SAHPRA’s New ISO 13485 Requirement: What Device Manufacturers in South Africa Need to Know

Regulatory agencies worldwide are strengthening their focus on quality management, and South Africa is the latest to make it official. 

In September 2025, the South African Health Products Regulatory Authority (SAHPRA) announced that ISO 13485 certification will now be a mandatory prerequisite for medical device establishment licences under Section 22C of the Medicines and Related Substances Act.

This move brings South Africa in line with global best practices, ensuring that all device and IVD manufacturers, importers, and distributors operating in the country maintain certified quality management systems (QMS).

In this post, we unpack the new SAHPRA guidance, key phases, risks, and what manufacturers should do next to stay compliant, plus how a Regulatory Information Management (RIM) platform like RegDesk can help streamline the process.

Background: ISO 13485 & SAHPRA’s Regulatory Landscape

What Is ISO 13485?

ISO 13485:2016 is the globally recognized standard for quality management systems for medical devices and in vitro diagnostics (IVDs). It ensures that manufacturers consistently design, produce, and distribute devices that meet regulatory and safety requirements throughout the product lifecycle, from design to disposal.

South Africa’s Evolving Regulatory Framework

Since 2017, SAHPRA (and previously the Medicines Control Council, MCC) has required all manufacturers, distributors, and importers to hold a medical device establishment licence. Under Regulation 5(1)(c)(iii), licence applicants must provide “acceptable documentary proof of certification to a quality management system for medical devices and IVDs.”

The September 2025 communication (Issue No. MD01-2025/2026_v2) formally enforces this requirement, clarifying the timelines and verification process for ISO 13485 certification and outlining a phased rollout plan through 2028.

Key Provisions of the SAHPRA Guidance

A Phased Implementation Approach

SAHPRA’s five-phase plan allows gradual adoption while maintaining market stability.

Phase #1: Preparation & Sensitization

Until April 2025, licensees were granted a grace period to implement and certify their QMS to ISO 13485:2016. SAHPRA used this phase to conduct stakeholder engagement sessions (2023–2025) and provide clarity on certification requirements.

Phase #2: Licence Renewals (Effective 1 June 2025)

• Any renewal application for a medical device establishment licence must include a valid ISO 13485:2016 certificate issued by a South African Conformity Assessment Body (CAB) recognized by SAHPRA.
• Companies still undergoing certification may submit proof of an active agreement with a recognized CAB, but must provide the final certificate once issued.
• SAHPRA will verify certificates during the review process.

Phase #3: Existing Licence Holders (Effective 1 April 2026)

Even companies not renewing or amending licences must submit ISO 13485 certificates for verification. SAHPRA may request proof during audits, product-complaint investigations, or vigilance activities.

Phase #4: Licence Amendments (Effective 1 June 2027)

Holders submitting amendments or product-list updates must include a valid ISO 13485 certificate (or proof of pending certification). Phases 3 and 4 may run concurrently.

Phase #5: All New Applications (Effective 1 April 2028)

From this date, every new establishment-licence application must include a valid ISO 13485:2016 certificate or proof of an agreement with a SAHPRA-recognized CAB.

Verification & Documentation

SAHPRA will verify each certificate’s authenticity directly with the issuing CAB and may request additional documentation for investigations or renewals. 

Certificates must:

• Be in the name of the South African licensed entity.
• Match the licensed address.
• Be issued by a CAB recognized by SAHPRA.

Transitional Declarations

Until full implementation, organizations without a valid certificate may submit a temporary declaration confirming that their QMS aligns with ISO 13485 and that certification will be completed by the defined deadline (e.g., 1 April 2025 for renewals).

Implications & Risks for Manufacturers and Distributors

The new rule raises the compliance bar for all medical device establishments in South Africa.

Key Implications:

• Non-compliance risk: Submitting renewal or new-licence applications without ISO 13485 proof can result in rejection or processing delays.
• Timeline pressure: Certification requires planning and an external audit, manufacturers should initiate the process now.
• Cost impact: Implementing a compliant QMS and hiring accredited auditors adds financial overhead.
• Operational alignment: Internal systems and documentation must reflect ISO 13485 requirements before CAB audits.
• Supply chain obligations: Importers and distributors must ensure all upstream partners maintain certified quality systems.
• Audit readiness: SAHPRA may request certificates during post-market vigilance or complaint investigations.

Practical Steps for Manufacturers in South Africa

1. Map your licence portfolio: Identify all existing establishment licences, renewal timelines, and amendments due before 2028.
2. Conduct a QMS gap assessment: Evaluate your processes against ISO 13485:2016 requirements.
3. Select a recognized CAB: Choose a SAHPRA-approved certification body and confirm timelines.
4. Schedule audits early: Allow time for pre-audit corrections and document submission.
5. Maintain organized records: Store certificates and CAB agreements centrally for quick access during SAHPRA verification.
6. Monitor regulatory updates: SAHPRA may issue follow-up notices or clarifications during implementation.
7. Leverage technology: A RIM platform like RegDesk simplifies document management, deadline tracking, and regulatory intelligence monitoring.

How RegDesk Supports Compliance

Managing multi-phase regulatory change is complex, but technology can help.

With RegDesk, manufacturers can:

• Track SAHPRA regulatory changes in real time.
• Maintain a centralized repository of ISO certificates and licence documents.
• Receive automated alerts for renewals and upcoming submission deadlines.
• Align ISO 13485 certification efforts with other markets using global regulatory intelligence.

By digitalizing compliance management, RegDesk helps teams move from reactive to proactive, reducing risk and saving time.

Conclusion

The new SAHPRA requirement marks a significant shift for South Africa’s medical device sector. By making ISO 13485 certification mandatory for all establishment licences, the regulator is aligning the country with global quality standards and strengthening patient safety.

For manufacturers and distributors, the path forward is clear: start your QMS assessment, schedule your CAB audit, and leverage regulatory technology to keep pace with SAHPRA’s phased timeline.

With RegDesk, you can track SAHPRA updates, manage certification records, and streamline your submission process, all in one platform.