An overview of 21 CFR Part 820 - quality systems for medical device manufacturers
What is 21 CFR Part 820?
21 CFR 820 is the FDA federal regulation that pertains to quality systems for medical device manufacturers, and it is part of the agency’s set of Current Good Manufacturing Practices (CGMP) for industry. Also referred to as the FDA’s quality system regulation (QSR), the regulation defines design controls and quality processes at all stages of device development in order to ensure that all medical devices marketed in the United States are safe and effective.
21 CFR 820 consists of 15 subparts, which define quality system requirements for each stage and function within the medical device manufacturing process. We define each subpart below.
Federal regulations are organized as Title → Chapter → Subchapter → Part, which means that 21 CFR 820 is short-hand for:
21 CFR 820 vs ISO 13485
ISO 13485 is the de facto international quality system standard for medical device manufacturers, but this is not currently the standard in the United States. While Part 820 and ISO 13485 are structured differently, they have no conflicting requirements. Therefore, companies that are marketing medical devices in the U.S. and in other markets will need to comply with both ISO 13485 and the FDA’s QSR, as defined in 21 CFR 820.
However, the FDA is moving towards harmonizing these standards, and on February 23, 2022 issued a proposed rule to amend the QSR to align more closely with the international consensus standard for Quality Management Systems, primarily by incorporating reference to the ISO 13485 standard. The FDA has published FAQ’s about the proposed rule.
21 CFR Part 820 Requirements
Part 820: General Controls (subpart A)
The General Controls subpart contains three sections providing general information about the regulation, including the scope and applicability along with key definitions.
Scope
The regulation defines current good manufacturing practice (CGMP) requirements governing the methods, facilities, and controls used for the “design, manufacture, packaging, labeling, storage, installation, and servicing of all finished devices intended for human use." Specifically, this subpart defines:
- Applicability:
The requirements of this regulation are intended to ensure the safety and efficacy of all finished medical devices intended for human use that are manufactured in or imported into the United States. Manufacturers that are involved in some, but not all, manufacturing operations should comply with those requirements that are applicable to the functions they are performing.
Exceptions:
- This regulation does not apply to manufacturers of medical device components, but such manufacturers are encouraged to use this regulation as guidance.
- Class I medical devices are exempt from the Design Controls defined in this regulation, except for those listed in § 820.30(a)(2).
- Manufacturers of blood and blood components are not subject to this regulation but are subject to Biologics good manufacturing practices as defined in Subchapter F, Part 606 of the regulation.
Definitions
This section of the regulation contains definitions for a number of terms used throughout the document. The following are the major definitions related to quality records:
- Design history file (DHF): A compilation of records that describes the design history of a finished device.
- Design input: The physical and performance requirements of a device that are used as a basis for device design.
- Design output: The results of a design effort at each design phase and at the end of the total design effort. The finished design output is the basis for the device master record. The total finished design output consists of the device, its packaging and labeling, and the device master record.
- Device history record (DHR): A compilation of records containing the production history of a finished device.
- Device master record (DMR): A compilation of records containing the procedures and specifications for a finished device.
Quality System
The section of the regulation sets the basic requirement for a quality system by stating that “Each manufacturer shall establish and maintain a quality system that is appropriate for the specific medical device(s) designed or manufactured, and that meets the requirements of this part.”
The term “appropriate” is used throughout this regulation and can be open to interpretation. A manufacturer, however, should assume that all requirements are appropriate and applicable except in cases where non-implementation of the requirement can be shown to have no effect on the product's specified requirements or ability to carry out necessary corrective actions.
Quality system requirements (subpart B)
This section of the regulation defines the overall responsibilities and the resources required for the management of the quality system.
Management responsibilities
Executive management is responsible for establishing a quality policy and ensuring adequate resources to effectively maintain and manage the quality system. In addition, management is responsible for establishing a specific quality plan, consisting of relevant practices, resources, activities, and procedures.
Quality audit
Periodic audits of the quality system are required to be conducted by personnel not directly responsible for the activities being audited. The dates and results of each audit need to be documented, along with the results of the audit. It is expected that corrective actions and, when necessary, reaudits, be performed for any identified noncompliances.
Personnel
Manufacturers are responsible for assigning sufficient personnel with appropriate experience and training to perform all tasks required by the quality system plan.
Design controls (subpart C)
Manufacturers of all class II and class III medical devices, along with the specific class I devices listed in paragraph (a)(2) of this regulation, are required to establish design control procedures that ensure design requirements are met as specified.
Design controls shall define:
- Design and development planning - Plans that describe the design and development activities, and responsibilities for these activities and their implementation.
- Design input - Procedures that ensure design requirements are appropriate and address the intended use of the device.
- Design output - Procedures that document design output, including acceptance criteria, so that conformance to design input requirements can be adequately evaluated.
- Design review - Formal and documented reviews of the ensign results that include participation from representatives of all.
- Design verification - Procedures for verifying the device design that confirm that the design output meets the design input requirements.
