Rimsys Announces Rimsys AI. Smarter, Faster, and Built for Medtech!

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Man and woman looking at a laptop screen together in an office setting.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
eBooks

The ultimate guide to the EU MDR and IVDR general safety and performance requirements (GSPR)

April 3, 2026

4 min read

This article is an excerpt from The ultimate guide to the EU MDR and IVDR general safety and performance requirements (GSPR) ebook.

Table of contents

Overview

With the initial rollout of the European Medical Device Regulation (MDR) complete, medical device companies are shifting focus to the sister In Vitro Diagnostic Regulation (IVDR) which has rolling effective dates starting in May 2022. Like the MDR, the IVDR also includes new General Safety and Performance Requirements (GSPR). The expanded 2nd edition of this ebook includes a detailed summary of the IVDR GSPR regulations in addition to those of the MDR. It provides you with practical guidance on how to meet the GSPR requirements for all types of medical technology products. This ebook, however, should not take the place of reviewing the actual regulations and consulting regulatory experts when needed

Timeline

The EU MDR submission became mandatory from the previous MDD directive on May 26, 2021, and the EU IVDR effective date is quickly approaching. In fact, all submissions for new devices under the new EU IVDR must be implemented no later than May 25, 2022. Below is a high-level overview of key dates for both regulations.

*Note that the timeline for compliance was extended in 2021. Class D (high-risk) devices have until 2025 to comply with IVDR, while Class C devices have until 2026. Class B and Class A sterile devices have until 2027 to comply with IVDR.

Terminology

What’s the difference between Essential Requirements, General Safety and Performance Requirements (GSPR), and Essential Principles. In order to have a meaningful dialogue, let’s first discuss the three (3) main terms used in the industry.

#1 Essential requirements

The ‘Essential Requirements’ is the backbone for establishing conformity with the Medical Device Directive (MDD 93/42/EEC) and the Active Implantable Medical Device Directive (AIMDD 90/385/EEC).  Detailed within Annex I of the MDD and AIMDD, the ‘Essential Requirements’ laid out the requirements that devices must meet in order to state compliance to the directives. With the implementation of the new EU Medical Device Regulation (MDR 2017/745), the ‘Essential Requirements’ will become superseded by the new EU MDR General Safety and Performance Requirements (GSPRs).

#2 Essential principles

The IMDRF laid out Essential Principles requirements in a document entitled Essential Principles of Safety and Performance of Medical Devices and IVD Medical Devices. From a high-level perspective, three basic tenets make up these ‘Essential Principles’:

  • A device must be designed to be safe and perform effectively throughout its lifecycle.
  • Device manufacturers must maintain all design characteristics.
  • Devices must be used in a way that is consistent with how it was designed.

Many countries use the term ‘Essential Principles’ when compiling the documentation required to determine compliance to the law.  For instance, the Australian Therapeutic Goods Administration (TGA) uses the term ‘Essential Principles Checklist’. Regardless of the term used, Essential Principles are of similar nature and overlap many of the Essential Requirements and new GSPRs.

#3 General safety and performance requirements (GSPR)

As of May 26, 2021, medical device manufacturers must start to comply with Annex I – General Safety and Performance Requirements (GSPRs) of the new EU Medical Device Regulation (MDR 2017/745).  GSPRs are specific to the European MDR and IVDR. If you hear any other term (i.e. Essential Principles), it most likely means it is not referencing the European market.

EU MDR/IVDR Annex I

Annex I of the EU MDR and IVDR details the specific requirements of the General Safety and Performance Requirements (GSPRs). The GSPRs are broken down into three (3) chapters in Annex I, MDR 2017/745 and IVDR 2017/746:

  • Chapter 1 - General requirements
  • Chapter 2 - Requirements regarding design and manufacture
  • Chapter 3 - Requirements regarding the information supplied with the device

Chapter 1 - General requirements

Both the EU MDR and the EU IVDR outline General Safety and Performance Requirements (GSPRs) in great detail for medical device designers and manufacturers. The general requirements for each are almost identical and consist of the following:

  • Devices must perform in a way that aligns with the intended design.
  • They must not compromise the health or safety of a patient, user, or any other person associated with the device.
  • Risks must be reduced as much as possible, but not so much that they negatively affect the risk-benefit ratio.
  • Device manufacturers must implement and maintain a thorough, well-documented, and evaluative risk management system that continues to be updated throughout the life cycle of a device.
  • Manufacturers and designers must include any necessary measures for protecting users in cases where risks cannot be completely eliminated.
  • Manufacturers must provide users with information about any potential risks that remain. This information must be clear, easy to understand, and considerate of the users’ technical knowledge level, use environment, and any applicable medical conditions.
  • Devices must withstand the stresses of normal use for the duration of their lifecycle. Devices must be designed, manufactured, and packaged in a way that protects them from damage during transport and storage.
  • When it comes to risks and negative side effects that are known and foreseeable, designers and manufacturers must make every effort to minimize negative outcomes. They must also ensure that potential risks are acceptable when compared to the potential benefits of a device to its users.

Chapter 2 - Requirements regarding design and manufacture

The GSPRs also provide key details regarding specific information about the performance, design and manufacture of medical devices. As it relates to design inputs, the MDR and IVDR GSPRs provide highly detailed requirements relating to a device’s technical information. Further detail can be found in the comparison tables in Appendix A and Appendix B, where we have compared MDR to MDD and IVDR to IVDD.

Chapter 3 - Requirements regarding the information supplied with the device

The final key area of governance within the GSPRs relates to specific information a manufacturer must supply with a device. The general requirements for this information states that, “Each device shall be accompanied by the information needed to identify the device and its manufacturer, and by any safety and performance information relevant to the user, or any other person, as appropriate.” The requirements provide further detail as far as location - specific information that must be provided on the following:

  • The device label includes its UDI.
  • The user instructions.
  • The packaging of a device that is intended to maintain its sterile condition.

