Short answer: in Colombia, a new software version usually goes to INVIMA as a modification of the existing registro sanitario, not a new registration, as long as you can show the change does not affect the device’s safety and effectiveness. The line you cannot cross is in Article 30 of Decreto 4725 de 2005, as substituted by Decreto 582 de 2017: no modification when the change is significant, or when it touches the design, the material, the energy source or the manufacturing process. For software, the way most sponsors trip that line is not the code. It is the claims.
We get this question every few weeks from manufacturers with registered software or software-driven devices in Colombia. Two holders asked it in the same week this month. Here is how we answer it.
Is software a medical device in Colombia?
Yes. Article 2 of Decreto 4725 de 2005 defines a medical device for human use as “cualquier instrumento, aparato, máquina, software, equipo biomédico u otro artículo similar o relacionado”, including the “programas informáticos que intervengan en su correcta aplicación”. Software that sits inside an equipo biomédico is covered too: the same article’s definition of equipo biomédico includes “los programas informáticos que intervengan en su buen funcionamiento”.
So standalone software with a medical purpose needs its own registro sanitario, and software that runs a registered device lives inside that device’s registro. Either way, when the software changes, the registro has to keep matching what you sell.
What the rule actually says
Article 30 of Decreto 4725, in the text substituted by Article 2 of Decreto 582 de 2017, sets three things:
- Modifications are processed automatically. INVIMA issues them within the term in Article 22(b) of the decree, with an after-the-fact review of the supporting documents.
- The burden is on the holder. INVIMA may approve a modification “cuando el solicitante demuestre que se trata de un cambio que no afecte la seguridad y efectividad del dispositivo médico”. You file INVIMA’s form with the technical and legal documents that support the change.
- The hard limit. The parágrafo says a registro cannot be modified when there is “un cambio significativo en el dispositivo médico que pueda afectar la seguridad y efectividad del mismo”, or when the change involves “cambios en el diseño, en la composición química del material, en la fuente de energía o en los procesos de manufactura”. In those cases you need a new registration.
“Automatic” describes the legal track, not the calendar. In our files the approval letter for a software amendment has taken weeks, not days, because the after-the-fact review still happens and INVIMA can ask questions.
How we sort software changes
This is our operator triage, not a regulation. It reflects what INVIMA has accepted in our files.
| Change in the new version | Usual route | Why |
|---|---|---|
| Bug fixes, performance, cybersecurity patches, new operating-system support, UI changes with the same functions | Modification, if the registered dossier (version, labeling, IFU) changes | No effect on safety or effectiveness; you document it |
| New companion app or software module named on the label or IFU, same intended use | Modification | We added a software note for companion apps to a registered cardiac device this way; INVIMA approved the amendment |
| New clinical performance claims backed by publications, same intended use | Modification, with careful IFU wording | A registered Class IIa planning software went through an earlier update as a modification, including an indications change |
| New output presented as a diagnosis or a prediction of patient outcome | Risk of a new registration, and possibly a higher class | It reads as a new intended use, which is hard to argue does not affect safety and effectiveness |
| Software that now drives a different energy source or hardware | New registration | Article 30’s parágrafo names energy source and design |
Claims are where software files go wrong
The code can change a lot and stay a modification. A single sentence in the IFU can turn it into a new registration.
The pattern we see: a registered tool says it is “not intended for diagnostic use” and supports device selection or planning. The next version adds a metric, and marketing wants to describe it as a predictor of how the patient will do. That wording moves the product from a planning aid toward a prognostic claim. Decreto 4725 classifies by intended use and risk, and when several classification rules apply, the one that leads to the higher class wins. A new prognostic purpose invites INVIMA to ask whether this is still the device it registered.
What we tell holders:
- Present new outputs the way the registered intended use already does, for example as simulation outputs that support implant selection and positioning.
- Do not present them as a standalone prediction of the patient’s outcome.
- Keep the “not intended for diagnostic use” statement in the IFU if it is there today.
- Tell us whether a metric is a new calculated output or an existing measurement that now carries a clinical claim. New outputs make the wording more important. They do not change the route on their own.
What goes in a software modification file
INVIMA’s form plus the documents that prove the change is safe. In practice we assemble:
- A change description that maps the old and new versions, function by function.
- The manufacturer’s software verification and validation summary for the new version (most manufacturers organize it around IEC 62304).
- The updated ISO 14971 risk analysis, showing no new unacceptable risks.
- Updated IFU and labeling in Spanish, with the changes marked.
- A signed manufacturer statement that the intended use, design principles and safety profile are unchanged, or a clear explanation of what changed and why it does not affect safety and effectiveness.
- Supporting publications when the change adds clinical performance claims.
File it before the new version ships in Colombia. A product on the market that no longer matches its registro is an INVIMA inspection finding waiting to happen.
When to ask INVIMA first
If the route is genuinely unclear, INVIMA accepts a written consultation to its registrations group asking whether a change can go as a modification. It adds a few weeks. We suggest it only when the holder needs the authority’s position in writing, for a business plan or a board. Most of the time a well-argued modification file, with the claims wording handled, is the faster path.
Two clocks to keep in mind
A registro sanitario for a medical device is valid for ten years from issuance (Decreto 4725, Article 31). Renewal must be filed three months before expiry, or INVIMA treats it as a new application (Article 32). A modification does not replace a renewal. If your registro expires in the next year, plan the software modification and the renewal together.
Frequently asked questions
Does every software patch need an INVIMA filing?
Only if it changes something in the registered dossier, such as the version on the label, the IFU, or a function described in the file. Keep your change log either way. INVIMA can ask for it.
Can an indications change go as a modification?
It has in our files, when the change was backed by evidence and did not alter the design or safety already authorized. The argument has to be made explicitly in the filing.
Does Brazil or Mexico work the same way?
No. Each regulator has its own change rules for software. For Mexico, see our note on COFEPRIS digital health software clearance.
Who files the modification?
The registration holder. If your registro sits with a distributor, you need them to sign, or you move the registro first. See how to transfer a registration to a new holder.
Related
- INVIMA registro for a device already FDA cleared or CE marked
- INVIMA medical device registration checklist
- Colombia INVIMA registration holder and IOR
- bioaccess® market access in Latin America
bioaccess® files INVIMA registrations, modifications and renewals for device manufacturers through our Colombian team. If you have a software release coming and a registro in Colombia, send us the draft IFU before you finalize it. Talk to bioaccess® about Colombia market access.
General information, not legal advice. Sources: Decreto 4725 de 2005, Articles 2, 22, 30, 31 and 32, with Article 30 as substituted by Decreto 582 de 2017 (INVIMA normograma). Last verified October 13, 2026.