- Design validation - Procedures for validating the device design, ensuring that devices conform to defined user needs and intended uses, and including testing of production units under actual or simulated conditions.
- Design transfer - Procedures to ensure that the device design is correctly translated into production specification.
- Design changes - Procedures for identifying, documenting, validating, and managing the verification and approval process of all design changes before they are implemented.
- Design history file - A design history file (DHF) is required for each type of device and should include or reference the records necessary to demonstrate that the design was developed in accordance with the approved design plan and device requirements.
Document controls (subpart D)
Medical device manufacturers are required to put in place document controls for all documents required in this regulation.
Document approval and distribution
One or more people must be assigned to review and approve documents prior to issuance. The approval must be documented, include a date and the signature of the approver, and be made available at all locations where applicable. Procedures must also be in place to ensure that obsolete documents are removed and/or prevented from being used.
Document changes
Similar to document approval procedures, changes to documents must be approved, reviewed, and documented. Records of all changes must be maintained.
Purchasing controls (subpart E)
To continue reading this Regulatory Brief, including a definition of the remaining subparts and a comparison of 21 CFR 820 to ISO 13485, please download the full brief.
CE marking guide for medical devices in the EU
This article is an excerpt from the CE marking guide for medical devices in the European Union.
Table of Contents
- What is CE marking?
- Why is CE marking important?
- CE marking responsibilities
- What countries require or accept CE marking?
- Which medical devices require a CE mark?
- Technical documentation
- What are the costs associated with CE marking?
- How do you apply the CE marking?
- CE mark and UDI
- Does the CE mark expire?
- Do I need to CE mark my software?
- Final steps
CE marking is a symbol that consists of “CE, “ which is the abbreviation of the French phrase "Conformité Européene" meaning "European Conformity". The term initially used to describe “CE” was "EC Mark" but it has officially been replaced by "CE marking" according to the EU Directive 93/68/EEC. CE marking is used in all EU official documents, although you will still see "EC Mark" being used in common language. If you are using EC Mark in your documentation, you should change that terminology to CE marking in the future.
The letters ‘CE’ appear on many products traded on the Single Market in all the member states of the European Union plus Iceland, Liechtenstein, Norway and Switzerland. Simply put, The CE mark is a mandatory compliance mark, informing the consumer that the product is compliant with all applicable EU directives and regulations where the CE mark is required.
The Single Market was established in 1993 and is still considered one of the most significant achievements of the European Union. The main goal was to ensure the movement of goods and services freely within all the member states and to establish high safety standards for consumers. The CE mark indicates that goods and services do not need to be verified when shipping into another member country. To further support this movement, in April 2011, the Single Market Act was established to boost growth and strengthen confidence in the economy even further.
CE marking is required for many types of products, not just medical devices. The CE symbol can be found on bicycle helmets, toys, laptop batteries, wheelchairs, construction equipment, gas appliances and cell phone chargers - to name a few. CE marking is required for products manufactured anywhere that are sold in the EU, and only for those products for which EU specifications exist and require CE marking. The CE marking signifies that the product has been found to meet the general safety and performance requirements (GSPRs) of the European health, safety and environmental protection legislation and allows the product to be sold in the EU.
Manufacturer responsibilities for CE marking
Medical device manufacturers are responsible for properly and legally CE marking products before they leave the warehouse.
Most Class II and III medical devices, along with IVDs and some Class I devices, require a conformity assessment performed by a Notified Body to ensure that all legislative requirements are met before it can be placed on the market. Manufacturers of most Class I devices can self assess conformity. This process needs to demonstrate that all the legislative requirements are met, including any testing and inspections, and that all necessary certifications are obtained.
The European Commission lists 6 steps that manufactures should follow to affix a CE marking to their devices:
- Identify the applicable directive(s) and harmonized standards - see EU standards for Medical Devices, In Vitro Diagnostic (IVD) devices, and Implantable Medical Devices.
- Verify product specific requirements using the essential principles identified in the above standards.
- Identify whether an independent conformity assessment by a Notified Body is necessary. Notified bodies will be required to verify compliance with relevant Essential Requirements for most medical devices classified as IIa, IIb, or III - along with sterile class I devices. See the Notified and Designated Organization (NANDO) database for available notified bodies.
- Test the product and check its conformity.
- Create and keep available the required technical documentation.
- Affix the CE marking and create the EU Declaration of Conformity.
Importer responsibilities for CE marking
If you are importing medical devices into the EU, it is your responsibility to review all the technical documentation and maintain a copy, or to make sure that it’s available to you upon request.
You should verify:
- That the device has been CE marked and that the EU declaration of conformity has been completed.
- That the manufacturer has designated and established an authorized representative.
- That the device is labeled appropriately and contains instructions for use (IFU).
- When applicable, that a UDI has been assigned to the product.
- Whether or not the product is registered in EUDAMED (registration is currently voluntary).
Take action:
- List your name and address on the device or packaging, in addition to the manufacturer’s information.
