COFEPRIS Compliance in Mexico: Health Licenses and Operating Requirements
COFEPRIS — the Federal Commission for Protection against Sanitary Risks — regulates every business in Mexico that handles food, beverages, pharmaceuticals, medical devices, cosmetics, supplements, tobacco, pesticides or health services. Its jurisdiction is broad, its enforcement is aggressive and its consequences for non-compliance are immediate: COFEPRIS can shut down your operation the same day an inspector finds a violation.
For many businesses, COFEPRIS requirements are the least understood part of their compliance obligations. Companies know they need STPS safety programs. They know they need SEMARNAT environmental permits. But COFEPRIS requirements vary dramatically by business type, and the line between needing a simple aviso de funcionamiento and needing a full health license with GMP certification is not always clear.
This guide covers every COFEPRIS requirement by business type, from the most basic notification to the most complex certification.
The Aviso de Funcionamiento
The aviso de funcionamiento is the most basic COFEPRIS requirement. It is a notification — not a permit — that your establishment exists and what it does. It is required for businesses that handle products or services regulated by COFEPRIS but that do not need a full health license. Businesses that typically need an aviso de funcionamiento: retail pharmacies, food retail establishments (not manufacturing), retail cosmetics sales, supplement sales, some healthcare providers and commercial establishments selling COFEPRIS-regulated products.
The process is relatively straightforward: it is submitted through COFEPRIS's online portal (SIIPRIS) with your business information, commercial activities and responsible person designation. There is no inspection before the aviso is issued. However, COFEPRIS can conduct follow-up inspections at any time, and operating without the aviso when it is required is a violation.
With 3,100 monthly searches for "aviso de funcionamiento COFEPRIS," this is one of the most searched compliance requirements in Mexico. Many businesses don't know they need it until it is requested during a local inspection or a client audit.
Health Licenses
A health license (licencia sanitaria) is a higher-level authorization than an aviso de funcionamiento. It is required for establishments that manufacture, process, or handle higher-risk health products. This includes: pharmaceutical manufacturing facilities, medical device manufacturing facilities, blood and tissue banks, diagnostic laboratories, pesticide manufacturing, and certain food processing operations.
A health license requires: facility inspection by COFEPRIS prior to issuance, compliance with specific NOMs for the product type, designation of a responsible sanitary officer (a licensed professional responsible for sanitary compliance), and ongoing compliance with GMP where applicable. Health licenses must be renewed periodically, and COFEPRIS conducts routine and surprise inspections to verify continued compliance. Losing a health license means the facility cannot legally operate.
Good Manufacturing Practices (GMP)
GMP certification is the highest level of COFEPRIS compliance. It is mandatory for pharmaceutical manufacturers, medical device manufacturers, and certain food processing operations.
Pharmaceutical GMP
Governed by NOM-059-SSA1. COFEPRIS conducts detailed facility inspections covering: facility design and maintenance, equipment qualification and validation, process validation, quality control systems, documentation and records, personnel training and hygiene, raw material and component control, packaging and labeling, storage and distribution, and complaint handling. GMP guidelines were updated in March 2025 to align with PIC/S and USMCA standards, raising the bar for Mexican pharmaceutical manufacturers.
Medical Device GMP
Governed by the new NOM-241-SSA1-2025, which came into effect in November 2025. It replaces the previous standard and aligns with international medical device manufacturing standards. Key changes: expanded design control requirements, enhanced risk management documentation, stricter cleanroom validation, and more detailed post-market surveillance obligations.
Food GMP
Governed by NOM-251-SSA1. It covers: hygiene practices for food processing, personnel health and training, facility maintenance and pest control, water quality, raw material control, process control, and product traceability. Food handler certifications are required for all personnel in direct contact with food products.
COFEPRIS Requirements by Business Type
Retail pharmacy: aviso de funcionamiento + designation of responsible sanitary officer + controlled substance permits (if dispensing schedule drugs).
Restaurant or food service: aviso de funcionamiento + food handler certifications + NOM-251 hygiene compliance + municipal sanitary inspection.
Food manufacturer: health license + NOM-251 GMP compliance + handler certifications + product registration (for processed foods) + periodic COFEPRIS inspection.
Pharmaceutical manufacturer: health license + NOM-059 GMP certification + controlled substance permits (if applicable) + responsible sanitary officer + periodic COFEPRIS GMP audit.
Medical device manufacturer: health license + NOM-241-SSA1-2025 GMP certification + responsible sanitary officer + product registration + periodic COFEPRIS audit.
Hospital or clinic: health license + service-specific permits (surgery, radiology, laboratory) + responsible sanitary officer + RPBI compliance (NOM-087) + periodic COFEPRIS inspection.
What Happens When COFEPRIS Finds Non-Compliance
COFEPRIS has some of the most immediate enforcement powers of any Mexican regulatory agency. Unlike STPS, which may issue findings with correction timelines, COFEPRIS can shut down operations the same day it finds a violation. For food establishments: immediate closure for hygiene violations, product seizure for safety concerns, and public notification of violations.
For pharmaceutical operations: suspension of GMP certification (halts all production), product recalls, revocation of health license, and potential criminal liability for counterfeit or adulterated products. For healthcare facilities: suspension of service-specific permits (no surgery, no radiology), facility closure for patient safety violations, and revocation of health license. The pattern is the same across all sectors: COFEPRIS does not wait for corrective actions before acting. If the violation represents a health risk, the response is immediate.
Tracking COFEPRIS Across Multi-Site Operations
For companies operating multiple locations — pharmacy chains, restaurant chains, multi-site manufacturers, hospital networks — COFEPRIS compliance multiplies in the same way as STPS and SEMARNAT compliance. Each location needs its own aviso de funcionamiento or health license. Each location has its own inspection cycle. Each location needs current food handler certifications, responsible sanitary officer designations, and evidence of compliance.
NAPSsoft EHS structures COFEPRIS requirements alongside STPS and SEMARNAT obligations in a single platform. Health licenses, aviso de funcionamiento status, GMP inspection cycles, food handler certification expirations, and responsible sanitary officer designations are tracked by location with renewal forecasting and evidence linking.
Everything About EHS Software for Mexico
Take your compliance to the next level