Shelter Services for Medical Device Manufacturers in Mexico

Shelter services for medical device manufacturers in Mexico can host a regulated production line. The shelter supplies the Mexican legal entity, the IMMEX program, payroll and customs administration. You keep the quality management system, the device design and the regulatory relationship with FDA and Health Canada, and your QMS reaches every operator on the line, including the people the shelter employs.

The model works when a written quality agreement gives every QMS process an owner. For how shelters work in general, start with the shelter companies in Mexico guide. This article summarizes public rules as of September 30, 2026 and is not legal or regulatory advice.

Mexico is an established device base. In 2024 it was the largest single-country source of US imports under HS 9018.90, other medical instruments and appliances, at about US$7.06 billion, and under HS 9018.39, needles, catheters and cannulae, at about US$3.54 billion, according to UN Comtrade data published through WITS.

When do shelter services fit medical device manufacturers?

Three questions decide it: who owns the quality system at the site, how large the site will become, and how long you plan to stay.

Factor	A shelter fits when	Your own entity fits when
QMS ownership	Your ISO 13485 or MDSAP-certified QMS extends to the new site, and the shelter's people work inside it under a quality agreement	You want the QMS, the employer, the premises and the registrations held by one company that is yours
Scale	You are transferring one product family or a first line, with headcount still being sized	The site is becoming a core plant, with several product families or in-house sterilization
Horizon and market	Output is exported, and you want production running while you prove the site	You plan a long stay, or want to sell devices in Mexico under a registro sanitario

The market row turns on LISR Art. 183, which bars shelter clients from selling Mexican-made products "que no se encuentren amparados con un pedimento de exportación." Shelter output leaves Mexico under an export pedimento, physically or as a virtual export to another IMMEX plant, and selling routinely to Mexican customers requires your own entity.

The two models can also run in sequence. RGCE 2026 rule 7.1.8 lets a company that operated through a shelter for the last three fiscal years, and obtained its own IMMEX in the past 12 months, count the shelter's personnel, infrastructure and investment toward its own IVA/IEPS certification. Providers estimate the full move at 12 to 18 months. The shelter or own entity guide covers the transition, and the guide to shelter, maquiladora and contract manufacturing compares the models.

For a scored read on your own case before provider conversations start, the Mexico Entry Readiness Diagnostic takes eleven questions and about three minutes and returns a read on ownership structure, site, regulatory routing, landed cost and timeline.

Which regulatory gates apply to a device plant in Mexico?

Five sets of rules reach a Mexican device plant. Which of them apply depends on where the devices are sold.

FDA registration and listing

A foreign establishment that manufactures devices imported into the United States is required to register and list with FDA, and no device may be imported unless it is listed and made at a registered establishment. Each foreign establishment designates one US agent, registers within 30 days of starting operations, and reviews its registration every year between October 1 and December 31. The FY2027 establishment fee, which applies from October 1, 2026, is $13,785.

The registrant is the "owner or operator" directly responsible for the establishment, and FDA's registration rules do not address shelters. Providers state that the device client keeps the registration and listings, a market practice worth confirming with FDA regulatory counsel before you sign.

The QMSR, in force since February 2, 2026

The Quality Management System Regulation, published as a final rule on February 2, 2024, states: "This rule is effective February 2, 2026." 21 CFR Part 820 incorporates ISO 13485:2016 by reference, adds US requirements for UDI, traceability, complaint reporting and advisory notices, and applies to finished devices imported into the United States. Component makers fall outside it and are controlled through your purchasing controls.

FDA now inspects under Compliance Program 7382.850, can review management review, internal audits and supplier audit reports, and states that an ISO 13485 certificate "will not be considered or accepted as a substitute for any oversight processes, including the performance of an inspection" under section 704 of the FD&C Act. For a PMA device, a new manufacturing site requires a 180-day site change supplement and may trigger a pre-approval inspection.

Health Canada and MDSAP

A Canadian Class II licence application includes a certificate that the quality system "under which the device is manufactured" meets CAN/CSA-ISO 13485, and all licence holders now participate in MDSAP. Under the Medical Devices Regulations, you remain the manufacturer when you sell under your own name, "whether those tasks are performed by that person or on their behalf."

MDSAP's audit approach draws the site boundary by QMS scope. Every site recorded on the certificate gets an on-site Stage 2 audit, and a party outside your internal audit scope counts as a supplier that auditing organizations may audit. FDA may accept MDSAP audit reports as a substitute for routine inspections, and COFEPRIS is an MDSAP Affiliate Member.

