Colombia Medical Device Regulatory Landscape: MSPS, INVIMA and SIRIS

1. Key takeaways

Colombian medical device regulation can be broken down into a vertical chain: the Ministerio de Salud y Protección Social (MSPS, the Ministry of Health and Social Protection) writes the rules, INVIMA (Instituto Nacional de Vigilancia de Medicamentos y Alimentos, the National Food and Drug Surveillance Institute) enforces them and issues certificates, and SIRIS (siris.invima.gov.co) is the online system that carries every submission action. These three are not parallel agencies but a three-layer structure of legislation, enforcement and execution. Most procedural delays that Chinese manufacturers encounter in Colombia stem not from thin technical files, but from failing to identify which layer of the chain they are stuck in at a given moment.

The current foundational decree is Decreto 4725 de 2005, published on December 26, 2005 and still in force. Under this framework, devices are classified into four risk classes — I, IIa, IIb and III — and Colombia has no Clase IV, while in vitro diagnostics are governed separately under Decreto 3770 de 2004 and its three categorías. The GRZAN regulatory team’s judgment is that the first step into Colombia is not product selection or classification, but confirming legal standing — foreign manufacturers cannot submit directly and must appoint a Colombian local legal representative (apoderado / representante legal), with the registration holder (titular) filing through SIRIS.

2. Legal basis

3. Expert insights

#### The MSPS and INVIMA division of labor means that changing the rules and changing the practice are two different things

Decreto 4725 de 2005 was issued within the MSPS system and sits at the level of an administrative regulation, while the party companies deal with daily is INVIMA, covering review, corrections, issuance, renewals, post-market inspections and vigilance. The GRZAN regulatory team has repeatedly seen one misjudgment in projects: companies treat an INVIMA reviewer’s oral request as a regulatory change and immediately rework their entire dossier. In reality, INVIMA’s operational interpretations can only explain and enforce the superior decree; they cannot alter the document lists already fixed by Art. 18 and Art. 19. The test is simple — if a requirement can be traced to an article of Decreto 4725 de 2005 or a current resolution, it is a binding legal obligation; if not, it is an operational interpretation that can be clarified in writing through a formal SIRIS inquiry. This distinction directly determines a company’s rework cost.

#### The four-class risk system is a pathway selector, not a label

Art. 16 and Art. 17 bind the registration pathway directly to the risk class: Class IIb and III products go through the Registro Sanitario (standard registration), while Class I and IIa products go through the Registro Sanitario Automático (automatic registration). The official review timelines differ enormously — automatic registration takes 2 business days, standard registration takes 90 business days, excluding correction rounds. This means the classification outcome is not merely an ordering principle for the document table of contents; it directly determines the magnitude of the market-entry timeline. The GRZAN judgment is that the classification conclusion must be locked down before drafting the technical file, not filled in casually just before submission.

#### The titular-centric system is an underrated long-term constraint

Art. 20 of Decreto 4725 de 2005 requires the registration certificate to state the name and address of the titular, and the registration number appears in a form such as INVIMA 2025DM-0002510-R2, where the R suffix indicates the renewal count. All rights and obligations attach to the titular: a change of titular is a change of a legal nature and follows a different procedure and fee schedule than technical changes such as a new manufacturer or new packaging specification. A common practice among Chinese manufacturers is to obtain the certificate under the local distributor’s name first. The GRZAN regulatory team reserves judgment on this approach — once the titular and the manufacturer are separated, every subsequent change, every vigilance report and every recall depends on the holder’s cooperation, and the manufacturer’s commercial negotiating position is structurally weakened.

4. Practical recommendations

1. The GRZAN regulatory team completes legal-standing confirmation at project initiation: determine who will act as titular, who signs the POA as the local legal representative (apoderado / representante legal) (Art. 29), and assess in parallel the long-term risks of separating the titular from the manufacturer.
2. Have the foreign manufacturer issue a power of attorney (POA) whose scope explicitly covers SIRIS submissions, correction replies, renewals and vigilance reporting, avoiding an overly narrow scope that would require fresh notarization and legalization for every later action.
3. The GRZAN recommendation is to complete the risk-class determination before drafting the technical file, and to fix the classification conclusion and the applicable Art. 7 rule numbers in writing as the baseline for the document table of contents and the pathway choice.
4. Have the titular open an account in SIRIS and complete entity information registration, ensuring that the name and address in SIRIS match the legal documents exactly, so that the stated contents required by Art. 20 do not deviate.
5. Establish an internal post-market vigilance process: report serious adverse events to INVIMA within 72 hours of awareness, submit periodic reports quarterly, and execute recalls per INVIMA instructions (Resolución 4816 de 2008).
6. Confirm that the importer holds a valid CCAA (Certificado de Capacidad de Almacenamiento y Acondicionamiento); the CCAA is valid for 5 years, the importer must employ a technical director (director técnico), and re-inspection must be requested at least 5 business days before expiry.

5. Verification checklist

• □ The titular has been confirmed and a POA signed by the foreign manufacturer has been obtained (Decreto 4725 de 2005 Art. 29)
• □ A Colombian local legal representative has been appointed, with authority covering all subsequent SIRIS actions
• □ The risk-class determination (I / IIa / IIb / III) has been completed, with the applicable Art. 7 rule numbers recorded in writing
• □ Review timeline expectations have been confirmed by pathway: automatic registration 2 business days / standard registration 90 business days
• □ The SIRIS account has been created, with the entity name and address matching the legal documents exactly (Art. 20)
• □ The importer’s CCAA has been confirmed valid, and the technical director (director técnico) is in place (Resolución 4002 de 2007)
• □ An internal process for 72-hour serious adverse event reporting and quarterly periodic reporting has been established (Resolución 4816 de 2008)
• □ The renewal owner and renewal window have been defined: renewal must start at least 3 months before expiry for devices

Regulatory information verified as of October 29, 2026

All outward-facing conclusions are based on the current regulatory texts published by the competent authorities and are verified item by item before delivery.

GRZAN provides end-to-end INVIMA registration and compliance support for manufacturers entering the Colombian market, covering legal-standing setup, risk classification, technical and legal documentation, SIRIS submissions, Spanish-language compliance, post-market vigilance and renewal management. For inquiries about INVIMA registration in Colombia, contact info@grzanglobal.com.