Medical Devices
Medical devices, including software-based medical devices (artificial intelligence/augmented reality/virtual reality, etc) are regulated by:
Personal Protective Equipment
Personal protective equipment is regulated by:
Medical Instruments
Medical instruments are regulated by:
Cosmetics
Cosmetics are regulated by:
Biocides
Biocides are regulated by:
Food
Food (including gene edited products, or GMOs) and nutrition supplements are regulated by:
Pharmaceuticals
Pharmaceuticals are regulated by:
Blood Products
Blood products are regulated by:
Psychedelics
Psychedelics are regulated by:
Cannabidiol (CBD)
CBD, when used for medicinal purposes, is regulated by:
Medical Apps
Medical apps are not yet regulated specifically in Mexico. Certain medical apps may be considered a medical device given their specific characteristics.
Telemedicine
Telemedicine is not specifically regulated, but mentioned in:
the General Health Law;
Federal Law on Protection of Personal Data Held by Private Parties;
Regulation of Sanitary Control of Products and Service;
Mexican Official Standard NOM-024-SSA3-2010 that established the objectives and functionalities that electronic clinical record system products must comply with in order to ensure interoperability, processing, interpretation, confidentiality, security, and use of standards and catalogues of information from electronic health records; and
Mexican Official Standard NOM-024-SSA3-2012 for the Electronic Health Record Systems, Exchange of health information.
Wearables
Wearables are not yet regulated specifically in Mexico. Certain medical apps may be considered a medical device given their specific characteristics.
Stem Cells
Stem cells are regulated by:
Borderline products are covered in the classifications mentioned above.
Manufacturing Sites
Manufacturing sites, including in respect of processes and quality require the following:
The facility must be designed, built and maintained in accordance with the operations to be carried out therein, based on the risk level of the medical device. Its design and construction should allow for cleanliness, order, maintenance and prevention of contamination, and the flow of personnel and materials should follow a logical sequence.
The size of the facility and the number of areas should be in accordance with the manufacturing capacity, equipment, diversity of medical devices and type of activities performed in each of them.
Alternate power supply systems must be available to maintain the condition of the critical systems involved in the manufacture of sterile medical devices manufactured by aseptic processing.
Indicators and alarms must be in place to detect failures in critical systems in a timely manner, in order to take the necessary measures in accordance with the corresponding SOP.
There should be manufacturing areas, laboratory and other rooms that are involved in manufacturing, which should be made of materials that allow cleaning, keeping them free of dust, insects, pests and facilitating their maintenance, in order to minimise the risk of contamination.
Activities for the prevention, control and eradication of harmful fauna must be carried out in accordance with an established programme.
Facilities and buildings must be subject to written instructions for cleaning and sanitising, according to the classification of the areas.
Lighting, temperature, humidity and ventilation must be adequate for the activities carried out in each of the areas and must not directly or indirectly affect the product, equipment and personnel.
The manufacturing areas must be identified and separated for each of the manufacturing processes; in the case of processes in which more than one operation is carried out continuously, risk management must be carried out and the design of the areas must be justified.
The facility must have specific areas for reception, inspection and/or sampling, weighing and/or assortment of inputs, production, bulk product storage and conditioning.
The design and location of the areas must be such that the flow of personnel, inputs, product in process, finished product and waste is carried out in a logical and sequential order according to the manufacturing process, avoiding cross flows, minimising the risk of contamination to the product and considering the levels of cleanliness.
Access to production areas must be restricted and controlled.
According to the classification of the manufacturing area and the risk level of the product, the ventilation duct installations, electrical power lines and other services inherent to the production areas must be hidden or outside of them. Their location and design must be such that they can be maintained, and in cases where volatile liquids are used in the production areas, there must be anti-explosion installations and systems that maintain the concentrations allowed in the applicable regulations.
Pipelines through which raw materials, intermediate or bulk products are transferred must be made of inert, non-contaminating material and must be identified.
The facility must have specific areas or cabinets, duly identified to store tools, substances or materials required for the maintenance of manufacturing equipment, which must comply with the same sanitary conditions according to the area in which they are located.
Areas, manufacturing equipment and processes must have the required critical systems such as: HVAC, compressed air, pharmaceutical water and pure steam.
The formulated product areas where dust is generated must have dust extraction and collection systems designed to avoid cross-contamination and environmental contamination.
