An overview of 21 CFR Part 820 - quality systems for medical device manufacturers
What is 21 CFR Part 820?
21 CFR 820 is the FDA federal regulation that pertains to quality systems for medical device manufacturers, and it is part of the agency’s set of Current Good Manufacturing Practices (CGMP) for industry. Also referred to as the FDA’s quality system regulation (QSR), the regulation defines design controls and quality processes at all stages of device development in order to ensure that all medical devices marketed in the United States are safe and effective.
21 CFR 820 consists of 15 subparts, which define quality system requirements for each stage and function within the medical device manufacturing process. We define each subpart below.
Federal regulations are organized as Title → Chapter → Subchapter → Part, which means that 21 CFR 820 is short-hand for:
21 CFR 820 vs ISO 13485
ISO 13485 is the de facto international quality system standard for medical device manufacturers, but this is not currently the standard in the United States. While Part 820 and ISO 13485 are structured differently, they have no conflicting requirements. Therefore, companies that are marketing medical devices in the U.S. and in other markets will need to comply with both ISO 13485 and the FDA’s QSR, as defined in 21 CFR 820.
However, the FDA is moving towards harmonizing these standards, and on February 23, 2022 issued a proposed rule to amend the QSR to align more closely with the international consensus standard for Quality Management Systems, primarily by incorporating reference to the ISO 13485 standard. The FDA has published FAQ’s about the proposed rule.
21 CFR Part 820 Requirements
Part 820: General Controls (subpart A)
The General Controls subpart contains three sections providing general information about the regulation, including the scope and applicability along with key definitions.
Scope
The regulation defines current good manufacturing practice (CGMP) requirements governing the methods, facilities, and controls used for the “design, manufacture, packaging, labeling, storage, installation, and servicing of all finished devices intended for human use." Specifically, this subpart defines:
- Applicability:
The requirements of this regulation are intended to ensure the safety and efficacy of all finished medical devices intended for human use that are manufactured in or imported into the United States. Manufacturers that are involved in some, but not all, manufacturing operations should comply with those requirements that are applicable to the functions they are performing.
Exceptions:
- This regulation does not apply to manufacturers of medical device components, but such manufacturers are encouraged to use this regulation as guidance.
- Class I medical devices are exempt from the Design Controls defined in this regulation, except for those listed in § 820.30(a)(2).
- Manufacturers of blood and blood components are not subject to this regulation but are subject to Biologics good manufacturing practices as defined in Subchapter F, Part 606 of the regulation.
Definitions
This section of the regulation contains definitions for a number of terms used throughout the document. The following are the major definitions related to quality records:
- Design history file (DHF): A compilation of records that describes the design history of a finished device.
- Design input: The physical and performance requirements of a device that are used as a basis for device design.
- Design output: The results of a design effort at each design phase and at the end of the total design effort. The finished design output is the basis for the device master record. The total finished design output consists of the device, its packaging and labeling, and the device master record.
- Device history record (DHR): A compilation of records containing the production history of a finished device.
- Device master record (DMR): A compilation of records containing the procedures and specifications for a finished device.
Quality System
The section of the regulation sets the basic requirement for a quality system by stating that “Each manufacturer shall establish and maintain a quality system that is appropriate for the specific medical device(s) designed or manufactured, and that meets the requirements of this part.”
The term “appropriate” is used throughout this regulation and can be open to interpretation. A manufacturer, however, should assume that all requirements are appropriate and applicable except in cases where non-implementation of the requirement can be shown to have no effect on the product's specified requirements or ability to carry out necessary corrective actions.
Quality system requirements (subpart B)
This section of the regulation defines the overall responsibilities and the resources required for the management of the quality system.
Management responsibilities
Executive management is responsible for establishing a quality policy and ensuring adequate resources to effectively maintain and manage the quality system. In addition, management is responsible for establishing a specific quality plan, consisting of relevant practices, resources, activities, and procedures.
Quality audit
Periodic audits of the quality system are required to be conducted by personnel not directly responsible for the activities being audited. The dates and results of each audit need to be documented, along with the results of the audit. It is expected that corrective actions and, when necessary, reaudits, be performed for any identified noncompliances.
