The medical devices and IVD industry is about to see the world’s most popular ISO standard for medical devices & IVDs quality management systems (QMS) revised significantly. James Alexander, Procorre, explains how device manufacturers can prepare for the changes and gives practical steps on becoming fully compliant.
Standards
The medical devices and in-vitro medical device (IVD) industry is one of the biggest industries within the healthcare sector and recent years have witnessed significant growth in new technologies.
However, the medical device and IVD market is facing a significant regulatory challenge that places more emphasis on quality and safety through more robust quality management systems (QMS). The changes could prevent device manufacturers and suppliers accessing key EU markets if they’re found to be non-compliant.
Put simply, this means any medical device (MD) or IVD that does not comply with the new ISO13485:2016 standard in the transitional time frame (ie. three years), or with the MDR and IVDR regulations (ie. three years for a MD and five years for an IVD) will be refused access to key markets. Medical device and IVD manufacturers cannot operate lawfully without compliance to the new ISO and MDR/IVDR standard/regulations.
The new ISO 13485:2016 revision places a greater emphasis on a risk based approach throughout the whole internal QMS and now extends throughout the whole supply chain and product life-cycle; including more robust controls on device usability, clinical evaluation and post-market surveillance requirements. Over the next three years, ISO13485:2003/2012 and ISO13485:2016 will co-exist, allowing device manufacturers, accredited certification bodies and regulators time to transition to the new standard (RAPS, 2016).
How can manufacturers prepare?
Unfortunately, it’s no longer as simple as conducting your own audit and ticking a box to say your product conforms to the necessary safety standards. Getting potentially hundreds of products compliant in time for the deadlines will be a significant challenge. Manufacturers have three main options:
- Employ a full time quality assurance/regulatory affairs (QA/RA) specialist – this is a long term solution but one that could be costly, depending on the size of the business
- Purchase specialist QMS software and technical file templates, plus two days of initial training – these tools will assist with approximately 75% of the work; then you’ll need a specialist to conduct a gap analysis/pre-assessment and provide a report on the items audited
- Engage a consultancy that will be able to provide fixed-term subcontractors to carry out a complete cradle-to-grave audit to certification service – this could be the most cost-effective solution and the package of support can be tailored to suit your individual requirements
There are many steps a business must take to ensure each product is fully compliant, including:
- An initial gap analysis to challenge their products’ lifecycle(s) – this should take between two to three full days
- Thoroughly review the gap analysis report to identify any major and minor non-conformances
- Produce a complete project plan (using a Gantt chart for example) driven by the gap analysis and based on the business’s preferred timeline to get fully compliant QMS and technical files in place
- Develop the QMS and technical files and deliver the project – this should take approximately 10 to 15 days of consulting support, depending on the size of the business and the classification level and number of products being audited
- Roll out the processes with internal staff (i.e. implementation phase) and then introduce an independent lead auditor to do a pre-assessment and identify any corrective action needed
- Arrange for a third-party auditing organisation (i.e. a notified body such as SGS, Lloyds, BSI etc.) to perform a certification assessment. Upon completion, you’ll be awarded the new ISO 13485:2016 and CE mark approval certifications.
If a business is considering bringing in a specialist team of device subcontractors, they may also decide to continue that relationship on an ‘outsourcing’ basis, to keep their QMS updated and manage potential complaints and/or reportable adverse incidents.
The transition periods seem to give plenty of time to introduce the necessary changes, however the extent and complexity of the changes are significant, and it is expected to take between six and 18 months to fully upgrade the QMS and technical construction files, so we’re urging organisations to start the process as soon as possible to avoid having their devices removed from the EU market.
To find out more about the ISO13485:2016 standard, and the ‘Recast MDR and IVDR regulations, download our medical devices whitepaper: info.procorre.com/medical-devices-whitepaper.