Philippines IVD Regulations: Which Rules Apply, Who Enforces Them, and What Compliance Actually Requires

Philippines IVD Regulations: The Statutes and Agencies That Actually Bind You

There is no single IVD statute in the Philippines. What binds an in-vitro diagnostic is one enabling law, one layer of ASEAN technical architecture, and a set of use-specific statutes that switch on depending on what your test detects. You need all three to know who can stop you, and where.

Layer one: the enabling statute. Authorization, registration and monitoring of health products rest on Republic Act No. 3720, the Food, Drug and Cosmetic Act, as amended by Republic Act No. 9711, the FDA Act of 2009. RA 9711 restructured the FDA and gave it its enforcement powers, and it is the legal source of the FDA's authority to inspect, suspend, revoke and order a recall. Every post-market action that looks merely administrative traces back here.

Layer two: the technical architecture. As an ASEAN member state, the Philippines aligns device and IVD technical requirements to the ASEAN Medical Device Directive (AMDD): risk classification follows the AMDD rules, the technical file follows the ASEAN Common Submission Dossier Template (CSDT), and post-market vigilance follows AMDD Annex 5. Many requirements you meet in Manila did not originate in Manila.

Layer three: statutes that attach to the use, not the company. The same kit can trigger blood services, HIV policy, notifiable-disease reporting and clinical laboratory licensing law simply because of what it tests for. Foreign manufacturers routinely miss this layer entirely; it gets its own section below.

Who regulates what: a map of everyone who can stop you.

• Philippine FDA — Center for Device Regulation, Radiation Health and Research (CDRRHR). The lead center for devices and IVDs. Establishment licensing, product authorization, post-market vigilance and inspection all sit here — not with the FDA's drug or food centers.
• Department of Health (DOH). Administrative Orders are issued at department level; FDA Circulars implement them. Rules therefore usually arrive as a pair of documents, not one.
• Bureau of Customs. Release at the port runs on Republic Act No. 10863, the Customs Modernization and Tariff Act. An FDA authorization does not by itself move a shipment — see our guide to regulated and restricted imports.
• DOH clinical laboratory regulation. Under Republic Act No. 4688, the Clinical Laboratory Law, and its implementing rules — this decides whether your customer may lawfully run your test at all, and it is the most underrated commercial gate in the category.
• National Privacy Commission (NPC). Under Republic Act No. 10173, the Data Privacy Act, test results are sensitive personal information; connected analysers and result-export software land squarely on this.
• DTI and consumer protection. Under Republic Act No. 7394, the Consumer Act, claims aimed at the public and self-test marketing carry extra constraints, and no promotional claim may exceed the approved intended use.

The practical value of that map is one sentence: compliance is not "we hold the FDA certificate", it is "no agency has a reason to stop us". Most IVD businesses that fail in the Philippines do not fail at the product-authorization step.

Why the General Device Rules in AO 2018-0002 Do Not Simply Apply to IVDs

Because that Administrative Order carved IVDs out of itself. Administrative Order No. 2018-0002, the guidelines governing the issuance of an authorization for a medical device based on the ASEAN harmonized technical requirements, is what moved general Philippine medical devices into the ASEAN framework: it set the A/B/C/D risk scale, put Class A on notification (CMDN) and Classes B, C and D on registration (CMDR). But its scope states that the requirements apply to medical devices sold, imported, exported, manufactured and used in the Philippines except in-vitro diagnostic and refurbished medical devices, for which separate Administrative Orders shall be issued.

That sentence is the single most consequential — and most frequently ignored — line in the category. It has three practical effects.

• Your device colleagues' experience does not transfer. General devices completed their migration under AO 2018-0002 and the FDA circulars implementing it (FDA Circular No. 2021-002 and its addenda). The IVD equivalent has spent years in draft, consultation and phased transition. "This is how we do it on the device side" is usually wrong for you.
• Effective dates and transition windows are the most valuable intelligence in this category. In a category that is changing tracks, what governs your filing is not the spirit of the rules but which issuance is in force on your filing date, whether a transition applies, and whether existing certificates carry over.
• Even the certificate names change. The direction of travel is a dedicated certificate set for diagnostics — the industry refers to a Certificate of IVD Notification (CIVDN) and a Certificate of IVD Registration (CIVDR), distinct from the device CMDN and CMDR. What you actually receive during a transition, and how long it runs, should be taken from the FDA issuance in force and from the certificate itself, never from an industry article — including this one — when you are drafting contracts or artwork.

