The crucial journey from ISO 9001 to ISO 13485 – and why…

Jacob Tyson, one of IMed’s Medical Writers, explains why ISO 13485 is key to medical device manufacturers QMS

More and more manufacturers are contacting IMed to determine if their product is now classified as a medical device and when they find out that it is, they have to quickly familiarise themselves with the regulatory requirements that their Quality Management System (QMS) must be compliant to. Our consultants are well versed in explaining, training, and supporting these clients with a complete regulatory strategy and because of their personal experience of working in the medical device industry, they do so with a firm focus on the commercial and practical issues that can arise when making and documenting these changes.

The new regulatory framework is challenging to all medical device manufacturers, particularly those with the lowest risk classification, e.g. Class I or General IVD, who are required to self-certify.

It is even more challenging if the manufacturer’s existing QMS is configured to ISO 9001 (quality management systems (2015)), because ISO 9001 isn’t designed for medical device manufacture and is completely unsuitable. This is why ISO 13485 (quality management systems concerned with medical devices (2016)), is widely acknowledged as an essential foundation when demonstrating compliance of medical device manufacturing QMS, to the regulations; it is ‘state of the art’.

Differentiating between ISO 13485 and ISO 9001 can be quite confusing. Both standards are intended for use as guidelines for manufacturers to ensure that the products produced are of the highest standard. This article aims to outline the similarities and where the two ISOs deviate, to demonstrate why ISO 13485 is so critical in complying with the required regulations required to achieve a CE Mark for your device.

So what’s the difference?

The big difference between ISO 13485 and ISO 9001 originates from the type of industry that the standards are tailored to, with ISO 9001 covering a much broader set of specifications intended for use by any organisation that produces a product or service. Production quality elements are still present in ISO 13485, of course – but the medical device standards go much further and include additional guidelines due to the fundamental issue of interaction of the products with patients and healthcare professionals. ISO 13485 places a much greater emphasis on the regulatory elements of ensuring a product’s quality and safety.

Let’s examine the specifics

Similarities between ISO 13485 and ISO 9001:

• The aim of both ISO standards is to be used in the creation of a quality management system.
• Emphasis on recognition and incorporation of risks in the products design and production stage.
• The use of a PDCA approach (Plan-Do-Check-Act) is recommended.
• Emphasis on the assurance that products meet customer requirements.
• Focus on the infrastructure of the quality management system, ensuring manufacturers maintain effective measures for Employee Competency, Defining Employee Roles in the Organisations Structure, Document Control, Audits, and Corrective Action.

The differences between ISO 13485 and ISO 9001:

• ISO 13485 contains additional information in regard to the quality management system (QMS) specifications it sets out for medical device manufacturers, meaning that much more documentation is required to be eligible for a CE mark or other certifications. The type of documentation included within this are:
  • Regulatory and system documentation
  • Product specifications
  • QMS approval records
  • Specific QMS requirement definitions for a device
  • Standards for data retention based on a products lifetime and regulatory requirements
• Unlike ISO 9001 whereby responsibilities within the QMS were not attributed to individuals, the ISO 13845 requires the identification of an individual that is responsible for different parts of the QMS. As well as this, the management team must show compliance to the new cGMP standards. Emphasis on management responsibility for quality policy, QMS reviews, QMS compliance verification, and regulatory updates are also part of the ISO 13485 standard.
• Despite both ISO 9001 and ISO 13485 placing a big focus on customer expectations, ISO 13485 provides more specifications as to how product quality can be used to reach this customer satisfaction outcome. These standards regard the products production and supply chain, and involve product traceability, standard operating procedures, cleanliness, installation/verification records, and record maintenance and updating.
• ISO 13485 no longer requires medical device manufacturers to show continuous improvement with regard to their products like ISO 9001 requires. Instead ISO 13485 gives broader definition to the activities a manufacturer can classify as ‘for device improvement’. Standards have been added that require manufacturers to:
  • Develop a feedback system to recognise and review device non conformances
  • Monitor and verify device quality throughout the production line and prior to product release/deliverance
  • Provide documentation should non-conformance products be revised, reworked, and released
  • Have standard procedures for the collection, analysis and retention of data concerning device quality
  • Have standard procedures to respond to advisory notices/complaints that do not require CAPA/adverse eventsI hope that this offers a much better understanding of the motivation for, and the reasons why, regulatory professionals use ISO 13485 to underpin their regulatory strategies for manufacturers. The notified body BSI recently published a document mapping each clause against the MDR and IVDR to demonstrate its relevance to the regulations, which new manufacturers or Quality Managers may find useful. I have referenced this as the top hyperlink at the foot of the article.

So this is why, for medical device manufacturers, ISO 13485 is the state-of-the-art medical device quality standard, which they must use as the benchmark for their quality system, to ensure compliance. It’s also why we regulatory professionals bang on about it so much! If you don’t work to ISO 13485, you are unlikely to meet your regulatory obligations as a medical device manufacturer and to obtain your CE Mark – it’s that simple.

Don’t panic though – help is just a click or a call away. IMed’s team can help you plan and fulfil a regulatory strategy for your device and answer any questions you may have. Just get in touch with us by phone on 01295 724286 or email us at hello@imedconsultancy.com.