The storage areas must be designed and constructed to ensure BPADs, must comply with cleanliness, temperature and RH conditions required by the type of inputs and/or products, and must be monitored and verified.
Storage areas must have the capacity and conditions necessary to preserve and/or conserve the supply, bulk product or finished product.
Printed materials for conditioning should be stored in an area with controlled and restricted access.
The quality control laboratory should be physically separated from the production and storage areas and have sufficient facilities and space for the tests and analyses carried out there.
The areas destined for medical service and dining rooms must be separated from manufacturing areas.
The areas for changing rooms, locker rooms, laundry and restrooms should be easily accessible and their size should correspond to the number of workers.
Sanitary facilities must not communicate directly or be located in passageways with manufacturing areas.
Specifications/Design/Requirements for the Manufacture of Products
Medical device manufacturing systems should follow written procedures to ensure compliance with GMP. The characteristics of each system will be conditioned by risk management, the nature of the processes and the quality specifications of each product.
There should be written procedures for the receipt, identification, sampling, storage, control and handling of all supplies used in the manufacture of medical devices.
Manufacturing operations should be performed by qualified personnel and supervised by personnel who have the experience, knowledge and educational background appropriate to the activity they are supervising.
Access to manufacturing areas must be restricted and controlled.
Manufacturing areas shall be maintained to the appropriate degree of cleanliness and sanitation in accordance with risk management, the nature of the processes and area classification.
Operations of different products or batches should not be carried out simultaneously in the same room, except when there is no risk of cross-contamination.
The flow of materials should be carried out in a logical sequence in such a way as to prevent the risk of cross-contamination.
The production or assembly order must remain in view during the process.
The production procedure should indicate the critical operations that need to be supervised.
The results of the tests and analyses carried out for process control must be recorded or attached to the production or packaging file.
Any deviation in the yields indicated in the production or packaging order must be investigated prior to batch release.
In order to release a batch of sterile product, satisfactory sterility test results must be available.
Additional requirements exist based on the type of product and/or process, including metal-mechanic devices, textile devices, biological medical devices, radiopharmaceuticals, assembly, software, etc.
Requirements of the Entity Responsible for Compliance
Each manufacturer must have a quality control laboratory independent from the production area and under the authority of a qualified person, with academic background and experience verifiable through their CV.
There should be standardised procedures for cleaning, maintenance and operation of laboratory areas, measuring instruments and equipment with corresponding records.
The laboratory must have a calibration programme for measuring instruments used and must have specifications, sampling procedures, test procedures and records, analytical or conformity certificates and records of environmental monitoring.
Retention samples of each batch of finished product should be kept at least one year after the expiration date of the medical device, in their final packaging and stored under the conditions indicated on the label.
There should be procedures describing the handling and storage of reagents, solutions, strains and culture media used in the laboratory.
All in-process control tests must be performed according to methods approved by the quality unit and should be performed at the manufacturing site.
There should be a procedure indicating the actions to be taken in the case of out-of-specification or out-of-trend analytical results.
The analysis of the same sample should not be repeated when any of the results is out of specification without first having carried out the corresponding investigation, nor can they be averaged when one of them is out of specification.
Sampling should be performed and recorded in accordance with written procedures approved by the technical director.
The technical director must determine the release of medical devices.
The inspection of the medical device should include at least: review of the analytical certificate and/or certificate of conformity; physical review of the condition of the product; and the number of samples to be evaluated should be determined based on statistical criteria.
There is no specific regulation relating to corporate social responsibility, the environment and sustainability for medical supplies; however certain regulations must be followed depending on the type of medical supply. For example, in the case of radioactive materials, the applicable regulation would be the Mexican Official Standard NOM-052-SEMARNAT-2005, which establishes the characteristics, identification procedure, classification, and lists of hazardous waste, as well as general laws such as the General Law of Ecological Balance and Environmental Protection, and the General Law for the Prevention and Comprehensive Management of Wastes, among others.
The Ministry of Health, through the Federal Commission for the Protection Against Sanitary Risks (COFEPRIS) shall authorise the advertising of medical devices in accordance with the characteristics and purposes for which they have been registered and shall be subject to the indications or uses approved.
The Ministry of Health, when granting or reviewing the registration of medical devices, shall specify in the advertising bases whether it may be directed to the general population or only to health professionals, technicians, and auxiliaries.
