Iso 13485: 2016

WELCOME
ISO 13485:2016 & MDR

ISO 13485:2016 Are you ready?
Susan Murphy
European Medical Device Operations Manager
So…Where Are We Now?
Definitions
Shall

Used to express a command or exhortation you shall go

Used in laws, regulations, or directives to express what is
mandatory <it shall be unlawful to carry firearms

You shall do as I say
Definitions
Will
Used to express
 desire
 choice
 willingness
 consent
 or in negative constructions refusal
Present
(*Most of the World)
ISO 13485:2003:
Medical Devices – Quality Management Systems,
Requirements For Regulatory Purposes
Present – Europe
(*Harmonized EU Version)
EN ISO 13485:2012: Medical Devices – Quality

Management Systems – Requirements For
Regulatory Purposes
Future
 Published as an ISO Standard on March 1st 2016
 Effective 1st March 2018 ISO 13485:2003 certificates will no

longer be issued, modified or revised by NSAI
 Effective 1st March 2019 all 13485:2003 certificates will

become invalid
 Effective until 1st March 2018 any new, modified or revised

ISO 13485:2003 certificates issued by NSAI will
have an expiry date not to exceed 1st March 2019
Harmonisation
 Once published, ISO 13485:2016 will still need to be reviewed,

accepted, and voted on for Harmonization in the EU.
 Only EU Harmonized Standards are recognized for “presumed

compliance” with EU Medical Directive requirements (e.g. EN
ISO 13485:2016 for CE Marking)
What’s New In 2016?
0.1 Introduction - General
• The standard “can be used by an organization involved in

one or more stages of the life-cycle of a medical device”
• And, by suppliers and other external parties providing

product to such organizations.
Section 1 – Scope
• 1.1 - This International Standard can also be used by

suppliers or external parties that provide product including
quality management system-related services to such
organizations.
• 1.2 - Any requirement of Clause 6, 7, or 8 can be deemed

“not applicable” to the organization (with documented
justification).
Section 1.2 – Scope
 “risk” = pertains to safety and performance requirements,
or meeting regulatory requirements
 “documented”= required to be established, implemented,

and maintained
 “Product” = now means product or service…

output that is intended for a customer, or…
an intended output of Product Realization
 “regulatory requirements” = is limited to the legal

requirements for the quality management system and legal
requirements for safety or performance of the device
Section 1.2 – Scope
 “The processes required by this International Standard that are

applicable to the organization, but are not performed by the
organization,
 are the responsibility of the organization and are
accounted for in the organization’s quality management
system by monitoring, maintaining, and controlling the
processes.”
Section 4: Quality Management System
4.1 General
 4.1.1 document the role(s) of the organization.
 4.1.2 determine and apply the processes needed and apply a risk
based approach to the control of those processes
4.1.4 Changes made to these processes must be:

 Evaluated for impact on the QMS
 Evaluated for impact on the medical device produced
 Controlled
 4.1 – General (software):
 4.1.6 – Requires documented procedures for the validation

of software used in the Quality Management System.
 4.1.6 – Such software shall be validated prior to initial use,

and as appropriate, after changes.
*4.2.3 - Medical Device File:
For each medical device type or medical device family,

the organization shall establish and maintain a file(s)
either containing or referencing documents generated to
demonstrate conformity with the requirement of this
International Standard and compliance with applicable
regulatory requirements. The content shall include, but
is not limited to….
(New sub-clause)
(4.2.3) Medical Device File Content:
 General description of the medical device, intended

use/purpose, and labelling, including any instructions for
use;
 Specifications for product,
 Specifications or procedures for manufacturing, packaging,
storage, handling and distribution;
 Procedures for measuring and monitoring;
 As appropriate, requirements for installation; and
 As appropriate, procedures for servicing.
(*New)
Section 5: Management Responsibility
 5.6 – Management Reviews

 The organization shall document procedures for
management review
 The organization shall carry out management review
at documented planned intervals
 New management review inputs
 Complaint handling
 Reporting to regulatory authorities
 New management review inputs

 Complaint handling
 Reporting to regulatory authorities
 New Management review outputs

 All outputs shall be recorded and include
the inputs reviewed and decisions in relation to
 Suitability, adequacy and effectiveness of the system
 Changes needed to respond to new and or revised regulatory
requirements
Section 6: Resource Management
 Demonstrating and maintaining competence
 Infrastructure prevent product mix-up and ensure

orderly handling of product.
Section 6: Resource Management
*6.4.2 – Contamination Control

 control of contaminated or potentially contaminated
product in order to prevent contamination of the work
environment, personnel, or product.
For sterile medical devices, the organization shall

document requirements for control of contamination with
micro-organisms or particulate matter and maintain the
required cleanliness during assembly or packaging
processes.
(*New sub-clause)
Section 7: Product Realization
 7.1 – Product Planning

