By David DelCollo, Attorney
It has been 13 years since the last set of requirements and guidelines was released, but this year, the ISO will be launching ISO 13485:2016. This new release will have a substantial impact on the design, development, production, installation, and delivery of medical devices and related services,-but what exactly will the introduction of these new regulations mean to your organization?
The primary requirements and guidelines for medical device designers and manufacturers are established by the International Organization for Standardization (ISO), which is an independent, non-governmental international organization with a membership of 162 national standard bodies, including North America and Europe. The main objective of the ISO, as stated by the organization, is “to facilitate harmonized medical device regulatory requirements for quality management systems,” which is done through bringing experts together to share knowledge and develop voluntary, consensus-based, market relevant International Standards that support innovation and provide solutions to global challenges. To date, the ISO has published more than 19,000 International Standards and related documents, covering virtually all sectors of modern industry including technology, food safety, agriculture, and automotive. But perhaps the most complex and convoluted ISO regulations prevail in the area of medical devices, ISO 13485.
ISO 13485 provides the requirements for a quality management system in the production and manufacturing of medical devices and related services. These requirements are generally used by suppliers or other external parties providing products or services to medical device manufacturers. By utilizing ISO 13485, companies are able to demonstrate compliance with regulatory requirements, manage risk, ensure best practice for quality and safety, improve overall processes, and provide confidence to patients. Until recently, the medical device industry has relied on a version of ISO requirements that were published in 2003. However, this year the ISO has introduced a new set of regulatory requirements and guidelines with the publication of ISO 13485:2016.
The new publication of ISO 13485:2016 was completed after four years of comprehensive work, comprised of industry experts from around the world. The main purpose of this new publication was to bring the standard up-to-date with all of the international regulatory changes that have occurred since the last revised publication in 2003. Presently, it is no longer enough to merely comply with FDA requirements. In today’s global medical device industry companies must address the demands of regulators from countries all around the world. In 2012, the European version of the standard, EN ISO 13485, attempted to merge the EU medical device directives to the ISO quality standard. With the introduction of the new ISO standards, however, the ISO has incorporated the requirements that were previously part of other international regulations.
Another objective of the industry experts that provided for these changes this time around was to make the standard more applicable to the entire supply chain in the medical device industry. While the previous version from 2003 was mainly tailored to device manufacturers, the new provisions aim to be relevant to suppliers of components and services as well, providing for a much greater uniformity throughout the industry. The new version also provides for exclusions in sections 6 and 8, in addition to section 7 of the standard, if they are not applicable to the activities undertaken by the organization or to the nature of the medical device for which the quality management system is applied.
The ISO revisions for 2016 also places a great emphasis on risk management and this is primarily due to the increased oversight by notified bodies and international regulatory authorities. While the previous ISO standards focused on risk management within the realm of design controls, the revised regulations take a risk-based view on the entire quality system as a whole.
Finally, the revisions also seek to address the entire life-cycle of a device, which is truly an innovative approach. Previously, the ISO placed a great deal of attention on the quality process of a device up to and until the device was placed in the hands of the consumer, but it was at this point that the oversight of the quality process would cease. This all changed, however, with the 2009 Poly Implant Prothèse (PIP) breast implant scandal which resulted in international regulatory scrutiny around product safety. The ISO revisions in 2016 now ensure that the quality standard covers the entire product lifecycle, cradle-to-grave.
Overall, the ISO 13485:2016 is a much more comprehensive set of regulatory requirements that should set out to provide for much more consistent and safe medical devices. And while these regulations may require some compliance hurdles for some companies, it will ultimately result in a better product and a safer world.
The most notable changes to ISO 13485 include:
- Alignment of global regulatory requirements
- Inclusion of risk management and risk-based decision making throughout the quality management system
- Additional requirements and clarity with regard to validation, verification, and design activities
- Strengthening of supplier control processes
- Increased focus regarding feedback mechanisms
- More explicit requirements for software validation for different applications
About the Author:
David DelCollo is a prominent attorney with more than a decade of experience in healthcare and contract law. DelCollo currently works for a large pharmaceutical firm with a substantial presence in the Philadelphia area. His peers know him as a diligent, meticulous lawyer who manages to balance a penchant for detail with a keen ability to see the big picture and cut to the heart of messy matters.