SAHPRA QMS Requirements for Medical Device Manufacturers: What ISO 13485 Alone Won't Cover

Medical device manufacturers entering the South African market often assume that an ISO 13485 certificate is the golden ticket to SAHPRA registration. It is not. While ISO 13485:2016 forms the backbone of quality management expectations globally, SAHPRA layers additional requirements on top of the standard — requirements that are locally specific, sometimes implicit, and frequently the reason applications stall or audits produce findings. Understanding where the international standard ends and SAHPRA's expectations begin is essential for any manufacturer serious about maintaining market access.

ISO 13485 Gets You to the Starting Line

ISO 13485:2016 provides a robust framework for design controls, risk management, supplier management, and production controls. It is recognised by regulators worldwide and serves as a harmonised baseline through the Medical Device Single Audit Program (MDSAP) and similar schemes. For SAHPRA, holding a valid ISO 13485 certificate from an accredited conformity assessment body is a prerequisite for licence applications under the Medical Devices regulations promulgated in terms of the Medicines and Related Substances Act (Act 101 of 1965).

But a certificate alone tells SAHPRA very little about how your QMS handles South African regulatory obligations. The standard was designed to be jurisdiction-agnostic. SAHPRA's expectations are not.

Where SAHPRA's Requirements Go Further

Several areas routinely catch manufacturers off guard because they sit outside — or only partially overlap with — what ISO 13485 demands.

Post-Market Surveillance and Vigilance Reporting

ISO 13485 clause 8.2.1 requires organisations to gather and monitor post-production information, but it does not prescribe how or to whom adverse events must be reported. SAHPRA requires medical device adverse event reporting aligned with the IMDRF National Competent Authority Report (NCAR) form, submitted within specific timeframes depending on severity. Your QMS must include a documented procedure for South African vigilance reporting, distinct from any FDA MDR or EU MedDev 2.12 procedures you already maintain. A generic "we report to regulators" statement in your quality manual will not satisfy an audit.

Establishment Licensing and Responsible Person Obligations

SAHPRA requires that a licensed establishment in South Africa holds the product registration, and that a designated responsible person — with defined qualifications and accountability — oversees regulatory compliance locally. Your QMS must reflect this structure. Job descriptions, training records, and documented authority for the responsible person should be traceable within the system. ISO 13485 addresses management responsibility in general terms (clause 5), but it does not contemplate the concept of a jurisdiction-specific responsible person with statutory duties.

Labelling and IFU Localisation

Clause 7.3 of ISO 13485 requires design outputs to include labelling, but it does not specify language or content mandated by any particular regulator. SAHPRA expects labelling to comply with South African requirements, including the use of English at minimum and alignment with any applicable SANS standards. Instructions for use must be appropriate for the South African clinical context. If your labelling process assumes a single global template with no local adaptation pathway, you have a gap.

Change Notification and Variation Management

ISO 13485 addresses change control internally (clause 7.3.9), but SAHPRA expects manufacturers to notify the Authority of significant changes to registered devices — changes to the intended purpose, design, manufacturing site, or sterilisation method, among others. Your QMS change control procedure must include a step to assess whether a change triggers a SAHPRA variation submission. Without this, changes slip through without regulatory notification, creating compliance exposure that surfaces during renewal or inspection.

Common Audit Findings

SAHPRA-aligned audits and pre-submission reviews consistently uncover the same gaps. Post-market surveillance procedures that reference only the FDA or EU notified bodies, with no mention of SAHPRA. Distribution and traceability records that cannot link a specific device lot to a South African consignee. Complaint-handling procedures that lack a decision tree for SAHPRA reportability. Management review minutes that never mention the South African regulatory landscape. These are not obscure technical failures — they reflect a QMS that was built for one jurisdiction and never adapted.

Preparing for Dual Scrutiny

The practical approach is to build SAHPRA-specific requirements into your existing QMS rather than running a parallel system. Add South Africa to your regulatory matrix. Include SAHPRA vigilance timelines in your adverse event procedure. Ensure your document control system captures South African labelling variants. Train your responsible person and document that training. Review your change control process to include a SAHPRA variation assessment gate. These additions are not onerous, but they must be explicit and auditable.

Manufacturers who treat ISO 13485 as sufficient rather than foundational will continue to face delays, audit findings, and — in the worst case — suspension of their establishment licence.

Avidara's Dossier Review service evaluates your QMS documentation against both ISO 13485 and SAHPRA-specific requirements, identifying gaps before SAHPRA does. If you are preparing a new device registration or responding to audit findings, book a review to ensure your quality system meets the full scope of South African expectations.