Personnel
Manufacturers are responsible for assigning sufficient personnel with appropriate experience and training to perform all tasks required by the quality system plan.
Design controls (subpart C)
Manufacturers of all class II and class III medical devices, along with the specific class I devices listed in paragraph (a)(2) of this regulation, are required to establish design control procedures that ensure design requirements are met as specified.
Design controls shall define:
- Design and development planning - Plans that describe the design and development activities, and responsibilities for these activities and their implementation.
- Design input - Procedures that ensure design requirements are appropriate and address the intended use of the device.
- Design output - Procedures that document design output, including acceptance criteria, so that conformance to design input requirements can be adequately evaluated.
- Design review - Formal and documented reviews of the ensign results that include participation from representatives of all.
- Design verification - Procedures for verifying the device design that confirm that the design output meets the design input requirements.
- Design validation - Procedures for validating the device design, ensuring that devices conform to defined user needs and intended uses, and including testing of production units under actual or simulated conditions.
- Design transfer - Procedures to ensure that the device design is correctly translated into production specification.
- Design changes - Procedures for identifying, documenting, validating, and managing the verification and approval process of all design changes before they are implemented.
- Design history file - A design history file (DHF) is required for each type of device and should include or reference the records necessary to demonstrate that the design was developed in accordance with the approved design plan and device requirements.
Document controls (subpart D)
Medical device manufacturers are required to put in place document controls for all documents required in this regulation.
Document approval and distribution
One or more people must be assigned to review and approve documents prior to issuance. The approval must be documented, include a date and the signature of the approver, and be made available at all locations where applicable. Procedures must also be in place to ensure that obsolete documents are removed and/or prevented from being used.
Document changes
Similar to document approval procedures, changes to documents must be approved, reviewed, and documented. Records of all changes must be maintained.
Purchasing controls (subpart E)
To continue reading this Regulatory Brief, including a definition of the remaining subparts and a comparison of 21 CFR 820 to ISO 13485, please download the full brief.
CE marking guide for medical devices in the EU
This article is an excerpt from the CE marking guide for medical devices in the European Union.
Table of Contents
- What is CE marking?
- Why is CE marking important?
- CE marking responsibilities
- What countries require or accept CE marking?
- Which medical devices require a CE mark?
- Technical documentation
- What are the costs associated with CE marking?
- How do you apply the CE marking?
- CE mark and UDI
- Does the CE mark expire?
- Do I need to CE mark my software?
- Final steps
CE marking is a symbol that consists of “CE, “ which is the abbreviation of the French phrase "Conformité Européene" meaning "European Conformity". The term initially used to describe “CE” was "EC Mark" but it has officially been replaced by "CE marking" according to the EU Directive 93/68/EEC. CE marking is used in all EU official documents, although you will still see "EC Mark" being used in common language. If you are using EC Mark in your documentation, you should change that terminology to CE marking in the future.
The letters ‘CE’ appear on many products traded on the Single Market in all the member states of the European Union plus Iceland, Liechtenstein, Norway and Switzerland. Simply put, The CE mark is a mandatory compliance mark, informing the consumer that the product is compliant with all applicable EU directives and regulations where the CE mark is required.
The Single Market was established in 1993 and is still considered one of the most significant achievements of the European Union. The main goal was to ensure the movement of goods and services freely within all the member states and to establish high safety standards for consumers. The CE mark indicates that goods and services do not need to be verified when shipping into another member country. To further support this movement, in April 2011, the Single Market Act was established to boost growth and strengthen confidence in the economy even further.
CE marking is required for many types of products, not just medical devices. The CE symbol can be found on bicycle helmets, toys, laptop batteries, wheelchairs, construction equipment, gas appliances and cell phone chargers - to name a few. CE marking is required for products manufactured anywhere that are sold in the EU, and only for those products for which EU specifications exist and require CE marking. The CE marking signifies that the product has been found to meet the general safety and performance requirements (GSPRs) of the European health, safety and environmental protection legislation and allows the product to be sold in the EU.
