Understanding the updated ISO 13485
The update to ISO 13485 doesn’t exactly make for light reading – which is why Med-Tech Innovation News asked Richard Poate, senior manager at notified body Tüv Süd for help in deciphering the revised standard.
What are the requirements?
ISO 13485:2016 addresses the development, implementation and maintenance of a quality management system for medical device manufacturers and suppliers. The standard details how customer specifications and relevant regulatory requirements should be incorporated within an organisation’s quality management system.
Published on 1st March 2016, ISO 13485:2016 has a three year transition period for device manufacturers and other organisations, after which old ISO 13485:2003 certificates will expire on February 28, 2019.
What’s new?
There are significant changes in a number of important areas:
Quality management system (clause 4)
All processes that are part of a manufacturer’s quality management system will now need to be developed using a risk-based approach. This represents a significant expansion from ISO 13485:2003, in which only product design controls and product realisation processes were subject to risk management requirements. In addition to this important change, processes that are outsourced must also apply a risk-based thinking approach.
This section also states that any software used as part of the quality system must be validated and documented. In addition, the revised standard requires the maintenance of a comprehensive technical file for each manufactured device that includes a description of the device along with all relevant specifications and records.
Management responsibility (clause 5)
Changes to this section primarily involve clarifications of existing requirements regarding quality management system planning, responsibility and authority, management representation and management review.
Resource management (clause 6)
Device manufacturers will be obliged to define the specific skills and experience required for personnel involved in the maintenance of the quality management system. ISO 13485 certified organisations will also have to maintain systems for ensuring that personnel maintain the requisite knowledge through ongoing training, as well as assess the effectiveness of such training.
A new clause in this section also addresses contamination control issues for sterile medical devices, and includes requirements related to the validation of processes intended to ensure the integrity and effectiveness of sterile device manufacturing.
Product realisation (clause 7)
Clause 7 addresses specific requirements within each of the areas defined within this enlarged scope of product realisation. Medical device manufacturers will also be expected to incorporate risk management principles in determining the application of these requirements. New sub-clauses have been added in design and development for transfer of design, as well as development outputs to manufacturing and maintaining a design and development file.
Measurement, analysis and improvement (clause 8)
Device manufacturers will be expected to formalise their processes for obtaining feedback from both production and post-production activities, and to develop sound methods for incorporating that feedback into its risk management programme. Requirements regarding the investigation and control of nonconforming products, as well as those related to corrective and preventative actions, have been strengthened. New sub-clauses have also been created in monitoring and measurement for complaint handling and reporting to regulatory authorities.
How can manufacturers prepare?
Given the extent of the changes, transitioning to the new requirements is likely to take a considerable investment of time and resources. Therefore, medical device manufacturers and other ISO 13485:2003 certified organisations are advised to promptly begin the process of evaluating the application of the standard’s updates against their existing quality management system, in order to determine the scope of required changes and the time that will be needed to implement them.