- Keep records of complaints, non-conformities, recalls, etc. on file.
- Report any noticed non-conformity or product complaints from end users to the manufacturer and authorized representative immediately.
- Maintain a copy of the EU declaration of conformity and any other relevant certificates.
Distributor responsibilities for CE marking
If you are a distributor, you are responsible for reviewing the technical documentation provided to you so that you can verify the product is safe to put on the local market. You must also be sure the product is labeled correctly with the CE marking symbol clearly visible. The technical file documentation contains all of the information that is necessary to show conformity of the product to the applicable requirements.
You should verify:
- That the device has been CE marked and that the EU declaration of conformity has been completed.
- That the device includes all the appropriate labeling, including instructions for use.
- That if imported, the importer has complied with all the EU regulations.
- When applicable, that a UDI has been assigned to the product.
Take action:
- Report any noticed non-conformity to the manufacturer, importer, and authorized representative immediately.
- If a product appears to be out of compliance to the regulations and could pose a serious risk, the information should be reported to the Competent Authority, and to the manufacturer, importer and authorized representative.
- Any complaints or reports from end users about the product should be reported to the manufacturer and, if necessary, to the importer and authorized representative.
Important note: If the importer or distributor markets the product under their own company name, then they become responsible for CE marketing, and take over that role from the manufacturer.
CE marking is mandatory when importing products into the European Union, which is part of the larger European Economic Area (EEA). The EEA Agreement, established in 1992 and made official in 1994, is an international agreement that enables the extension of the European Union’s single market to non-EU members. It consists of the 27 EU countries plus the four European Free Trade Association (EFTA) countries - Iceland, Liechtenstein, Norway and Switzerland. Today, the EFTA has 29 Free Trade Agreements (FTAs) with 40 countries and territories outside the EU. Because these countries operate in the single market, this allows free movement of goods and services across all of the EEA.
Source: European Environment Agency (EEA).
All medical devices sold in the EU require a CE mark. While a CE mark is not required for items such as chemicals and pharmaceuticals, it can be required for combination devices and medical device software. For these two situations, how do you know if your product requires a CE mark?
To continue reading this ebook, including an overview of CE mark costs, and the associated technical documentation/general safety and performance requirements (GSPRs) that manufacturers are required to maintain please register to download the full version
%2520(1755%2520x%2520550%2520px)%2520(855%2520x%2520268%2520px).avif)
Why a RIM System is Critical to Successfully Support MedTech M&A Activities
There was significant M&A activity in the MedTech sector in 2024, and the industry is predicting another big year for mergers and acquisitions. As MedTech companies aim to expand their product lines, enter new markets, innovate faster, and remain competitive in a rapidly evolving space, mergers and acquisitions can be attractive and cost-efficient options. Additionally, some manufacturers are choosing to divest parts of their business to hone their focus, drive additional investment in other key areas, and optimize operations.
For the regulatory affairs professional, M&A activities can be anything but efficient. An influx of new products, registrations, and regulatory information to maintain can wreak havoc on RA teams who are already struggling to effectively manage and maintain compliance amid a seemingly constant state of regulatory change.
In an increasingly complex regulatory landscape, many MedTech teams are turning to RIM systems to help them centralize regulatory information across the business, automate time-consuming, manual processes, and strengthen global compliance. These benefits are even more palpable for companies undergoing mergers, acquisitions, and divestitures, giving them streamlined, fully visible regulatory information management that can scale with their evolving business needs and additional regulatory information to manage.
Case Study: Large, Publicly Traded Device Manufacturer Navigates Product Line Divestiture with Ease
A large, publicly traded manufacturer of products for pain management, digestive health, and IV therapy was in the process of divesting one of its product lines to another company. As a result, some of their regulatory employees were transitioned to the company that purchased its product line. The customer leveraged Rimsys’ unique Linked Accounts feature, which allows users to grant external stakeholders controlled access to Rimsys, to give those impacted access to the 100+ registrations associated with the divested products. As a result, the transitioned employees lost no access to their respective products and are able to manage, review, and approve those registrations as they normally would.
“Linked Accounts is a fantastic feature that I didn’t originally appreciate as much. Rimsys made it easy for us to identify the products impacted by the divestiture and provide access to those who need them. It has been a bright spot in the sea of headaches both teams are experiencing when trying to review and approve information in other systems.”
-Program Manager, Regulatory Information Management
When the transaction is complete, the customer will easily be able to export the list of registrations by product tag and archive the registrations in Rimsys for easy management and visibility. The transitioned employees will also still retain access to the information they need in Rimsys as they work to implement their own Rimsys solution to manage those registrations.
Navigating Business and Regulatory Changes with RIM Systems
As the MedTech industry prepares for additional mergers, acquisitions, and divestitures this year, getting a solid regulatory information foundation in place is critical for a successful transition and ongoing compliance. Yet, many MedTech RA teams are using manual processes and siloed systems to manage regulatory information.
