INVIMA

Colombia - INVIMA

GuidanceLast updated · 2023Verified · 2026-10-17

Decreto 4725/2005 + INVIMA SaMD and cybersecurity criteria

Authority

Instituto Nacional de Vigilancia de Medicamentos y Alimentos

Enforced

2005 (rev. 2023)

Legal framework

Decreto 4725/2005 + Ley 1581 (data protection) + INVIMA circulars

FDA package reuse

~85%

Editorial estimate · how →

Scope

All medical devices marketed in Colombia; risk-class based sanitary registration.

Pre-market

Risk-class dossier; reference-jurisdiction route accepts FDA / CE / Health Canada / TGA / PMDA.

Post-market

Tecnovigilancia reporting, sanitary surveillance.

SBOM

Recommended

Encouraged via FDA alignment.

Vulnerability disclosure

ColCERT coordinated disclosure encouraged.

Penalty

Registration cancellation, sanitary fines.

Unique requirements

01Colombian Sanitary Registration Holder
02Spanish-language IFU and labelling
03BPM (Buenas Prácticas de Manufactura) certification

Highlights

Reference jurisdiction route accepted
Spanish-language documentation
Andean Community harmonisation

Aligns with

IMDRF N60 ISO 13485 FDA 2023 Guidance

Timeline

2005
Decreto 4725 published
2023
SaMD and cyber circulars updated

Key documents

INVIMA - Dispositivos médicos y equipos biomédicos

https://www.invima.gov.co/productos-vigilados/dispositivos-medicos/dispositivos-medicos-equipos-biomedicos

INVIMA - Dispositivos Médicos (programa)

https://www.invima.gov.co/productos-vigilados/dispositivos-medicos

How to submit in Colombia

Playbook reviewed · 2026-07-16

Submission route

INVIMA sanitary registration

INVIMA accepts CE and FDA evidence. Cybersecurity documentation, when present, is reviewed as part of the technical file.

Authority portal

Step-by-step

Step 01
Appoint local representation
Most jurisdictions require a locally-established entity to hold the registration or act as authorised representative before submission.
Step 02
Reuse FDA or CE package as baseline
Adapt the cybersecurity subsection you already prepared for FDA or CE; regulators here typically accept the structure and ask for local labeling additions.
Step 03
Translate and localise
Local-language technical summary and labeling are usually mandatory; certified translation is safest.
Step 04
Submit + track queries
Respond to clarification rounds promptly; each unanswered question can add 30-90 days to the clock.

Evidence checklist

Item	Level	FDA equivalent	Notes
Cybersecurity documentation (baseline FDA or CE)	Required	SPDF
Local authorised representative agreement	Required	—
Local-language labeling and IFU	Required	—
SBOM	Recommended	—	Not mandatory but reduces clarification rounds.

Common INVIMA rejections

No Colombian legal representative

Common

Fix · Appoint a Colombian legal rep before filing.

Typical timeline

End-to-end window: 6-12 months

Phase 01

Local rep + dossier prep

2-4 months

Phase 02

Regulatory review

6-12 months

Phase 03

Approval + market entry

1-3 months

Related markets

Australia

~85% FDA reuse

Saudi Arabia

~85% FDA reuse

Argentina

~85% FDA reuse

United Kingdom

~80% FDA reuse

Frequently asked about Colombia

Is SBOM required for medical devices in Colombia?

Recommended. Encouraged via FDA alignment.

What does INVIMA require for pre-market cybersecurity?

Risk-class dossier; reference-jurisdiction route accepts FDA / CE / Health Canada / TGA / PMDA.

What are the post-market cybersecurity obligations under INVIMA?

Tecnovigilancia reporting, sanitary surveillance.

What is the penalty for non-compliance with INVIMA cybersecurity rules?

Registration cancellation, sanitary fines.

How much of my FDA cybersecurity package is reusable in Colombia?

Roughly 85% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report).