Presentation at Lancashire SME workshop - regulation and medical device workshop, at Tickled Trout, Preston on Thursday 21 March 2019.

1. Quality Management System and
Regulatory Workshop
21st March 2019

2. Agenda – Regulatory Affairs
• Medical Devices
• EU Medical Device Regulation
• Device Classification
• General Requirements
• Consensus Standards
• Clinical Evaluation
• Post Market Surveillance
• UDI
• Notified Bodies
• CE Mark
• Brexit
©2019 Patient Guard Ltd
Presenter – David Small

3. Medical
Devices
‘medical device’ means any instrument, apparatus, appliance, software, implant, reagent, material
or other article intended by the manufacturer to be used, alone or in combination, for human
beings for one or more of the following specific medical purposes:
— diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease,
— diagnosis, monitoring, treatment, alleviation of, or compensation for, an injury or disability,
— investigation, replacement or modification of the anatomy or of a physiological or pathological
process or state,
— providing information by means of in vitro examination of specimens derived from the human
body, including organ, blood and tissue donations,
and which does not achieve its principal intended action by pharmacological, immunological or
metabolic means, in or on the human body, but which may be assisted in its function by such
means. The following products shall also be deemed to be medical devices:
— devices for the control or support of conception;
— products specifically intended for the cleaning, disinfection or sterilisation of devices as referred
to in Article 1(4) and of those referred to in the first paragraph of this point.
MDR EU 2017/745 – Article 2(1)

4. EU Medical
Device
Regulation
• Three Medical Device Directive’s
• Came into force in 1993, last updated in 2007
• Now outdated with current technology
• Directives replaced with MDR and IVDR 2017
• Come into force in May 2020 for MDR and May
2022 for IVDR
• No ‘grandfathering’ all device’s new and old
must comply with new regulations

5. Device
Classification
• MDR
• Class I; Class I (Sterile); Class I (Measuring);
• Class IIa; Class IIb;
• Class III
• IVDR
• Class A
• Class B
• Class C
• Class D

6. Device Class
Examples
Class I – Wheelchairs
Class I (Sterile) – Sterile Bandages
Class I (Measuring) – Urine collection bottles
Class IIa – IV Administration Sets
Class IIb – Infusion Pumps
Class III – Pacemakers

7. New Devices
added to
scope
Products without an intended medical purpose
• Contact lenses or items to be introduced into
the eye
• Body Modification via surgically invasive means
• Dermal or mucous membrane fillers
• Liposuction, lipolysis or lipoplasty equipment

8. Borderline
Devices
Grey Area
Devices that could be considered as a Medicine or
incorporate medicinal products; if there is doubt
the medicines directive takes precedence.
Its usually best to get the MHRA to decide where
these devices fall under classification.

9. General
Requirements
• The General Requirements found in Annex I of
MDR
• These are the safety principles that medical
device manufacturers need to demonstrate
evidence against to show conformity
• The principles are broad to cover all types of
devices, so some may not be applicable to your
device
• Conformity is usually demonstrated though
applying consensus standards (ISO, EN, BS,
ANSI)

10. Commonly
used
Consensus
Standards
• ISO 13485 – Quality Management
• ISO 14971 – Risk Management
• ISO 62366 – Usability Engineering
• ISO 10993 – Biological Evaluation
• ISO 15223 – Symbols for labelling
• EN 62304 – Software Life Cycle
• ISO 60601 – Electrical Safety
• ISO 11607 – Packaging for terminally sterilized
medical devices

11. Risk
Management
ISO 14971
• Risk Management plays the most important
part of the Design, Manufacture and Post
Market activities
• This must be demonstrated through application
of risk management principles through out the
life cycle of the medical device
• Using ISO 14971 standard satisfies the
requirements of MDR

12. Verification
and Validation
• To demonstrate that your devices design inputs
meet the design outputs a manufacturer has to
perform verification and validation.
• There may be specific standards that apply to
your device to demonstrate verification and
validation testing
• If your device has electronics then ISO 60601
• If your device is supplied sterile then ISO 11607
may apply
• If your device is software or incorporates
software then EN 62304 may apply

13. Biological
Evaluation
ISO 10993 Series of Standards
• If your medical device has patient contact either
directly or indirectly a biological evaluation in
line with ISO 10993 will be required
• Chemical characterisation testing and Biological
testing maybe required depending on how
much toxicological evidence is already available

14. Clinical
Evaluation
• All medical devices require a Clinical Evaluation,
this must be reported inline with MEDDEV 2.7/1
Revision 4.
• This is a report that critically evaluates the
clinical information available for your device or
similar devices
• Clinical Trial (if required) information would be
included in this report.