Medical devices are subject to significant regulations and a full understanding of EU MDR and/or IVDR labeling as defined in Annex 1 Chapter 3.

EU MDR/IVDR Annex II

In addition to the specific requirements identified within Annex I of the EU MDR and IVDR, Annex II, Technical Documentation, identifies additional requirements. Specifically, in both EU MDR and IVDR’s Section 4 – General Safety and Performance Requirements it states:

“the documentation shall contain information for the demonstration of conformity with the general safety and performance requirements set out in Annex I that are applicable to the device taking into account its intended purpose, and shall include a justification, validation and verification of the solutions adopted to meet those requirements. The demonstration of conformity shall include:

(a) the general safety and performance requirements that apply to the device and an explanation as to why others do not apply;

(b) the method or methods used to demonstrate conformity with each applicable general safety and performance requirement;

(c) the harmonised standards, CS or other solutions applied; and

(d) the precise identity of the controlled documents offering evidence of conformity with each harmonised standard, CS or other method applied to demonstrate conformity with the general safety and performance requirements. The information referred to under this point shall incorporate a cross reference to the location of such evidence within the full technical documentation and, if applicable, the summary technical documentation.”

Let’s break this down into each part.

Requirement

(a) the general safety and performance requirements that apply to the device and an explanation as to why others do not apply;

What needs to be documented for the requirements that apply or the requirements that do not apply?

Each and every section of the EU MDR GSPR or EU IVDR should be assessed in its own right as it pertains to your medical device. When a requirement applies, a simple statement may be made that this requirement applies to the device. In practice this is often achieved using a checklist or table, with a column for applicability and a Yes/No answer against each requirement. When a requirement applies, you can move on to the other parts of demonstrating conformity regarding methods used and standards applied.

When a requirement is not applicable, a statement must be made to that effect, i.e. a ‘No’ in the applicability column. Additionally, it must be fully and properly justified. Such a justification may be something like ‘The device is not powered and is therefore not an active device. This requirement does not apply.' The justification should clearly state why the requirement has been deemed not to apply so that your notified body can understand your reasoning

Requirement

(b) the method or methods used to demonstrate conformity with each applicable general safety and performance requirement;

What is meant by “method or methods used”?

This relates to the way you complied with that GSPR requirement, historically it would be listed as a standard or other documentation reference that you have applied to demonstrate compliance, however, the question of ‘method or methods used’ is new to the MDR and it is expected that a verbal description be provided such as:

i. Risk analysis weighed against clinical evaluation benefit
ii. Performance intended demonstrated by design requirements, verification and validation

Requirement

(c) the harmonized standards, common standards (CS) or other solutions applied;

What are harmonized standards, common specifications (CS), and “other solutions”?

Harmonized standards

These are standards that have been specifically developed and assessed for compliance to a regulation or directive. They are published in the Official Journal of the European Union (sometimes just referred to as ‘the OJ’) and if you comply with these standards then there is a ‘presumption of conformity’ with that directive or regulation to which they have been harmonized. These harmonized standards can only be created by a recognized European Standard Organization (such as CEN or CENELEC). When a standard is harmonized, an annex is added that describes how the standard conforms to the directive or regulation. When using harmonized standards, you should make sure that you understand how the standard conforms so that you do not claim compliance when the standard either does not meet that requirement or only partially meets that requirement.

If a standard does not meet a certain requirement of the directive or regulation, or indeed only partially meets it, then you must employ additional mechanisms for compliance. If a harmonized standard meets part of a directive or regulation, then by complying with that standard you also fully meet the corresponding requirement(s) The list of harmonized standards continues to grow - refer to the “Healthcare Engineering” section of the European Commission’s Harmonized Standards page for current information. In this case, using an MDD harmonized standard and documenting a justification for doing so (i.e. how you believe the standard demonstrates compliance with the GSPRs), should provide sufficient evidence

Common specifications

Common Specifications (CS) are a new concept in the MDR. They allow the European Union to add additional requirements that must be met in order to claim compliance where harmonized standards do not exist or where relevant standards are considered insufficient. The definition of a Common Specification is:

‘A set of technical and/or clinical requirements, other than a standard, that provides a means of complying with the legal obligations applicable to a device, process or system.’

Requirement

(d) the precise identity of the controlled documents offering evidence of conformity with each harmonized standard, CS or other method applied to demonstrate conformity with the general safety and performance requirements. The information referred to under this point shall incorporate a cross- reference to the location of such evidence within the full technical documentation and, if applicable, the summary technical documentation;

What is the expectation for incorporating a "cross-reference to the location of such evidence within the full technical documentation"?

This means that someone looking at the document should be able to identify exactly where in the technical documentation that the compliance evidence can be found. For example, this may refer to test reports and their exact location, or it could even reference locations within a large document, depending on the GSPR and your particular documentation. (i.e. if you have included usability risks as part of a larger risk assessment, you may need to say ‘See Technical File XXX, Section XX, Doc RMF001 rev 3 lines 65-78’). In other cases it could just mean the whole document reference, i.e. Have you done risk management? – then yes, it is RMF001 rev 3. What the specific reference actually is depends on how you have managed your technical documentation and how defined it is (i.e. separate reports or one big one). There should be no ambiguity as to where the document is located

An example of a completed GSPR checklist could look something like this (applicable and nonapplicable examples are shown):

