Insights & Intelligence for Regulatory Leaders

Regulatory affairs professionals at large medical device companies must manage heavy submission workloads, registrations for products currently on the market, and ever-changing regulatory requirements. Many RA teams are still relying on paper documents, spreadsheets, and other outdated tools and methods to complete this work, while others have taken steps toward digitization and automation of key processes.

Regulatory teams often struggle to find software tools designed specifically for their workflows. ERP (Enterprise Resource Planning) systems are sometimes used by RA teams to track product attributes, such as selling status and support/service history. ERP systems, however, are not designed to handle the complexities of regulatory workflows nor the type of data that needs to be securely managed within a medtech company.

What is ERP software?

Enterprise Resource Planning (ERP) software encompasses a wide range of systems that typically manage multiple sectors within an organization. Originally designed for manufacturers, ERP systems are now used by industries as varied as public utilities, wholesale distributors, service organizations, and retail companies.  

ERP systems manage the data and workflows associated with almost every sector within an organization, including:

• Manufacturing  
• Device identification/history
• Purchasing and sourcing
• Service delivery
• Finance
• Human resources
• Engineering
• Asset management
• Supply chain
• Customer management and sales

Modern ERP systems are designed to provide a single, integrated platform to manage the majority of functions within an organization. The trade-off, however, is that because functionality needs to meet the needs of a variety of organizations, it will often fall short in highly regulated industries that require very specific data, workflows, and controls.

What are RIM systems?

Regulatory information management (RIM) systems have been around for years in the pharmaceutical industry but are relatively new in the medical device industry. Holistic RIM systems enable users to create a single source of truth for all data associated with regulatory submissions and registration management. Think of a RIM system as an ERP system for regulatory teams that is used to digitize data and automate key processes across the organization.

Medtech RIM system functions are designed to support a range of regulatory activities across a product’s lifecycle. In addition to centralizing core regulatory data and managing regulatory registrations and certificates, RIM systems can also support:

• Submission planning, authoring, and assembly
• Collaborative content authoring and project management
• UDI management
• Standards management
• Essential principles/GSPR management, including bulk updating

RIM systems are product-centric, structuring data around individual regulated products and their requirements, market by market. This means that RIM systems can track product-specific data, such as UDI records, and link standards with individual products to easily identify products affected by standards updates and assess their impact.

Integrating ERP and RIM systems

The most common point of integration between ERP and RIM systems is an “available to sell” setting at the product level. Product information in a RIM system will include registration status for each country and an indication of whether the product can currently be marketed and sold there. It is critical that the ERP system restrict distribution and/or sale of a product automatically based on the selling status set by the regulatory team.

ERP systems will also often be integrated with Product Lifecycle Management (PLM) systems used by product development and manufacturing teams to manage product information and at every step of a product’s lifecycle, including product data, records, specifications, and configurations. ERP systems can also be integrated with eQMS (electronic quality management systems) and RIM systems to ensure coordination of risk management activities, product updates, and quality data between the regulatory, quality, development, and manufacturing teams. Ideally, your regulatory team is notified as early as possible of any planned updates or changes to a product that is in-market or pending market approval.

RIM for regulatory projects and processes

Digitization and automation of regulatory data are more critical as global regulations continue to change and become more complex. Getting a medical device to market is a difficult process, but RIM software cuts the time and costs associated with product registrations while providing tools essential for ensuring ongoing compliance. ERP systems are central to an organization’s operation, but their broad focus simply does not provide the detailed functionality needed by regulatory teams. Integrate your ERP system with a holistic RIM system to give your regulatory team the tools they need to bring your products to market successfully and to maintain compliance. To get your regulatory ducks in a row, only a RIM system will do!

To learn more about the Rimsys RIM system, talk to one of our experts today.

‍

What is IEC 62304?

IEC 62304:2006 / AMD 1:2015 is the current version of the international standard that defines the software lifecycle processes for software used in medical devices. IEC 62304:2006 is considered a harmonized standard, meaning that it is recognized by the FDA and other regulatory agencies around the world.  

