How to Implement ISO 13485 Updates

Implementing ISO 13485:2016
 Introduction
 Overview of changes
 New QMS requirements
 Implementing the requirements using PDCA
 Future changes
 Questions/Comments

Overview of Changes
Current State:
 ISO 13485:2003 addresses general quality system
requirements for medical device manufacturers
 Regulatory bodies assign criteria for meeting these
quality system requirements
 Regulatory bodies establish additional requirements
specific to device safety and functionality that are not
addressed by ISO 13485:2003

Overview of Changes
Current State:
 ISO 13485:2003 contains 20 clauses that require
“documented procedures” to address QMS processes
such as document control, design control, or CAPA.
 ISO 13485:2003 has 10 additional clauses that require
“documented requirements “ for processes such as
maintenance or rework. These are usually documented as
work instructions.

Overview of Changes
Current State:
 FDA 21CFR part 820 requires an additional 12 procedures
addressing QMS processes such as calibration, labeling or
statistical techniques.
 FDA 21CFR part 820 also contains requirements for
maintaining quality records including design history files,
master device records, device history records and
complaint files.

Overview of Changes
New State:
 ISO 13485:2016 now requires 26 procedures including the
original 20 procedures from ISO 13485:2003 and 6 new
procedures already required by regulatory agencies.
 ISO 13485:2016 now contains requirements for
maintaining design history files, medical device records,
device history records, and complaint files.

Overview of Changes
New State:
 The new procedures address management review,
competency and training, calibration, rework, complaint
handling and regulatory reporting.
 There are 6 additional procedures still required by the
FDA that are not required by ISO 13485:2016: process
control, final acceptance, labeling, distribution, statistical
techniques.

4.0 Quality System

QMS Documentation Requirements
4.2.3 Medical Device File
 A file is required for each device type or family containing
or referencing all documents required to comply with
quality and regulatory requirements.
 Typical contents are product specifications, labeling and
IFU specifications, packaging specifications, procedures
and work instructions required for product realization,
forms required as quality records.

QMS Documentation Requirements
4.2.5 Control of Records
 Methods must be defined for protecting confidential
health information contained in records according to
applicable regulatory requirements.

5.0 Management Responsibility

Management Responsibility
5.4.1 Quality Objectives
 Quality Objectives must also address
regulatory requirements.
 Quality Objectives must be measurable – should show
performance over time using methods defined in an
Analysis of Data procedure.
 Quality Objectives must be consistent with the Quality
Policy – should focus on product and regulatory
requirements and effectiveness of the quality system.

Management Responsibility
5.6 Management Review
 A Management Review procedure is required
(already an FDA requirement)
 Management Review inputs now include complaint
handling and regulatory reporting
(in addition to feedback)
 Be sure to review quality objectives each time; review
quality policy at least annually

6.0 Resource Management

Resource Management
6.2 Human Resources
 Organization must now document the process for
establishing competency, providing needed training, and
establishing employee awareness.
(already an FDA requirement)
 Recommend a general procedure supported by individual
work instructions addressing competency, training,
and awareness.

Resource Management
6.2 Human Resources
 Competency requirements are education, skills, and
experience – usually documented in job descriptions
 Training needs should address new employee orientation,
safety training, procedural training, job skill training,
external certifications
 Employee awareness training should help employees
understand the impact of their work upon the doctors
and patients who use the company’s products

Resource Management
6.3 Infrastructure
 Requirements for facilities, equipment, and support
services must be documented
 These requirements must include provisions to prevent
mixing of product and assure proper handling
 PM requirements to be documented for production
equipment, environmental controls, and monitoring or
measuring equipment

Resource Management
6.4 Work Environment
 Requirements for the production environment
must be documented
 For sterile medical devices, the organization shall
document requirements for control of contamination
with microorganisms or particulate matter, and maintain
the required cleanliness during assembly or
packaging processes

7.0 Product Realization

Product Realization
7.2 Customer-Related Processes
 Customer requirements now include applicable
regulatory requirements; organizations must
communicate with regulatory authorities in accordance
with applicable regulatory requirements
 Customer requirements now include user training
requirements. The organization shall identify what
training is required to assure that physicians and patients
can use a device in a safe and effective manner; such
training must be made available to the device users

Product Realization
7.3 Design and Development V&V
 Design verification and validation protocols/reports must
state the methods used, acceptance criteria, and
statistical rationale for sample sizes
 Design validation must be performed using representative
product, such as initial production runs
 Rationale for the product used must be documented in
the validation report

Product Realization
7.3 Design and Development V&V
 If a device must interface or be connected to another
device during use, the device must interface or be
connected during design verification and
validation activities
 In the above instance, the validation criteria must verify
the device meets the requirements for its intended use
when so connected or interfaced

Product Realization
7.3.8 Design and Development Transfer
 A procedure is required for the transfer of a design
project to production
 The procedure must require that design V&V activities
have been complete and production processes have been
validated prior to production transfer

Product Realization
7.3.9 Design and Development Changes
 A procedure is required for the design change process
 The procedure must require that design changes identify
the impact of potential changes upon the function,
performance, usability, and safety of the device, plus the
impact upon applicable regulatory requirements