GSPR Description Applicable? Methods Applied Standards & Solutions Evidence
7 Devices shall be designed, manufactured, and packaged in such a way that their characteristics and performance during their intended use are not adversely affected during transport and storage, for example, through fluctuations of temperature and humidity, taking account of the instructions and information provided by the manufacturer Yes Design considers packaging requirements. Packaged product has been verified through shipping and transit testing. Product was stored at extremes of temperature and humidity. EN ISO 13585 QMS
EN ISO 15223-1
Labelling
ISTA 2A Testing
Design procedure XXXXXX, rev XX located in document management system
QMS certificate XXXXXX
Package design drawings XXXXXX, rev XX located in document management system
Product label XXXXXXX, rev XX found in section XX of Tech File XX ISTA 2A test report title XXXXX, dated XX/XX/XX found in section XX of Tech File XX
Storage condition test report title XXXXX, dated XX/XX/XX found in section XX of Tech File XX
11.5 Devices labelled as sterile shall be processed, manufactured, packaged and sterilised by means of appropraite, validated methods. No N/A - This does not apply to this device (device id XXXXX) as it is not a sterile device and cannot be sterilised. N/A - This does not apply to this device (device id XXXXX) as it is not a sterile device and cannot be sterilised. N/A - This does not apply to this device (device id XXXXX) as it is not a sterile device and cannot be sterilised.

Proactive monitoring & maintenance

Specification developers and manufacturers must continually maintain their technical documentation to stay compliant. Part of this process is to ensure that they take into account the "generally acknowledged state of the art".

Proactive monitoring

'State of the art'

There is no formal definition of ‘state of the art’ within the EU MDR or IVDR, although it is mentioned many times. ‘State of the art’ is an ongoing debate; however, it generally means that it embodies what is currently and generally accepted as good practice in the medtech industry. The ‘state of the art’ does not necessarily imply the most technologically advanced solution.

One consensus on state of the art is being up to date and compliant with the current and in effect standards that are applicable to your device. This means that if a standard is updated that your medical device is compliant with, you must evaluate that update to ensure that it would meet the EU MDR or EU IVDR ‘state of the art’ requirement. This is not a new requirement from the EU MDD but it is spelled out more clearly in the EU MDR.

The specification developer or manufacturer is ultimately responsible for determining if the updated standard applies or does not apply to their device(s). Either way, the justification should be documented within a gap analysis.

Monitoring for changes

Of course, 'state of the art' only applies if you actually know if something changed. This is why you need to develop a process for monitoring the standards that compliance is claimed. Every single standard that is associated with your technical documentation must be actively monitored, reviewed, and reported on.

If you have a product on the market and need a better way to monitor and maintain your General Safety and Performance Requirements (GSPR) or Essential Principles, Rimsys can help. Rimsys digitizes and automates GSPR and Essential Requirements so you can dynamically update and proactively monitor changing standards and evidence files.

When a standard or evidence file changes, you will automatically be notified and can update one GSPR or all of your GSPRs as applicable with a single click of a button. If additional information is needed, such as testing, it’s also invaluable to ensure that all devices are identified. What used to take weeks of manual, error-prone administrative tasks is now done in seconds within a fully validated, secure, maintenance-free, cloud-based solution

Maintenance

Maintaining and updating your technical documentation is generally the hardest part of staying compliant. Robust processes must be established to ensure nothing slips through the cracks and show up as nonconformances during regulatory audits.

Gap analysis

In addition to meeting the ‘state of the art’ requirements and the continuous proactive monitoring of standards, once a change has been detected that affects the technical documentation, a proper and thorough gap analysis must be completed.

The gap analysis between the old versions and the new versions, or an evaluation of a brand new standard, must occur and be properly documented. The gap analysis should detail what is applicable and what is not applicable, with your supporting justification.

If something within the new or revised standard was applicable to your device, additional engineering testing, documentation, justification, and, in some instances design changes, may be needed to ensure compliance

GSPR updates

Once the gap analysis has been properly documented, specification developers and manufacturers must update their GSPRs.

These updates include finding the withdrawn or superseded standard or evidence file throughout each row within your GSPR table, for every single device on the market on which this change is applicable. This could be one table or dozens of tables depending on the complexity of the products and your product mix.

Without a holistic RIM system to help you, this is an error-prone process as is it tedious, administrative, and extremely easy to miss an inappropriate referenced standard or evidence file.

Extreme diligence on the regulatory or engineering team must occur to ensure these critical updates to the GSPRs are not missed and a gap analysis must be properly referenced throughout. Any justification for including or excluding a new standard or evidence file will be scrutinized by regulatory auditors, and without proper maintenance, may lead to additional review time.

Comparison table: EU MDR Annex I GSPRs vs EU MDD Annex I Essential Principles

To continue reading this eBook including Comparison Table of the EU MDR Annex I GSPR vs. the EU MDD Annex I Essential Requirements, please register to download the full version.

eBooks

The beginner's guide to the FDA PMA submission process

April 3, 2026

4 min read

This article is an excerpt from The beginner's guide to the FDA PMA submission process ebook.

Table of Contents

Introduction

If your organization is planning to market a new medical device in the United States, you first need to determine which regulatory class the device falls under. The vast majority of medical devices regulated by the FDA are either Class I or Class II medical devices, requiring a 510(k) premarket notification or a simple registration if exempt from 510(k) requirements. However, if your device sustains or supports life, is implanted, or presents a “potential unreasonable risk of illness or injury,” your device is likely a Class III device which will require Premarket Approval (PMA) from the FDA before it can be marketed in the United States. Novel devices, for which there are no existing substantially equivalent devices, are automatically classified as Class III as well. Novel devices with a lower risk profile, however, may qualify for the De Novo process instead of the PMA. Just 10% of devices regulated by the FDA are Class III devices.

This ebook provides an overview of the PMA process and its requirements, but it is not designed to be the only resource used in compiling a PMA submission. The FDA provides significant documentation on this process, starting with the regulation governing premarket approval that is located in Title 21 Code of Federal Regulations (CFR) Part 814.