Note that this standard applies both to Software as a Medical Device (SaMD) and Software in a Medical Device (SiMD).

How is IEC 62304:2006 organized?

There are 9 chapters in IEC 62304. The first 4 chapters define the scope of the standard as well as references, terms, and general requirements. The following 5 chapters are as follows:

• Chapter 5 – Software Development Process. This chapter is the most important to fully understand because it defines the software development planning process, including requirements analysis, design, testing, and release processes.  
• Chapter 6 – Software Maintenance. This chapter defines the need for a software maintenance plan, including implementation of a maintenance plan and issue analysis procedures.
• Chapter 7 – Software Risk Management. Identification of hazardous situations, risk control, verification, and risk management procedures assume that an organization-level risk management plan is in place following the ISO 14971 standard.
• Chapter 8 – Software Configuration Management. This includes change control and configuration status tracking.
• Chapter 9 – Software Problem Resolution. This chapter addresses investigating and reporting on problems, change control processes, trend analysis, and resolution testing and verification.

IEC 62304:2006 software risk categories

IEC 62304:2006 defines three classes of risk for medical device software based on the risk of harm from a hazardous situation which the software could cause or to which it could contribute. As with risk management systems for other medical devices, the procedures, controls, and processes for medical device software should be appropriate for the level of risk posed by the software.

• Class A – No injury or damage to health is possible.
• Class B – Injury is possible, but not serious.
• Class C – Death or serious injury is possible.

Software development and maintenance processes in IEC 62304

The software development process, as defined in Chapter 5 of this standard, lays out 8 process steps.  

• Software development planning (5.1)
• Software requirements analysis (5.2)
• Software architectural design (5.3)
• Software detailed design (5.4)
• Software unit implementation and verification (5.5)
• Software integration and integration testing (5.6)
• Software system testing (5.7)
• Software release (5.8)

IEC 62304 recommended documentation

In general, the following list of deliverables is typically needed to establish conformance with IEC 62304:2006:  

• Software development plan - Define processes, deliverables, and development activities. The plan should include the Life Cycle Activities, Risk Management Plan, Documentation Plan, Configuration Management Plan, Change Control process, and Problem Resolution process.
• Software verification plan - Describe the software test plan. Include all verification activities, such as code review, unit test and integration test plans, and the final system software verification test plan.
• Software classification – Classify the software based on risk level as Class A, B, or C per definitions in the standard. Classification should also be established per market-specific requirements (ie: FDA Class I, II, or III).
• Software description – High-level description of the software function, intended use, and technology used.
• Software requirement specifications - Include specifications for all requirements, including functional, performance, interface, and safety requirements.
• Software architecture - Include diagrams of subsystems, major components, and the interfaces between them. This can provide segregation of software entities for risk control.
• Software hazards analysis - The hazard analysis should identify potential hazards and the software components that could cause them. Include mitigations that feed back into the requirements. Be sure to include OTS and wireless QoS hazard analysis where applicable.
• Cybersecurity plan - Document cybersecurity controls and features, threat model, hazard analysis, and penetration testing.
• Detailed design descriptions - Include specifications detailing how the software is implemented.
• Off-the-shelf software list – Identify any OTS software used, including detailed information regarding source, version, and licensing.
• Code unit verification - Document the unit test and code review as performed to plan.
• Integration tests - Document the integration, regression, and OTS software testing performed per the plan.
• System software verification protocols - Document test protocols for final device software. Include requirements tracing and show coverage of requirements (using pass/fail criteria).
• Summary test report - Create a summary of all software verification per the verification and validation plan.
• Trace matrix - Link system requirements to software requirements to associated design specifications and test protocols in one document (typically a spreadsheet). Include software hazards with software mitigations.
• Revision level history - Document major revisions and releases made during development, including descriptions of each.
• Unresolved anomalies - Document any anomalies still present and their associated risk. Include justification for release.
• Software problem resolution process - Describe how reported problems are evaluated and investigated, including how change requests and any necessary regression testing will be handled.

Complying with IEC 62304

More than most other standards, IEC 62304 requires an understanding of multiple disciplines to ensure compliance. Be sure to include team members with expertise in software development, risk management, and regulatory affairs when defining processes related to this standard.