Manufacturer responsibilities for CE marking
Medical device manufacturers are responsible for properly and legally CE marking products before they leave the warehouse.
Most Class II and III medical devices, along with IVDs and some Class I devices, require a conformity assessment performed by a Notified Body to ensure that all legislative requirements are met before it can be placed on the market. Manufacturers of most Class I devices can self assess conformity. This process needs to demonstrate that all the legislative requirements are met, including any testing and inspections, and that all necessary certifications are obtained.
The European Commission lists 6 steps that manufactures should follow to affix a CE marking to their devices:
- Identify the applicable directive(s) and harmonized standards - see EU standards for Medical Devices, In Vitro Diagnostic (IVD) devices, and Implantable Medical Devices.
- Verify product specific requirements using the essential principles identified in the above standards.
- Identify whether an independent conformity assessment by a Notified Body is necessary. Notified bodies will be required to verify compliance with relevant Essential Requirements for most medical devices classified as IIa, IIb, or III - along with sterile class I devices. See the Notified and Designated Organization (NANDO) database for available notified bodies.
- Test the product and check its conformity.
- Create and keep available the required technical documentation.
- Affix the CE marking and create the EU Declaration of Conformity.
Importer responsibilities for CE marking
If you are importing medical devices into the EU, it is your responsibility to review all the technical documentation and maintain a copy, or to make sure that it’s available to you upon request.
You should verify:
- That the device has been CE marked and that the EU declaration of conformity has been completed.
- That the manufacturer has designated and established an authorized representative.
- That the device is labeled appropriately and contains instructions for use (IFU).
- When applicable, that a UDI has been assigned to the product.
- Whether or not the product is registered in EUDAMED (registration is currently voluntary).
Take action:
- List your name and address on the device or packaging, in addition to the manufacturer’s information.
- Keep records of complaints, non-conformities, recalls, etc. on file.
- Report any noticed non-conformity or product complaints from end users to the manufacturer and authorized representative immediately.
- Maintain a copy of the EU declaration of conformity and any other relevant certificates.
Distributor responsibilities for CE marking
If you are a distributor, you are responsible for reviewing the technical documentation provided to you so that you can verify the product is safe to put on the local market. You must also be sure the product is labeled correctly with the CE marking symbol clearly visible. The technical file documentation contains all of the information that is necessary to show conformity of the product to the applicable requirements.
You should verify:
- That the device has been CE marked and that the EU declaration of conformity has been completed.
- That the device includes all the appropriate labeling, including instructions for use.
- That if imported, the importer has complied with all the EU regulations.
- When applicable, that a UDI has been assigned to the product.
Take action:
- Report any noticed non-conformity to the manufacturer, importer, and authorized representative immediately.
- If a product appears to be out of compliance to the regulations and could pose a serious risk, the information should be reported to the Competent Authority, and to the manufacturer, importer and authorized representative.
- Any complaints or reports from end users about the product should be reported to the manufacturer and, if necessary, to the importer and authorized representative.
Important note: If the importer or distributor markets the product under their own company name, then they become responsible for CE marketing, and take over that role from the manufacturer.
CE marking is mandatory when importing products into the European Union, which is part of the larger European Economic Area (EEA). The EEA Agreement, established in 1992 and made official in 1994, is an international agreement that enables the extension of the European Union’s single market to non-EU members. It consists of the 27 EU countries plus the four European Free Trade Association (EFTA) countries - Iceland, Liechtenstein, Norway and Switzerland. Today, the EFTA has 29 Free Trade Agreements (FTAs) with 40 countries and territories outside the EU. Because these countries operate in the single market, this allows free movement of goods and services across all of the EEA.
Source: European Environment Agency (EEA).
All medical devices sold in the EU require a CE mark. While a CE mark is not required for items such as chemicals and pharmaceuticals, it can be required for combination devices and medical device software. For these two situations, how do you know if your product requires a CE mark?