Chapter 1: PMA Basics

FDA: Background and device oversight 

Before we explain what a PMA is, let’s first talk generally about the Food and Drug Administration (FDA) and device oversight. The FDA is the U.S. governmental agency responsible for overseeing medical devices, drugs, food, and tobacco products. When it comes to medical devices, the FDA’s mission is to “protect the public health by ensuring the safety, efficacy, and security of...medical devices.” At the same time, the FDA also has an interest in “advancing public health by helping to speed innovations.” In other words, the FDA’s goal is to make sure devices are safe and effective for public use, while also ensuring that devices have a quick and efficient path to market.

In order to achieve this balance of safety and efficiency, the FDA has three different levels of oversight depending on the risk level of the device: (1) exempt from premarket notification, (2) Premarket Notification, also known as 510(k), and (3) Premarket Approval (PMA). 

PMA submissions - medical device classes

When is a PMA required?

The PMA process is the most stringent regulatory process for medical device approval under the FDA and applies to almost all Class III devices. To determine whether your device requires a PMA, you must first Classify your device by searching the Product Classification Database. The database will provide you with similar devices; their name, classification, and link to the Code of Federal Regulations (CFR) if applicable.

  • If a substantial equivalent is found in the Product Classification Database with a submission type of 510(k), you should submit a 510(k), not a PMA.
  • If the product classification database identifies your device as Class III and/or requiring a PMA - you should submit a PMA.
  • If your device involves a new concept and does not have a classification regulation in the CFR, the database will list only the device type name and product code. In this case, the three-letter product code can be used to search the PMA database and the 510(k). 
  • If  your device cannot be found in the product classification database because it is a new type of device and should be classified as a Class III device because of the level of risk it presents*.

Class III devices support or sustain human life, are of substantial importance in preventing impairment of human health, or present a potential and unreasonable risk of illness or injury.

Note that if your device is a new concept without a substantial equivalent, but does not present the level of risk of a class III device, it may be eligible for the De Novo process as a class I or class II device.

PMA vs 510(k)

Not only are PMA and 510(k) processes applicable to different types of devices, they have different purposes.

510(k): A 510(k) is intended to demonstrate that the device for which approval is being sought is as safe and effective as a currently marketed device that does not require a PMA.

PMA: A PMA is intended to prove that a new device is safe and effective for the end user. A PMA is much more detailed and in-depth than a 510(k). Device manufacturers are typically required to present human clinical trial data, in addition to laboratory testing data.

The difference in complexity between a PMA and 510(k) also affects the time needed to process the submissions. The FDA typically accepts or rejects a 510(k) submission within 30-90 days, at which point the device is posted to the FDA’s 510(k) database. A PMA submission can take up to 180 days to be processed, at which point the FDA can approve or deny the application. The FDA may also issue an “approvable” or “not approvable” letter, which the applicant can choose to respond to, thereby adding time to the submission process. 

PMA application methods

There are a number of types of PMA application methods. While most devices which require a PMA will follow the traditional process, be sure to verify that you are using the correct application process to maximize your chances for success and avoid unnecessary delays:

Traditional PMA

The most common method for attaining FDA clearance for Class III devices, the traditional PMA is the appropriate option for most devices that have completed clinical testing. 

Modular PMA

The modular PMA is the appropriate application method for devices that have not yet completed clinical testing. Applicants complete individual “modules,” with final confirmation granted once all sections are completed. For additional information on specific requirements of a modular PMA, read the FDA’s Premarket Approval Application Modular Review.

Product Development Protocol

Use the Product Development Protocol (PDP) with medical devices that are based on well-established technology. The PDP process for gaining market approval merges the clinical evaluation and development of information, and involves an agreement between the manufacturer and the FDA. The process provides the advantage of early predictability for the manufacturer and allows early interaction that can identifyFDA concerns as soon as possible in the development process. Because the PDP identifies the agreed upon design and development details, a completed PDP is considered to have an approved PMA. For additional information, read more about the FDA’s PMA Application Methods.

Humanitarian Device Exemption

A Humanitarian Use Device (HUD) is specifically defined as a device intended to benefit patients that are affected by a disease or condition that affects less than 8,000 individuals in the U.S. per year. TheHumanitarian Device Exemption (HDE) approval process is designed to encourage clinical activity around rare conditions, and does have certain restrictions, including:

  • After receiving HDE approval, a HUD is eligible to be sold for profit only if the device is intended to address a disease or condition that occurs primarily in pediatric patients, or occurs in pediatric patients in small numbers.
  • If an HDE is approved to be sold for profit, the FDA will determine an annual distribution number(ADN). Any devices sold beyond the ADN limit are required to be sold for no profit.

For more information see the FDA’s explanation of the Humanitarian Device Exemption.

CBER Submissions

There are two centers within the FDA responsible for evaluating medical devices. While the majority of devices will go through the Center for Devices and Radiological Health (CDRH), some will be managed by The Center for Biologics Evaluation and Research (CBER). CBER regulates medical devices related to blood and cellular products, including blood collection and processing procedures as well as cellular therapies. This ebook focuses on submissions made through the CDRH, but you can view CBER Regulatory Submissions – Electronic and Paper for more information on the CBER process.

Chapter 2: FDA Interactions

To continue reading this eBook, including a walk through of the different types of required and optional FDA meetings and communications, a detailed list of the contents of a traditional PMA submission, and an overview of quality management system requirements, please register to download the full version.

Regulatory Briefs

An overview of 21 CFR Part 11 regulations for medical device companies

April 3, 2026

4 min read

What is 21 CFR Part 11?  

21 CFR Part 11 refers to the federal regulation that address electronic records and electronic signatures associated with FDA requirements. This single, relatively small, part of the Code of Federal Regulations is extremely significant for companies with FDA-regulated products because it impacts every document signature, electronic file, and FDA submission. Codified in 1997, interpretations of this FDA-issued regulation continue to be debated and re-evaluated as the technology supporting electronic records and signatures changes. In this article, we’ll discuss the regulation and generally accepted interpretations.

Note that discussions and statements in this document are our observations only and should not be taken as fact. You can refer directly to the regulation here.