15. Labelling
• Labelling must be included with all medical
devices
• It must contain recognised symbols in line with
ISO 15223-1
• It must contain the CE mark and designated
Notified Body Number (if relevant)
• Must contain any warnings or contraindications
identified from risk management activities

16. UDI (Unique
Device
Identifier)
• The Unique Device Identifier is a new addition
for MDR
• It is to allow for full traceability of medical
devices
• It is a barcoded format with details of the
device inputted onto a EU database by the
manufacturer
• First Part of the Code will identify the device
and manufacturer (Static) and the second part
of the code will identify the batch or serial
numbers (Dynamic)

17. ©2019 Patient Guard Ltd

18. Post Market
Surveillance
• Post Market Surveillance Plan
• Vigilance
• User feedback
• PMCF (Post Market Clinical Follow Up)
• PSUR (Periodic Safety Update Reports – Class IIa
upwards)

19. Technical File
• Device Description
• Labelling
• Design and Manufacturing
• General Requirements Checklist
• Risk Management
• Verification and Validation
• Biological Evaluation
• Clinical Evaluation
• Post Market Surveillance

20. Notified
Bodies
• Notified Bodies (NB) are registered with
Competent Authorities (MHRA) to issue CE
mark certificates to Medical Device
manufacturers, for Class I (measuring) Class I
(Sterile), Class IIa, Class IIb and Class III devices.
• Certificates are issued for 3 years with an
annual surveillance audit
• Notified Bodies also perform unannounced
audits (if the manufacturer does not let them
perform the audit they loose their certification)

21. CE Marking
• Manufacturers of Class I devices self-certify and
do not need a NB assessment of their technical
file to apply the CE mark to their devices. They
will need to register with a EU Competent
Authority
• Manufacturers of Class I M/S and Class II
upward devices need to have their CE mark
certificated by a NB. The CE mark will need to
be displayed on the device followed by the NBs
designated number

22. Brexit
• Draft legislation has been issued UK MDR 2002
(as amended by the UK MDR 2019)
• Regulation will be the same as MDR and IVDR
• Manufacturers outside of the UK who sell into
the UK will need to apply a CE mark equivalent
• Manufacturers outside of the UK will need a UK
Authorised Representative with a registered
address in the UK
• Manufacturers in the UK will need a EU
Authorised Representative with a registered
address in a member country
• There will be a transition period as per the
Brexit withdrawal agreement

23. No Deal Brexit
• All UK registered NB CE mark issued certificates
will become invalid from the 29th March 2019
• Currently only BSI can transfer their issued CE
marks over to their Netherlands registered
office

24. Agenda – Quality Assurance
©2019 Patient Guard Ltd
1. What is ISO 13485:2016?
2. Who is the standard relevant to?
3. Is the standard mandatory?
4. Link to MDR EU/2017/745
5. Benefits of implementing the system
6. ISO 9001:2015 v ISO 13485:2016
7. Mandatory documentation
8. Process approach & PDCA
9. Risk Management
10. Scope, exclusions and non-applicable clauses
11. Management commitment/Management Representative
12. Certification process
13. Getting started!
14. Patient Guard
Presenter – Clare Unsworth

25. What is ISO
13485:2016?
ISO 13485: 2016 is an internationally agreed standard that sets out the
requirements for a quality management system specific to the medical device
industry.
The standard is divided into the following sections:
1. Scope
2. Normative references
3. Terms and definitions
4. Quality management system (requirements)
5. Management Responsibility
6. Resource management
7. Product realization
8. Measurement, analysis and improvement
Clauses 4 – 8 are auditable

26. Who is the
standard
relevant to?
ISO 13485: specifies requirements for a quality management system where an
organization needs to demonstrate its ability to provide medical devices and
related services that consistently meet customer and applicable regulatory
requirements. (ISO)
Organisations for which the standard is relevant may be involved in one or more
stages of the life-cycle of the device, including the following:
- Design and development;
- Production;
- Storage and distribution;
- Installation;
- Servicing;
- Provision of technical support;
- Provision of components/raw materials for medical devices;
- Sterilisation services;
- Calibration/maintenance services;
- Quality management system services.

27. Is the
standard
mandatory?
The standard is not mandatory.
The decision to certify to the standard will be
based on the following:
- Customer requirements (tendering);
- Internal requirements – see also benefits of the
standard;
- Regulatory compliance (for legal manufacturers
of medical devices) – see link to MDR

28. Link to MDR
EU/2017/745
• The new MDR provides greater detail than the
MDD for the requirements of a quality
management system (Article 10)
• 13 requirements are listed
• All but one of them can be linked to a relevant
clause in ISO 13485:2016
• Exception – Strategy for regulatory compliance

29. Benefits of
implementing
the standard
• It is the most effective standard covering the
requirements of a QMS stated in the new MDR;
• Certification to ISO 13485:2016 provides confidence
to the Notified Body that systems are compliant
with MDR requirements;
• Enhanced reputation;
• Greater tendering success;
• Assurance for customers that the product and
service will be of the required standard;
• Effective control of processes/less waste;
• Enhanced customer satisfaction;
• Continual improvements.

