a registration file, or an inspection finding that touches an import permit — surface quickly when everything sits in one place. A unified ledger also gives management a realistic picture of total regulatory exposure for each product, rather than a fragmented view assembled from inboxes.

4. Practical recommendations

1. Identify the correct counterpart at project initiation: foreign manufacturers do not file directly with COFEPRIS and must act through a Mexican registration holder, so confirm that entity before preparing any dossier content.
2. Build a documentation structure of one product, one master file: place the classification rationale, the registration dossier, the labeling versions and the vigilance records under a single index so the file can be produced promptly in an electronic verification under Article 396, section I.
3. Monitor official publications rather than industry summaries: changes in regulatory interpretation are authoritative only as published in the DOF texts and announcements on gob.mx, so verify every reported change against the official source before acting on it.
4. Schedule separately for devices involving radioactive sources: the National Commission for Nuclear Safety and Safeguards (CNSNS) participates in the licensing of such devices, and this additional involvement needs its own timeline in the project plan.

5. Verification checklist

• □ Confirmed that the competent authority is COFEPRIS and that it is not an independent ministry
• □ Recorded the current text dates of LGS Articles 262 and 376
• □ Recorded the date of the RIS amendment decree (DOF 2026-04-24)
• □ Confirmed whether the product involves radioactive sources or other cases requiring CNSNS participation
• □ Established a unified documentation ledger to support electronic verification

Regulatory information verified as of October 28, 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Mexican market. Our team manages COFEPRIS registrations and equivalence (equivalencia) reviews, coordinates third-party authorised centre routes, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com