On February
25, 2016, the International Organization for Standardization (ISO) published
its revisions to ISO 13485 replacing the previous version from 2003. This is
the global standard for medical device quality management systems (QMS). Over
the next three years, ISO 13485:2003 and ISO 13485:2016 will coexist, allowing
manufacturers, accreditation/certification bodies and regulators time to
transition to the new standard.
Although the
new standard is a revision to the original guidance, there are areas in which
the standard had significant updates. The major changes between the 2003 and
2016 ISO standards include:
Regulatory
requirements
While the
2003 standard expected you to establish a QMS that complies with ISO 13845, the
2016 standard explicitly expects you to conform to all regulatory requirements.
This requirement is emphasized throughout the new standard. In addition, it is
expected that objectives are set for meeting both regulatory requirements in
addition to product requirements.
Risk based
approach
The 2016
standard expects the application of a “risk based approach†to the QMS process.
In the previous standard, risk was applied during product realization. In the
new standard, risk management methods are applied to all QMS processes,
including outsourced processes.
Medical
device file
While both
old and new standards expect the establishment of a special file for each type
of medical device, the new standard defines this to include a description of
the medical device(s) which will include all associated specifications,
procedures and records.
Record
keeping
The new
standard expects Sponsors to record supplier monitoring and the re-evaluation
of activities. Privacy regulations must be considered to protect confidential
health information.
Product
realization
In addition
to the 2003 requirements covering product verification, validation, monitoring,
inspection, and testing requirements the new standard has added product
handling, storage, measuring, revalidation, and traceability requirements as
well.
User
training
The 2003
standard required the identification of product requirements specified by the customer
and regulatory bodies. The new standard sets an expectation that you also
evaluate safety and performance of your products and associated training needs
of the end user prior to supplying product to the customers. Regulatory
requirements must be verified and user training is performed.
Design and
development inputs
Risk
management outputs must be considered to clarify product usability and safety
requirements and to make sure that the input requirements can be verified and
validated.
Design and
development verification and validation
Verification
and validation plans must be verified, and to verify and validate medical
devices that connect to or interface with other medical devices. Design inputs
and outputs must be verified when devices are connected or interfaced together
and to validate the intended use or application requirements when devices are
connected or interfaced.
Design and
development changes
The new
standard addresses a few gaps with the old standard around how to control
design and development changes. The new standard expects you to establish
processes to control design and development changes and to evaluate their
significance and impact. It also expects file maintenance for each medical
device or family of medical devices that documents the changes.
Design and
development transfer
The 2016
standard has established a specific design and development transfer subsection.
Special emphasis is given to ensure that outputs are suitable for manufacturing
before they become official production specifications.
Purchasing
The new
standard provides details on supplier selection and evaluation criteria. Now
you must consider your medical device and the risks associated with the
purchased products and the impact on safety and performance. You must ensure
that your suppliers can meet the product, organization and all relevant
statutory requirements.
Supplier
monitoring
As part of
your supplier selection process you not only must monitor the supplier
performance, you must also consider the risk associated whenever suppliers
underperform. The response and actions of supplier performance concerns must be
proportional to the risk associated with the supplier’s services and/or
processes. The old and new standard both had requirements to establish records
of the supplier’s evaluation, but in the new standard you are also expected to
record monitoring and re-evaluation activities
Purchased
product risks
The old and
new standards expect verification that purchased products meet purchase
requirements. But now consideration must be given to the risk associated with
the product purchased and to worry about unanticipated changes made to these
products. You must also determine whether these changes affect your medical
device or your product realization process.
Process
validation
The old and
new standards expect you to establish procedures to validate production and
service delivery processes that generate outputs that can’t be verified until
the product is in use or the service has been delivered. In the new standard,
you must establish validation plans and to revalidate processes whenever
necessary.
Servicing
In addition
to the 2003 standard of documenting your organization’s servicing procedures
and reference materials, analyzing servicing records to identify servicing
complaints and improvement opportunities has been added.
Complaints
The new
standard includes requirements to include all complaints (not just customer
complaints). You must develop and document complaint handling procedures that
comply with all applicable regulatory requirements. The old standard simply
asked you to establish arrangements, not procedures.
Delivery
of nonconforming product
The new
standard expects that delivered nonconforming products are investigated. You
must determine corrective action and consider if notification must be provided
to external parties (e.g., end-users, suppliers).
Improvement
Requirements for maintaining a suitable and effective QMS were required of both the old and new standard, but it is now required that you also maintain the safety and performance of your products whenever improvements are being considered. In addition, before implementing any corrective and preventative actions, you must verify that those actions comply with all applicable regulatory requirements and that those actions don’t compromise the safety and performance of your medical devices.
User questions & answers