The Crosswalk

    ANVISA

    Flag of BrazilBrazil - ANVISA

    MandatoryLast updated · 2023Verified · 2026-10-17

    RDC 751/2022 + Cybersecurity Guide for Medical Devices

    Share

    Authority

    Agência Nacional de Vigilância Sanitária

    Enforced

    Mar 2023 (RDC 751)

    Legal framework

    RDC 751/2022 + LGPD

    FDA package reuse

    ~60%

    Editorial estimate · how →

    Scope

    All medical devices, with risk-class proportional cybersecurity scrutiny. SaMD specifically addressed.

    Pre-market

    Cybersecurity documentation in registration dossier, risk management evidence aligned to ISO 14971.

    Post-market

    Tecnovigilância reporting, lifecycle updates, post-market surveillance.

    SBOM

    Recommended

    Encouraged, not strictly required.

    Vulnerability disclosure

    Encouraged, CERT.br coordination.

    Penalty

    Registration cancellation; LGPD fines up to 2% Brazilian revenue (max BRL 50M per infraction).

    Unique requirements

    • 01Brazilian Registration Holder (BRH)
    • 02Portuguese-language IFU and labelling
    • 03INMETRO certification for electrical safety

    Highlights

    • Risk-class based scrutiny
    • MDSAP partially recognised
    • Portuguese-language documentation required

    Aligns with

    IMDRF N60 MDSAP (partial)

    Timeline

    1. 2020

      ANVISA cybersecurity guide v1

    2. Sep 2022

      RDC 751/2022 published

    3. Mar 2023

      RDC 751 effective

    Key documents

    RDC 751/2022

    https://www.gov.br/anvisa/pt-br

    ANVISA Cybersecurity Guide

    https://www.gov.br/anvisa/pt-br

    How to submit in Brazil

    Playbook reviewed · 2026-07-16

    Submission route

    ANVISA registration or notification under RDC 751/2022 and cybersecurity guidance in RDC 657/2022 for SaMD

    ANVISA aligns broadly with IMDRF and MDSAP. Cybersecurity documentation must be in Portuguese, and Class III/IV devices require the Brazilian Good Manufacturing Practices Certificate (CBPF) before registration.

    Authority portal

    Step-by-step

    1. Step 01

      Appoint a Brazilian Registration Holder (BRH)

      Foreign manufacturers cannot register directly.

    2. Step 02

      Obtain CBPF (Class III/IV)

      ANVISA GMP inspection or MDSAP-based CBPF; MDSAP path shortens the queue substantially.

    3. Step 03

      Prepare cybersecurity dossier (Portuguese)

      Follow RDC 657/2022 structure; reuse FDA content with Portuguese translation.

    4. Step 04

      Submit via ANVISA portal

      Petition includes the technical dossier and CBPF reference.

    Evidence checklist

    ItemLevel
    Cybersecurity dossier (Portuguese)Required
    CBPF (Class III/IV)Required
    SBOMRecommended
    BRH agreementRequired

    Common ANVISA rejections

    CBPF not in place at time of registration filing

    Common

    Fix · Use MDSAP-based CBPF path to compress the pre-registration timeline.

    Dossier not fully translated to Portuguese

    Common

    Fix · Portuguese translation is non-negotiable; budget 6-8 weeks for certified translation.

    Typical timeline

    End-to-end window: 1-3 months (notification) to 18-30 months (Class III/IV with CBPF).

    Phase 01

    CBPF (MDSAP path)

    6-12 months

    Phase 02

    Registration review (Class III/IV)

    12-18 months

    Phase 03

    Registration review (Class I/II notification)

    1-3 months

    Related markets

    Flag of European Union

    European Union

    ~60% FDA reuse

    Flag of Norway

    Norway

    ~60% FDA reuse

    Flag of South Korea

    South Korea

    ~65% FDA reuse

    Flag of Switzerland

    Switzerland

    ~55% FDA reuse

    Frequently asked about Brazil

    Is SBOM required for medical devices in Brazil?

    Recommended. Encouraged, not strictly required.

    What does ANVISA require for pre-market cybersecurity?

    Cybersecurity documentation in registration dossier, risk management evidence aligned to ISO 14971.

    What are the post-market cybersecurity obligations under ANVISA?

    Tecnovigilância reporting, lifecycle updates, post-market surveillance.

    What is the penalty for non-compliance with ANVISA cybersecurity rules?

    Registration cancellation; LGPD fines up to 2% Brazilian revenue (max BRL 50M per infraction).

    How much of my FDA cybersecurity package is reusable in Brazil?

    Roughly 60% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report).