Bill Beck
(Alabama) - ISO 9001, ISO 14001
The third edition of ISO 13485 has been published as the replacement for ISO 13485:2003. ISO 13485:2016, Medical devices — Quality management systems — Requirements for regulatory purposes, sets out the requirements for a quality management system specific to the medical devices industry. The new edition was issued to respond to the latest developments in quality management, technology, and regulatory requirements.
With the standard applicable to so many types of products, the revision was no easy task. A medical device is any product intended for use in the diagnosis, prevention, and treatment of medical conditions. They range from simple products like wound dressings to dentist chairs, cardiac pacers, life-support machines, and even in vitro diagnostic reagents.
Improvements
The new version of the standard includes improvements such as broadening its applicability to include all organizations involved in the life cycle of the product (from concept to end of life), greater alignment with regulatory requirements, and a greater focus on post-market surveillance, including complaint handling. There is also a greater emphasis on having the appropriate infrastructure, particularly for the production of sterile medical devices, and more focus on risk management.
Clause Changes
The eight clause structure of ISO 13485:2003 (which matches ISO 9001:2008) has been carried over to ISO 13485:2016. The new ISO 13485 standard did not adopt the High Level Structure of Annex SL used by other management system standards such as ISO 9001:2015 (quality), ISO 14001:2015 (environment), and ISO 27001:2003 (information security).
The key clause changes from ISO 13485:2003 to ISO 13485:2016 were:
1. The addition of clause 4.2.3 for “Medical device file”. The “Control of documents” was shifted to 4.2.4 and the “Control of records” moved to 4.2.5.
2. The title for clause 6.4 on “Work environment” has been expanded to include “Contamination control”.
3. Clause 7.3 on “Design and development” has added sub-clause 7.3.1a for “General”, 7.3.8 on “Design and development transfer”, and 7.3.10 on “Design and development files.” The other sub-clauses on Planning, Inputs, Outputs, Review, Verification, and Changes remain, but have been renumbered because of the additions.
4. The sub-clauses under 7.5.1, “Control of production and service provision”, have been elevated in the clause hierarchy, e.g., “Installation activities” at 7.5.1.2.2 is now 7.5.3. As a result, other sub-clauses have been renumbered, e.g., “Customer property” at 7.5.4 is now 7.5.10. A new sub-clause 7.5.7 has been added on “Particular requirements for validation of processes for sterilization and sterile barrier systems”.
5. New clauses 8.2.2 on “Complaints handling” and 8.2.3 on “Reporting to regulatory authorities” have been added. These additions shifted the old clause entries to new numbers, e.g., “Internal audit” is now 8.2.4.
6. Clause 8.3 on “Control of nonconforming product” has four new sub-clauses: 8.3.1 for “General”; 8.3.2 for “Actions in response to nonconforming product detected before delivery”; 8.3.3 for “Actions in response to nonconforming product detected after delivery”; and 8.3.4 for “Rework”.
Annex A and Annex B
Annex A of ISO 13485:2016 provides a comparison of the content between ISO 13495:2003 and ISO 13485:2016, while Annex B describes the correspondence between ISO 13485:2016 and ISO 9001:2015.
Requirements Applicability
The processes required by ISO 13485:2016 that are applicable to the organization, but are not performed by the organization, are the responsibility of the organization and are accounted for in the organization’s quality management system (QMS) by monitoring, maintaining, and controlling the processes.
If applicable regulatory requirements permit exclusions of design and development controls, this can be used as a justification for their exclusion from the QMS. These regulatory requirements can provide alternative approaches that are to be addressed in the QMS. It is the responsibility of the organization to ensure that claims of conformity to ISO 13485:2016 reflect any exclusion of design and development controls.
If any requirement in Clause 6 (Resource management), 7 (Product realization), or 8 (Measurement, analysis, and improvement) of ISO 13485:2016 is not applicable due to the activities undertaken by the organization, or the nature of the medical device for which the QMS is applied, the organization does not need to include such a requirement in its QMS. For any clause that is determined to be not applicable, the organization must record the justification as described in 4.2.2 (Quality manual).
Transition Timing
During the transition period, ISO 13485:2016 will co-exist with ISO 13485:2003. Due to the requirement changes, users will have three years in which to update their quality management systems to meet the requirements of ISO 13485:2016. It is recommended that the users of ISO 13485:2003 work with their certification bodies or registrars to schedule an upgrade audit at a convenient time within the transition period.