One of Rimsys’ goals is to serve as a strategic partner to MedTech RA teams, helping them better understand their current RIM state and the steps they need to advance their processes. This includes the implementation of a RIM system such as Rimsys to centralize their regulatory information, enable easy collaboration with internal and external stakeholders, and automate time-consuming manual processes for strengthened global compliance.
See our Guide to MedTech RIM Maturity, which provides our RIM Maturity Model Framework, for ways to better assess your organization’s current RIM state and incrementally reach new milestones.
Rimsys has helped global MedTech leaders navigate business and regulatory change with unified RIM software that provides full visibility into their regulatory activities. If you’re looking to stay ahead of upcoming strategic activities or are simply looking for a better way to manage your information amid increasing complexity, contact us to learn how Rimsys can help you streamline and automate your processes for long-term success.
Rimsys POV: Updated EUDAMED timeline
The EU Commission has recently announced updates for completing and implementing EUDAMED based on amendment 2024/1860. This article outlines the current EUDAMED timelines and our point of view on these timelines to help industry prepare accordingly.
Current EUDAMED Timelines:
- The target date for the first mandatory application of functional EUDAMED modules is still January 1, 2026. The Vigilance module is expected to be mandatory beginning in Q3 2026 with full EUDAMED functionality planned for Q2 2027.
- The Actor, UDI & Devices, Certificates, and Market Surveillance modules are currently under audit. The independent Minimum Viable Product (MVP) audit is intended to assess and confirm functionality and interconnectivity of the modules that are deemed audit ready. This audit is foreseen to be completed by Q2 2025.
- Mandatory use of each module is to commence six (6) months after the module is declared fully functional through the independent audit and publication in the Official Journal of the European Union (OJEU). The Actor, UDI & Devices, Certificates, and Market Surveillance modules are expected to be declared fully functional at the end of Q2 2025, leading to their mandatory application date of January 1, 2026.
- The Actor, UDI & Devices, Certificates, and Market Surveillance modules are expected to be declared fully functional by the end of Q2 2025 and mandatory for industry use on January 1, 2026.
- The Vigilance module is not part of the ongoing MVP audit and will not be declared fully functional along with the previously mentioned modules. The revised timeline indicates that the audit of that module will occur between Q2 and Q3 of 2025, with the goal of the mandatory application date in Q2 of 2026.
- The development of the Clinical Investigation/Performance Studies (“CI/PS”) module is intended to continue through Q3 2026. An audit to assess the CI/PS module together with the other five (5) modules will be completed once the CI/PS MVP has been developed.
Photo courtesy of the European Commission
Here is how Rimsys views the impact of this announcement for each stakeholder group:
Rimsys
UDI is front of mind as well as future interaction with the Vigilance module. There is no change to our current plans, as Rimsys will continue to develop UDI and Post Market Surveillance functionality regardless of the updated target dates. We also recognize the potential impact of establishing data transfer (DTX) capabilities to interact with EUDAMED in a machine-to-machine (M2M) capacity. With the publication of the final requirements needed for M2M DTX to EUDAMED, Rimsys is positioned to finalize our connection and deliver M2M capabilities as part of the EUDAMED solution.
Industry/customer
Since the European Commission(EC) has made multiple updates to EUDAMED timelines, we expect industry will have some reluctance to accept the new target dates. As a result, this could delay re-engagement with EUDAMED preparations. However, we do not expect the EC to push these updated timelines. Manufacturers that don’t have a plan to submit data to EUDAMED by Q2 this year should expect significant challenges to meet these deadlines. With the audit of expected modules underway with the associated technical documentation published, Rimsys recommends taking steps to organize regulatory data now and submit their information early to all available EUDAMED modules.
EU Commission
The EC strongly recommends industry continues to establish its solution and to submit data on a voluntary basis. Do not wait. The commission’s position is that submitting data early will give companies an advantage by having their data “in” before the onslaught of the entire global MedTech industry, all trying to add data at the same time EUDAMED becomes mandatory. These companies will also be in front of the line to work with the commission resources if data submission issues occur.
* Note - this article includes regulatory interpretations and opinions from the Rimsys team. We try to be as informative as possible, but this information isn’t intended to serve as a substitute for official guidance from regulatory authorities.
%2520(1).avif)
Using EUDAMED as the Foundation for a Global UDI Strategy
If your company is selling medical devices in the European Union, you’re likely thinking about EUDAMED. If you’re not, it's time to start. Come January 2026, medical device manufacturers will be required to submit their UDI data to EUDAMED. EUDAMED’s data requirements and interconnectivity are complex. Not only is it easy to underestimate the time it will take to organize and verify UDI data, but many manufacturers are still using manual processes such as spreadsheets or internally built systems to manage this information. And with a number of organizations treating UDI data management and submission as an IT or supply chain process, some RA teams don’t even know where their UDI data is.