 (c) required verification, validation, monitoring, measurement, inspection
and test, handling, storage, distribution and traceability activities
specific to the product together with the criteria for product acceptance
 7.2.1 – Determination of Product

Requirements
 d) any user training needed to ensure specified performance and safe
use of the medical device;
7.2.2 – Review of Requirements related to

the product:
 c) applicable regulatory requirements are met,
 d) any user training identified in accordance with 7.2.1 is
available or planned to be available,..
 7.2.3 – Communication:
 The organization shall communicate with regulatory

authorities in accordance with applicable regulatory
requirements.
Section 7.3: Design and Development
 7.3.2 – Design and Development Planning

 design and development planning documents shall be
maintained and updated as the design and development
progresses
 the methods to ensure traceability of design and development
outputs to design and development inputs; and
 the resources needed including necessary competence of
personnel
 Inputs shall include usability and
 The requirements for the design and development of the
product and processes.
 7.3.5 – Design and Development Review

 Shall include the identification of the design under review, the
participants involved and the date of the review
7.3.6 – Design and Development

Verification
The organisation shall
 Document verification plans, including acceptance criteria, statistical
techniques and rational for sample size
 Where a device is connected to another device, verification shall include
confirmation that the design output meets the design input when connected
 7.3.7 – Design and Development
Validation
 The organisation shall
 Document validation plans, including acceptance criteria, statistical
techniques and rational for sample size
 Validation shall be conducted on representative samples. The rational for
product choice shall be recorded
 Where a device is connected to another device, validation shall include
confirmation that the requirements for the specified application or intended
use have been met
 a medical device used for clinical evaluation or performance
evaluation is not considered to be released for use to the customer
 Validation shall be completed prior to release for use of the product to
the customer.
*7.3.8 – Design and Development Transfer

 The organization shall document procedures for transfer of design
and development outputs to manufacturing.
 Results and conclusions of the transfer shall be recorded (see 4.2.5).
(*New sub-clause)
 7.3.9 – Control of Design and Development

Changes
 The organization shall determine the significance of
the change to function, performance, usability, safety
and applicable regulatory requirements for the
medical device and its intended use
 the changes shall be:
 reviewed;
 verified;
 validated, as appropriate; and
 approved.
7.3.9 – Control of Design and Development

Changes (cont’d)
The review of design and development changes shall include
 evaluation of the effect of the changes on constituent parts
and product in process or already delivered,
 inputs or outputs of risk management and product
realization processes.
*7.3.10 – Design and Development Files

The organization shall maintain a design and development
file for each medical device type or medical device family.
This file shall include or reference records generated to
demonstrate conformity to the requirements for design and
development
 and records for design and development changes.
(*New sub-clause)
Section 7.4: Purchasing
 7.4.1 – Purchasing Process
 The organization shall establish criteria for the evaluation and

selection of suppliers. The criteria shall be:
 based on the supplier’s ability to provide product that

meets the organizations’ requirements,
 based on the performance of the supplier,
 based on the effect of the purchased product on the
quality of the medical device, and
 proportionate to the risk associated with the medical
device.
 7.4.1 – Purchasing Process (cont’d)

 The organization shall plan the monitoring and re-evaluation
of suppliers
 Nonfulfillment of purchasing requirements shall be
addressed with the supplier proportionate to the risk
associated with the purchased product and compliance with
applicable regulatory requirements.
7.4.3 – Verification of Purchased Product
 The extent of verification activities shall be based on the

supplier evaluation results and proportionate to the risks
associated with the purchased product.
 When the organization becomes aware of any changes to the
purchased product, the organization shall determine whether
these changes affect the product realization process or the
medical device.
Section 7.5: Production & Service Provision
 7.5.1.1 – Control of Production…

 As appropriate, production controls shall include but are not
limited to:
 b) qualification of infrastructure,
 c) implementation of monitoring and measurement of process
parameters and product characteristics
7.5.2 – Cleanliness of Product

The organization shall document requirements for cleanliness of product
or contamination control of product if:
 c) product cannot be cleaned prior to sterilization or its use,
and its cleanliness is of significance in use;
 7.5.4 – Servicing Activities
 The organization shall analyze records of servicing activities

carried out by the organization or its supplier:
 to determine if the information is to be handled as a
complaint and
 as appropriate, for input to the improvement process
7.5.6 – Validation of Processes (cont’d)
 as appropriate, statistical techniques with rationale for

sample sizes
 requirements for records (see 4.2.5);
 revalidation, including criteria for revalidation; and
 approval of changes to the processes
7.5.6 – Validation of Processes (cont’d)
 The specific approach and activities associated with software

validation and revalidation shall be proportionate to the risk
associated with the use of the software including the effect
on the ability of the product to conform to specifications.