Part 11: General Provisions

The General Provisions section of 21CFR11 addresses the scope of the regulation, when and how it should be implemented, and defines some of the key terms used. It states that the purpose of Part 11 is to define the criteria under which electronic records, electronic signatures, and handwritten signatures attached to electronic records are equivalent to, and as reliable as, handwritten signatures on paper documents.

Fundamentally, any record that is maintained, used, or submitted under any FDA records regulation is subject to Part 11, and the FDA will accept electronic records in lieu of paper records if an organization can prove that their records and systems meet the Part 11 requirements.

The General Provisions subpart also sets forth a number of definitions, and we’ve listed the ones that are most significant to our discussion here:

  • Closed System: A computer system or software whose access is controlled by the same people who are responsible for the information stored in the system. Because the opposite of a closed system, and “open system,” is subject to additional scrutiny be sure that you are able to thoroughly explain and provide documentation for a decision to classify your system as a “closed system.”  
  • Open System: A computer system or software whose access is not controlled by the same people who are responsible for the information stored in the system.
  • Digital Signature: An electronic signature created in a manner that can be verified, ensures the identity of the signer, and maintains the integrity of the document and signature. This often involves the use of cryptography and/or biometric data.
  • Electronic Signature: Symbols that represent a legally binding equivalent to an individual’s handwritten signature (as adopted and authorized by the signer).

Part 11: Electronic Records

The Electronic Records section sets forth the requirements for administration of closed and open electronic record-keeping systems, then discusses signature manifestations and requirements for establishing a link between signatures and records.

Part 11 defines a “closed system” as any computer system in which the users controlling access to the system are the same people who are responsible for the data in the system. Today, most systems can be classified as closed systems, but take special care to document control procedures around software that is hosted offsite or classified as a SaaS solution.  

This section of the regulation deals with the controls that need to be in place for all applicable electronic record systems by defining:

  • Procedures to ensure that all electronic records are authentic, have integrity, and can ensure confidentiality (where that is appropriate).
  • Validation requirements for systems that maintain electronic records to ensure that all records are accurate, reliable, and that the system performs consistently according to regulatory requirements.
  • Audit trail requirements for all regulated records to ensure a complete history of all changes to records are maintained.
  • Controls around system access and document signatures.

Part 11: Electronic Signatures

The Electronic Signatures section defines the components of electronic signatures and the required controls and procedures necessary for using them.

In general, an organization must be able to demonstrate that electronic signatures:

  • Are unique to each individual, and that the individual assigned an electronic signature has had their identity and level of authorization verified.
  • Must be based either on biometric data (such as fingerprints) or made up of two distinct pieces (ie: a User ID and password)
  • Require appropriate controls to ensure that they are verified periodically, cannot be used by someone other than the intended user, and are immediately deactivated if compromised in any way.

Practical application of 21CFR Part 11 for regulatory affairs professionals

21 CFR Part 11 is a critical regulation, and one that can be open to interpretation. Below, we cover some of the key areas that should be of concern for RA professionals. This is an overview of key areas only, and should not be taken as complete instruction or guidance for 21CFR part 11 compliance.

System compliance and validation

Any system that you are using to store electronic records that fall under FDA regulations needs to be compliant with Part 11. This includes everything from spreadsheets to full-featured RIM and document management systems.  

Software vendors will often document how their systems are developed to be compliant, and may even support system validation during implementation - but it is ultimately the responsibility of the user organization to ensure that their systems and processes are compliant with Part 11.  System validation is the process of documenting that your system meets all of the Part 11 requirements.  Software vendors can support this process by ensuring that their systems are built on a highly secured infrastructure that can be demonstrated and proven.  

The Rimsys system was built from the ground up to meet the stringent requirements of not only 21 CFR Part 11, but other industry standards and good practices guidelines (GxP).  We have put in place a rigorous validation program, built by industry experts and supported by a secure and well-documented infrastructure. For more information, visit the Rimsys Security and Privacy page.

Audit trails

Audit trails are the required system logs that track the who, when, and what of every change made to data that falls under Part 11. Audit trails should be generated and time-stamped by the system, with no ability for users to change that information. Audit trails serve two purposes under 21 CFR Part 11:

  • To demonstrate that documented policies and procedures are being followed, including that only users with the appropriate authority are managing data.
  • To prove that data retention policies are being adhered to (see below).

At any time, you should be able to view the history of any record, from a Design History File to a submission document, in order to determine what changes have been made, when they were made, and by whom.

Record retention

21 CFR Part 11 specifies that electronic records must be protected and readily available throughout the defined record retention period. Additionally, 21 CFR Part 820 specifies that records related to the quality, manufacturer, regulatory submissions, or any other data that falls under FDA regulation, should be maintained for the life of the medical device and for a minimum of two years from the date of first commercial distribution.  This is often referred to as “cradle to grave” tracking.

This means that regulatory professionals need to not only be aware of their company’s record retention policy, but need to ensure that any system being used to track regulatory submissions or other data subject to audit meets Part 11 and Part 820 requirements. Note that record retention requirements apply also to paper records where they are the source document.

Electronic and digital signatures

An important piece of 21 CFR Part 11 is its definition of electronic and digital signatures. “Electronic signature” is used to define any set of symbols that are used in place of a handwritten signature, whereas a “digital signature” is an electronic signature based on methods that ensure the identity of the signer where the integrity of the data can be verified. A digital signature can be based on biometric data (such as fingerprints) or secure user IDs and passwords that are controlled to ensure only one authorized user can use the signature.  

As a regulatory affairs professional, you should ensure that:

  • Everyone on your team who needs to sign documents has their own unique digital signature and understands the importance of protecting it. Sharing of electronic credentials is a common FDA audit observation. Also ensure that users who are not required to sign documents have appropriate access to data to discourage other users from sharing login credentials with them.
  • You are following your company’s policies concerning electronic signature audits so that passwords remain updated and strong and signatures are revoked when a user leaves or changes positions.
  • You immediately report any possible loss, theft, or sharing of user credentials or devices that generate identification codes.