Getting your UDI data EUDAMED ready for submission by January 2026 is going to take some time, but there is a tremendous opportunity amidst the extensive preparation. With a little bit of foresight, RA teams can position the data output of their EUDAMED compliance project as the foundation for a global UDI program. Here are some reasons why using EUDAMED as the primary building block for a global UDI strategy will enable long-term success:
The product data needed for EUDAMED can be applied to current and future global UDI requirements
With many required data attributes and Basic UDI family groupings, establishing EUDAMED compliance for UDI is going to take some careful planning, detailed organization of current data, and careful consideration of your regulatory strategy for the European market. Many manufacturers need to start with the basics: locating current UDI data to understand how it is currently managed and transmitted to the respective regulatory bodies. This process is also going to require an assessment of your UDI data. Do you have information populated for all of the required attributes?Is this information current and accurate? Finding answers to these questions is going to take thoughtful collaboration among all stakeholders, but it’s also going to set your organization up with a solid data foundation that will help you meet additional market requirements.
It’s going to require an audit of your people, processes, and systems
Industry is focused on establishing UDI data in EUDAMED to align with current requirements for timing but transmitting your UDI interaction with EUDAMED is not a one-time process as it may be currently treated for other regulators. New devices, device changes, UDI data updates, and commercial availability may require EUDAMED updates or establishing new UDI profiles altogether. Are your current processes able to support you long-term? Manual processes are going to make it nearly impossible to keep pace and compliance, and internally built systems are going to require regular validation and subject matter expertise to keep up with evolving requirements and EUDAMED version updates. Taking the time to make sure you have the proper expertise and systems to maintain EUDAMED compliance will more easily allow you to scale your UDI management as your business grows and the regulatory landscape evolves.
The risks of non-compliance are too steep to ignore
Those who fail to submit UDI data to EUDAMED in line with the required timelines are at risk of audit findings, financial penalties, product delays, and worst of all, having to remove products from the market. Not only does product removal have lasting productivity, competitive, and economic impacts on the manufacturer, but it also decreases the availability of life-changing medical devices to end users. These risks are simply too significant to ignore and necessitate a comprehensive global compliance strategy that can meet the needs for EUDAMED and additional countries as global regulations change.
Additional regulators are establishing UDI requirements and big data technologies
As the value of UDI is recognized, More global markets are adopting UDI requirements to enhance the traceability of their devices and improve patient safety. For instance, Australia has established UDI requirements with mandatory compliance for data submission expected in the summer of 2025. Additionally, Rimsys expects the competent authorities from Switzerland and the United Kingdom to adopt their own UDI requirements following their exit from the European Union. Even though each regulator has varying requirements to some degree, organizing product data to meet EUDAMED’s robust set of data attributes and requirements will put you in a position to more easily meet additional global UDI requirements.
How Rimsys supports a global UDI strategy
Both the regulatory and technology requirements for UDI continue to grow in complexity. Rimsys has an integrated, automated UDI solution that provides medical device manufacturers the ability to manage their UDI data alongside their regulatory activities for total visibility and control.
Not only does Rimsys have the expertise necessary to help MedTech manufacturers navigate UDI data and transmission to EUDAMED for January 2026, but we're also dedicated to supporting MedTech companies with solutions and strategies that go beyond EUDAMED compliance to support a scalable and efficient global UDI program to meet the needs of evolving regulatory requirements. Rimsys provides MedTech manufacturers with a single-sourced UDI solution that allows them to manage their UDI data and status alongside regulatory activities.
Our novel Universal UDI® approach centrally stores common data attributes across global markets for simple management, reduced compliance risk, and increased efficiency. Using data established in Rimsys for EUDAMED as a baseline, we’re enabling MedTech companies to more easily meet additional global UDI requirements in a unified RIM solution that applies these common attributes between various market requirements (with more coming soon!):
Ready to increase your team’s efficiency and compliance with integrated and automated UDI management to support your long-term goals? Request a custom Rimsys UDI demo here!
%2520(1).avif)
Assessing RIM Maturity: Takeaways from our Expert Panel
Rimsys recently hosted a webinar, Assessing RIM Maturity for Your Regulatory Management Strategy, to help RA teams put together a practical RIM transformation plan for their MedTech company. Featuring industry leaders, Adrian Bishop of Boston Scientific, Brian Williams of KPMG, Steve Gens of Gens Associates, and James Gianoutsos of Rimsys, the discussion centered on the evolving MedTech regulatory information management (RIM) landscape, using the RIM Maturity Model Framework to guide your regulatory information management strategy, a RIM maturity case study, and AI’s role in regulatory information management. Here's a quick recap of the insights we discussed:
The Growing Need for MedTech RIM Modernization
The session underscored the increasing complexity of global regulatory requirements in the MedTech sector. From EU MDR to the adoption of EUDAMED, the shifting regulatory environment is pushing companies to modernize their RIM processes to ensure compliance and avoid operational inefficiencies. Steve Gens shared key insights from his 2024 World Class RIM Study research that by 2024, 52% of life sciences companies had fully adopted global RIM programs, a significant leap from 32% in 2022. However, many MedTech organizations remain in the early stages of RIM maturity, reflecting the need for process harmonization and robust digital solutions.