Advertising directed to health professionals shall be limited to the advertising bases approved by the Ministry of Health in the authorisation of these products, and shall be exclusively aimed at professionals, technicians and assistants of health disciplines.
The information contained in the message on quality, origin, purity, conservation, and benefits of use must be verifiable.
The message shall not induce behaviours, practices or habits harmful to physical or mental health that imply risk or threaten the safety or physical integrity or dignity of persons.
Advertising of medical devices should include messages that avoid self-treatment, when required due to their characteristics.
Advertising of medical devices directed to the general public shall:
Substantiation of Claims
Claims against medical devices may be brought before COFEPRIS pointing out circumstances that may harm the health of individuals and/or the population. The claim must provide sufficient information to identify and locate the cause of the health risk or damage and, if applicable, the persons involved.
Once the claim has been filed, COFEPRIS will start an investigation which will result in an administrative proceeding against the company responsible for the products, which will have to demonstrate that the claim is not sustained.
With regards to product liability, individuals affected by a medical device may also file a claim before the Federal Consumer Protection Agency (PROFECO) in terms of the Federal Consumer Protection Law and its Regulations, or through a civil lawsuit.
In the matter of medical devices and consumer protection regarding environmental complaints, they will be handled according to general environmental regulations. Even though the General Law of Ecological Balance and Environmental Protection does not specifically regulate cases of deception, it does indicate that a claim will not be admissible when the act of such does not exist. In the same way, if the complaint is valid but the act which is the subject of the complaint does not violate any laws or regulations, the claim may be concluded.
According to the Mexican Official Standard NOM-241-SSA1-2021 of Good Manufacturing Practices for Medical Devices, a conformity assessment is established, where the health authority will conduct a review of the final product to ensure its safety and compliance with regulations in the field.
The standard also mentions internal evaluations (risk assessments, quality management evaluations, etc), studies (such as stability studies conducted over different timeframes), inspections, tests, audits and validations with documentary evidence.
Medical devices require a marketing authorisation for their distribution in the country. Requirements for the marketing authorisation may vary based on the country of origin of the product, but in general terms include:
In general, the healthcare sector in Mexico can be considered to have a strict regulatory framework, primarily due to the authority responsible for most of the permits and consultations, COFEPRIS, which is known for its strong regime and no flexibility or adaptation to the market.
Specifically, in respect of medical devices, there is extensive regulation; however, there are many gray areas, particularly with regards to development of new technologies and the intersection between wearables and medical devices.
Something particularly relevant from a manufacturing perspective is the new US policy relating to nearshoring, which is translating to a rapid transfer of business operations to Mexico in order to take advantage of its geographical proximity.
The entry into force of the United States – Mexico – Canada Agreement (USMCA), which came in effect on 1 July 2020, and supersedes NAFTA, has further strengthened the commercial and productive integration of North America, providing additional incentives for the manufacturing and import/export of products within the region.
Post-market Surveillance Obligations
Mexican Official Standard NOM-240-SSA1-2012, Installation and Operation of Techno-vigilance establishes a set of activities aimed at identifying and evaluating adverse incidents produced by medical devices in use, as well as identifying the risk factors associated with them, based on the systematic reporting, recording and evaluation of adverse incident reports, in order to determine the frequency, severity and incidence of such incidents in order to prevent their occurrence and minimise their risks. Ideally, the information of the techno-vigilance system is shared between competent authorities and manufacturers/distributors, to facilitate techno-vigilance activities, as well as preventive and corrective actions for each case at national and international level that impact on the national territory.
There must be a product recall procedure when it is determined that the products are out of their specifications or when their safety, quality and effectiveness has been compromised.
Record-Keeping Requirements
Documents containing information related to the manufacturing of medical devices must be safeguarded, with security measures in place to ensure the integrity of the documents.
As for the manufacturing record of each batch or unit produced, it should be kept for at least one year after its expiration or shelf-life date, or five years after the batch’s production.
The rest of the information, such as primary data (eg, validation or stability-related data), supporting the information for the sanitary registration or marketing authorisation, should be preserved as long as the authorisation remains valid.
Corrective Actions
As previously mentioned, there are no specific actions for medical devices or healthcare products, thus, the corrective actions to follow will be determined as the consumer protection practices entails:
Notification to Regulatory Authorities
As per Article 25 Bis of the LFPC, suppliers have an obligation to promptly inform the authorities if they discover that any of their products could potentially pose risks to consumers’ life or health.