To continue reading this ebook, including an overview of CE mark costs, and the associated technical documentation/general safety and performance requirements (GSPRs) that manufacturers are required to maintain please register to download the full version
5 signs you are ready to take your medical device regulatory team digital
The medical device industry is in dire need of robust, practical and easy-to-use software to make regulatory professionals’ lives easier. Without a unified, collaborative, and regulatory digital system, serious consequences to a business can occur, including an increased risk of noncompliance, increased costs, and a significant reduction in a product’s revenue potential.
Here are the five biggest indicators that it’s time to take your medical device regulatory team digital.
1. You miss simple regulatory compliance requirements
Has your company missed an update to a standard? When a standard is updated that compliance is claimed for your products, a thorough review and associated gap analysis need to be conducted to determine if there is any impact to your products. You also need to go through every single essential requirements checklist to determine where that standard is referenced and update it throughout. If you miss those activities, you will most likely receive a finding when being audited that will require corrective action and significant resources to fix and ensure it doesn’t happen again.
Additionally, as the new Medical Device Single Audit Program (MDSAP) is rolled out, regulators from different markets are now working together to identify instances of noncompliance as well as misalignment of information in submissions and other communications.
MDSAP requires medical device manufacturers to produce evidence of marketing authorization for each country that they sell into. Your regulatory team needs automation to work for them in a way that creates safeguards to prevent unintentional release of products into markets.
There is a high need for more effective control of the submission process, enabled by a unified platform, which can lead to a leaner, higher quality submission and a reduced regulatory burden.
2. Your revenue is impacted
Are you missing registration dates, experiencing slow-to-market losses or long-term, cascading impacts such as loss of customer loyalty? All of these have an immediate and lasting impact on market capitalization.
If your marketing authorization lapses, your company legally cannot continue to sell within that country or market, guaranteeing your sales team becomes frustrated because they won’t hit their sales numbers and your company’s financial projections will be impacted.
Moreover, improper release of a product due to lack of visibility to regulatory statuses can cause fines and loss of credibility with authorities, which can result in increased scrutiny.
Based on a recent survey of 100 companies, 65% of regulatory professionals require at least a week to gather the information needed to determine where their products are sold and whether they are properly registered within a country or market.
If you can’t easily find the information, how effective and compliant can you really be? It may be time to take your regulatory team digital.
3. You miss your time-to-market targets
How do you organize and manage your regulatory information?
If you immediately thought of SharePoint, Excel, Word, Email, Outlook, or Dropbox, you probably aren’t working in the most efficient manner.
In fact, based on a Deloitte study, up to 50% of a regulatory team member’s time is wasted looking for information. Not only is your process inefficient but the way that you manage data and documents from a regulatory perspective is broken.
Based on FDA’s published data, 35% of all 510(k)s submitted to the FDA get stamped with Refuse to Accept (RTA) designation due to simple and avoidable mistakes.
Avoiding these needless delays in getting your products to market should be a top priority to ensure months or years are not added to getting your product the proper clearances.
4. You are burdened by administrative activities
Are you having trouble with efficiency, collaboration, and talent retention on your regulatory team?
Employee turnover on regulatory teams is linked to stress and increases greatly if team members consider processes to be inefficient or wasteful. Being able to perform one’s job efficiently and the perception of being part of a high-performing organization contributes to employee satisfaction and retention.
Regulatory processes touch multiple functional areas of a business in the highly regulated medical device industry. Regulatory teams have been piecing together disparate systems to achieve marginal improvement for years and are notoriously understaffed.
By giving them the right tools, so that they can do their jobs effectively and efficiently, should be priority number one.
5. You rely on institutionalized knowledge
Has a top member of your regulatory team left the organization, leaving you with no idea about what projects they had their hands in, the status of current submissions, broken down communications with external stakeholders, or lost critical tribal knowledge that wasn’t passed down?
Have you ever called that employee at their new company just to “pick-their-brain” because that critical information wasn’t transferred before they left?
Having a fail-safe in place now for when (not if) your top talent leaves prevents the loss of company and product specific tribal knowledge.
Bringing your regulatory processes into the digital age so your team and company can perform work within a central location ensures everything is properly documented and builds that critical archive of information. A unified system and collaboration hub keeps everyone on the same page within a single regulatory platform. Think of it as your company’s regulatory insurance policy.