“The manual nature of spreadsheets and desktop authoring tools is no longer sustainable with all the different regulations and the global operating model that most companies have where you're trying to quickly get submissions out to different markets and then have to keep track of where your products are registered and where there are renewals, and where there are expiration dates. Having that information in informal spreadsheets and SharePoint sites is really not sustainable and creates a lot of compliance risks." - Brian Williams, KPMG
The RIM Maturity Model: A Framework for Transformation Progress
Our panel also explored the new RIM Maturity Model framework from Rimsys, which was built to help MedTech teams modernize their processes no matter where they are in their transformation journey.
“MedTech teams want to modernize their processes but don't know where to start from a business or data collection standpoint. They don't have a framework that takes their current processes into account." - James Gianoutsos, Rimsys
The RIM Maturity Model categorizes organizations into six levels based on their current regulatory information management processes:
- Level 0 - Unaware
- Level 1 – Aware
- Level 2 – Reactive
- Level 3 – Proactive
- Level 4 – Well Managed
- Level 5 – Optimized
Most MedTech teams fall between Levels 0 and 2, relying on siloed data and manual processes and reactive regulatory information management. Progressing toward higher maturity levels involves:
- Data Harmonization: Establishing consistent definitions and processes across business units.
- Process Transformation: Moving beyond "firefighting" modes to proactive regulatory planning.
- Technology Adoption: Implementing a RIM system that centralizes data, automates tasks, and facilitates cross-functional alignment. This is a critical step to reaching fully optimized regulatory information management.
“If you're considering a RIM adoption or are already going through one, make sure you understand your own expectations. You can't get to a spacecraft without without getting into a horse and buggy, Data collection and harmonization is milestone-driven and progression-based. You're not going to get to an optimized state on Day 1. But as long as you keep continuing to make well-informed decisions with your data and aligning internally on key terms in that data digitization processes, you will… get there." - James Gianoutsos, Rimsys
"As you're progressing, you need to be really thoughtful about the cost benefit of any initiatives that you're undertaking, Make sure that you have clear objectives that can be measured and that you can report value against and really just make sure that you create recognition with your management teams and with your operational teams that this is going to be a phased journey. You're not going to get there overnight and set expectations appropriately, but try to make measurable steps along the way. And as you do that, you start to build confidence, you build awareness and you build trust that you're delivering on the kind of the objectives that you set out to deliver. It's really a journey.” - Brian Williams, KPMG
Case Study: RIM Maturity Lessons from Boston Scientific
Adrienne Bishop from Boston Scientific shared her company’s journey toward RIM maturity. After previous attempts to implement global systems, the team learned to prioritize readiness, secure buy-in from stakeholders, and leverage external expertise.
“The added benefit of a MedTech solution is also that with these external partners, we can understand what is industry standard and that can help us with our change management.” -Adrienne Bishop, Boston Scientific
Key lessons they learned include:
- Start with Data: Define data fields clearly and cross-check sources to ensure accuracy.
- Limit Customization: Avoid over-customizing solutions that can hinder transformation; instead, adopt proven industry-standard processes.
- Invest in Change Management: Equip teams with the skills and mindset to embrace transformation.
Boston Scientific’s phased approach—beginning with foundational product registration data and expanding capabilities over time—demonstrates the importance of incremental progress. Boston Scientific, for example, has made strides in adopting a RIM system by focusing on transformation rather than harmonization alone, emphasizing the importance of cross-department collaboration and clear data governance.
"The solution we picked works for other people, so we can make it work for us. We also realized that what we were doing before maybe wasn't wrong, but it was definitely inefficient. We now have different inputs and different regulations. And now we need to change to get there." - Adrienne Bishop, Boston Scientific
AI and Automation in RIM
The panel distinguished the key differences between automation and AI, noting that while automation focuses on rule-based processes, AI serves as a good starting point for handling complex, abstract tasks. While AI can reduce time spent on tasks, it’s important for RA teams to verify the source information and the outputs for accuracy.
“There's a lot of anxiety about really what AI will deliver. But I think a lot of people that have been working with it, they see it as the virtual assistant or assisting. So it's more augmentation because there's a lot of concern.” - Steve Gens, Gens and Associates
Both automation and AI are important to regulatory modernization. Specific use cases include:
- Automation: Streamlining data ingestion, workflows, and compliance monitoring.
- AI: Mining historical regulatory data, collecting regulatory research, and enhancing regulatory intelligence.
Despite the attention around AI, the panel emphasized that its effectiveness hinges on high-quality, harmonized data. Poor data foundations can render even the most advanced AI tools ineffective, highlighting the need for a phased, data-first approach to digital transformation.