While 21 CFR Part 11 is usually considered more of a “quality regulation,” it is important that regulatory teams within medical device organizations fully understand this regulation and its compliance implications.  To learn more about the regulations, click below to read our regulatory brief.

Webinars

Why UDI is a regulatory concern - and not just an operational process

April 3, 2026

Case Studies

A leading global microbiology manufacturer makes regulatory information instantly accessible

April 3, 2026

Webinars

RIM for medical devices - challenges and opportunities for automation

April 3, 2026

Blogs

The ultimate guide to the China NMPA UDI system and database

By

Michael Peach

July 17, 2021

4 min read

This article is an excerpt from The ultimate guide to the China NMPA UDI system and database ebook.

Table of Contents

Overview

The current Chinese medical device regulatory regime kicked-off in 2014 with the Regulation on Supervision and Administration of Medical Devices. This core set of registration requirements, modeled after the United States and European Union systems, established a set of device classifications (class I, II, and III) based on risk and procedures for obtaining market clearance for each type of device.

Medical devices in China are regulated by the National Medical Products Administration (NMPA). Class I devices, such as clinical laboratory equipment or non-invasive skin dressings, require only notification to the NMPA for marketing authorization, and that authorization does not expire. Class II and III devices such as implantable devices or devices with a measuring function require full registration and a formal review before market clearance can be obtained.

These initial regulations have been expanded since their introduction, adding accelerated pathways to market for certain products in certain regions, easing acceptance of clinical data from overseas, and more specific roles and responsibilities for local agents of international manufacturers. In addition, in 2019, the regulations added a provision that medical devices carry a unique device identification (UDI). China’s UDI requirements are similar to those in the US and European Union. They establish specific device ID and labeling requirements, as well as a central, state-administered database of devices.

This eBook walks through the basics of medical device UDIs, the specifics of China’s implementation, and how MedTech companies who market their devices in China can prepare for the full rollout of these regulations in the coming years.

UDI basics and benefits

A UDI is a unique alphanumeric code that is designed to identify medical devices sold in a particular country/region from manufacturing, through distribution, to use by a patient. Like other aspects of the medical device regulatory regime, the UDI system in China follows the approach taken by the United States FDA and European Commission, and is based on the guidance from the International Medical Device Regulators Forum (IMDRF). Generally, UDI systems are designed to improve patient safety and optimize care by:

  • Increasing the traceability of medical devices, including field safety corrective actions
  • Providing an unambiguous identification method for medical devices throughout distribution and use
  • Making adverse event reports more accessible
  • Reducing medical errors by providing detailed information related to the device
  • Simplifying medical device documentation and making it more consistent

There are three components to the UDI system in China:

  • UDI code: The actual UDI code can be assigned by one of three (3) issuing agencies and contains information about the product, it’s expiration date, and the manufacturing batch/lot it’s associated with.
  • UDI labeling: Put simply, medical devices must carry the UDI code on them. The regulations stipulate how devices and their packaging must be labeled for compliance.
  • UDI database: In addition to labeling, all device UDIs must be submitted to a central database that is administered by the NMPA.

The following sections explore each of these components in more detail.

The UDI code

The first element of the UDI system is the code itself. The UDI code is the alphanumeric identifier that is associated with a specific medical device. UDI codes have two (2) elements to them, the UDI device identifier (UDI-DI) or static portion, and the UDI production identifier (UDI-PI) or dynamic portion. You can see the two components in the UDI diagram below:

The UDI-DI contains information about the issuing entity—the organization that is authorized to assign UDI codes. In China, this can be one of three entities: GS1, an international barcode and electronic data interchange standards organization, and two domestic organizations: the Zhongguancun Industry & Information Research Institute (ZIIOT), and AliHealth. Additional details about the issuing agencies are covered in Chapter 2. In addition, the UDI-DI contains information about the manufacturer and the specific model or version of the device.

The UDI-PI contains information about the manufacturing and production of the device. This typically includes information about the lot or batch number in which the device was manufactured, the manufacturing date and expiration date for the device (if applicable), and the specific serial number for the device. Here you can see all of the components marked up using the same UDI example:

Note that each packaging permutation and level for a given device will need to be assigned its own UDI. So for example, let’s say that a company manufactures 5ml enteral (oral) syringes in two packaging options: 1 – packaged individually and 2 – packaged in a box of 5. Each packaging option would need its own UDI, despite the fact that the underlying product is the same.

Now looking at packaging levels, let’s assume that the manufacturer packages the single syringe offering into boxes of 6, and again into larger containers of 24. Each of those packaging options needs its own UDI as well.

Labeling

In addition to obtaining UDI code for each device as outlined in the previous section, medical device manufacturers are required to ensure that devices are appropriately labeled with the assigned UDI. This label is called the UDI Carrier. The UDI is represented in two forms on the UDI Carrier: a machine-readable form and a human-readable form.

The machine-readable form or automatic identification data capture (AIDC) is a barcode or some other technology that can be used to automatically capture UDI information. The NMPA regulations support 3 types of machine-readable formats: 1-dimensional barcode, 2-dimensional barcode, and radio-frequency identification (RFID).

The regulations note that “use of advanced automatic identification and data collection technologies is encouraged”—prompting manufacturers to use more modern 2D and RFID machine-readable carriers where possible. Note, however, that if a device uses RFID, the UDI Carrier must also include the UDI in barcode format.

The human-readable form or human-readable interpretation (HRI) is the numeric or alphanumeric code for the UDI that can be read and manually entered into systems.

The UDI Carrier should be included on the device and on all levels of packaging. The UDI Carrier must be clear and readable during the operation and use of devices. If there isn’t room on the device for both the human and machine-readable forms of the UDI, then manufacturers should prioritize the machine-readable form.