Complying with IEC 62304 is only part of what is required for market clearance for software as a medical device. In the U.S., a 510(k) submission is typically required. Read our 510(k) guide here.

‍

Regulatory affairs professionals at large medical device companies must manage heavy submission workloads, registrations for products currently on the market, and ever-changing regulatory requirements. Many RA teams are still relying on paper documents, spreadsheets, and other outdated tools and methods to complete this work, while others have taken steps toward digitization and automation of key processes.

Regulatory teams often struggle to find software tools designed specifically for them. Because the processes they manage are typically product-focused, RA teams may attempt to use software built for product design and engineering teams, including product lifecycle management (PLM) systems.

What is PLM software?

Product lifecycle management (PLM) applications provide a central system for managing everything from the design of a new product to testing and ongoing maintenance. PLM systems are typically used by multiple teams, including product design and engineering teams, to coordinate product-related processes. The core elements of a PLM system include:

• Document management of design files and process documents
• Product structure management (source of truth for bills of material)
• Product component detail tracking and approvals (attribute management)
• Workflow and project/task management for product-related processes
• Product version control
• Secure management and approval processes for engineering and product changes (ECNs, ECOs, etc.)
• Integration with CAD and PDM (product data management) tools

PLM software can be considered both a data warehouse and a secure project system. PLM systems are used for storing and retrieving all product design-related information; including version-specific manufacturing (CAD) drawings, specifications, and supplier requirements. These systems also manage the workflows associated with each stage of a product’s lifecycle, from the design process to product maintenance to end of life activities. For medical device manufacturers, the PLM system is typically where design history files and device master records are maintained.

What are RIM systems?

Regulatory information management (RIM) systems have been around for years in the pharmaceutical industry but are relatively new in the medical device industry. Holistic RIM systems enable users to create a single source of truth for all data associated with regulatory submissions and registration management. RA teams are able to focus on critical tasks by using RIM systems to digitize data and automate key processes.  

RIM system functions are designed to support a range of regulatory activities across a product’s lifecycle. In addition to centralizing core regulatory data and managing regulatory registrations and certificates, RIM systems can also support:

• Submission planning, authoring, and assembly
• Market entrance requirements and pre-built submission templates
• Collaborative content authoring and project management
• UDI management
• Standards management
• Essential principles/GSPR management, including bulk updating

RIM systems also tend to be product-centric, structuring data around individual regulated products, but are focused on saleable products, components, and packages where PLM systems are focused on the manufactured items. This means that RIM systems can track product-specific data, such as sales status by country, and link standards with individual products to easily identify products affected by standards updates and assess their impact.

Integrating PLM and RIM systems

PLM systems will often be integrated with ERP systems to ensure the correct bills of material and other product details for the current version of the product are being used by the manufacturing system. PLM systems can also be integrated with eQMS (quality management systems) and RIM systems to ensure coordination of risk management activities, product updates, and quality data between the regulatory, quality, and product teams. Ideally, your regulatory team should be notified as early as possible of any planned updates or changes to a product that is in-market or pending market approval.

RIM for regulatory projects and processes

Digitization and automation of regulatory data are more critical as global regulations continue to change and become more complex. Getting a medical device to market is a difficult process, but RIM software cuts the time and costs associated with product registrations while providing tools essential for ensuring ongoing compliance. PLM systems are critical as well, but their focus on product design and other product details simply does not provide the functionality needed by regulatory teams. Integrate a strong PLM system with a holistic RIM system to give both your engineering and regulatory teams the tools they need to bring your products to market successfully and to maintain compliance. To get your regulatory ducks in a row, only a RIM system will do!

To learn more about the Rimsys RIM system, talk to one of our experts today.

Today at Rimsys, we unveiled the 2023 MedTech Regulatory Performance Report, a new set of insights into the state of medtech regulatory affairs. Compiled based on interviews with 200 regulatory professionals and executives, the study provides a detailed look into how regulatory teams are staffed, their processes, the tools they use, and ultimately how they perform.