Product Realization
7.3.10 Design and Development Files
 A file is required for each device or device family
 The file must include or reference all records that were
used to verify compliance to device requirements and to
verify any design changes

Product Realization
7.4. Purchasing – Change Notification
 Purchasing information must include a written agreement
that the supplier will notify the customer prior to
implementing any changes that could impact the ability
of the product to meet requirements
 When the customer becomes aware of any changes to
purchased product, the impact of the changes upon the
production process or product must be evaluated

Product Realization
7.4 Purchasing - Supplier Evaluation
 Criteria must be established for supplier evaluation and
selection that is based upon supplier performance and is
proportionate to the associated risk
 Supplier performance must be monitored; the results
used during supplier re-evaluation; and records must be
maintained of evaluation, selection, monitoring and re-
evaluation (supplier scorecards)

Product Realization
7.4 Purchasing
 The extent of verification activities shall be based upon
supplier evaluation results and be proportionate to the
associated risk

Product Realization
7.5.4 Servicing
 Servicing has been added to 8.4 Analysis of Data
 Service records must be analyzed to determine if the
underlying service issue constitutes a complaint
 Service records must be analyzed to determine if the
underlying service issue requires a formal
corrective action

Product Realization
7.5.6 Process Validation
 Production controls must include qualification of
infrastructure (Equipment Qualification)
 Processes must be validated if the resulting output
cannot OR IS NOT verified
 The FDA requires validation unless the output
is 100% verified

Product Realization
7.5.6 Process Validation
 Validation procedures must utilize statistical methods and
provide rationale for sample sizes
 Validation of production software shall be proportionate
to the risk posed by the software
 Software must be revalidated following any changes
 Requirements to validate sterilization processes has been
expanded to include sterile barrier systems

Product Realization
7.5.11 Preservation of Product
 Packaging and shipping containers must be designed and
constructed in a manner that will protect the product
from alteration, contamination or damage when exposed
to expected conditions or hazards
 Requirements for special conditions must be documented
if packaging alone cannot preserve the product
 Special conditions must be controlled and
records maintained

Product Realization
7.6 Monitoring and Measuring Equipment
 Calibration activities are to be performed using
documented procedures or work instructions
 Any adjustments to equipment must be documented
 Software used during inspection or testing must be
validated in proportion to the risk presented
 Validation requirements must be documented in a
procedure; Validation records must be maintained

8.0 Measurement, Analysis, Improvement

Measurement, Analysis and Improvement
8.2.1 Feedback
 The methods used to gather and use feedback must be
documented in a procedure or work instruction.
 Feedback must be obtained from both production and
post-production activities.
 Information gained from feedback should be used as an
input to the risk management process.

8.2.2 Complaint Handling
 A procedure is required to define requirements for the
documentation, investigation, and reporting of
complaints and handling the related product
 If a complaint is not investigated, justification
must be documented
 Resulting CAPA activities must be documented

8.2.4 Internal Audit
 Internal audit criteria must include compliance to
applicable regulatory requirements
 Internal audit reports must identify the areas and
processes being audited, and conclusions reached
by the auditors

8.2.6 Monitoring and Measurement of Product
 Inspection records must identify the inspection
equipment used to perform measurement activities

8.4 Analysis of Data
 The procedure for analysis of data must define
appropriate methods for analysis, including statistical
techniques and the extent of their use.
 Analysis must be performed on data from feedback,
product conformity, process trends, supplier
performance, audit results and service reports.

8.5 Improvement
 The organization shall identify and implement any
changes necessary to maintain effectiveness of the
quality system as well as medical device safety and
performance through the use of the quality policy, quality
objectives, audit results, post-market surveillance,
analysis of data, corrective actions, preventive actions,
and management review.

Plan, Do, Check, Act
PLAN the quality system upgrade
 Perform a gap analysis to identify what new requirements
are satisfied by the current quality system.
 Assign resources and timelines for creating new
procedures, work instructions, or forms.
 Identify subject matter experts who can advise on the
correct interpretation of the new requirements.

DO - Implement the new QMS requirements
 Train personnel to understand the new requirements and
utilize the new documentation
 Implement methods and tools for monitoring
performance of the new processes
 Establish quality objectives for the new processes
 Incorporate the new requirements into the
internal audit process

CHECK – verify implementation and compliance
 Utilize techniques such as line-side-review or layered
audits to assure effectiveness of the
implementation process
 Verify compliance via the internal audit process
 Monitor process performance using appropriate
statistical methods

ACT – Continuous Improvement
 Management monitors compliance to new requirements
during management review and takes action when
milestones or quality objectives are not being met
 Corrective actions are taken when audit findings identify
the new requirements are not being met

Future Changes
MDSAP

Future State
MDSAP
 Medical Device Single Audit Program addresses
requirements of 21CFR part 820, Canadian MDR,
ANVISA(Brazil), Australia, and Japan MHLW
 ISO 13485:2016 audits for MDSAP participants will
include applicable QMS regulatory requirements from
participating countries

Any questions?

How to Implement ISO 13485 Updates

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to How to Implement ISO 13485 Updates (20)

More from April Bright (20)

Recently uploaded (20)

How to Implement ISO 13485 Updates