Quality System Evidence in Indonesia: ISO 13485, CPAKB/CPB and CDAKB Requirements

1. Key takeaways

Imported devices stand on the foreign manufacturer’s ISO 13485 certificate, and locally made devices stand on CPAKB/CPB — neither track accepts substitutes. For imports, reviewers examine the certificate on three points: it must be within its validity period, its scope must cover the product being submitted (not merely bear the company’s name), and the certification body must hold the relevant qualification. ISO 9001 or CE marking may serve as supplements, but they cannot replace ISO 13485.

For local production, the governing certificate is CPAKB/CPB (Cara Pembuatan Alat Kesehatan yang Baik / Cara Pembuatan yang Baik — the good manufacturing practice regime). For Indonesian entities that both produce and distribute, CPAKB has been mandatory since 1 January 2024. Permenkes 5/2026 goes further and establishes CPB certification as a general obligation for all medical product production facilities (Articles 13 and 15).

• Import track: valid ISO 13485 certificate from the foreign manufacturer, scope covering the submitted product, issued by a qualified body.
• Local track: CPAKB/CPB certificate; mandatory for producing-and-distributing entities since 1 January 2024, and a general obligation under Permenkes 5/2026 Articles 13 and 15.
• CE or FDA approvals: supplementary evidence only — they reduce the amount of data a reviewer requests but never replace the mandatory certificates.
• Distribution side: CDAKB (good distribution practice) has been a precondition for filing a marketing authorisation application since 1 July 2024.
• Pre-registration discipline: run a certificate health check across five documents, each with validity covering the expected review period plus 6 months.

2. Legal basis

The import-side requirements sit in Permenkes No. 11/2025, Appendix 3 (ISO 13485 and production licence requirements). The production-side obligations sit in Permenkes No. 5/2026, Articles 13, 15, 16, 18 and 21. Distribution-side CDAKB traces to Permenkes No. 4/2014, and its role as a licensing precondition was set by the Kemenkes circular FR.03.01/E/884/2024. The references below were verified on 26 October 2026.

Permenkes 5/2026 adds three production-side requirements worth reading closely. First, production facilities must appoint dedicated, qualified responsible persons (Article 16); pharmaceutical production facilities must have at least 4 such persons, respectively in charge of production, quality assurance, quality control and distribution. Second, contract manufacturing (maklon) is formally recognised (Article 18), provided it operates under a valid CPB. Third, relaxed arrangements apply to micro and small enterprises (UMK) producing certain devices and PKRT (Article 21).

3. Expert insights

Insight 1: scope coverage is the trap inside the ISO 13485 requirement. The certificate is examined for validity, scope and issuer qualification, and scope is where submissions fail. A certificate that names the company but not the product category leaves the reviewer unable to confirm that the quality system covers what is being registered. Before submission, the scope statement on the certificate should be read line by line against the device description, and a scope extension requested from the certification body if the product is not named.

Insight 2: reference-country approvals are a discount, never an exemption. CE or FDA approvals serve as supplementary evidence: they can reduce the volume of data a reviewer asks to be supplemented, and a complete CE technical file or FDA record makes the review materially easier. But the system certificate and the CFS are independent mandatory items. The principle generalises across the Indonesian framework: approvals from reference countries are always a bonus, never a substitute. Planning a submission on the assumption that a strong foreign approval waives a domestic certificate is planning a deficiency.

Insight 3: the distribution side now gates the application itself. Since 1 July 2024, CDAKB has been a precondition for submitting a marketing authorisation application (see article 32). This moves good distribution practice from a post-licensing concern to a filing prerequisite: the licence holder’s distribution certification must be in place before the dossier is even lodged, which is one more reason the licence holder’s certificate status has to be audited before a project is committed.

4. Practical recommendations

• Run a certificate health check before registration. Review five documents: ISO 13485 (manufacturer), IDAK (licence holder), CDAKB (licence holder), CFS (country of origin) and LoA (authorisation).
• Check each validity against the expected review period plus 6 months. Any one of the five expiring mid-review triggers a deficiency or a rejection outright.
• Verify ISO 13485 scope against the submitted product, and request a scope extension from the certification body where needed.
• Confirm the certification body’s qualification for the product category in question.
• For local production, map CPAKB/CPB obligations early — including dedicated responsible persons under Article 16 and maklon arrangements under Article 18.
• Use the UMK relaxations only where they genuinely apply under Article 21, rather than as a default assumption.
• Treat CE and FDA files as evidence supplements, while budgeting the mandatory certificates as separate, non-negotiable line items.

The health check deserves emphasis because its economics are asymmetric. Comparing five validity dates against a project schedule costs hours; discovering during review that one certificate lapsed costs a deficiency round and months of calendar time. The check is also repeatable — once built as a template, it runs on every new submission and every renewal with minimal effort.

5. Verification checklist

• □ ISO 13485 certificate valid, scope covering the submitted product, body qualified
• □ CPAKB/CPB status confirmed for local production, including Permenkes 5/2026 Articles 13, 15, 16, 18 and 21
• □ CDAKB in place for the licence holder as a filing precondition since 1 July 2024
• □ CFS valid for the country-of-origin requirement
• □ LoA valid and legalised
• □ All five certificates checked against the expected review period plus 6 months
• □ CE/FDA approvals positioned as supplementary evidence only

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including Indonesia. Our team prepares dossiers to ASEAN CSDT structure, manages AKL/AKL-I submissions with Kemenkes, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com