Employees change roles, leave departments, and move on to other companies, leaving you to pick up the pieces. Retraining a new employee without the subject matter expert can cause delays and wasted time. So stop relying on disparate systems, disjointed processes, color-coded excel files, and emails that get lost in the shuffle and inhibit progress.
The good news
There is good news. Software solutions already exist that create a collaboration hub to help medical device companies actively navigate the changing regulatory landscape.
Software solutions such as Rimsys Regulatory Management Software can empower your current team. They provide better planning and tracking in a unified system that can monitor process metrics, milestones, and automatically inform submissions plan timelines with actual performance. A solution that connects planning to execution, allowing improved, real-time process monitoring provides teams visibility to quickly spot constraints and take action, allowing products to get through your regulatory process faster and with improved compliance.
It is time to set the new standard for the industry. It is time to go digital and start automating your broken systems.
Announcing the Rimsys advisory board
Rimsys Regulatory Management Software, the leading Regulatory Information Management (RIM) platform designed specifically for the medical device industry, is proud to announce the creation of its prestigious advisory board.
By creating an advisory board with the most forward-thinking minds and preeminent talent in the medical device industry, Rimsys is now aligned and positioned to continue its growth and mission as the leading regulatory management software in the medical device industry.
The board members serve as strategic partners in the continued development and success of Rimsys, as a catalyst to achieving its short-term and long-term goals. The board is comprised of trusted thought leaders, known for being change agents in the industry and having the respect of their peers throughout their career and community.
"The management team could not be more pleased with the addition of these board members and involvement they have with the direction of our company. We are fortunate and thrilled to have such talented and experienced industry veterans and look forward to their many contributions,” said James Gianoutsos, Founder & President of Rimsys."
As advocates and ambassadors of Rimsys, the board supports the management team through strategic analysis, consultation, and providing professional expertise and guidance to help navigate and mitigate potential risks, discover opportunities, and define benchmarks for continued success and organizational growth.
"Rimsys is a very unique product in the marketplace, so it’s only fitting that we bring on such unique minds to the board. Their expertise and vision are exactly what is needed to help us improve our business, our technology and expand our product offerings,” said Brad Ryba, CTO of Rimsys."
The current advisory board members include:
John Speer
Jon Speer has over 20 years of experience in the medical device industry that includes quality management, product development, and project management at Creo Quality, Cook Inc., Theron Inc., and Maetrics LLC. Jon is experienced in managing multiple projects and taking medical device concepts through development, regulatory submission, and ultimately to market. Additionally, Jon is an expert in the design and implementation of FDA-compliant quality management systems and is an active contributor at MedCity News, Med Device Online, Quality Digest, QMed, and is the host of the #1 most downloaded podcast in the industry, The Global Medical Device Podcast. Jon currently serves as the Founder and VP QA/RA at Greenlight Guru, an eQMS that is specifically designed for the medical device industry.
Chris Ferguson
Chris Ferguson has over 15 years of global medical device quality and regulatory affairs experience managing class I, II, and III medical devices and consumer products for numerous world-class global organizations. Chris has successfully led global quality and regulatory projects and teams through FDA, ISO, consumer safety audits, and quality system remediation activities and has in-depth knowledge of the current regulatory landscape. Chris currently serves as Director of Quality Assurance for TransEnterix, Inc.
Bruce McKean
Bruce McKean has over 25 years of medical device industry experience as a regulatory professional specializing in quality and regulatory (Q&R) compliance, design controls, and Q&R related mergers and acquisitions. During his career, Bruce has focused on implementing and maintaining design controls, product submissions, quality management systems internal to his company and for newly acquired companies, corporate Q&R internal audit program, and performing Q&R due diligence audits on target companies. Most recently, Bruce has led a corporate-wide MDSAP compliance initiative and is focusing on the EU MDR implementation. Bruce currently serves as Director of Q&R Operations at Philips Healthcare.