COFEPRIS for export-only IMMEX manufacturing

The Ley General de Salud ties device authorization to sale or supply (Art. 204), and COFEPRIS defines the registro sanitario as the authorization under which a device "puede ser distribuido y puesto en venta en territorio nacional." Device manufacturing is absent from Art. 198's list of establishments that need a sanitary authorization. A device plant files an aviso de funcionamiento instead, at least 30 days before operations begin.

Two points remain open. Art. 82 of the Reglamento de Insumos para la Salud says devices need a registro "para su producción, venta y distribución," and Art. 16 requires manufacturing documents in Spanish with no explicit export carve-out. How COFEPRIS applies both to an export-only IMMEX plant, and whose name the aviso carries under a shelter, are questions for Mexican regulatory counsel. If you plan to sell devices in Mexico through your own entity, the registro route and the May 2026 COFEPRIS simplification enter your plan.

NOM-241-SSA1-2025

NOM-241-SSA1-2025, Mexico's good manufacturing practice standard for devices, was published on April 4, 2025, took effect 240 calendar days later and replaced the 2021 version. It binds manufacturers operating "con fines de comercialización o suministro en México." COFEPRIS's question-and-answer guide, which describes itself as orientative, answers the export question directly: "No. Aplica a Dispositivos Médicos fabricados y comercializados en territorio nacional."

For a Mexico-market plant, the standard applies whether or not you hold an MDSAP report, and a current ISO 13485 certificate counts only toward its Chapter 5 quality-system requirements. Within its scope, outsourcing a process requires an aviso de maquila to COFEPRIS and a technical agreement (acuerdo técnico) setting each party's quality obligations.

How do you evaluate a shelter for regulated manufacturing?

ISO 13485 clause 4.1.5 frames the evaluation. You "retain responsibility of conformity" for outsourced processes, and the clause adds: "The controls shall include written quality agreements." The clause text is reproduced by RCA. The shelter selection guide covers the general scorecard. For a device line, test each provider on these points.

Who owns what in the QMS. Map every ISO 13485 clause to you, the shelter, or both. You hold the quality system and the regulatory filings, and most day-to-day customs, payroll and labor administration sits with the shelter.

The quality agreement. Sign it together with the commercial agreement. A law firm's shelter-contract checklist covers recall liability, quality-control responsibility and audit rights. For a device line, add change notice, inspector access and record retention.

Document control. Clause 4.2.4 extends control to documents of external origin. Settle which system is master, how Spanish versions are controlled if Art. 16 applies, and how records held in the US reach an inspector, which the QMSR preamble expects "by the next working day or two, at the latest."

Training records for shelter-employed staff. In the QMSR preamble, FDA reads the training duty as covering "internal and external personnel," contractors included, with training "carefully recorded." Every operator the shelter hires enters your training matrix before touching product.

Traceability and UDI. The QMSR requires the UDI to be recorded for each device or batch and checked on labels before release. The duty sits with the labeler, normally you, and your device history records tie out to the shelter's inventory lots.

Change control. Clauses 4.1.4 and 7.4 call for evaluated, controlled changes and advance notice from suppliers. Shelter-side changes to shifts, facilities, customs brokers or IT enter your change control before they happen.

Supplier controls and CAPA. FDA notes that supplier "certification may not provide adequate assurances of supplier quality without further evaluation." Qualify the shelter under your purchasing controls or bring the site into your internal audit scope, and route shelter-side nonconformities into your CAPA, where clause 8.5.2 expects action "without undue delay."

Audit readiness. Ask how the provider supports an FDA inspection, an MDSAP Stage 2 audit and a COFEPRIS visit, and ask for evidence of its own tax compliance. Under LISR Art. 183-Bis, a shelter that does not cure a breach within 30 calendar days of a SAT requirement is suspended from the importers' register, and its foreign client is deemed to have a permanent establishment in Mexico. The guide to what a shelter program costs covers the fee side.

How does cross-border trade work for a device shelter?

The IMMEX interface. The shelter holds the IMMEX albergue program, is importer of record into Mexico and is liable for foreign-trade taxes on its temporary imports. You keep title to your materials and equipment. LISR Art. 183 bars selling them to the shelter, so equipment is typically lent under a comodato. Inputs may stay under temporary import for up to 18 months and machinery for the life of the program, and on the US side you are typically the importer of record.