Why did we create this study? There were two driving factors behind the research. The first was a common theme that we heard from a number of our customers: Regulatory leaders don’t have clear data and benchmarks. They don’t necessarily know how long a new market submission should take, and how to plan for or assess the work of their teams. While other studies look at the medtech industry broadly or the state of the regulatory profession, this study tries to build a comprehensive resource for regulatory (and company) leaders.

The second factor was really for ourselves and the team at Rimsys. As a company building solutions specifically for medtech regulatory affairs, we wanted more insight into where companies were successful, where they struggled, and where we can add value.

What did we find? Regulatory teams perform a lot of hero work and rate themselves highly for their accomplishments. At the same time there is a lot of opportunity for process improvements, and companies that invest in digital transformation for regulatory affairs see better performance. ‍

Regulatory professionals are superheroes

Regulatory teams are generally pretty small. Most companies have less than 10 full-time regulatory professionals. These small teams complete an enormous amount of work. Last year on average, RA teams completed 50 license renewals, 50 license updates, and 10 new market submissions. This is impressive output.

Digging a bit under the covers, we found that this output relied heavily on the support of external consultants. 90% of companies use consultants to keep pace with their regulatory workload. Front-line employees also struggle with burnout. They were much more likely to report feeling under-resourced than regulatory leaders. ‍

But process problems persist

A lot of regulatory work remains extremely manual. 70% of regulatory teams spend half their time or more on repetitive administrative tasks.  All of this manual work increases the frequency of errors and required rework. 61% of companies reported a major non-compliance incident in the past 2 years.

Manual work also makes it difficult to complete regulatory projects in a timely fashion. Teams completed a lot of projects, but each took a long time. Over half of all companies spend 4 months or more on license renewals, license updates, and new market submissions.  ‍

Moving regulatory affairs forward

As regulatory requirements become more complex, there’s a natural question about how teams will work moving forward. MDR & IVDR in Europe have significantly increased the regulatory workload required to bring and keep products on the market. Will organizations be able to keep pace with the same resources, tools, and processes?  

No, and the performance report shows that medtech companies are investing to improve their regulatory capabilities. The majority of companies are planning to increase the sizes of their RA teams in 2023, and 40% expect to increase their investments in regulatory software. Companies are increasingly adopting specialized software to better support regulatory processes. ‍

Dig into the survey results

The full survey results provide insights into more aspects of regulatory performance. They show that companies need to take a deeper look into their processes and how regulatory resources are allocated. There are two ways to learn more:

1. Visit the survey page to see the full results (the survey whitepaper can be downloaded at no cost)
2. Watch the recording of our webinar with PA Consulting. We discuss the survey results in more detail and share our regulatory predictions for 2023

‍

Regulatory affairs professionals at large medical device companies must manage heavy submission workloads, registrations for products currently on the market, and ever-changing regulatory requirements. Many RA teams are still relying on paper documents, spreadsheets, and other outdated tools and methods to complete this work, while others have taken steps toward digitization and automation of key processes. 

Regulatory teams often struggle to find software tools designed specifically to help manage their regulatory projects. As a result, some RA teams attempt to repurpose software developed for other functions, such as electronic quality management systems (eQMS). While eQMS systems can provide some functionality that RA teams need, regulatory information management (RIM) software delivers a holistic platform designed to reduce administrative work and manage global compliance activities. In this post, we’ll compare eQMS and RIM software as they relate to regulatory compliance.

What is eQMS software? 

Electronic quality management systems (eQMS) are software programs that help quality teams centrally store, monitor, and manage quality and compliance processes. These platforms are usually provided via cloud technology as software-as-a-service (SaaS) solutions. They aim to provide digitization and automation of critical tasks that quality teams traditionally handle manually, such as quality, compliance, and design processes. For medical device companies, these requirements are defined by multiple standards, most notably ISO 13485:2016, FDA 21 CFR Part 820, and the EU MDR.