Adam Price
Adam Price has over 15 years of medical device industry experience as a quality assurance and regulatory affairs professional. Adam is currently focused on the development of strategies and solutions to establish and maintain compliance in today’s fast-paced regulatory environment to enable businesses to meet the demands of the global market. Adam is cognizant of dynamic and complex market requirements and the need for effective tools and solutions to allow businesses to maintain continued regulatory compliance. Adam currently serves as Head of Post-market Surveillance at Philips Healthcare.
The 510(k) application: if content is king, then communication is queen
Often, the first thing we hear from a consultant or a medical device company regarding an FDA 510(k) premarket notification is that it was delayed because the FDA reviewer did not understand something simple within the application, or completely missed it.
What is wrong with the reviewer? How could they have missed something so simple? I couldn’t have been any clearer!
Sound familiar?
FDA is overworked, under-resourced, and will most likely miss something simple in your file upon reviewing.
As the specification developer, you know the design and history of the product better than anyone. You are providing that entire history in a formal application for review, and hopefully, clearance. A basic understanding of the technology is a must; however, think about the situation from the FDA reviewers’ point of view. 510(k) applications are inherently technical and sometimes need a brief discussion with the FDA reviewer for clarification or a general overview of your device.
Starting this dialog earlier is important for a smooth path to clearance. Part of this process involves requesting a Pre-Submission (“Pre-Sub”). Pre-Subs are a type of feedback that is part of FDA’s Q-Submission program.
Pre-Subs
Pre-Subs are a formal written request from an applicant for feedback from FDA to be provided in the form of a formal written response or a meeting (in-person or teleconference) in which the feedback is documented in meeting minutes. A Pre-Sub provides the opportunity for a submitter to obtain FDA feedback prior to intended submission of a premarket submission (i.e., IDE, PMA, HDE, De Novo request, 510(k), Dual, BLA, IND) or Accessory Classification Request, among others.
Pre-Subs are entirely voluntary on the part of the applicant. However, early interaction with FDA and careful consideration of FDA’s feedback may improve the quality of subsequent submissions, shorten total review times, and facilitate the development process for new devices.
Pre-Subs provide FDA reviewers with an introduction to you and your device rather than just having a 510(k) application dumped on their desk. FDA reviewers appreciate Pre-subs because they can get a sense of when they should anticipate filings and can plan their workloads accordingly.
FDA reviewers, like all of us, only have a certain amount of time during the day. If they are unable to find information easily or do not properly understand something, then they may state that the relevant information is missing from the application or needs further clarification. This kicks the 510(k) application back to you and stops the review clock. That is directly on the industry submitter, not the FDA reviewer.
The bottom line
FDA reviewers are people too. This is an obvious but often overlooked point to make. Sometimes they miss simple (and sometimes seemingly apparent) information. They make mistakes. The last thing you want to do is start yelling or pointing fingers. After all, you don’t want to burn any bridges as you will most likely deal with the same FDA reviewer upon subsequent submissions for similar products. Always be timely, concise, straightforward and respectful.
At the end of the day, keep in mind that your FDA reviewer isn’t as familiar with your medical device as you are. You need to help them understand items that are unclear, and the only way to do that is through building the communication channel early and having constructive conversations.
Did you know Rimsys Regulatory Management Software will keep track of all communications, notes, decisions, and tasks associated with your 510(k) application and other international regulatory submissions? Find out more now with a free demo and we will show you the power of the only regulatory information management (RIM) system platform designed specifically for the medical device industry.
Introducing government submission templates (i.e. 510k, STED, CSDT) and more!
Rimsys released a major revision on Dec. 3, 2018 that included adding registration workflows, registration owners, Kanban boards, new registration dates (e.g. anticipated approvals dates) and registration lifecycle stages.
Rimsys has been working aggressively over the last month to finish up the final touches on our next release, and we are excited to tell you that it has been officially released! These new features will benefit any size of an organization and continues our pathway to better serving the regulatory affairs professionals in the medical device industry.
Here are a few of our features released:
- Document templates – Depending on where you are registering your product, you can now choose or create your own document template that your team can follow to keep you compliant, better organized, and standardize your regulatory process. A few of our templates include: Summary of Technical Documentation (STED) for IVD and non-IVD Medical Devices, ASEAN Common Submission Dossier Template (CSDT), 510k Template, and more!