One clarification, because it gets misread constantly: a category in transition is not a category that is unregulated. The duties under RA 3720 and RA 9711 never lapsed. The company still needs a license, the product still needs an authorization, the shipment still needs to clear, and problems still have to be reported. What the transition changes is which route, which format and which certificate — not whether you must comply.

Classification Logic: The Class Is a Legal Position You Argue, Not a Value You Look Up

An IVD's risk class in the Philippines is derived by applying the ASEAN classification rules to the intended use you yourself wrote — it is not read off a product list. In regulatory terms the class is a position you must be able to defend, not an objective property of the kit.

The four classes, A through D, run in increasing order of risk to the individual and to public health, and the reasoning is diagnostic: what clinical action follows a wrong result, whether there is a public-health dimension such as blood or donor screening, whether the user is a trained professional or a layperson self-testing, and whether the result stands alone or is always confirmed. Once the class is set, everything downstream follows it:

• The route — the lighter notification path, or a registration with substantive assessment.
• The evidence burden — how deep the analytical and clinical performance package has to go.
• Local verification — higher classes may require performance evaluation or endorsement by an FDA-recognized laboratory such as the Research Institute for Tropical Medicine, which is its own separate timeline and cost line.
• Certificate validity and renewal cadence, and the fee tier that comes with them.

The key point: the FDA holds the final say on class, not you. The class on your application form is a claim, and a reviewer can raise it based on the intended use you stated. When that happens, route, evidence and timeline are all re-drawn — that is a re-run, not a supplementary submission. Two things therefore have to be done before filing:

• Freeze the intended use and repeat it identically everywhere. Target analyte, specimen types, qualitative or quantitative, screening or confirmatory, professional or self-test, intended population and setting. The technical file, label, IFU, letter of authorization and free-sale certificate must all recite the same wording. More than half of all classification disputes start as an inconsistency between those documents.
• Keep a written classification rationale. State which classification rule you applied, why the kit lands in that class, and which higher-class scenarios you ruled out. When challenged, you then hold an argument rather than a habit.

For what typically sits in each class and how the two filing routes actually work in practice, see our IVD classification, labeling and registration guide. The general-device A/B/C/D scale is reasoned along a completely different path — that one is in our medical device classification and registration guide.

Philippines IVD Regulatory Requirements: Four Layers of Obligation, Not One Certificate

Keeping an IVD lawful in the Philippines requires four layers of obligation to hold at the same time; break one and the chain breaks. Most companies think the product authorization is the finish line. It is layer two of four.

• Layer 1 — establishment: the License to Operate. Issued by FDA CDRRHR to a company for a declared activity: importer, distributor or wholesaler, trader, or manufacturer. It is tied to an inspectable warehouse and a qualified technical person. The license holder is the applicant on every product filing, which is why the sequence cannot be reversed.
• Layer 2 — product: a per-item authorization. Lower risk on notification, higher risk on registration, held under that LTO. Crucially, an authorization has a scope: model names, kit sizes, catalogue numbers, pack configurations and intended use are written into it. Anything outside that scope is unauthorized, however similar it looks.
• Layer 3 — conduct of business: what you do every day after the certificate. This layer produces no certificate, only records — and it is what inspections actually examine. Traceable importation and distribution records, complaint intake and handling records, storage and cold-chain conditions with monitoring evidence, the technical person actually in post, reported changes, and promotional claims kept inside the approved intended use.
• Layer 4 — consignment: getting the shipment released. Arriving regulated health products routinely need shipment-level clearance in addition to the standing product authorization, and the entry documents must agree with the authorized product and its scope on product name, catalogue number and quantity.

One layer with nobody accountable, and the other three were paid for nothing? → IVD access and ongoing compliance handling

Two joints fail most often. The first is scope drift — marketing adds a pack size or the plant changes a catalogue number, the certificate does not cover it, and the goods stop at layer four. The second is unreported change — a manufacturing site, formulation, kit configuration, label, software version or authorized representative changes and is never filed. Nothing happens for a year; then an inspection or an adverse-event traceback surfaces it, and that is a far more serious finding than a slow approval.

How to actually stand those layers up — the LTO route, the dossier, the filing mechanics — is covered in the IVD classification and filing guide. The establishment-then-product structure across all FDA categories is in the FDA product registration overview.

Post-Market Duties: Complaints, Adverse Events, FSCAs and Recalls

Post-market work is no longer optional in the Philippines. Administrative Order No. 2025-0030 implements the Post-Marketing Alert System (PMAS) requirements of Annex 5 of the ASEAN Medical Device Directive as a mandatory national framework, and it expressly covers in-vitro diagnostic medical devices. It applies to manufacturers, marketing authorization holders, importers, distributors and traders.