Records of the results and conclusion of validation and necessary
actions from the validation shall be maintained (see 4.2.4 and
4.2.5).
7.5.7 Particular Requirements for the Validation of

Process of Sterilization and Sterile Barrier Systems
 The organization shall document procedures (see 4.2.4) for the

validation of processes for sterilization and sterile barrier systems.
 Processes for sterilization and sterile barrier systems shall be

validated prior to implementation and following product or process
changes, as appropriate.
 Records of the results and, conclusion of validation and necessary

actions from the validation shall be maintained
7.5.8 – Identification
 The organization shall identify product status with respect to

monitoring and measurement requirements throughout product
realization. Identification of product status shall be maintained
throughout production, storage, installation and servicing of
product to ensure that only product that has passed the
required inspections and tests or released under an authorized
concession is dispatched, used or installed. (*was previously sub-
clause 7.5.3.3)
 If required by applicable regulatory requirements, the

organization shall document a system to assign unique device
identification to the medical device.
 7.5.11 – Preservation of Product
 The organization shall protect product from alteration,

contamination or damage when exposed to expected conditions
and hazards during processing, storage, handling, and
distribution by:
 designing and constructing suitable packaging and shipping

containers, or
 documenting requirements for special conditions needed if

packaging alone cannot provide preservation
Section 8: Measurement, Analysis and Improvement
8.2.1 – Feedback
 This feedback process shall include provisions to gather data
from production as well as post-production activities
*8.2.2 – Complaint Handling

 The organization shall document procedures for timely complaint
handling in accordance with applicable regulatory requirements.
 These procedures shall include at a minimum requirements and

responsibilities for:
• receiving and recording information,
• evaluating information to determine if the feedback constitutes a
complaint,
• investigating complaints,
• determining the need to report the information to the
appropriate regulatory authorities,
• handling of complaint-related product, and
• determining the need to initiate corrections or corrective actions.
*8.2.2 – Complaint Handling (cont’d)

 If any complaint is not investigated, justification shall be documented.
Any correction or corrective action resulting from the complaint handling
process shall be documented.
 If an investigation determines activities outside the organization

contributed to the complaint, relevant information shall be exchanged
between the organization and the external party involved.
 Complaint handling records shall be maintained (see 4.2.5).
(new sub clause)

*8.2.3 – Reporting to Regulatory Authorities

 If applicable regulatory requirements require notification of complaints
that meet specified reporting criteria of adverse events or issuance of
advisory notices, the organization shall document procedures for
providing notification to the appropriate regulatory authorities.
 Records of reporting to regulatory authorities shall be maintained (see

4.2.5).
(*NEW sub-clause)
8.2.6 – Monitoring and Measuring of Product
records shall identify the test equipment used to perform

measurement activities.
 *8.3.1 – General
 The evaluation of nonconformity shall include a determination of
the need for an investigation and notification of any external
party responsible for the nonconformity.
 *8.3.2 –
 Actions in response to nonconforming product detected before
delivery
 Records of actions relating to the issuance of advisory notices
shall be maintained
(*New sub-clause)
If the analysis of data shows that the quality management

system is not suitable, adequate or effective, the
organization shall use this analysis as input for
improvement as required in 8.5
8.5.2 – Corrective Action

verifying that the corrective action does not adversely affect the
ability to meet applicable regulatory requirements or the safety and
performance of the medical device;
8.5.3 – Preventive Action

verifying that the action does not adversely affect the ability to
meet applicable regulatory requirements or the safety and performance
of the medical device;
GCL-25-01
NSAI Technical Questionnaire
MDR: Major Changes and
Impact on Industry
Colm O’Rourke
NSAI- Medical Devices
colm.orourke@nsai.ie
@NSAI_Medical
What we will cover
• Current status and NB designation plan

• Why we got to where we are
• Outcome of investigations
• What is a Notified Body and how do we work
• MDR content and changes
• Industry/Market impact
• Wrap up
Charles Darwin
Current status & NB designation plan
• MDR not officially published
• 3 year transition period from date of official publication
• Notified Body re-designation likely an 18 month process
Publication 6-12 month Full Existing certs void 4
in OJ provisions application years from full
of MDR application of the MDR