- Multi-product registrations – You can choose 1 or 1000 products (at the part number level) to register simultaneously into one market.
- Bulk search & replace for essential principles – We have been working with a few of our customers to get this functionality rolled out by the beginning of January. You now have the ability to search / replace / or remove a standard or a document throughout multiple essential principle tables simultaneously. Let’s say you are managing 10 (or even 500) essential requirements checklists…with a few clicks of a button, you can search, find and replace 1 (or all) standards or documents in EVERY table! If you have ever managed an essential requirements checklist before, we can’t stress enough of how HUGE of a time saver this is for you and your team!
- Embedded documents in essential principles – We now automatically embed your objective evidence directly into the Essential Principles PDF record. This means that when you export your essential principles as a PDF, every single document that is linked to it will be embedded directly into the searchable PDF. You never have to go looking for documents again!
- Dashboard updates – Added key metrics so your team can all be on the same page
- Expanded reporting capabilities – Added the ability to drill-down into key metrics
With this release, Rimsys will be better positioned to cater to organizations of all sizes. We have even more features and modules coming out in the coming months that will further enhance the benefit you receive from using Rimsys.
What’s next?
Rimsys has been working hard to be the single source of truth of all things regulatory related for medical devices. One of the most frequently requested features from our customers is the ability to bring regulatory updates on regulations, laws and guidance documents directly into Rimsys. We are happy to report that this feature has been in development for quite some time and we will be releasing in the next couple of months.
MDSAP device marketing authorization and facility registration
What is the medical device single audit program (MDSAP)?
The International Medical Device Regulators Forum (IMDRF) recognized that a global approach to auditing and monitoring the manufacturing of medical devices could improve their safety and oversight on an international scale. This created the Medical Device Single Audit Program (MDSAP) and allows a recognized Auditing Organization to conduct a single regulatory audit of a medical device manufacturer that satisfies the relevant requirements of the regulatory authorities participating in the program.
To date, the MDSAP participating countries include:
- Australia (Therapeutic Goods Administration – TGA)
- Bazil (Agência Nacional de Vigilância Sanitária)
- Canada (Health Canada)
- Japan (Japanese Pharmaceuticals and Medical Devices Agency)
- United States (FDA)
The World Health Organization (WHO) Prequalification of In Vitro Diagnostics (IVDs) Programme and the European Union (EU) are Official Observers, which means they are waiting for the results of the pilot MDSAP program to determine if it’s worth their while to sign on as an official partner.
When does MDSAP come into effect?
Starting January 1, 2019, if you’re selling medical devices into Canada, it’s not optional and you must be certified to MDSAP, or at the very least, show evidence that you are in the process of complying.
As part of the MDSAP auditing program, there are seven chapters an auditor must cover. One of those chapters is specific to marketing authorization and facility registration, which also touches on two other chapters, management and design development. An auditor will be specifically looking for the following:
- Have you complied with requirements to register and/or license your device facility;
- Did you submit device listing information;
- Did you obtain device marketing authorization;
- Have you arranged for assessment of changes and obtained marketing authorization for changes to devices or the quality management system which require an amendment to existing marketing authorization
You must have that information organized in a meaningful way that you can get to it quickly and show, objectively, that you fulfilled the requirements of MDSAP and all of the country regulatory requirements that fall under MDSAP. That also goes hand-in-hand with ISO 13485:2016 where you need a controlled release of products into the appropriate jurisdiction. If you’re trying to be a global leader or a global company, for that matter, in this day and age, you need to have a solid system in place to manage those marketing authorizations worldwide.
Controlled release of product
If you are selling out of the United States, you must comply with the laws of each importing country. That simply means, no matter where you sell outside of the United States, you must meet the importing country’s requirements for marketing authorization. Your regulatory team and business need to be on point by having a robust regulatory system in place that upon product release, you’re meeting those specific requirements. You must have a mechanism in place to ensure that you don’t release product prior to it being properly registered.