The structure of AMDD Annex 5 is, in effect, a list of the four things you must build:

• Importation and distribution records (traceability). You must be able to take a lot number and say which customers, hospitals and laboratories received it. This is not a by-product of your warehouse ledger — it is the precondition for a recall being executable. If you cannot reach the end user, a recall is only a letter.
• Complaint records and a handling process. An intake channel, triage, assessment, closure and retention — and the ability to answer whether a given complaint is a reportable event.
• Adverse event reporting: criteria and format. What counts as reportable, who decides, and on which template it is submitted.
• Field safety corrective action reporting. Recalls, field safety notices, software updates, use restrictions and label corrections all have to be notified in the prescribed form.

Deadlines are tiered, and the tightest tier is measured in hours, not days. AO 2025-0030 sets graduated reporting periods by severity and urgency: shortest for events posing a serious threat to public health, longer for events resulting in death or serious deterioration in health, longer again for events that would be serious if they recurred. Take the exact hour and working-day figures from the AO text and the FDA issuance in force on the day you need them — these numbers are the most frequently garbled in secondary sources, and reporting late is a real violation. The AO also provides a transition period for authorization holders to build the system.

On the regulator's side, the FDA performs an initial assessment on receipt of an alert and then a fuller risk assessment, and can issue safety advisories, require labeling changes, suspend marketing or order a recall — the enforcement powers behind all of that come from RA 9711. In practice the thing worth preparing is not "what do we do if something goes wrong", it is "can we produce a complete traceability list within days". If you cannot, the response escalates from recalling one lot to pulling the product.

The Layer That Attaches to the Test, Not the Company

The same kit can trigger several statutes that have nothing to do with the FDA, purely because of what it detects. This layer appears in no registration guide, yet it frequently decides whether the product can be sold at all.

• Blood and donor screening. Republic Act No. 7719, the National Blood Services Act of 1994, and its implementing rules require screening of blood for transmissible agents before transfusion. For a manufacturer this means the kit enters a procurement and use environment governed by the DOH blood services system, not simply a market where an FDA authorization is enough to sell.
• HIV testing. Republic Act No. 11166, the Philippine HIV and AIDS Policy Act, requires HIV testing to use approved test kits and channels confirmatory testing and result release through the national reference laboratory system and defined protocols. Rapid-test and self-test manufacturers need to understand that chain of use on top of the FDA authorization.
• Notifiable diseases. Republic Act No. 11332, on mandatory reporting of notifiable diseases and health events of public health concern, pulls certain results into a public-health reporting chain. If your assay sits on that list, customers will hold you to higher expectations on result format, traceability and reporting cooperation.
• Clinical laboratory licensing. Under Republic Act No. 4688, clinical laboratories must be DOH-licensed and may only perform tests appropriate to their licensed category. This is the most underrated commercial gate in the category: if your assay can only be run in a higher-category laboratory, your addressable customer list shortens dramatically; if your platform suits primary-level facilities, the market is a different shape entirely. When sizing the Philippine market, ask who is allowed to run the test before you ask who wants to.
• Self-tests and consumer claims. Products aimed at the public also sit under Republic Act No. 7394 and advertising rules; no claim may exceed the approved intended use, and lay readability of the instructions is itself part of the assessment.
• Result data. Test results are health-related sensitive personal information under Republic Act No. 10173, supervised by the National Privacy Commission. Analysers and companion software that upload, report to the cloud or export results land on device regulation and data privacy at the same time — decide that at design stage, not the first time it appears on a customer's procurement questionnaire.

IVD Regulatory Affairs Philippines: What the Function Has to Own In-Country

Regulatory affairs on this line compresses into ten things that need a named owner. None of them produces a certificate; together they decide whether your certificates stay valid.