UDI database

The third component of the NMPA UDI system is the UDI database. This is a centralized database of UDI and product information, administered by the NMPA. Manufacturers are required to submit UDI information into the database within 60 days after a product is approved (for sale in China) and before it is commercialized. The database contains a more detailed product record than what is included in the UDI itself, and it is the responsibility of the manufacturer (and/or their in-country representative) to submit the information correctly, and ensure that it’s kept up to date.

Chapter 3 of this eBook goes into detail about the specific fields and data requirements for UDI database submissions.

UDI format & issuing entities

To continue reading this eBook including information about UDI format requirements and issuing entities, implementation timelines, and affected device types, please register to download the full version.

MedTech
Blogs

The ultimate guide to the EU MDR/IVDR UDI

By

Bethaney Lentz

June 22, 2021

4 min read

This article is an excerpt from The ultimate guide to the EU MDR/IVDR UDI ebook.

Table of contents

Overview

The EU Medical Device Regulation (2017/745) (“MDR”) and EU In Vitro Diagnosis Regulation (2017/746) (“IVDR”) introduce two new systems for information exchange: UDI (Unique Device Identifier) for device identification and EUDAMED (European Databank on Medical Devices) to centralize and disseminate information. UDI is a specific code assigned to all devices and higher levels of packaging. This will allow for devices being sold in the European market to be identified and traced through a globally harmonized approach. EUDAMED is the IT system developed by the European Commission to replace the EUDAMED2 database previously in place under the Medical Device Directives (MDD). EUDAMED is a multi-functional system that will be used to coordinate device registration, provide information about devices to industry professionals and the public, and highlight necessary safety details.

UDI basics and benefits

The EU MDR and IVDR UDI system is based upon the guidance of the International Medical Device Regulators Forum (IMDRF). It’s a globally harmonized system that’s designed to increase patient safety and optimize care.

UDI system goals

Increase patient safety

  • Improve tracing of devices
  • Reduce the presence of counterfeit devices

Ensure access to accurate information

  • Unambiguous identification of devices throughout distribution and use

Improve post-market surveillance

  • Improve accessibility of adverse event reports

Enhance supply chain Management

  • Streamline supply chain process and inventory management
  • Simplify medical device documentation processes

The UDI system has four key elements

Element 1 Element 2 Element 3 Element 4
Assignment of a UDI consisting of:
- Basic UDI-DI
- UDI-DI and UDI-PI
- Packaging UDI
Placing UDI on Device or Packaging through UDI Carrier Storage of UDI information by Economic Operators UDI Database to Access Information

Element 1: Assignment of UDI (UDI Components)

The first element of the UDI system is the assignment of a UDI. The UDI is a code of alphanumeric characters that acts as the access key to information about a specific medical device on the market. The EU MDR and EU IVDR requires that a UDI be assigned to all medical devices except for custom-made or investigational devices. There are three components of a UDI:

  • Basic UDI-DI
  • UDI (consisting of UDI-DI and UDI-PI)
  • Packaging UDI (Note: This is not an official term used in the EU MDR and IVDR, but we’re using it to help explain the concept. The Packing UDI is part of the UDI itself.)

1. Basic UDI-DI

The Basic UDI-DI identifies the device group that a particular device fits into. A device group is a group of products that all share the same intended purpose, risk class, essential design, and manufacturing characteristics. A device group is generally classified by medical device manufacturers as a “Product Family” or “Product Category,” depending on the internal nomenclature used within the company. The Basic UDI-DI functions as a parent or higher-level descriptor of a device.

NOTE: There can only be one Basic UDI-DI per UDI-DI.

The Basic UDI-DI is not printed on the product itself or on the packaging of a product, but rather it must be included in the following documents and applications:

  • Certificates (Including Certificate of Free Sale)
  • EU Declarations of Conformity
  • Techical Documentation
  • Summary of Safety and Clinical Performance

2. UDI (UDI-DI and UDI-PI)

The second component is the UDI itself, which consists of two parts:

Device Identifier (DI)

Production Identifier (PI)

The UDI-DI (Device Identifier DI, also referred to as “static”) identifies specific, detailed information about a particular device. If any of the below details should change, the device will need a new UDI-DI.

  • Name or trade name of the device
  • Device version or model
  • If labelled as a single use device
  • Packaged as sterile
  • Maximum number of uses
  • Need for sterilization before use
  • Quantity of devices provided in a package
  • Critical warnings or contra-indication
  • CMR/endocrine disruptors

NOTE: There can be several UDI-DIs for one Basic UDI-DI.

Meanwhile, the UDI-PI (Production Identifier PI, also referred to as "dynamic") contains manufacturing information (including serial number, lot/batch number, software identification, and manufacturing or expiry date or both types of dates.)

To better illustrate this concept of Basic UDI-DI and UDI (UDI-DI and UDI-PI), let’s use a syringe as an example. The Basic UDI-DI would identify the category of a syringe, for example, "Enteral (Oral) Syringe."

A 5ml Enteral (Oral) Syringe – Sterile (Color: Purple) would get a unique UDI-DI and a 10m Enteral (Oral) Syringe – Sterile (Color: Orange) would get a unique UDI-DI. Both products would be associated to the same Basic UDI-DI. In this case, the "Enteral (Oral) Syringe," which defines the category.

Each time that 5ml Enteral (Oral) Syringe – Sterile (Color: Purple) is manufactured at the same revision, it will get a new UDI-PI per lot. See the graphic below.

Each product is identical and therefore has the same UDI-DI. However, the UDI-PI changes to reflect the manufacturing date, lot number, expiry date, and serial number, as applicable.

The UDI will contain all device-specific information and have the same functions as the comparable database (GUDID) of the United States FDA. The main difference (in EUDAMED) is that the UDI data is divided into components of Basic UDI-DI, UDI, and Packaging UDI.