“There are some benefits you can definitely achieve with AI. But first and foremost data is going to be the most challenging yet the most effective way to get to that holy grail that I think everybody wants out of a regulatory information management system.” - James Gianoutsos, Rimsys
Looking Ahead: The Future of RIM As the MedTech industry advances
Achieving higher levels of RIM maturity will require strategic investment in technology, data, and talent. Organizations must treat RIM modernization as a holistic transformation, integrating robust processes and aligning cross-functional teams. With automation poised to play an increasingly significant role, companies that prioritize data governance and process maturity today will be well-positioned to leverage advanced technologies like AI tomorrow.
RIM modernization is not just a compliance imperative but a competitive advantage. By adopting a structured maturity model, focusing on data quality, and embracing RIM solutions like Rimsys, MedTech organizations can streamline regulatory processes, reduce risk, and drive innovation. If your organization is considering RIM modernization, now is the time to assess where you stand and take the first steps toward a holistic transformation.
For more insights, listen to the webinar recording here!
.avif)
5 Reasons It’s Time to Stop Managing Your UDI Data in Spreadsheets
UDI data management is continuously getting more complex. Not only do global markets have varying UDI requirements, but new markets are expected to come online in the coming months. Additionally, the mandatory application of EUDAMED will begin in January of 2026, meaning that MedTech manufacturers selling products in the European Union will have to submit their UDI information to EUDAMED.
Submitting UDI information to EUDAMED will require careful and thorough preparation to ensure that manufacturers have all of the required data attributes necessary to meet the EU’s requirements and that they have a strategy in place to organize, review, and submit all of their information.
MedTech regulatory affairs processes are largely manual and siloed, and UDI management is no different. Many teams are still managing their UDI data in complex spreadsheets. While the forthcoming mandatory EUDAMED requirements have prompted many manufacturers to start planning more comprehensive UDI strategies, managing a high volume of UDI data in spreadsheets is unsustainable long term.
Efficient and scalable UDI management requires deep expertise, collaboration, and full visibility into your products’ global regulatory activities that spreadsheets simply can’t match. Here are 5 reasons it’s time to move away from managing your UDI data in spreadsheets:
1. They’re setting you up for compliance risks
UDI management involves a high volume of data across different markets and regulator IT systems. Not only are the assembly and maintenance of those data in a spreadsheet prone to human error, but they don’t enable the regulatory expertise necessary to ensure that your requirements for each applicable market are up to date. Further, siloed spreadsheets aren’t connected to systems that help you unlock regulatory insights. The responsibility is yours to make sure your spreadsheet has current, accurate, and reliable information.
With cumbersome version history and change tracking (or lack thereof), spreadsheets also lack the traceability needed for audits, making it difficult and time-consuming for MedTech companies to effectively demonstrate compliance. This not only adds time to the audit, but opens your organization up for audit findings, financial penalties, product delays, and revenue loss.
2. They’re time-consuming and difficult to manage
When multiplying the markets you’re selling in by the number of products you’re selling, it’s easy to see how complex UDI spreadsheets can get. Since there’s no automation to ensure the attributes and data in your spreadsheet are up to date, it’s up to you to validate it periodically and research the updated requirements. If you do establish a process to validate that UDI data, this adds critical time for Medtech teams that are already tasked to execute faster with limited team members. If you do not periodically validate UDI data, you take on an increased risk of non-compliance.
Additionally, new market regulatory and IT requirements make managing UDI information even more difficult each time a new market is added. With several countries expected to mandate or enact new UDI requirements and systems over the next couple of years, the complexity is only going to grow with time.
3. They limit collaboration across your team
Multiple stakeholders working within the same spreadsheet can easily create confusion. Not only is it difficult to track changes, but there’s a likelihood of overwriting critical information. This can not only lead to the compliance risks mentioned above, but spreadsheets also impact your team’s ability to effectively collaborate. Team members often duplicate the spreadsheet and work off of different versions when there are limited controls in place to prevent this from happening.
On a strategic level, spreadsheets impact your team’s ability to share knowledge with one another. There’s no way to effectively share detailed notes and tasks, and there’s also limited functionality to track transmission status and troubleshoot transmission errors with your team.
4. They don’t provide full visibility into your products’ selling statuses
UDI spreadsheets are usually designed for one purpose, UDI data management. However, UDI is just one facet of obtaining market clearance for your product. The product must also be approved and registered in each respective market. Many manufacturers have multiple teams and spreadsheets to track regulatory activities where UDI responsibilities may lie outside of the regulatory team. This approach limits their ability to get full visibility into the status of their products and integrate this information with other relevant applications across the business. With regulatory information scattered and siloed, it’s easy to miss the connection between UDI data and upcoming expirations and renewals.
5. They don’t easily scale with your business and growing market requirements
As you create new products and bring existing ones into new markets, do you have a plan in place to help you scale effectively? The regulatory activities along with the expanding UDI requirements associated with new product introductions and market expansions are high enough, and spreadsheets simply can’t keep pace with business growth.
