What Is NOM-220-SSA1 in Mexico's Pharmacovigilance Context?

NOM-220-SSA1-2016 is the Official Mexican Standard that governs the installation and operation of pharmacovigilance in Mexico. Published by the Secretaría de Salud and enforced by COFEPRIS, it defines the legal framework for how adverse events must be detected, evaluated, documented, and reported for pharmaceutical products and vaccines authorized for human use in the Mexican market.

The norm is not a guideline or a recommendation. It is a binding regulatory instrument. Non-compliance is subject to sanitary sanctions, and COFEPRIS has the authority to conduct inspections to verify that MAHs and other regulated entities are operating in accordance with its requirements.

NOM-220 was updated in 2016 and entered into force in July 2017, replacing the previous 2004 version. Its revision incorporated elements from international pharmacovigilance frameworks, including ICH E2 guidelines and principles from the EMA's Good Pharmacovigilance Practices (GVP), while maintaining a structure specific to Mexico's regulatory architecture and its role within the PAHO international drug monitoring network.

Who does it apply to?

NOM-220 applies to all entities involved in the lifecycle of pharmaceutical products and vaccines in Mexico. For companies operating from outside Mexico, the most relevant obligation falls on the marketing authorization holder (MAH) — the titleholder of the sanitary registration — or its designated legal representative in Mexico.

This includes foreign manufacturers entering the Mexican market for the first time, companies with existing registered products, and distributors or commercializes that hold or manage registrations on behalf of the original manufacturer. The norm also establishes specific obligations for healthcare institutions, hospitals, and clinical research sites — but for the purposes of market authorization and post-marketing compliance, the MAH is the primary responsible party.

The obligation does not depend on whether the product is actively marketed. A product with a valid sanitary registration in Mexico carries pharmacovigilance obligations regardless of commercial activity status.

What does it require from MAHs?

NOM-220 requires MAHs to establish, maintain, and operate a functional pharmacovigilance system aligned with its provisions. The core obligations include:

• Local pharmacovigilance responsible. The MAH must designate a person responsible for pharmacovigilance in Mexico and notify COFEPRIS of that designation. Any subsequent change must also be reported. This is a named, identifiable individual — not a department or a function.
• Adverse event reporting. Serious and unexpected adverse reactions must be reported to the Centro Nacional de Farmacovigilancia (CNFV) within defined timelines. The norm specifies separate reporting requirements for domestic and foreign cases, with different urgency thresholds for serious events.
• Periodic safety reports. MAHs are required to submit periodic pharmacovigilance reports to COFEPRIS on a defined schedule, including a benefit-risk assessment for the product in the Mexican market context.
• Literature monitoring. The MAH must maintain an ongoing process for monitoring published scientific literature for safety signals relevant to its registered products.
• Internal audits. The norm requires that MAHs conduct internal pharmacovigilance audits and permit COFEPRIS inspections. Audit findings and corrective actions must be documented.
• PV system documentation. The MAH must maintain a documented pharmacovigilance system that describes its structure, processes, and responsible personnel — the functional equivalent of a PSMF in international frameworks, though NOM-220 uses its own terminology and structure.

Where NOM-220 draws a line that GVP doesn't

Companies with pharmacovigilance programs built for the EU or FDA markets often approach Mexico under an assumption of equivalence: if the program meets GVP or FDA 21 CFR Part 314 requirements, Mexico should be covered by extension. In practice, this assumption creates gaps that are specific to NOM-220's architecture.

The most structural difference is the local responsible person requirement. Under EU GVP, the QPPV is a centralized role that can be based anywhere within the European Economic Area and oversees the PV system globally for EU obligations. National contact persons at the local level are optional in most EU member states — the QPPV structure is designed for centralized oversight. NOM-220 does not follow this model. It requires a locally designated responsible person specifically accountable to COFEPRIS, with a named contact registered with the authority. A global QPPV based in Europe or Asia does not satisfy this requirement by default.

The second divergence is in the reporting channel. Adverse events in Mexico are reported to COFEPRIS through the CNFV — not through EudraVigilance or FDA MedWatch. The timelines, formats, and pre-evaluation requirements under NOM-220 are specific to this channel and do not map directly onto the reporting logic of other frameworks.

The third is the scope of the periodic report. NOM-220's periodic safety reports are submitted directly to COFEPRIS and must address the benefit-risk profile in the Mexican market context. A PSUR or PBRER prepared for EMA submission does not automatically meet the content and submission requirements that COFEPRIS expects — adaptation is required.

What this means when Mexico is in scope

For a company adding Mexico to its regulatory portfolio, NOM-220 is not a derivative obligation that follows automatically from existing compliance. It requires deliberate structuring: a designated local responsible person registered with COFEPRIS, reporting processes connected to the CNFV, and a documentation layer that reflects Mexico-specific obligations rather than simply referencing a global PSMF.

For a company already operating in Mexico, the question is whether the program currently in place reflects how COFEPRIS interprets and applies NOM-220 today — not just whether it was built to the norm at the time of implementation. The standard has been progressively aligned with international benchmarks since 2017, and COFEPRIS's designation as a PAHO Reference Regulatory Authority in 2025 signals that this trajectory continues.

Understanding precisely where your program stands against NOM-220's current requirements — and against COFEPRIS's operational expectations — is the starting point. Freyr works with MAHs at both stages: building a compliant system from the ground up and assessing whether an existing program holds up under current scrutiny.