INVIMA Market Surveillance and Sanctions: Inspections, Suspensions, Cancellations

1. Key takeaways

INVIMA’s market surveillance is a toolkit chain: inspection powers (entering premises, examining documents, taking samples), health safety measures (immediate restriction of circulation), suspension of the registration (suspension of eligibility), and cancellation (final termination). The authorization basis is the sanitary code Ley 9 de 1979 and the surveillance regime established by Decreto 4725 de 2005, with procedural detail and the suspension and cancellation rules supplied by Decreto 582 de 2017. The most routine mechanism is Article 57 of Ley 962 de 2005: INVIMA must conduct a follow-up control within 15 days after issuance of a certificate.

GRZAN’s judgment is that the most common trigger of surveillance is not product quality but a mismatch between the certificate contents and reality. An unreported change of titular name or address, an importer’s expired CCAA, an uncompleted semantic report — these informational gaps push companies into surveillance procedures more often than quality incidents do. What genuinely limits the damage is the opportunity to respond within the administrative procedure: the deficiency response period is 90 days (a practical estimate), a single missed response is treated as a suspension, and the procedure itself runs under Ley 1437 de 2011 (CPACA).

2. Legal basis

3. Expert insights

1. The follow-up control normalizes surveillance: it begins within 15 days of the certificate

Article 57 of Ley 962 de 2005 defers supervisory resources to after issuance, which also explains why automatic registration (Decreto 4725 de 2005, Art. 17) can be fast — certificate first, verification after. For companies, issuance is not the end point of compliance; the first check may arrive within 15 days. GRZAN advises treating the certificate date as the starting point of compliance: immediately verify the certificate contents (Art. 20), the POA (Art. 29), the importer’s CCAA and the semantic reporting status — these four items are the high-frequency targets of follow-up controls.

2. The four tools form a ladder, not a parallel set

Inspection powers are a means of obtaining information and carry no consequence by themselves; health safety measures are an immediate instrument for quickly blocking circulation; suspension of the registration acts on eligibility; cancellation is the terminal instrument. Understanding this ladder matters because responses differ by stage: at the inspection stage, complete ledgers can end the escalation; at the safety-measure stage, evidence of execution and remediation is required; at the suspension and cancellation stages, the procedure enters Ley 1437 de 2011, and argumentation and production of evidence become the main tools. GRZAN’s position is that the earlier the engagement, the more tools remain available and the lower the cost.

3. The deficiency period is a window to answer, not a grace period

Many companies treat the deficiency notice as something to set aside, reasoning there are 90 days anyway. In reality, submitting a complete response within the 90-day window lets the procedure continue; not submitting leads directly to a presumption of suspension. GRZAN requires its clients to start immediately upon receiving a deficiency notice, organizing materials according to the procedural requirements of Ley 1437 de 2011 rather than using up the 90 days. Foreign manufacturers must also budget for cross-border communication and document translation — all submissions must be in Spanish, although technical or scientific information may be submitted in English with an official Spanish translation attached.

4. Practical recommendations

1. Registration holder (titular): set the certificate date as the compliance starting point and complete the four-item follow-up control self-check within 15 days (certificate contents, POA, CCAA, semantic reporting status).
2. Regulatory affairs leads: maintain a certificate contents ledger; when the titular name or address (Art. 20) changes, file the change immediately under the procedure of Decreto 582 de 2017.
3. Importers: set CCAA expiry reminders and request re-inspection at least 5 business days before expiry, per Resolución 4002 de 2007.
4. Vigilance responsible person: implement the 72-hour serious adverse event reporting and quarterly periodic reporting of Resolución 4816 de 2008, retaining ledgers and receipts.
5. Regulatory affairs leads: start the response immediately upon receiving a deficiency notice, planning backward from the 90-day window and including Spanish translation time.
6. Chinese manufacturers: designate a local legal representative (apoderado / representante legal) to receive INVIMA documents, so late receipt never costs you the response period.

5. Verification checklist

• □ The follow-up control self-check has been completed within 15 days of the certificate, per Article 57
• □ The certificate contents (Art. 20) match reality and changes have been filed through the procedure
• □ The POA (Art. 29) is valid and a local legal representative able to receive INVIMA documents has been designated
• □ The importer’s CCAA is within its validity and re-inspection is scheduled with the 5-business-day lead time
• □ Semantic reporting has been completed (Resolución 1405 de 2022)
• □ A deficiency response process exists, planned backward from 90 days (practical estimate) with translation time included

Regulatory information verified as of October 29, 2026

All conclusions published here defer to the current regulatory texts as issued by the competent authority, verified item by item before delivery.

— GRZAN Regulatory Team

GRZAN defends manufacturers through every stage of INVIMA market surveillance: preparation for follow-up controls and inspections, responses to health safety measures, deficiency responses within the CPACA procedure, and the ledger discipline that prevents informational gaps from becoming enforcement actions. For support before, during or after an inspection, contact the GRZAN regulatory team at info@grzanglobal.com.