The Crosswalk
    NewPer-page social previews and this changelog

    INVIMA

    Flag of ColombiaColombia - INVIMA

    GuidanceLast updated · 2023Verified · 2026-07-16

    Decreto 4725/2005 + INVIMA SaMD and cybersecurity criteria

    Share

    Authority

    Instituto Nacional de Vigilancia de Medicamentos y Alimentos

    Enforced

    2005 (rev. 2023)

    Legal framework

    Decreto 4725/2005 + Ley 1581 (data protection) + INVIMA circulars

    FDA package reuse

    ~85%

    Scope

    All medical devices marketed in Colombia; risk-class based sanitary registration.

    Pre-market

    Risk-class dossier; reference-jurisdiction route accepts FDA / CE / Health Canada / TGA / PMDA.

    Post-market

    Tecnovigilancia reporting, sanitary surveillance.

    SBOM

    Recommended

    Encouraged via FDA alignment.

    Vulnerability disclosure

    ColCERT coordinated disclosure encouraged.

    Penalty

    Registration cancellation, sanitary fines.

    Unique requirements

    • 01Colombian Sanitary Registration Holder
    • 02Spanish-language IFU and labelling
    • 03BPM (Buenas Prácticas de Manufactura) certification

    Highlights

    • Reference jurisdiction route accepted
    • Spanish-language documentation
    • Andean Community harmonisation

    Aligns with

    IMDRF N60 ISO 13485 FDA 2023 Guidance

    Timeline

    1. 2005

      Decreto 4725 published

    2. 2023

      SaMD and cyber circulars updated

    Key documents

    How to submit in Colombia

    Playbook reviewed · 2026-07-16

    Submission route

    INVIMA sanitary registration

    INVIMA accepts CE and FDA evidence. Cybersecurity documentation, when present, is reviewed as part of the technical file.

    Authority portal

    Step-by-step

    1. Step 01

      Appoint local representation

      Most jurisdictions require a locally-established entity to hold the registration or act as authorised representative before submission.

    2. Step 02

      Reuse FDA or CE package as baseline

      Adapt the cybersecurity subsection you already prepared for FDA or CE; regulators here typically accept the structure and ask for local labeling additions.

    3. Step 03

      Translate and localise

      Local-language technical summary and labeling are usually mandatory; certified translation is safest.

    4. Step 04

      Submit + track queries

      Respond to clarification rounds promptly; each unanswered question can add 30-90 days to the clock.

    Evidence checklist

    Item Level FDA equivalent Notes
    Cybersecurity documentation (baseline FDA or CE) Required SPDF
    Local authorised representative agreement Required —
    Local-language labeling and IFU Required —
    SBOM Recommended — Not mandatory but reduces clarification rounds.

    Common INVIMA rejections

    No Colombian legal representative

    Common

    Fix · Appoint a Colombian legal rep before filing.

    Typical timeline

    End-to-end window: 6-12 months

    Phase 01

    Local rep + dossier prep

    2-4 months

    Phase 02

    Regulatory review

    6-12 months

    Phase 03

    Approval + market entry

    1-3 months

    Related markets

    Frequently asked about Colombia

    Is SBOM required for medical devices in Colombia?

    Recommended. Encouraged via FDA alignment.

    What does INVIMA require for pre-market cybersecurity?

    Risk-class dossier; reference-jurisdiction route accepts FDA / CE / Health Canada / TGA / PMDA.

    What are the post-market cybersecurity obligations under INVIMA?

    Tecnovigilancia reporting, sanitary surveillance.

    What is the penalty for non-compliance with INVIMA cybersecurity rules?

    Registration cancellation, sanitary fines.

    How much of my FDA cybersecurity package is reusable in Colombia?

    Roughly 85% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report).