The ISO 13485:2016 update will have a significant impact. Here's what medical device manufacturers need to know.

Bart Reitter

In March, the International Organization for Standardization (ISO) overhauled the longstanding ISO 13485 global standard for medical device quality management systems. Device manufacturers are now assessing the ins and outs of the overhaul, ISO 13485:2016, and comparing and contrasting it to ISO 13485:2003. Manufacturers will need to make provisions to update their respective systems over the next three years to adhere to the new standard.

Why did ISO update the standard? As the medical device industry continues to grow vigorously around the world, novel technologies emerge that challenge the status quo and supply chains become longer and more complex. Global regulators, therefore, have sharpened their focus on the safety and efficacy of medical devices.

Since many regulatory bodies integrate ISO 13485 into their schemas, the impact of the updated standard is profound. It reflects the transformation of the industry, and it expands beyond just the design and manufacture of devices. The updated standard provides greater emphasis on risk management and quality throughout the supply chain and over the complete product lifecycle, including post-market surveillance and product disposal. Now organized into five major categories, the details of ISO 13485:2016 reflect the changing nature of the medical device sector in the areas of:

The broader reach of the new standard can be felt in its introduction, which indicates it can be used by "an organization involved in one or more stages of the life-cycle of a medical device including design and development, production, storage and distribution, installation, servicing and final decommissioning and disposal of medical devices, and design and development, or provision of associated activities (e.g., technical support)."

Device manufacturers, service providers, and supply chain partners are assessing their quality management systems with the aim of adapting them to the dynamic global environment and easing regulators' concerns about device quality and performance. Let's explore some of the modifications contained in ISO 13485:2016, and the implications they pose for medical device manufacturers.

The New Provisions of ISO 13485:2016

Regulatory

Industry experts and regulators alike contributed to the updated standard with the intention of achieving greater harmonization of QMS solutions around the world and across different jurisdictions. Many nations already utilize ISO 13485, while others have modified their regulations to align with it. Greater harmonization aims to ultimately achieve a Medical Device Single Audit Program, currently being piloted by the International Medical Device Regulators Forum (IMDRF), which would allow companies to conduct a single regulatory audit of its QMS that satisfies the requirements of multiple geographies. This would ease the burden on manufacturers to satisfy multiple regulatory authorities with individual audits.

ISO 13485:2003 required a medical device manufacturer to establish a QMS that complied with the standard. ISO 13485:2016, without naming specific jurisdictions, stipulates that an organization must identify its role as it relates to the regulatory requirement, identify the regulations that apply to its activities, and incorporate those regulations into its QMS. In addition, companies must demonstrate the effectiveness of their QMS and utilize a risk-based approach to determine its impact on product safety and performance. The application of risk also now applies across the product life cycle rather than just during the design phase.

Computer Systems Validation

Another change to the standard deals with the applicability of computer systems validation. While the 2003 version of ISO 13485 specified the validation of software for "production and service provision," the new standard specifically calls out the requirement for software used as part of the QMS. This extends the standard's reach beyond the production and service environment into the quality arena, which may present challenges to some organizations. In addition, ISO 13485:2016 now adds the application of risk to the validation process, and mandates validation and revalidation be "proportionate to the risk associated with the use of the software."

Supplier Management

Due to the new standard's broader reach, suppliers and outsourcing activities now receive far more scrutiny. ISO 13485:2016 places much greater emphasis on supplier selection criteria. The 2003 version required the establishment of supplier standards, but the updated standard focuses on the performance of the supplier and how that performance can ultimately affect the quality of the device. As with the rest of the standard, risk management is more broadly applied so supplier performance is also taken into consideration depending on the risk classification of the device and if the device is able to meet applicable regulatory requirements. There are also reevaluation criteria, as well as actions taken when requirements are not met.

Production Control

ISO 13485:2016 institutes a number of changes, with more detail than the previous standard, to provide greater control over device production. These changes concern cleanliness of the product, records of servicing activities, and software validation proportionate to the risk associated with the use of the software on product quality. Section 7.5.8 specifically calls out the requirement for Unique Device Identification (UDI), and includes a documented procedure for product identification and status during production.

The Benefits of ISO13485:2016

There are many benefits to adopting ISO 13485:2016 associated with the importance placed on medical device safety and performance. Regardless of where an individual medical device is in its current lifecycle, the new standard helps the manufacturer:

The impact of an effective QMS, and an organization's approach to quality, are frequently overlooked. Too often, quality is viewed as a burden. However, organizations that embrace quality often enjoy lower costs, fewer recalls, and overall productivity gains. Embracing quality helps achieve compliance, improves operations, and ultimately delivers a competitive advantage.

Conclusion

Now that ISO 13485:2016 is here, its new provisions can help ensure manufacturing and supply chain quality and integrity, mitigate risk, and navigate more stringent regulatory hurdles. Medical device manufacturers are well advised to take an in-depth look at the new standard and see how it can benefit them. They stand to gain operational and cost benefits, as well as the ability to ensure the quality of their product portfolios and the ultimate safety of the patients who use them.

Bart Reitter is the director of life sciences at Santa Barbara, Calif.-based manufacturing enterprise resource planning (ERP) software company QAD, Inc. (NASDAQ: QADA) He can be reached at [email protected].

[Image courtesy of STUART MILES/FREEDIGITALPHOTOS.NET]