4 min read
Most pharmacovigilance programs in Mexico were built to comply with NOM-220. That was the right move. The problem is not what companies built — it is the assumption that what they built stays sufficient as long as no one tells them otherwise.
NOM-220-SSA1 has not been repealed. Its text has not fundamentally changed. But the standard that COFEPRIS applies in practice has evolved — through inspection criteria, through accumulated operational experience in front of the authority — experience that does not appear in a decree but becomes visible in what COFEPRIS verifies during an inspection, and through progressive alignment with international pharmacovigilance frameworks, particularly the GVP guidelines of the EMA. Not every evolution in regulatory expectations is immediately reflected in updates to NOM-220 itself.
What changes is what COFEPRIS looks for when it verifies that a program functions as described — and that shift does not arrive in a notification. It becomes visible when a company faces an inspection and discovers that the program it built, technically aligned with the norm, does not reflect what the authority evaluates today.
This gap affects two different types of companies — and it reaches both at the worst possible moment.
For a company evaluating Mexico as its next market, the risk is structural: building a PV program calibrated to the written norm rather than to the operational standard means investing in compliance that will need to be corrected before it is ever tested. For a company with products already registered in Mexico, the risk is immediate: the program it designed and implemented may be operating on a version of the standard that COFEPRIS has since moved past.
In both cases, the gap is not visible from the inside. That is what makes it costly.
The norm hasn't changed. The standard has.
NOM-220 defines the framework: who must have a pharmacovigilance system, what it must include, how adverse events must be notified, and what the MAH's obligations are throughout the product lifecycle. It is the foundation. What it cannot capture is how COFEPRIS interprets and applies that foundation over time.
Three areas concentrate the majority of the gaps Freyr identifies in PV program reviews for Mexico. They are not gaps in the written norm — they are gaps between what the norm requires on paper and what COFEPRIS, increasingly aligned with international GVP standards, verifies in practice.
The first is signal detection and documentation. NOM-220 requires that MAHs have a process for detecting, evaluating, and reporting safety signals. What COFEPRIS evaluates in practice is whether that process is operational — not whether it exists on paper. A signal detection protocol that has never been activated, tested, or updated since implementation does not meet the operational standard, regardless of what the documentation says.
The second is the alignment between the PSMF and the actual program. The Pharmacovigilance System Master File is the formal description of how the PV system works. When it describes a system that no longer reflects what the organization actually does — because roles changed, vendors changed, or processes evolved without a corresponding update to the PSMF — the document becomes a liability rather than a compliance tool. COFEPRIS reads the PSMF as a representation of current operations, not as a historical record.
The third is the relationship between the MAH's global PV structure and the local Mexican obligations. Companies that manage PV centrally often assume that global processes cover local requirements by default. They do not. COFEPRIS expects a demonstrable local component: a qualified person responsible for PV in Mexico, a defined escalation path for COFEPRIS-specific reporting, and documentation that connects the global system to the local obligations under NOM-220. The absence of that local articulation is one of the most consistent findings in external PV assessments for Mexico.
Where the gap becomes visible — and when
The pattern Freyr observes across PV engagements in Mexico is consistent: companies do not discover the gap when they are building their program. They discover it when something external creates pressure — an inspection signal, a regulatory query, a market entry process that requires submitting PV documentation to COFEPRIS for review.
By that point, the cost of the gap has already compounded. Correcting a PV program under regulatory pressure is not the same as correcting it proactively. The former is reactive, time-constrained, and visible to the authority. The latter is a strategic decision that a company can execute on its own timeline, with the depth the correction actually requires.
The distinction matters commercially. COFEPRIS was designated as a PAHO Reference Regulatory Authority in 2012 — a recognition that reflects the agency's increasing alignment with international PV standards and its growing role as a regional benchmark. That trajectory does not reverse. The direction of travel is toward higher operational expectations, not lower ones.
A company that calibrates its PV program to what COFEPRIS evaluates today — not to what the written norm requires — is not over-investing in compliance. It is building a program that will not need to be rebuilt when the standard catches up to it.
Understanding where your program stands against COFEPRIS's current operational standard is the first decision — and it is one that yields value regardless of what follows. Freyr works with MAHs entering Mexico and with companies that have had products in the market for years, and the starting point is always the same: an honest assessment of what the program has, what COFEPRIS expects, and what the distance between them actually means for the business.
If that assessment is something your team has not done recently — or has not done against the right standard — it is worth doing before COFEPRIS does it for you.