That mechanism starts during product realization. Sales, marketing, customer service, engineering, operations, and regulatory teams must all be on the same page. Often times, regulatory is perceived as the bottleneck to product release. However, this is a misconception and is primarily driven by poor planning during the design and development process.
Auditing to MDSAP
Auditors are looking for the standardized process for controlling the release of the product and ensuring that the process has been adequately established and implemented within your facility. MDSAP has a very rigid auditing process to ensure the proper market authorizations have been obtained and facility registrations have occurred.
When your company is audited, an auditor will request records from product outside of the MDSAP participating countries due to the broad jurisdiction of US and international regulations. If the auditor finds issues with those products, they can draw that parallel to determine that your company doesn’t have a controlled product release process and you need to investigate to ensure there isn’t a systemic issue. That means an audit observation and a corrective and preventive action (CAPA) plan need to be established to rectify the issue(s).
What does this mean for medical device manufacturers?
A regulatory professional’s job is worldwide nowadays, which means it is a lot of responsibility, burden and business risk that are on their shoulders. Do you really want all of that being managed by excel files, outlook reminders, and disjointed processes? It must be a fundamental, standardized process, ingrained into your quality management system, that you need in place in order to NOT run into any compliance issues. Your organization must have a standardized process to ensure that your company is releasing good (and approved) product into the market while maintaining any changes to that product (and registration) while it’s in that market.
The requirement is not only that you get the marketing authorization, but you stay compliant when you’re already in that market. That means you must constantly be monitoring for expiring registrations, any type of design changes with your product, and how they affect your marketing authorizations within those countries.
From a quality management system standpoint, you need a good change control process in place that ties directly to your regulatory team. If you don’t have a good regulatory process now, you’re not going to have one later. It’s going to be too late, and the amount of information that your regulatory team must handle today is only going to increase. That’s why you must develop those systems now.
To learn more about the MDSAP, markets where it’s applicable, pros and cons of using MDSAP vs Regulatory Authority inspections, and audit sequence and grading, download our Ultimate Guide to MDSAP.
Top 6 benefits of a regulatory information management (RIM) system for medical devices
The medical device and in-vitro diagnostic medical device industry are in dire need of a robust, practical and easy to use regulatory information management (RIM) system. Without a unified and collaborative system, serious consequences to your business can occur, including an increased risk of non-compliance, increased costs as well as a possible significant reduction in a product’s revenue potential.
1. Revenue impact
Missing registration dates, slow-to-market losses, and long-term, cascading impacts such as loss of customer loyalty have an immediate impact to market capitalization. Moreover, improper release of product due to lack of visibility to regulatory statuses can cause fines and loss of credibility with authorities, which can result in increased scrutiny.
2. Regulatory compliance
Compliant product releases are required in the medical device industry. Automation that creates safeguards to prevent unintentional release of products into markets is a must. Regulators from different markets are working together to identify instances of non-compliance as well as misalignment of information in submissions and other communications. More effective control of the submission, enabled by a unified platform, can lead to a leaner, higher quality submission and a reduced regulatory burden.
3. Faster time to market
Better planning and tracking in a unified system can monitor process metrics, milestones, and automatically informing submissions plan timelines with actual performance. A unified solution connects planning to execution, allowing improved, real-time process monitoring. Teams can quickly spot constraints and take action, allowing the product to get through your process faster.
4. Efficiency and collaboration
Regulatory processes touch multiple functional areas. Regulatory functions have been piecing together disparate systems to achieve marginal improvement. This landscape inhibits the accurate and timely transfer of data and disruption in cross-functional workflow.
5. Efficiency and collaboration
Employee turnover on regulatory teams is linked to the stress and increases greatly if team members consider processes to be inefficient or wasteful. Being able to perform one’s job efficiently and the perception of being part of a high-performing organization contributes to employee satisfaction and retention.
6. Insurance policy
Having a fail-safe in place now for when (not if) your top talent leaves prevent the loss of company and product specific tribal knowledge. Retraining a new employee without the subject matter expert can cause delays and wasted time. A unified system keeps all information within the company.
