--- title: "Philippines FDA-PH - Cybersecurity Submission Playbook" description: "How to submit a medical device to FDA Philippines in Philippines: step-by-step route, evidence checklist, common rejections, and typical review timeline. Comp" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "WebSite", "name": "The Medical Device Cybersecurity Crosswalk", "alternateName": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "description": "Compare FDA, EU MDR, MHRA, PMDA, NMPA, TGA, MFDS and Health Canada medical device cybersecurity requirements across 29 jurisdictions." }, { "@context": "https://schema.org", "@type": "Organization", "name": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "logo": "https://mdccrosswalk.com/favicon.png", "sameAs": [ "https://bluegoatcyber.com" ], "description": "An editorial reference comparing global medical-device cybersecurity regulations. Maintained by Blue Goat Cyber." }, { "@context": "https://schema.org", "@type": "Article", "headline": "Philippines - AO 2018-0002 + FDA Circulars on SaMD and cybersecurity", "description": "How to submit a medical device to FDA Philippines in Philippines: step-by-step route, evidence checklist, common rejections, and typical review timeline. Comp", "author": { "@type": "Organization", "name": "MDC Crosswalk" }, "publisher": { "@type": "Organization", "name": "MDC Crosswalk" }, "image": "https://mdccrosswalk.lovable.app/favicon.png", "datePublished": "2023", "about": "Food and Drug Administration, Philippines, Center for Device Regulation, Radiation Health and Research", "dateModified": "2026-07-16", "mainEntityOfPage": "https://mdccrosswalk.lovable.app/standards/ph" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is SBOM required for medical devices in Philippines?", "acceptedAnswer": { "@type": "Answer", "text": "Recommended. Encouraged for SaMD; not yet mandated." } }, { "@type": "Question", "name": "What does FDA Philippines require for pre-market cybersecurity?", "acceptedAnswer": { "@type": "Answer", "text": "Risk-class registration; ASEAN CSDT template; FDA / CE accepted." } }, { "@type": "Question", "name": "What are the post-market cybersecurity obligations under FDA Philippines?", "acceptedAnswer": { "@type": "Answer", "text": "Adverse-event reporting; National Privacy Commission breach notifications." } }, { "@type": "Question", "name": "What is the penalty for non-compliance with FDA Philippines cybersecurity rules?", "acceptedAnswer": { "@type": "Answer", "text": "Registration cancellation; Data Privacy Act fines and criminal liability." } }, { "@type": "Question", "name": "How much of my FDA cybersecurity package is reusable in Philippines?", "acceptedAnswer": { "@type": "Answer", "text": "Roughly 80% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report)." } }, { "@type": "Question", "name": "Why do FDA-PH submissions get rejected for \"no licence to operate (lto) for local importer\"?", "acceptedAnswer": { "@type": "Answer", "text": "Ensure importer holds a valid LTO before filing." } } ] }, { "@context": "https://schema.org", "@type": "HowTo", "name": "How to submit a medical device to FDA Philippines", "description": "Philippine FDA operates a CPR route with heavy reliance on GHTF founding-member approvals for higher-risk devices.", "totalTime": "4-9 months", "step": [ { "@type": "HowToStep", "position": 1, "name": "Appoint local representation", "text": "Most jurisdictions require a locally-established entity to hold the registration or act as authorised representative before submission." }, { "@type": "HowToStep", "position": 2, "name": "Reuse FDA or CE package as baseline", "text": "Adapt the cybersecurity subsection you already prepared for FDA or CE; regulators here typically accept the structure and ask for local labeling additions." }, { "@type": "HowToStep", "position": 3, "name": "Translate and localise", "text": "Local-language technical summary and labeling are usually mandatory; certified translation is safest." }, { "@type": "HowToStep", "position": 4, "name": "Submit + track queries", "text": "Respond to clarification rounds promptly; each unanswered question can add 30-90 days to the clock." } ] }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://mdccrosswalk.lovable.app/" }, { "@type": "ListItem", "position": 2, "name": "Standards" }, { "@type": "ListItem", "position": 3, "name": "Philippines" } ] } ] --- [ The Crosswalk ](/) [Overview](/)[Playbook](/playbook)CompareReference [New Per-page social previews and this changelog ](/changelog "Per-page social previews and this changelog") Search⌘K 1. [Home ](/) 2. Standards 3. Philippines FDA Philippines # ![Flag of Philippines](/flags/ph.svg)Philippines - FDA Philippines Guidance Last updated · 2023 Verified · 2026-07-16 AO 2018-0002 + FDA Circulars on SaMD and cybersecurity Share Copy link X LinkedIn Email Sources verified · 2026-07-16 FDA Philippines device rules confirmed; standalone cyber guidance awaiting SME review. Authority Food and Drug Administration, Philippines, Center for Device Regulation, Radiation Health and Research Enforced 2018 Legal