Digitization and automation are growing trends in most industries, including regulatory affairs and quality management. As you know, medical device manufacturers, especially their quality and RA teams, must manage a large volume of data, of which accuracy and consistency are of the utmost importance. eQMS systems typically handle data and processes in support of the following:

• Document management
• Non-conformance tracking
• Audit management
• Risk management
• Corrective and preventive action (CAPA) management
• Training management

This means that while eQMS software provides some functions and certainly have information that RA teams can use, they are designed around the processes that quality teams are responsible for. RIM software, on the other hand, is designed specifically to help regulatory specialists work more effectively and efficiently.

What are RIM systems, and what do they do?

Regulatory information management (RIM) systems have been around for years in the pharmaceutical industry, but are relatively new in the medical device industry. Comprehensive RIM systems enable users to create a single source of truth for all data associated with regulatory submissions and registration management. These systems lighten the burden on RA teams by digitizing data and automating key processes. 

RIM system functions are designed to support a range of regulatory activities across a product’s lifecycle. In addition to centralizing core regulatory data and managing regulatory registrations and certificates, RIM systems can also support:

• Submission planning, authoring, and assembly
• Market entrance requirements and pre-built submission templates
• Collaborative content authoring and project management
• UDI management
• Standards management
• Essential principles/GSPR management, including bulk updating

RIM systems also tend to be product-centric, structuring data around individual regulated products, as opposed to the process-centric approach taken by most eQMS systems. This means that RIM systems can track product-specific data, such as sales status by country, and link standards with individual products to easily identify products affected by standards updates and assess their impact.

Integrating eQMS and RIM systems

While processes in an eQMS system are designed to support quality and risk management requirements, they contain a lot of information that is relevant to regulatory affairs teams. RIM systems such as Rimsys are designed to integrate to eQMS, PLM, and ERP systems in order to coordinate processes and synchronize data. In the case of RIM and eQMS integrations, the systems can synchronize product master data to ensure smoother regulatory submissions and identify the impact of changing documentation on global product registrations and submissions. And Performance and testing data can be linked to digital essential principles tables.

RIM for regulatory projects and processes

Digitization and automation of regulatory data are more critical as global regulations continue to change and become more complex. Getting a medical device to market is a difficult process, but RIM software cuts the time and costs associated with product registrations while providing tools essential for ensuring ongoing compliance. Quality systems are critical as well, but their focus on risk management and corrective and preventative activities simply does not provide the functionality needed by regulatory teams. Integrate a strong eQMS system with a holistic RIM system to give both your quality and regulatory teams the tools they need to bring your products to market successfully and to maintain compliance. To get your regulatory ducks in a row, only a RIM system will do!

To learn more about the Rimsys RIM system, talk to one of our experts today.

‍

The latest announcement from the European Commission (EC) recommending an extension to the MDR transition period has led to sighs of relief throughout the healthcare community in the EU, where providers and patients have been concerned about the ongoing availability of life-saving medical devices. Medical device manufacturers, however, have no time to waste in moving forward with MDR certifications for their devices.

On January 6^th, the EC adopted the proposal recommended a month earlier to delay the full implementation of the Medical Device Regulation (MDR). The EU’s parliament and council now needs to issue final approval for the proposal, which will be processed through an “accelerated co-decision procedure.” While the proposed changes give medical device manufacturers some breathing room in recertifying existing devices, the changes do not apply to all devices or all situations and are not designed to allow manufacturers to delay the entire process of becoming compliant with MDR requirements.

Yes, if the proposal is approved by the European Commission as it is written today, your MDD-certified device may be able to remain in the EU market longer – the end of 2027 for high-risk devices and 2028 for medium- and low-risk devices. So, why do regulatory teams need to push forward as quickly as possible with MDR certification projects?

1. No extension for IVD devices

The proposed extensions to the transition periods apply only to medical devices covered under the MDR. The original deadlines for IVD devices as defined by the IVDR remain in place:

• May 26, 2025 - Class D IVD devices
• May 26, 2026 - Class C IVD devices
• May 26, 2027 - Class A sterile IVD devices and Class B IVD devices.

