Legal Hierarchy of LGS and RIS in Mexico

1. Key takeaways

Mexican medical device regulation is built as a four-level structure: laws (the General Health Law, LGS), regulations (the Regulation of Health Supplies, RIS), official standards (NOM) and pharmacopeial supplements (FEUM), and administrative agreements and platform rules (Acuerdos, Lineamientos, DIGIPRiS). When making a compliance judgment, a lower-level instrument must not conflict with a higher-level one, and the higher levels generally state principles only — the provisions that are actually executable in daily work sit mostly in the RIS and the NOM standards. In practical terms, this means that a company can rarely answer a regulatory question by reading a single document: the law tells you whether a product is regulated at all, the regulation tells you what obligation applies, the NOM tells you how to meet technical requirements, and the agreements tell you whether a specific product benefits from a special pathway. Teams that map every requirement to its level resolve conflicts faster and document their reasoning more convincingly when a reviewer challenges a position.

2. Legal basis

The table below lists the four levels with their key provisions and dates. Note that both core instruments were amended recently, and several standards and agreements were issued in 2025 and 2026, so the applicable text for any given project must be confirmed against the publication dates.

A useful way to work with this table is to treat it as a reading order rather than a list. Start at the law to establish whether the product falls within the regulated universe and which obligations attach at that level. Move to the regulation to find the operative provisions — registration requirements, classification criteria, dossier contents and holder obligations. Consult the NOMs for the technical detail of manufacturing and labeling, and the FEUM supplement for classification rules that translate the regulatory principles into concrete product decisions. Finish with the agreements, which operate as overlays that can expand or shrink the scope of registration obligations for named products. Teams that adopt this reading order in a fixed sequence find that most apparent conflicts disappear once each question is asked of the correct level.

3. Expert insights

Insight 1: The law level has changed more frequently than the regulation level in recent years. The LGS received a major amendment on 2026-01-15 covering digital health, post-market surveillance and registration validity, and the RIS followed on 2026-04-24 by adjusting renewal provisions. Because the two lines were amended at different moments, projects running in the intervening period must determine which set of rules applies to their facts, and reading only one of the two documents is not enough. For a dossier in preparation at the time of an amendment, the safe approach is to check each requirement against both the pre- and post-amendment texts, record which version was applied, and keep the source dates in the classification report so that any later reviewer can reconstruct the reasoning.

Insight 2: A NOM is a binding standard, not advisory guidance. NOM-241 and NOM-137 are mandatory standards, and non-conformity constitutes a compliance failure. However, every requirement in a NOM must trace back to an enabling source in the LGS and the RIS. For example, the legal basis of NOM-137-SSA1-2025 is expressly listed as Articles 194, 194 Bis, 195, 210, 212, 214 and 262 to 266 of the LGS and Articles 11, 24, 165, 179, 182 and 183 of the RIS. Companies can use this chain when assessing whether a novel requirement genuinely binds their product category, and when preparing responses that argue a technical point by reference to the underlying law rather than only to the standard.

Insight 3: An administrative agreement can directly change the fate of a product. The 2025 low-risk agreement moved a group of devices that previously required registration out of the registration obligation, and also brought a group of previously exempt devices back into registration. Changes of this kind do not go through a law amendment; they are published as a single Acuerdo in the DOF. A company that only monitors the law level will miss them entirely. This is why the four-level ledger recommended below includes agreements as a distinct level with its own review cadence, and why cross-functional teams should be briefed that product scope changes can arrive through instruments that never touch the statute book.

4. Practical recommendations

1. Maintain a ledger of the four legal levels: for each instrument record its name, publication date, effective date and applicable provisions, and review the ledger quarterly so that newly published instruments are incorporated before they affect active projects.
2. When instruments conflict, resolve the question in the order of law over regulation, regulation over standard, and standard over agreement, and write the reasoning into the classification report so the analysis is auditable.
3. Track NOM effective dates separately from publication dates: most NOMs use the formulation of entering into force a number of calendar days after publication, so the publication date alone does not tell you when the obligations begin.
4. For agreement-type documents, verify whether older agreements were repealed, and make sure no team member continues to rely on a superseded list.

5. Verification checklist

• □ Complete list of the four legal levels (law / regulation / standards and pharmacopeia / agreements)
• □ LGS amendment decree date recorded as DOF 2026-01-15
• □ RIS amendment decree date recorded as DOF 2026-04-24
• □ Publication dates and effective dates recorded separately for the three NOMs
• □ Dates and supersession relationships of the two 2025 agreements verified

Regulatory information verified as of October 28, 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Mexican market. Our team manages COFEPRIS registrations and equivalence (equivalencia) reviews, coordinates third-party authorised centre routes, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com