Changing Times - Diversify to ISO 13485

With many of the challenges and changes being faced in the market at time of writing (though indeed when is the market not changing?) there is the increasing potential, and perhaps even pressure, for SMEs to diversify their operations.

Appealing to new customers and different markets can offer an advantage in times of uncertainty; where one market drops others may remain stable or even grow, thereby granting some mitigation against losses felt. Otherwise, diversifying offers new opportunities that may benefit any organization. There are no guarantees in the business world, but you have to be in it to win it.

The medical device industry represents an interesting opportunity; one way or another, the industry will always be there. However, though demand for suppliers in the medical device industry may grow, so does the amount of scrutiny they face. For this reason, to help enter the market, building on an existing QMS to become certified to ISO 13485:2016 may be of benefit to a number of different organizations.

Medical device manufacturers

Most medical device regulations, particularly those in the EU and UK, base the level of control of medical device manufacturers on the risk category of the devices they produce. The lowest risk devices (which also do not have a measuring function or require sterilization) can often be self-certified. However, the requirements of the regulations must still be implemented, including the implementation of a suitable QMS to ensure these requirements are understood and achieved. 

Since product quality and patient safety are essential in the medical industry, ISO 13485 helps meet medical device standards throughout the product development lifecycle. It provides requirements for a quality management system for medical devices, and as these standards have been agreed upon internationally, quality management systems developed to meet the requirements of ISO 13485 will contribute to meeting regulatory requirements.

This medical device standard is the most widely used in the industry for quality management. Though it is not mandatory. ISO 13485 creates a framework for a quality management system, and its processes should meet the majority of legal and regulatory requirements. There are some minor regulatory requirements not directly addressed by the standard; predominantly on unique device identification, labelling and post market surveillance processes. However, the standard does include an annex that compares the EU regulations to the standard to highlight these so they can be addressed.

Beyond meeting legal requirements, ISO 13485 certification improves quality processes and demonstrates that there is a sound system in place for meeting both customer and legislative needs. Many medical device customers will want to see that there is an external body verifying that there is a QMS in place and that it is adequate for the device being manufactured.

If the device is self-certified, there is no notified body or regulatory authority providing direct oversight and so having an accredited organization conducting audits and providing certification of these manufacturers can give customers confidence.

Medical device distributors

In a similar vein to manufacturers, there are regulatory requirements that medical device distributors need to meet. For example, in the EU the distributor needs to ensure devices have been CE marked, declarations of conformity have been drawn up and labelling and identification is all accurate. You may also need an authorized representative allocated. Further, similar to low risk device manufacturers, notified body involvement is not always required, so oversight may be limited.

Achieving ISO 13485 certification may help you demonstrate to customers that you have a QMS that is independently verified as effective. Important processes and requirements like traceability, feedback management, supplier evaluation and infrastructure maintenance.

Part suppliers and service providers

Due to recent scandals in the medical device industry, the amount of requirements placed on medical device manufacturers by regulators has increased in particular ways, such as adoption of unannounced auditing and adjustment of risk classification of devices. In many cases, notified bodies and regulators require that manufacturers have an increased level of scrutiny of their suppliers and external service providers. ISO 13485 can help to demonstrate to manufacturers that a potential supplier can meet their requirements.

These requirements specifically include increased need for traceability, identification, risk assessment, cleanliness, documentation of procedures and their own supplier evaluation processes. This may sound familiar to organizations with AS9100 or IATF 16949 when they compare to ISO 9001; these standards have similar higher-level quality requirements to so organizations with them are already well set up to meet the requirements of ISO 13485.

With the aero industry in a slump due to COVID and uncertainty in the automotive industry in some places (such as the UK) there may be good opportunities to diversify by offering parts and services to the medical device industry.

This doesn’t mean that organizations with ISO 9001 alone or even without an existing QMS can’t achieve ISO 13485 certification; more work may be needed but a lot of the principles discussed are simply extensions of existing processes and concepts.

Authored by: Tam Rowell, NQA UK Regional Assessor