framework RA 9711 (FDA Act) + AO 2018-0002 + Data Privacy Act 2012 FDA package reuse ~80% [Editorial estimate · how →](/methodology#fda-reuse) ## Scope All medical devices marketed in the Philippines; SaMD scope expanding via FDA Circulars. Pre-market Risk-class registration; ASEAN CSDT template; FDA / CE accepted. Post-market Adverse-event reporting; National Privacy Commission breach notifications. SBOM Recommended Encouraged for SaMD; not yet mandated. Vulnerability disclosure DICT-CERT coordinated disclosure recommended. Penalty Registration cancellation; Data Privacy Act fines and criminal liability. ## Unique requirements - 01 Philippine License to Operate (LTO) - 02 Philippine Authorised Representative - 03 Filipino / English IFU and labelling ## Highlights - ASEAN CSDT template alignment - Data Privacy Act overlay - FDA / CE approvals accepted ## Aligns with ASEAN MDD IMDRF N60 ISO 13485 ## Timeline 1. 2018 AO 2018-0002 published 2. 2023 SaMD and cyber circulars expanded ## Key documents [ FDA Philippines - Draft Guidelines on Medical Device Software (MDSW) https://www.fda.gov.ph/draft-for-comments-guidelines-on-the-regulation-of-medical-device-software-mdsw-by-the-food-and-drug-administration-fda/ ](https://www.fda.gov.ph/draft-for-comments-guidelines-on-the-regulation-of-medical-device-software-mdsw-by-the-food-and-drug-administration-fda/)[ FDA Philippines (homepage) https://www.fda.gov.ph/ ](https://www.fda.gov.ph/) ## How to submit in Philippines Playbook reviewed · 2026-07-16 Submission route Philippine FDA Certificate of Product Registration (CPR) Philippine FDA operates a CPR route with heavy reliance on GHTF founding-member approvals for higher-risk devices. [Authority portal](https://www.fda.gov.ph/medical-devices/) ### Step-by-step 1. Step 01 Appoint local representation Most jurisdictions require a locally-established entity to hold the registration or act as authorised representative before submission. 2. Step 02 Reuse FDA or CE package as baseline Adapt the cybersecurity subsection you already prepared for FDA or CE; regulators here typically accept the structure and ask for local labeling additions. 3. Step 03 Translate and localise Local-language technical summary and labeling are usually mandatory; certified translation is safest. 4. Step 04 Submit + track queries Respond to clarification rounds promptly; each unanswered question can add 30-90 days to the clock. ### Evidence checklist Item Level FDA equivalent Notes Cybersecurity documentation (baseline FDA or CE) Required SPDF Local authorised representative agreement Required — Local-language labeling and IFU Required — SBOM Recommended — Not mandatory but reduces clarification rounds. ### Common FDA-PH rejections No Licence to Operate (LTO) for local importer Common Fix · Ensure importer holds a valid LTO before filing. ### Typical timeline End-to-end window: 4-9 months Phase 01 Local rep + dossier prep 2-4 months Phase 02 Regulatory review 4-9 months Phase 03 Approval + market entry 1-3 months [Previous ![Flag of Vietnam](/flags/vn.svg)Vietnam ](/standards/vn)[Next ![Flag of Ukraine](/flags/ua.svg)Ukraine ](/standards/ua) ## Related markets [![Flag of United Kingdom](/flags/gb.svg) United Kingdom ~80% FDA reuse ](/standards/uk)[![Flag of Taiwan](/flags/tw.svg) Taiwan ~80% FDA reuse ](/standards/tw)[![Flag of South Africa](/flags/za.svg) South Africa ~80% FDA reuse ](/standards/za)[![Flag of Malaysia](/flags/my.svg) Malaysia ~80% FDA reuse ](/standards/my) ## Frequently asked about Philippines ### Is SBOM required for medical devices in Philippines? Recommended. Encouraged for SaMD; not yet mandated. ### What does FDA Philippines require for pre-market cybersecurity? Risk-class registration; ASEAN CSDT template; FDA / CE accepted. ### What are the post-market cybersecurity obligations under FDA Philippines? Adverse-event reporting; National Privacy Commission breach notifications. ### What is the penalty for non-compliance with FDA Philippines cybersecurity rules? Registration cancellation; Data Privacy Act fines and criminal liability. ### How much of my FDA cybersecurity package is reusable in Philippines? Roughly 80% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report). Sponsored note · Blue Goat Cyber Submitting to FDA Philippines? Get a second pair of eyes before you file. Blue Goat Cyber has packaged cybersecurity evidence for Philippines alongside 37 other markets. We'll tell you what to keep, what to rework, and what's missing, in 30 minutes. [Talk through your FDA-PH submission](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) The Crosswalk An independent reference for global medical device cybersecurity standards. A field guide for MedTech innovators and RA/QA teams charting an international path. Resource - [Comparison matrix](/compare) - [Global playbook](/playbook) - [Glossary](/glossary) - [FAQ](/faq) Sponsored by [Blue Goat Cyber ↗](https://bluegoatcyber.com) Editorially independent. Sponsorship keeps it free. © 2026 The Crosswalk. Not legal advice. Validate every requirement against current regulator publications.