According to the RLFPC's interpretation, a product or service is deemed to affect life when its consumption endangers life’s continuity or disturbs the proper functioning of the human organism. This may be due to characteristics such as corrosiveness, reactivity, explosiveness, toxicity, flammability, radioactivity, biological infectivity, or involving the use of inherently hazardous mechanisms, instruments, or devices due to their high speed, energy conduction, or similar factors.
Regarding the time frame for informing about risky products or services in respect of consumer protection, there is no specific period mentioned, but an immediate obligation to notify is established. In the case of pharmaceutical products, as outlined in the Official Mexican Standard NOM 220-SSA1-2016, holders of a sanitary registration have up to seven calendar days to report a considered serious adverse event. Additionally, they have a maximum of 48 hours to report two or more serious cases with the same drug and lot.
Consumer Protection does not provide predefined formats for notifying PROFECO about a risky product or service. However, the supplier’s representative must present a valid power of attorney and the company’s articles of incorporation. For pharmacovigilance reports, the holder of the sanitary registration must use a specific format provided by the National Pharmacovigilance Center.
The relevant regulatory authorities are:
The Ministry of Economy (SE)
SE is responsible for reviewing and implementing the country’s overall policies related to industry, foreign trade, domestic trade, supply and pricing. It also regulates, promotes, and oversees the marketing, distribution, and consumption of goods and services. Additionally, the Ministry is involved in developing consumer protection policies, which serve as essential social and economic instruments to support and safeguard consumers’ interests and rights.
The Ministry of Health (SS)
SS is tasked with creating and implementing national policies related to social security, medical services, universal free medical services and general health. It co-ordinates health authorities at all levels, including federal, state and municipal levels. Part of its responsibilities include formulating programmes and legal provisions on health matters.
The Federal Consumer Protection Agency (PROFECO)
PROFECO is a decentralised federal agency providing social service. Its primary role is to promote and safeguard the rights and interests of consumers. It ensures fairness and legal certainty in the relationships between suppliers and consumers.
The Federal Commission for the Protection Against Sanitary Risks (COFEPRIS)
COFEPRIS operates as a de-concentrated administrative body of the Ministry of Health. It has technical, administrative and operational autonomy. COFEPRIS is responsible for regulating, controlling and promoting sanitary matters. This includes evaluating and regulating health risks associated with the use or consumption of goods and services.
The General Directorate of Standards (DGN)
DGN is a division within the Ministry of Economy. It is responsible for designing, promoting and disseminating public policies and strategies related to metrology, standardisation, and the evaluation of the industry.
The following product safety offences exist in respect of the product categories listed in 1. Applicable Product Safety Regulatory Regimes.
Penalties
In terms of the General Health Law, sanitary safety measures can be imposed by COFEPRIS, including the suspension of health advertising messages and the seizure and destruction of products, among other actions.
Furthermore, COFEPRIS may also determine administrative sanctions, such as warnings, temporary or permanent closure (partial or total), up to 36 hours of arrest, and fines from MXN200,000 to MXN2 million, with the possibility of doubling the fines for repeated offences.
Regarding the LFPC (Federal Consumer Protection Law) and the RLFPC (Regulation of the Federal Consumer Protection Law), violations of the Consumer Protection provisions may result in the following penalties:
Information is not public regarding examples of the application of penalties, however there have been several administrative proceedings against medical device companies for non-compliance with manufacturing practices, conditions of the facility, misleading advertisement and incorrect labelling of products, amongst others. Penalties are usually in the form of fines.
As mentioned, product liability will be regulated by civil and consumer protection practices, and the main legal bases on which product liability claims can be brought are the following:
There is currently no specific legislation and no major impact of technological advancements in medical devices and consumer health products in Mexican law, mainly because of the lack of technology-related legislation in general in Mexico; however, that does not exempt medical devices from regulation.
Judicial requirements will be determined depending on the relevant law. In respect of medical devices, the requirements for a claim to proceed would be the following:
In product liability cases, there is no specific provision for the payment of legal costs. When dealing with consumer rights protection matters before the PROFECO (Federal Consumer Protection Agency), no costs are incurred for processing proceedings before this authority.
In court trials, the general principle dictates that the losing party shall bear the responsibility for indemnifying the other party for all incurred judicial costs, including attorneys’ fees, if it has filed frivolous or improper defences or appeals with the intention of causing delays in the proceedings.