2. Lack of Notified Body resources

In April, 2022, a survey of MedTech Europe members revealed that MDR certificates had not yet been issued for more than 85% of the 500,000+ medical devices certified under MDD or AIMDD. Currently, certifications for lower classifications of devices take approximately 10 to 18 months; and for more complex products, the certification timeline can be two years or more. The number of Notified Bodies certified to review MDR applications remains low, and even if Notified Bodies are able to add resources in the coming years, review timelines will only become longer as companies rush to certify the hundreds of thousands of devices expected to remain on the market. The challenges will be even greater for smaller manufacturers and others that do not already have an established relationship with a Notified Body.

What does this mean for medical device manufacturers today? For those with higher-risk class devices, assume a 2-year certification period – which means starting the process with a Notified Body as early as possible, given the unknown availability of NB resources in the near future. At the latest, manufacturers need to have signed with a Notified Body by September 26, 2024 (Per Annex VII, Section 4.3 of the MDR). And prior to starting that process, of course, all required data, processes, and documentation should be in place. This means that any manufacturer who has not started this process needs to do so now.

3. Inability to update devices

The postponed MDR deadlines only apply to devices that do not present any unacceptable risk to health and safety and have not undergone significant changes in design or intended purpose. Any medical device certified under the MDD to which significant changes are made will need to recertify under the MDR before the updated device is placed on the market.

4. EUDAMED and UDI compliance deadlines remain the same

While the exact deadlines for EUDAMED compliance are based on the actual (future) release dates of all modules, The European Commission expects requirements around vigilance, clinical investigation and performance studies, and market surveillance modules to become mandatory by the end of 2024. The Commission is proposing a longer transition period for UDI/device registration and the notified body certificate modules, with a mandatory compliance date around the 2^nd quarter of 2026.  

Note that the expected EUDAMED compliance dates are prior to the extended MDR compliance deadlines. This means that information not previously tracked under MDD requirements will be mandatory within the next few years. This includes UDI and device information, including Basic UDI-DI (BUDI-DI). Post-market surveillance (PMS) and periodic safety update reports (PSUR), requirements of the vigilance and market surveillance module, also become required upon EDUAMED implementation.

5. MDR certification may affect registrations in non-EU countries

An increasing number of countries outside of the EU will accept CE certification as a path to accelerated market approval. In some countries, such as China, proof of certification in the device’s country of origin is required. It is unclear how these requirements will change in recognition of MDR requirements and deadlines. If your current regulatory strategy requires country of origin for the European Union, you may experience a more burdensome application process in other markets.

6. Opportunity to create a competitive advantage  

Instead of looking at MDR as an obstacle to overcome, medical devices manufacturers would be well advised to take this as an opportunity to create a competitive advantage. Companies without the necessary resources to re-certify all existing devices are expected to remove products from the EU market in the coming years. In addition, those companies who wait will likely experience higher costs and longer delays in obtaining certification – creating additional opportunities for their competitors.

And don’t forget that the transition period extensions apply only to legacy devices - any new products entering the EU market will require certification under MDR before being placed on the market!

If your data and processes aren’t yet fully ready for MDR, implementing a Regulatory Information Management (RIM) system as part of the process can create additional advantages beyond streamlining the MDR submission process. RIM systems digitize, automate, and simplify the submission and tracking of regulatory documents. The use of a RIM system not only speeds time to market, but provides regulatory teams tools for ensuring continued compliance for all products in all markets.

Doing nothing now is not an option

It is important to note that the extensions apply only to manufacturers that already have MDR compliance activities underway and have made an effort to become compliant, including the implementation of a compliant quality management system.  Per Annex VII, Section 4.3 of the MDR, manufacturers must submit a formal application for a conformity assessment by May 26, 2024. In addition, the manufacturer and Notified Body must have signed a written agreement no later than September 26, 2024.  The intent of the extended transition period is primarily to allow manufacturers to access Notified Body resources, and the Commission appears to be making an effort to limit any incentives for manufacturers to delay MDR certification.  

We expect to see leaders in the medical device industry embracing MDR compliance not only as a way to keep revenue-generating devices in market, but as a way to gain a competitive advantage and market share in the coming years.

Want to learn more? Watch a replay of our recent webinar  - Impact of the MDR transition period extension.

‍