Sanitary import permits. Under the Secretaría de Salud's import and export acuerdo, regulated device inputs imported under IMMEX and not destined for sale in Mexico enter with a COFEPRIS prior sanitary import permit, homoclave COFEPRIS-01-015-A for the maquila modality, in place of a registro. Parts and accessories of Chapter 90 instruments need no such permit. The acuerdo has been modified since 2020, so the current tariff-line list is worth checking with your customs broker.

Customs documentation. Since January 1, 2026, each pedimento's electronic file includes documents showing that the operation actually took place (Ley Aduanera Art. 59), and IMMEX holders run Anexo 24 inventory control. Reconciling your device history records with the shelter's customs records on a set schedule keeps both aligned, and the customs, trade and IMMEX service covers that interface.

USMCA Annex 12-E. The USMCA medical device annex requires each Party to recognize MDSAP audits by authorized auditing organizations, and bars a Party from requiring marketing authorization in the country of manufacture as a condition of its own. A Section 232 investigation covering medical equipment, including devices, opened September 2, 2025, and BIS lists no resulting action as of September 30, 2026. The USMCA device and pharma analysis has the wider backdrop.

Regulated manufacturing readiness checklist

#	Readiness item	Owner
1	QMS scope extended to the site under ISO 13485 and 21 CFR 820.10	You
2	FDA owner-or-operator question settled with counsel; one US agent named	You
3	Registration within 30 days of operating; listing before import; annual fee budgeted	You
4	Health Canada licence and MDSAP scope updated; Stage 2 site audit scheduled	You
5	PMA site change supplement assessed where it applies	You
6	Quality agreement signed together with the shelter agreement	Shared
7	Document control live, including Spanish versions and remote records	Shared
8	Training records for every shelter-employed operator	Shared
9	UDI recorded per device or batch; label check before release	You
10	Device history records tied to the shelter's Anexo 24 inventory	Shared
11	Advance notice of shelter-side changes	Shared
12	Shelter qualified as a supplier or inside your internal audit scope	You
13	CAPA routing for shelter-side nonconformities	Shared
14	NOM-241 scope decision documented	You
15	Aviso de funcionamiento filed at least 30 days before operations	Shared
16	Every shipment exported under a pedimento with a complete electronic file	Shelter
17	COFEPRIS import permits for inputs that need them	Shelter
18	Equipment under comodato; title documented as yours	Shared
19	US entries declared by you as importer of record	You
20	Shelter's Art. 183-Bis compliance evidenced; your RFC and DIEMSE filings made	Shared

What do the first 90 days look like?

Weeks	Focus	What you finish
1 to 4	Evaluation	Device scope and markets fixed; regulatory map drafted for FDA, MDSAP and COFEPRIS; shortlisted shelters sent a quality questionnaire; counsel engaged on the open questions
5 to 8	Contracting	Shelter and quality agreements negotiated together; comodato, audit access, change notice, recall and exit terms settled; site chosen; transfer and validation plan drafted
9 to 13	Site readiness	Facility and utilities ready for qualification; first operators hired by the shelter and trained in your system; equipment imported under IMMEX; aviso filed; readiness audit complete

Shelter providers publish 2 to 4 months to first production, and as little as 30 days in move-in-ready space. Those figures describe operations starting. Process validation and production release usually run past day 90, and a contract manufacturer puts regulated device transfers at 6 to 18 months or more. The week ranges in the table are a planning assumption, and no independent benchmark for device transfer timelines in Mexico was found.

Common pitfalls

• Reading a provider's certificates as your coverage. FDA does not accept an ISO 13485 certificate in place of an inspection, and your QMS is what it inspects.
• Signing the fee schedule first. Audit access, change notice and recall terms are easiest to secure while commercial terms are open.
• Leaving shelter-employed operators outside your training records. FDA's training duty reaches contractors.
• Assuming the export-only COFEPRIS position without counsel. Reglamento Arts. 82 and 16 leave room for interpretation.
• Planning Mexican sales from the shelter. A sale without an export pedimento breaks the Art. 183 condition.
• Missing the FDA calendar. Registration review runs October 1 to December 31 each year.

The bottom line

A shelter gives a device maker a Mexican entity, an IMMEX program and an administration in months, while the quality system and your accountability to FDA and Health Canada stay with you. It fits a certified QMS extending to an export site. Your own entity fits a core plant, a long horizon or sales in Mexico. In either model, the quality agreement, the training records and the change-control interface decide how the site performs under inspection.

Calder & Vale is an independent advisory that sells no shelter services, so you get an independent read on which model fits, help running the provider selection, and the entity and incentives work when you build your own. If you want to test your plan against these gates, a complimentary 30-minute call carries no pitch, and you get a reply within 24 hours.