Additionally, a party may be ordered to pay judicial costs when (i) acting with recklessness or bad faith during the process; (ii) failing to provide evidence to support the cause of action or defences; (iii) presenting false documentation; (iv) receiving identical judgments in both first and second instances; and (v) engaging in judicial actions, defences, appeals, or ancillary proceedings that are notably improper.
However, in class actions, the burden of judicial costs falls solely on the defendant and not on the entire class.
What other mechanisms are available in respect of product-related contentious matters; for example, public law (judicial review of decisions made by regulatory bodies), inquests, inquiries and preliminary (medical) assessments.
In case of an incident derived by a product, it could also be classified as a crime, which would then entitle a criminal law matter, for example in case of fraud or deception of the product offered versus the product received.
There is no public information relating to the most prominent examples of contentious matters in Mexico.
As a result of various jurisprudential criteria of the Mexican Supreme Court of Justice and a constitutional amendment in July 2010, a chapter was added to the Federal Code of Civil Procedures in August 2011 to introduce and regulate class actions. The purpose of these class actions is to protect diffuse and collective rights and interests, as well as individual rights of collective incidence.
The application of class actions encompasses several areas, including (i) consumer and supplier relations; (ii) users of financial services; (iii) public services; (iv) damages arising from undue concentrations or monopolistic practices; (v) environmental damages; and (vi) civil liability cases.
Under the CFPC, class actions may only be initiated by (i) specific authorities such as PROFECO, the Federal Antitrust Commission, the National Commission for the Protection and Defense of Financial Users, the Federal Attorney’s Office for Environmental Protection, and the Federal Attorney General’s Office; (ii) a common representative of a class consisting of at least 30 members; and (iii) non-profit civil associations.
To proceed with a class action, it must meet certain key requirements, including (i) involving acts that harm consumers, users of public or private goods or services, or the environment, or harm caused by undue concentrations or monopolistic practices; (ii) involving common factual or legal issues among the class members; (iii) having at least 30 members in the class; (iv) demonstrating a correlation between the cause of action and the harm suffered; (v) not being previously adjudicated in other proceedings (res judicata); and (vi) being within the statute of limitations, among others.
There is yet to be a collective action against a medical device. Collective actions in Mexico have historically focused on other industries such as automotive and real estate.
Mediation
Involves a third-party member which will support both parties for them to arrive at a mutual agreement. The mediator can issue an agreement which may or may not be complied with.
Conciliation
A conciliator invites both parties to reach an agreement but does not issue the final decision; the parties must arrive at such solution.
Arbitration
An arbitrator or a group of arbitrators which are appointed by both parties or by a specialised institution will mediate the situation taking into account evidence and testimonies, and a binding resolution will be dictated.
If a civil lawsuit or class action is filed, the powers of verification and surveillance of PROFECO are not excluded, thus the proceeding before PROFECO can continue in parallel with the civil lawsuit.
There is a link between product safety compliance and product liability claims; it is necessary to prove the link between a breach of the product’s safety and the product liability claim for it to proceed.
The following trends are seen:
On 10 May 2023, several reforms to the General Health Law and its Regulations were published in the Federal Official Gazette, aimed at further strengthening the definition of medical devices under national law, so as to include medical equipment, prostheses, orthoses, functional aids, diagnostic agents, dental supplies, surgical and healing materials and hygienic products.
Furthermore, the Decree introduced a legislative change that empowers the Ministry of Health to classify any medical supply as a medical device if its characteristics and use can be considered as such.
The Decree also introduced “low-risk medical devices” as a category in the General Health Law, specifying that this category of medical devices does not require a sanitary registration. This was already provided in lower regulations, but was not included as part of the Law.
Finally, the Decree granted a period of 180 days for the Ministry of Health to issue the necessary regulatory provisions for its implementation. In addition, the Ministry must issue policies to determine whether a product is a medical device, and must keep the list of low-risk medical devices up to date, for the purpose of exempting marketing authorisations.
There is no specific legislation regulating AI in Mexico. It relies on common civil law and consumer protection practices.
Main office:
Córdoba 42, floor 5-B
Roma Norte, Cuauhtémoc
06700, Mexico City
Mexico
Tijuana office:
Misión de San Javier 10643, suite 400, floor 4, Zona Río
22010, Tijuana, Baja California
Mexico
+52 (55) 8438 0000
contacto@mqsc.mx www.mqsc.mx