NOM-059 — in full NOM-059-SSA1-2015, Buenas prácticas de fabricación de medicamentos — is the official Mexican standard that sets the GMP requirements for manufacturing medicinal products intended for the Mexican market. If you work in QA or Regulatory Affairs at a company that exports to Mexico, manufactures through a Mexican CMO, or is preparing for a COFEPRIS verification visit, knowing this standard is not an academic exercise: it is the documentary basis on which the Mexican authority builds every inspection. In this article we look at what NOM-059 is, how it is structured, how closely it aligns with PIC/S and ICH, and how to prepare in a defensible way.
What NOM-059 Is (Mexico's GMP Standard)
In Mexico, the Normas Oficiales Mexicanas (NOM) are technical standards of mandatory observance: not guidelines, but binding requirements with regulatory force. NOM-059-SSA1-2015 was published in the Diario Oficial de la Federación (DOF) on 5 February 2016 and entered into force in August 2016, replacing the previous NOM-059-SSA1-2013. In 2021 the systematic review required under the Mexican framework concluded with the confirmation of the standard, which remains the current reference for GMP in Mexico today.
The scope covers establishments dedicated to the manufacture of medicinal products for human use marketed in Mexico, including foreign sites exporting to the Mexican market: a European or US facility, too, must demonstrate compliance with this standard before COFEPRIS — the Comisión Federal para la Protección contra Riesgos Sanitarios, Mexico's federal health authority — to keep its products registered.
The Structure of the Standard: the Areas the Inspector Expects Under Control
The architecture of NOM-059 is recognizable to anyone who works with EudraLex Volume 4 or the PIC/S Guide: a quality management system as the frame, quality risk management as the cross-cutting method, then the operational chapters. The main areas covered by the standard are: quality management system; quality risk management; personnel; facilities and equipment; qualification and validation; manufacturing systems; quality control laboratory; finished product release; product recall from the market; outsourced activities; final disposal of waste; good storage and distribution practices. The standard closes with two normative (i.e. mandatory) appendices: Appendix A on the classification of manufacturing areas and Appendix B on the annual product review.
The following table helps you find your bearings by mapping the NOM-059 areas onto references a US or European QA professional already knows:
| NOM-059 area | Familiar EU/PIC/S reference | Practical watch-outs |
|---|---|---|
| Quality management system | EudraLex Vol. 4 Ch. 1, ICH Q10 | Your existing PQS covers almost everything, but NOM compliance must be stated |
| Quality risk management | ICH Q9, EudraLex Annex 20 | The risk-based rationale must be documented, not just applied |
| Qualification and validation | EudraLex Annex 15, PIC/S PI 006 | Validation status always current and traceable in the VMP |
| Area classification (App. A) | EudraLex Annex 1, ISO 14644 | Check the correspondence between classes: designations do not always match |
| Annual product review (App. B) | PQR under EudraLex Ch. 1 | The appendix is normative: format and minimum content are not negotiable |
| Storage and distribution | EU GDP guidelines | In Mexico the requirement sits inside the GMP standard, not in a separate text |
Do you work across regulated markets and want a weekly compass on GMP, inspections and regulatory news? Subscribe to The Pragmatic GMP, GuideGxP's free weekly newsletter: one operational topic every week, explained with the same audit-ready angle as this article.
NOM-059, PIC/S and ICH: How Aligned Is Mexico?
Since January 2018, COFEPRIS has been a member of PIC/S (the Pharmaceutical Inspection Co-operation Scheme): a step that anchored the Mexican inspection approach to international standards and facilitates the mutual recognition of GMP evidence among participating authorities. NOM-059 itself devotes a chapter to concordance with international and Mexican standards, and its architecture reflects the established ICH references: risk management along the lines of ICH Q9 and the quality system along those of ICH Q10.
Be careful, though, not to treat NOM-059 as a mere translation of EU GMP. Local specificities remain that make the difference in an audit: the mandatory reference to the FEUM (Farmacopea de los Estados Unidos Mexicanos, the Mexican pharmacopoeia) for analytical quality standards, the normative appendices with precise requirements, and the inclusion of good storage and distribution practices directly in the body of the GMP standard. The typical failure is not a missing technical requirement but a missing documented rationale linking the company's quality system to the Mexican text: a formalized NOM-059 gap analysis is the cleanest way to close that distance.
COFEPRIS: Oversight and Verification Visits
Oversight of NOM-059 compliance rests with COFEPRIS, which exercises it through visitas de verificación sanitaria (health verification visits) at facilities, in Mexico and abroad. For a manufacturing site, the visit follows a logic anyone who has been through EMA or FDA inspections will recognize immediately: review of the documentation system, of production and laboratory areas, of qualification and validation status, and of the consistency between what procedures declare and what records demonstrate. The winning preparation is the same as for any serious GMP inspection: deviations investigated with solid root causes, CAPAs with effectiveness checks, and self-inspections that find the problems before the inspector does.
Toward the Update: PROY-NOM-059-SSA1-2024
The framework is not static. In 2024 the draft revision PROY-NOM-059-SSA1-2024 entered the Mexican regulatory process, going through public consultation via the federal regulatory improvement commission (CONAMER/COFEMER). Until final publication in the DOF the 2015 version remains in force, but anyone with interests in the Mexican market should already be monitoring the process: an update of the national GMP standard, after Mexico joined PIC/S, will predictably move toward further international alignment — and reaching publication day with your gap analysis already set up is a concrete advantage.
GuideGxP Recommendation
The most efficient way to approach NOM-059 is not to build a parallel system "for Mexico", but to demonstrate with evidence that your PQS already covers the Mexican requirements, documenting the few local specificities (FEUM, normative appendices, storage and distribution). In practice: a formal NOM-059 vs EudraLex/PIC/S gap analysis, an addendum to the site master file for the Mexican market, and an inspection package ready for the COFEPRIS visit. And since every verification visit is won on the deviation–self-inspection–CAPA chain, that is where to invest first.
To build that chain in a defensible way, the GuideGxP guide Deviations, Self-Inspections and CAPA: the chain that holds up in inspection provides the process, templates and ready-to-use tools, with precise regulatory references for every step.
Official Sources
- Secretaría de Economía — official record for NOM-059-SSA1-2015 (status, DOF publication, history)
- Diario Oficial de la Federación (DOF) — official text of the Normas Oficiales Mexicanas
- COFEPRIS — Comisión Federal para la Protección contra Riesgos Sanitarios
- PIC/S — official list of participating authorities