• 1. An authorization register. One queryable table: product name, certificate number, class, route, the models and catalogue numbers inside the authorized scope, validity, and the date renewal work starts. Renewals have windows, and missing a window usually means re-filing rather than catching up.
• 2. A change-control trigger list. Write down which changes must be reported and hand it to R and D, manufacturing and marketing: manufacturing site, formulation and raw-material source, kit and pack configuration, label and IFU, intended use and claims, software version, authorized representative or license holder. The list belongs inside the change process, not in a regulatory affairs drawer.
• 3. Version control over label and IFU artwork. Every revision gets reconciled against the technical file and the authorized scope. A label promising something the dossier never proved is the most avoidable rejection in this category and the easiest finding for an inspector to write up.
• 4. A legalization pipeline for foreign documents. Free-sale certificates, ISO 13485 certificates and letters of authorization all expire, and foreign-issued documents generally need notarisation plus apostille or consular authentication. Put those expiry dates on a calendar — the legalization queue, not the technical review, is the usual reason a project starts late.
• 5. Regulatory clauses in distributor and authorized-representative contracts. Who holds the certificate, whether it can be transferred and how, how data is handed over on termination, how quickly complaints and adverse events must be passed to you, and how inspections are supported. Agree these before the first filing — afterwards you have no leverage.
• 6. A working local intake for complaints and adverse events. A real channel, a named assessor and an internal clock that is shorter than the regulatory clock; otherwise you are permanently filing at the deadline.
• 7. Storage and cold-chain records. Temperature mapping, continuous monitoring, alarm and response logs, backup power against brownouts, and a written excursion rule that says who reads the logger, against which stability data, who quarantines and who releases.
• 8. Inspection readiness as a steady state. Licenses and authorizations on hand, evidence the technical person is in post, lot-level traceability in and out, complaint and CAPA files, training records, retained samples and disposal records. Records assembled the week before an inspection look exactly like records assembled the week before an inspection.
• 9. Regulatory review of promotional and tender material. Claims in bid documents, brochures and training decks must sit inside the approved intended use. Over-claiming in a tender is a standard route by which a competitor reports you.
• 10. A subscription and filing habit for rule changes. One named person tracks FDA issuances and turns each change into three answers: which of our certificates does this touch, does it require action, and what is the deadline.

Items 2, 5 and 10 are the ones most often unowned — and the ones that resurface expensively about a year later.

Where the Rules Are Heading, and How to Read a Rule Change

The direction is unambiguous: IVDs are being moved out of borrowed device rules and into a dedicated, ASEAN-aligned set of their own. Several threads are visible.

• Dedicated rules are advancing. AO 2018-0002 said in 2018 that separate orders would follow for IVDs, and the FDA has since published draft authorization rules for in-vitro diagnostics for public comment, aligning IVD classification to the AMDD rules and pairing it with its own certificate set (referred to in the trade as CIVDN and CIVDR).
• The transition is phased. The drafted path brings products of every risk class into notification first and then migrates them to registration by class, with carry-over and re-issuance arrangements for existing certificates. That makes "ours only needed a notification last time" a hypothesis to verify, not a conclusion.
• Local verification for higher classes is being reinforced. Higher-class IVDs may require performance evaluation or endorsement by an FDA-recognized laboratory such as the Research Institute for Tropical Medicine. Schedule that as its own workstream rather than starting the search after a deficiency letter arrives.
• Clinical performance studies are getting their own rules. The FDA has circulated draft rules covering clinical investigation of medical devices and clinical performance studies of IVD medical devices — the signal being that local performance work will run on a defined authorization and ethics pathway rather than as informal commercial validation.
• Post-market moved from principle to mechanism. AO 2025-0030 turned vigilance into something with formats, deadlines and inspectable evidence. It is the change with the largest effect on day-to-day operations in recent years.

How to read any rule change — four questions, in order:

• 1. What is the effective date, and is there a transition period? Most panic comes from reading "published" as "in force".
• 2. What happens to existing certificates? Carried over to expiry, re-issued within a deadline, or re-filed from scratch — this decides whether you note a date or start a project.
• 3. Is supplementary documentation required? This is the usual hidden cost, because it often restarts foreign document legalization.
• 4. Did the certificate name, validity period or fee tier change? Any of those three moves contracts, artwork and budget with it.

Three accompanying disciplines: do not treat your last filing as the rule; do not treat a general-device colleague's experience as the rule; take the rule from the Administrative Order and FDA circular in force on the day you file. Anyone offering a fixed approval date, a guaranteed outcome or a schedule accurate to the day is describing a hope rather than a process.

Two neighbouring guides close the loop: if the question is whether a kit can move faster through the queue, see Philippines IVD expedited market access; if it is which certificate you actually end up holding, see Philippines certification of medical devices.

This article is general information only and is not legal, regulatory or medical advice. The statutes, issuance numbers, classification approach, route boundaries and post-market requirements described here are revised by DOH Administrative Order and FDA circular and are highly product-specific; your own product must be assessed on its own facts against the rules in force on your filing date. If you want this layer made solid — applicable-rule mapping, a defensible classification rationale, an obligation-chain audit, and a post-market and inspection-readiness build — Yixing's product access team can run a compliance health check and tell you where the chain breaks before the FDA or your customer does.