Why ISO 13485:2016 Certification Matters for Medical Device Manufacturers?

A device with a high level of technical advancement, clinical usefulness, and commercial potential may well be unable to find market acceptance if its quality system is unable to demonstrate that it meets the requirements for safety, performance, traceability, and regulatory control.

ISO 13485 is not a general quality management standard; it was developed for organizations involved in the medical-device life cycle and offers a structured approach to controlling processes related to design, production, storage, distribution, installation, servicing, and other pertinent activities. ISO states that the 2016 edition is the current version following the most recent review.

For manufacturers who are planning to obtain regulatory approval, improve their quality systems, or enter international markets, certification to ISO 13485 for medical devices can thus be an important component of their compliance strategy.

What Is ISO 13485:2016 Certification?

ISO 13485:2016 is an international standard that specifies the requirements for a Quality Management System (QMS) for medical devices.

It is intended for organisations involved in activities such as:

• Medical device design and development
• Manufacturing
• Installation
• Servicing
• Storage and distribution
• Supplier and outsourced-process management
• Other activities connected with the medical-device life cycle

The standard relates to maintaining the processes in such a way that medical devices meet the requirements of the customer and regulator; ISO claims that the standard gives more weight to risk management, regulatory requirements, and controls at all levels of the supply chain.

ISO 13485:2016 Certification vs ISO 9001

It is a common mistake to think that ISO 9001 certification means that all the requirements of a medical-device quality management system will be met.

This is wrong since ISO 9001 is a universal quality management system, while ISO 13485 certification takes into account specific requirements related to the regulatory and safety issues of medical devices. The following special attention is given to ISO 13485: regulatory compliance, risk management, process validation, and controls related to the medical device industry.

Why is Certification to ISO 13485:2016 Important?

For medical-device producers, quality should not only consist of checking the final product, since quality should be controlled throughout the whole life cycle of the product.

An effective ISO 13485 system helps manufacturers to establish controlled and documented processes for:

• Product and process quality
• Risk management
• Design and development
• Purchasing and supplier controls
• Production activities
• Traceability
• Validation
• Complaint handling
• Corrective and preventive actions
• Documentation and records
• Post-market activities

As per ISO, the standard enables companies to establish systematic approaches to design, development, manufacturing, and distribution, and also helps in risk management and regulatory compliance.

What is the Link with the Regulations Regarding ISO 13485:2016 Certification in India?

When companies in India are applying for ISO 13485:2016 Certification, they should understand the distinction between an ISO certificate and a license to manufacture in the regulatory framework of India’s medical device industry.

In India, the regulation of medical devices is done according to the Medical Devices Rules, 2017 (MDR 2017), and is governed by the Central Drugs Standard Control Organization (CDSCO), which is an organization under the purview of the Ministry of Health & Family Welfare, Government of India. The Medical Devices Rules, along with any amendments made to it, can be accessed from the CDSCO website.

The quality management system requirements of medical device and IVD manufacturers set out in Schedule V of MDR 2017 include various areas such as design and development, manufacturing, packaging, labelling, testing, installation and after-sales servicing. The schedule also covers cases where some of the activities are carried out by third parties or are not carried out directly by the manufacturer.

Manufacturers should not view ISO 13485:2016 Certification for Medical Devices as a replacement for the relevant CDSCO licensing or other regulatory approvals.

It should rather be viewed as a key component of the overall regulatory compliance framework.

What Are the Essential Requirements of ISO 13485:2016?

An organisation, if it wishes to obtain certification, must set up a quality management system which is suitable to its activities in the field of medical devices.

Important areas include:

• Quality Management System
• Management Responsibility
• Resource Management
• Product Realisation
• Risk Management
• Measurement, Analysis and Improvement

What is ISO 13485:2016 Certification?

The area in question extends beyond that of traditional manufacturers; any organisation which participates in one or more of the stages of the medical device life cycle can benefit from ISO 13485. 

According to BIS’s official frequently asked questions page, organisations engaged in design and development, production, storage and distribution, installation or servicing are eligible for ISO 13485 certification.

This can include:

• Medical-device manufacturers
• Contract manufacturers
• Medical-device designers
• Component suppliers
• Installation and servicing organisations
• Distributors and other relevant supply-chain organisations
• Organisations providing associated services

The scope should be determined based on the organisation’s activities and the relevant regulatory requirements.

Key Benefits of ISO 13485:2016 Certification for Medical Devices

• Better Regulatory Readiness
• Stronger Risk Management
• Improved Product Consistency
• Greater Customer Confidence
• Better Market Access
• Improved Supplier Control

What Documentation is Needed in Order to Obtain ISO 13485:2016 Certification?

The degree to which documentation is carried out will vary according to the organisation’s scope, products, and processes; typical documents and records may be:

• Quality Manual
• Responsibilities and authorities
• Medical device file
• Procedure for document control
• Procedure for design and development
• Procedure for validation

The documentation must show what the organisation actually does, rather than being produced just for the sake of certification.

ISO 13485:2016 Certification Process: Step-by-Step

Getting certified means undergoing a structured evaluation of the organisation’s quality management system.