Moving your UDI management off spreadsheets is going to set you up for a successful, long-term UDI program. MedTech companies not only need to be aware of the forthcoming mandatory EUDAMED application timelines, but they also need a sustainable solution as additional UDI requirements come online. Finding a solution that’s built with the complexities of UDI data management in mind, automates time-consuming, manual processes, and offers complete visibility into all of your regulatory activities is going to help you ensure that your UDI program is compliant and scalable to meet your evolving business needs.
The Rimsys RIM platform allows you to manage your UDI program in a single-sourced, unified, and connected solution that enables you to track your UDI activities alongside your product registrations and selling status to give you confidence in your compliance. Additionally, Rimsys has a novel Universal UDI approach that captures common attributes across various market requirements to reduce administrative burden and help you submit your UDI information consistently and with ease.
Want to see how a purpose-built MedTech RIM solution can offer you a compliant, scalable, and comprehensive approach to UDI management? Request a demo to see Rimsys in action!
.avif)
Rimsys secures $5 million in growth financing round
Rimsys recently secured $5 million in a growth financing round from Global Opportunity Pennsylvania Fund II, L.P. (GO PA Fund), Riverfront Ventures, and existing investor, Innovation Works. GO PA Fund, Riverfront Ventures, and Innovation Works have a strong commitment to fostering innovation and creativity in Pennsylvania, which makes them great financial partners for Rimsys.
“We’re ecstatic to have support from GO PA Fund, Riverfront, and existing investors as we enter a new growth phase at Rimsys,” said James Gianoutsos, Rimsys Founder and CEO. “Our next phase of growth builds on our mission to increase accessibility to life-changing medical technologies with a focus on regulatory intelligence, submissions management, and UDI enhancements and thoughtfully incorporating advanced technologies like AI into our roadmap to meet growing demand and changing global regulatory requirements. We are grateful to work with firms that are committed to nurturing innovation in the Pittsburgh region, which has given so much opportunity to us.”
Our growth financing will help ensure that Rimsys provides a world-class, unified regulatory information management (RIM) solution for the medtech industry and that it meets the challenges that come with a frequently evolving regulatory landscape.
Those interested in learning more can read the press release from GO PA Fund and a recent Post-Gazette interview with our founder, James Gianoutsos:
ABOUT GO PA FUND
Formed by Ben Franklin Technology Partners of Southeastern Pennsylvania, with collaboration from Ben Franklin of Northeastern Pennsylvania, Ben Franklin of Central and Northern Pennsylvania, and Innovations Works from Southwestern Pennsylvania, the GO PA Fund invests in technology-based ventures throughout the Commonwealth of Pennsylvania. The GO PA Fund primarily invests as a follow-on fund to companies selected from Ben Franklin’s statewide portfolio of more than 600 burgeoning ventures throughout Pennsylvania. The Fund leverages Ben Franklin’s best-in-class multi-year/multi-round due diligence to ensure access to qualified and vetted opportunities while minimizing costs of investment. Visit us at gopafund.com.
ABOUT BEN FRANKLIN TECHNOLOGY PARTNERS OF SOUTHEASTERN PENNSYLVANIA
Ben Franklin Technology Partners of Southeastern Pennsylvania (“Ben Franklin”) is the Philadelphia region’s Partners with a Purpose. Nationally ranked among the most active seed and early-stage investors, Ben Franklin helps high-growth innovative enterprises plant and nurture their roots, creating both immediate connections and lasting economic growth. The nonprofit has supported more than 2,000 companies to deliver an impact of more than $5 billion and 32,000 jobs in the Philadelphia region. Whether in tech, life sciences, manufacturing, or industries and breakthroughs yet discovered, Ben Franklin works to raise the community of innovation higher, to benefit present and future generations of Pennsylvanians. Visit us at partnerswithapurpose.org, or follow us at @bftp_sep.
ABOUT INNOVATION WORKS
Innovation Works is one of the most active early-stage investors in the country and the most active in Pennsylvania. Since its inception of the seed fund in 1999, Innovation Works has invested in over 760 companies that have gone on to raise $3.3 billion in follow-on funding. Portfolio companies have generated and retained over 20,000 jobs in Pennsylvania. Innovation Works is part of the Ben Franklin Technology Partners network, which has catalyzed economic growth over the last 30 years by providing access to capital and networks that help foster innovation and technology-based economic development in Pennsylvania. Learn more at innovationworks.org.
ABOUT RIVERFRONT VENTURES
Riverfront Ventures is an early-stage venture capital fund based in Pittsburgh, PA focused on investing in early-growth stage tech companies. Learn more at riverfrontventures.com.
ABOUT RIMSYS
Rimsys is improving global health by accelerating delivery and increasing availability of life-changing medical technologies. Rimsys Regulatory Information Management (RIM) software digitizes and automates regulatory activities, helping medtech regulatory affairs teams to plan more effectively, execute more quickly, and confidently ensure global regulatory compliance. Rimsys is designed around medtech workflows and supports a full breadth of regulatory activities including registrations, submissions, UDI, essential principles, and standards management in a single, integrated platform. For more information, visit www.rimsys.io.