30. ISO 9001:2015
V ISO 13485
ISO 9001:2015 is the most recognized standard for quality
management; however ISO 13485:2016 is the most suitable
standard for medical device organisations.
The main differences between 9001 and 13485 are:
- 9001 is not product specific (Several inclusions in the
13485 standard, specifically related to medical devices);
- Regulatory requirements are addressed in ISO
13485:2016;
- ISO 13485 mandatory documentation is more onerous
than 9001;
- 9001 requires the monitoring of customer
satisfaction/13485 demands that information is
monitored to ensure customer requirements are met;

31. Mandatory
Documentation
ISO 13485:2016 requires considerably more mandatory documentation than ISO 9001
Mandatory documentation includes the following:
- A medical device file;
- Quality manual;
- Quality Policy
- Quality objectives
- 23 procedure requirements
- Records and miscellaneous requirements
In addition to mandatory documentation, the organization must also maintain
documentation specific to the control of the organization’s processes and to comply with
relevant regulatory requirements.
The complexity of the documentation is relative to the process it refers to the controls
needed.
NB: Documentation is not mandatory if the company can justify an exclusion or non-
applicable process.

32. Process
Approach &
PDCA
The standard is based on a ‘process approach’ to quality management.
A ‘process’ can be defined as any activity that converts an ‘input’ to an ‘output’.
An output of one process often becomes an input of another process.
A process approach to quality management involves the management of the
interaction of processes to achieve the desired outcome.
There is a requirement in the standard to determine this interaction of
processes.
The ‘Plan, do, check, act’ system is also incorporated within the system.
Plan – procedures/work instructions/objectives
Do - performance
Check – audits/data analysis/measuring and monitoring/management review
Act – Improvements/new objectives/corrective actions

33. Risk
Management
Risk management is in fundamental concept of ISO
13485:2016 and is referenced numerous times within
the standard.
Section 4.1.2 states ‘The organization shall apply a
risk-based approach to the control of the appropriate
processes needed for the quality management system.
Previous revisions of the standard focused risk
management on product alone, but the 2016 standard
requires additional risk management of processes,
ensuring ‘risk-based’ decisions are applied throughout
product realization.

34. Scope,
Exclusions and
Non-Applicable
clauses
The scope of the Quality Management System must
be defined within the Quality Manual and
justifications stated for any exclusions or non-
applicable clauses.
When defining the scope, it is not permittable to
exclude or claim N/A for any activities that are part of
the product realization process.
Exclusions are limited to design and development
activities only.
Non-applicable clauses are limited to clauses 6,7, and
8 only

35. Management
Commitment/
Management
Rep
An effective system requires commitment from ‘Top’ management. (Clause 5.1)
The standard requires management to provide evidence of this commitment by:
- Communicating to the organization the importance of meeting customer and applicable
standards;
- Establishing the quality policy;
- Ensuring quality objectives are established;
- Conducting management reviews;
- Ensuring the availability of resources
Top management must also appoint a management representative for the QMS with the
following responsibilities:
- Ensuring processes needed for the QMS a documented;
- Reporting to top management on the effectiveness of the QMS and need for
improvement;
- Ensuring the promotion of awareness of applicable regulatory and QMS requirements
throughout the organization.
- (Typically the Management rep will be responsible for document compilation and
control, coordinating management review, the audit schedule, and corrective
actions/complaints)

36. Certification
process
- Appoint a Notified Body (4 in the UK – BSI,
LRQA, SGS, UL)
- Prepare all documentation
- Implement system
- Stage 1 Notified Body Audit (Document review)
- Stage 2 Notified Body Audit (Full system review)
- Allocation of certificate following successful
audit (3 year validity)
- Annual surveillance audits

37. Getting
started!
- Confirm responsibilities for the QMS (Top Management, process owners, auditors)
- Appoint Management Representative with knowledge and skills to implement system;
- Agree Quality Policy in compliance with 5.3 of the standard, stating the overall aims of
the organization and providing a framework for establishing objectives;
- Agree initial objectives, including goals, measures and strategy for achievement;
- Confirm and compile processes necessary for effective management of the system,
including relevant mandatory procedures;
- Confirm system for generating relevant mandatory records is in place;
- Compile Quality Manual in compliance with clause 4.2.2, including an interaction of
processes;
- Review documentation against the requirements of the standard (clauses 4 – 8) –
compliance matrix?
- Implement system (awareness, training)
- Check effectiveness of system (audits/management review)

38. Patient Guard
Patient Guard can provide support for your
organization, offering the following service:
- Compilation and implementation of QMS
documentation;
- 13485:2016 training and awareness;
- Internal and supplier audits;
- Coordination and support with Notified body audits;
- Complaint and vigilance support;
- Management representative responsibilities.
- MDR/IVDR Transition services
- Qualified Person