Step 1: Prepare the Quality Manual

Draw up a Quality Manual that should specify the scope, structure, procedures, and basic framework of the Medical Device Quality Management System (QMS).

Step 2: Define Roles and Authorities

Make a record of the roles, responsibilities, functions, and authorities of the personnel participating in the implementation and management of the QMS.

Step 3: Prepare the Medical Device File

Prepare and maintain a Medical Device File with details regarding the medical device, such as its characteristics, specifications, the methods used in its manufacturing, and the relevant quality records.

Step 4: Establish Document Control Procedure

Prepare a documented Document Control Procedure, which should include the preparation, review, approval, updating, distribution, and control of QMS documents and records.

Step 5: Establish Design & Development Procedure

Prepare a systematic Design and Development Procedure that should include aspects relating to design and development planning, the inputs and outputs, design reviews, verification, validation, changes, and the maintenance of the relevant records.

Step 6: Establish Validation Procedure

Set up suitable validation procedures for the relevant processes, methods, and activities to make sure that they always achieve the results that were intended and specified.

How long does it take to get ISO 13485:2016 certification?

There is no single fixed timeline that can be applied to all organisations. The timeframe may depend on:

• Organisation size
• Number of employees
• Number of locations
• Product complexity
• QMS maturity
• Existing documentation
• Certification scope
• Design and development activities
• Regulatory requirements
• Audit findings
• Speed of corrective actions

About certification through the BIS management system, the BIS states that the average time taken to issue a licence is generally between 6 and 14 months from the date on which a complete application is received, on the condition that the appropriate process is followed and satisfactory audits are carried out.

A realistic timeline should only be established after the organisation’s present compliance status has been reviewed.

What Difficulties do Manufacturers Usually Encounter?

Medical-device manufacturers often encounter challenges such as:

• Understanding applicable ISO requirements
• Preparing suitable QMS documentation
• Establishing effective risk-management processes
• Maintaining complete records
• Controlling suppliers and outsourced activities
• Implementing document and change controls
• Conducting effective internal audits
• Handling complaints and CAPA properly
• Aligning QMS requirements with Indian regulatory requirements
• Preparing employees for certification audits

Failure to implement the QMS while merely buying documents or acquiring a certificate can result in serious compliance weaknesses.

What makes UMSPCS the choice for ISO 13485:2016 certification?

Preparing for medical-device certification can include more than just the preparation of a series of documents; the quality management system has to be suitable for your real products, processes, and regulatory responsibilities.

Having more than 6 years of experience and having supported over 600 product compliance requirements, UMSPCS is dedicated to helping businesses to understand and put into practice regulatory and quality-system requirements.

UMSPCS can assist businesses with:

• Initial compliance assessment
• ISO 13485:2016 requirement mapping
• QMS documentation support
• Procedure and format preparation
• Risk-management documentation support
• Implementation guidance
• Internal audit preparation
• Certification audit preparation
• Nonconformity/CAPA support
• Coordination and certification-process guidance

Conclusion

For those who make medical devices, quality management can be ultimately tied to patient safety, consistency of the product, and the confidence of the regulators.

The framework provided by ISO 13485:2016 certification can be applied to the management of these responsibilities at every stage of the medical device life cycle; it helps improve regulatory readiness, supports internal controls, and shows a commitment to consistent quality.

It should be regarded as a working management system, not just as a certificate to display.

Should you intend to obtain ISO 13485:2016 certification in India or require assistance in understanding the quality management system requirements that apply to your medical device business, we will be able to provide you with help.

What if you need some professional advice and guidance in this area?

Then contact us at UMSPCS right away.

Read more also: Do Scanners Need BIS CRS Certification in India IS 13252

FAQs

1. Should all the Indian manufacturers of medical equipment possess the ISO 13485:2016 certificate?

The answer is dependent on the concrete regulatory scheme, nature of products, and production process, since the ISO 13485 certificate is a third-party certification itself, but the particular requirements of CDSCO should also be taken into account separately.

2. Why should one obtain an ISO 13485:2016 certificate for his medical equipment?

This is a third-party certificate certifying that the quality management system of the company’s medical equipment has been certified according to the ISO 13485:2016 standard.

3. What is the time taken to obtain ISO 13485 certification?

There is no single timeline that can be applied in all cases, since the timeline varies according to the size of the company, the extent of its operations, the quality management system it already possesses, the amount of its documentation, the implementation process, and the degree of readiness it has for audit.

4. What documents are needed to obtain ISO 13485 certification?

The documents that are included in QMS documentation include the QMS document, Quality Policy document, process documentation, Risk Management documentation, supplier control documentation, Training Control documentation, Internal Audit documentation, Management Review documentation, and all other documents needed with regard to the regulations.

5. Is there any difference between ISO 13485 and ISO 9001?

ISO 13485 is designed specifically for managing the quality of medical devices and concentrates heavily on regulations and product requirements.

6. Does ISO issue an ISO 13485 certificate?

The standard is developed by ISO, but it is up to independent certification bodies to carry out the certification audits, rather than the organisation itself.