Why is it all changing?
Directive Regulation
Outcome of investigations by FVO
and Joint Commission
80
Notified Bodies
56
What is a Notified Body?
NSAI
BSI
TUV
SGS
LNE G/MED
LRQA
DEKRA
MDR (Medical Device Regulation) –
What is it?
• More detailed requirements on everything:
previous MD Directive 60+ pages vs. new
regulation of 566 pages
• It will greatly change how approval for products

is sought and maintained (CE–mark)
MDR – Software as a medical device
• Much more focus
• Life cycle development
• Classification
MDR – Grandfathering
• Established product must

comply
• What standards were used in

product development?
• Was a clinical trial carried

out?
• Will there be market supply

issues?
MDR – Equivalence
• Level of access to predicate

data
• Contract in place?
• Disproportionately effect
start-ups/smaller companies
• Will this reduce the number

of new products?
MDR – Classification
• Some devices will be up

classified
• Some products named

specifically: breast implants,
hip replacements, meshes
• Expert panel – increased

time to market
• Act now to check if your

classification will change
MDR – Notified Bodies
• Increased pressure from CA
• Stricter competency
requirements
• Overall capacity squeeze

MDR – Other areas of interest
• Clinical data requirements

• Common Specifications
• UDI
• Person Responsible
• Revised Economic Operator roles
• General safety and performance requirements
• Cosmetic devices/Devices without an indented medical purpose
• EUDAMED
• Additional reports required: PSUR/SSCP
• Unannounced audits: MDR states at least once every 5 years
Industry/Market impact
• New product development
• Increased risk management requirements
• Time to Market
• Clinical data
• Approval process
• Post market surveillance
• Overall resource drain

• Getting and maintaining compliance
• Remediation of existing products
• Removal of non-compliant products
Wrap up
NSAI is here to help

Colm O’Rourke
NSAI- Medical Devices
colm.orourke@nsai.ie
@NSAI_Medical
Questions?

Iso 13485: 2016

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Iso 13485: 2016

Uploaded by

Copyright:

Available Formats

WELCOME

ISO 13485:2016 & MDR

EN ISO 13485:2012: Medical Devices – Quality

 Published as an ISO Standard on March 1st 2016

 Effective 1st March 2018 ISO 13485:2003 certificates will no

 Effective 1st March 2019 all 13485:2003 certificates will

 Effective until 1st March 2018 any new, modified or revised

 Once published, ISO 13485:2016 will still need to be reviewed,

 Only EU Harmonized Standards are recognized for “presumed

• The standard “can be used by an organization involved in

• And, by suppliers and other external parties providing

• 1.1 - This International Standard can also be used by

• 1.2 - Any requirement of Clause 6, 7, or 8 can be deemed

 “documented”= required to be established, implemented,

 “Product” = now means product or service…

 “regulatory requirements” = is limited to the legal

 “The processes required by this International Standard that are

4.1.4 Changes made to these processes must be:

 4.1 – General (software):

 4.1.6 – Requires documented procedures for the validation

 4.1.6 – Such software shall be validated prior to initial use,

*4.2.3 - Medical Device File:

For each medical device type or medical device family,

(4.2.3) Medical Device File Content:

 General description of the medical device, intended

 5.6 – Management Reviews

 New management review inputs

 New Management review outputs

 Demonstrating and maintaining competence

 Infrastructure prevent product mix-up and ensure

*6.4.2 – Contamination Control

For sterile medical devices, the organization shall

 7.1 – Product Planning

 7.2.1 – Determination of Product

7.2.2 – Review of Requirements related to

 The organization shall communicate with regulatory

 7.3.2 – Design and Development Planning

 7.3.5 – Design and Development Review

7.3.6 – Design and Development

*7.3.8 – Design and Development Transfer

 7.3.9 – Control of Design and Development

7.3.9 – Control of Design and Development

*7.3.10 – Design and Development Files

 7.4.1 – Purchasing Process

 The organization shall establish criteria for the evaluation and

 based on the supplier’s ability to provide product that

 7.4.1 – Purchasing Process (cont’d)

7.4.3 – Verification of Purchased Product

 The extent of verification activities shall be based on the

 7.5.1.1 – Control of Production…

7.5.2 – Cleanliness of Product

 7.5.4 – Servicing Activities

 The organization shall analyze records of servicing activities

7.5.6 – Validation of Processes (cont’d)

 as appropriate, statistical techniques with rationale for

7.5.6 – Validation of Processes (cont’d)

 The specific approach and activities associated with software

7.5.7 Particular Requirements for the Validation of

 The organization shall document procedures (see 4.2.4) for the

 Processes for sterilization and sterile barrier systems shall be

 Records of the results and, conclusion of validation and necessary

 The organization shall identify product status with respect to

 If required by applicable regulatory requirements, the