ABOUT ISO 13485:2003(E) Medical devices

ISO 13485:2003, Medical devices - Quality management systems - Requirements for regulatory purposes, is based on quality management system requirements currently contained in medical device regulations as well as those appropriate requirements contained in ISO 9001:2000.

The US regulations are in 21 CFR 820 maintained by the FDA.

Part of section 7.1 planning for production requires you to have a documented procedure for risk management throughout product realization. ISO 14971:2000(E) Medical Devices-Application of risk management to medical devices provides further detail for this innocent "seeming" requirement. Luckily, the automotive FMEA works well here, and Midwest can help you adapt that methodology to your device manufacturing.

The new standard replaces ISO 13485:1996 and is the work of ISO technical committee ISO/TC 210, Quality management and corresponding general aspects for medical devices, working group WG 1, Application of quality systems to medical devices, in conjunction with members of the Global Harmonization Task Force (Study Group 3).

"The key objectives of ISO13485:2003 are to maximize the probability that a medical device organization will meet regulatory quality management system requirements worldwide, will provide safe and effective medical devices, and will meet customer requirements," said Ed Kimmelman, Convenor of the working group that developed the new standard.

Health Canada requires medical device manufacturers to use a quality system certificate as evidence of compliance to the appropriate regulatory quality system requirement. Health Canada will only accept quality system certificates that have been issued by special third party auditing organizations called Canadian Medical Devices Conformity Assessment System (CMDCAS) recognized registrars. The Medical Devices Regulations do not require importers or distributors of medical devices to have a registered quality system.
The Medical Devices Regulations requires Class II medical devices to be manufactured under CAN/CSA ISO 13488-1998, and Class III and IV medical devices to be designed and manufactured under CAN/CSA ISO 13485-1998. There are no regulatory quality system requirements for Class I medical devices. These quality system requirements came into force on January 1, 2003.

The US FDA has a lot to say about ISO 13485

What is the relationship between FDA's Quality System Regulation for Devices, Part 820, and ISO 9001:2000?

FDA's Quality System Regulation Part 820, is harmonized with ISO 13485:1996, which is based on ISO 9001:1994. ISO 13485:1996 contains requirements for medical device manufacturers in addition to the general quality system requirements found in ISO 9001:1994.

ISO 9001:2000 has replaced ISO 9001:1994. Therefore ISO 13485:1996 must also be revised. FDA's Part 820 is not harmonized with ISO 9001:2000. FDA is working closely with the revisions to ISO 13485. We expect these revisions be complete by late 2002 or early 2003.

Why did FDA harmonize its quality system regulation with the ISO standards?

· Many other countries rely on ISO standards in regulating medical devices. It is easier and less confusing for industry to develop a quality system if the quality system requirements of various countries are similar.

· FDA and device regulatory agencies from other countries can more readily rely on one another's inspections and exchange inspection reports if the quality system requirements are similar. This becomes important when countries negotiate agreements to exchange information with one another.

Why didn't FDA adopt ISO 9001 instead of developing its own regulation?

FDA found that ISO 9001 did not totally serve its purposes. Also, ISO 9001 is revised periodically and might serve FDA's purposes even less well after future revisions. ISO 9001 is copyrighted and cannot be published as a Federal Regulation in the Federal Register.

Can't FDA just change Part 820 to harmonize it with the new ISO 9001:2000?

FDA and medical device regulators from other countries see problems with enforcing some ISO 9001:2000 requirements relating to:

· Assuring customer satisfaction: This goes beyond the safety and efficacy of medical devices. Therefore, to a large extent the requirement to assure customer satisfaction outside the purview of medical device regulators.

· Engaging in continuous improvement (in regard to increasing efficiency): Improvement is within the medical device regulator's purview when it is done to correct violations. However, improvement for the sake of operating more efficiently is outside the purview of medical device regulatory agencies.

· Documentation: ISO 9001: 2000 requires less documentation. Auditors and investigator, whether they be from FDA or from some other organization, need documentation to know what a company intends to do and what they actually did.

The committee revising ISO 13485 intends to address these issues in their revisions. Also, ISO 9001:2000 is written using a process model approach instead of the twenty (20) element format used in ISO 9001:1987 and 1994. In a voluntary standards arena there is no requirement for a manufacturer to change the structure of its documentation to meet the format of the standard. In a regulatory environment, however, manufacturers often feel the need to align their documentation structure with that of the regulations.

FDA sees no safety or quality benefit in having the manufacturers completely change their documentation structure and systems to the process model. Manufacturers may choose whatever documentation structure and system works best for their organization and regulatory obligations. The reasons the authors of the new ISO 9001:2000 changed to a process model are not necessarily transferable to the medical device industry.

Why would device manufacturers want ISO 9001:2000 certification?

· Many customers (hospitals, clinics, doctors, etc. ) want their medical device suppliers to be ISO 9001 certified. Customers perceive some level of security in knowing they are buying from a manufacturer that has an ISO 9001 certified quality system.

· The European Union does not require device manufacturers to comply with ISO 9001 in order to obtain a CE mark. Manufacturers have several options including having their devices tested OR having a quality system. If they have a quality system they can design it to comply with the quality system standard of their choice. In theory, they could use FDA's Part 820.

However, since many of their customers want them to have ISO 9001 certification, most medical device manufacturers choose to use ISO 13485 or EN 46001 to obtain a CE mark. These standards, which are currently being revised, reference the quality system requirements in ISO 9001:1994 and contain additional requirements for medical device manufacturers who are establishing or maintaining a quality system.