3. Packaging UDI

The third component of UDI is the Packaging UDI. (Note: This is not an official term used in the EU MDR and IVDR, but we’re using it to help explain the concept.)

Each level of packaging, except shipping containers, must receive its own unique UDI. Packaging UDI refers to the unique UDI assigned to higher levels of packaging instead of the device itself.

In the event of significant space constraints on the unit of use packaging, the UDI Carrier may be placed on the next higher packaging level.

Returning to our earlier example of syringes, if a manufacturer first packages a single sellable syringe into an individual box, this package would receive its own UDI-DI and UDI-PI.

If then the manufacturer packages those individual boxes into containers of six (6), those containers would receive their own UDI-DI and UDI-PI.

And finally, if the manufacturer packages those six (6) containers into cases of four (4), those cases would receive their own UDI-DI and UDI-PI.

Each of those levels of packaging must be assigned its own UDI-DI and UDI-PI. The initial syringe did not change, but the way it is packaged did, therefore, requiring its own UDI-DI and UDI-PI.

Element 2: Placing UDI on the device and/or packaging

The second element to the UDI system is the placing of the UDI on the device or on its packaging through what is referred to as a “UDI Carrier.” The UDI Carrier is the part of the label that contains the UDI information that is applied directly to the device or included on the device packaging. The UDI Carrier should have both a machine-readable portion (AIDC) and a human-readable portion (HRI). (Specific details about each element of the UDI will be covered in Chapter 2.)

  • Machine-readable form – AIDC – (Automatic Identification and Data Capture) is a barcode or other machine-readable technology that can be accessed automatically by scanning the UDI information.
  • Human-readable form – HRI – (Human Readable Interpretation) is the numeric or alphanumeric code, which can be manually entered into the system for access to the UDI information.

If there are space constraints limiting the use of both the AIDC and HRI on the label, then only the AIDC is required to appear. However, on devices that are intended to be used in home-health care or other non-medical facility settings, the HRI would be required to appear.

Single-use devices may contain the UDI Carrier on its lowest level of packaging rather than on the device itself.

Reusable devices must include the UDI Carrier on the device itself, unless any type of direct marking would interfere with the safety or performance of the device, or if it is not technologically feasible to directly mark the device. If so, this should be properly documented in your design history file.

Most importantly, the UDI Carrier must be readable for the intended lifecycle of the device.

Below is an example of a GS1 AIDC and HRI barcode label.

Element 3: Storage of UDI information by Economic Operators

Storage of UDI information by "Economic Operators" is the third element of the UDI system. 2017/745 Articles 2(35), 22(1), and 22(3) define an economic operator as:

  • A manufacturer
  • An authorized representative
  • A distributor
  • An importer
  • An investigator for clinical investigations
  • A person who sterilizes systems or procedure packs

Class III, implantable device:

According to EU MDR 2017/745 Annex II, the manufacturer shall keep an updated list of all UDIs that it has assigned. Economic operators and all health institutions are required to store, preferably by electronic means, the UDI of all the devices for which they have supplied or with which they have been supplied.

For Devices Other than Class III:

Member States are encouraged, and in some cases require, health institutions to store, preferably by electronic means, the UDI of the devices with which they have been supplied. The UDI must also be included in any field safety notice for reporting serious incidents and field safety corrective actions.

The EU MDR and EU IVDR also give the European Commission authority to make additional requirements regarding the submission or maintenance of UDI information. In making those decisions, the European Commission must consider six (6) areas:

  • Confidentiality and data protection
  • Risk-based approach
  • Cost-effectiveness of the additional measures
  • The need to avoid duplications in the UDI system
  • The needs of the healthcare systems of the member states
  • Harmonization with other medical device identification systems

Element 4: The UDI Database

To continue reading this eBook including information about the EUDAMED database, UDI format requirements and issuing entities, implementation timelines, and key differences between the EU and US UDI systems, please register to download the full version

MedTech
Blogs

Dispatches from RAPS Convergence: The state of regulatory tools

By

Michael Peach

June 7, 2021

4 min read

A few weeks ago we attended (virtually) the RAPS Euro Convergence conference. The event, despite the virtual format, still brought together regulatory professionals from across the European region for several days of immersive learning. At Rimsys, we took advantage of the opportunity to explore the state of regulatory tools and processes in the region, and see how they compare to those of North American teams.

Visitors to the Rimsys booth, both at RAPS Euro Convergence and at last year’s North American RAPS Convergence event were invited to fill out a short survey in exchange for the opportunity to win an Amazon gift card. While the respondents were self-selected, and the results aren’t statistically significant, they still showcase some interesting differences in the tools and mindset of regulatory affairs professionals in each region.

Regulatory tools used

Across both regions, Excel is the most commonly used tool by regulatory teams. Over half of respondents across both regions reported using Excel to manage regulatory information and processes. European regulatory affairs professionals were much more likely to use an electronic quality management system (eQMS) to manage their work, and about one-third of respondents to both surveys indicated that they used physical paper-based documents.

Tools used for regulatory processes

We also asked respondents how well their tools were working. European respondents were generally more content with their toolset with 66% saying their tools were “good”. By comparison only 22% of North American respondents felt the same. One thing that was clear was the impact of paper-based processes on satisfaction. Respondents who reported struggling with their current tools were nearly twice as likely to use paper-based processes as part of their regulatory activities.

Percent of respondents using paper-based processes

Work efficiency and satisfaction

Just over 50% of all respondents indicated that the tools they use “could be better”. This may have something to do with the amount of manual work that RA teams find themselves doing. As part of the survey we asked respondents how many hours it takes on average for them to update one of their Essential Principles / General Safety and Performance Requirements (GSPR) tables. The most common response from the EU event was 3-7 days, while those at the North American event were most likely to report greater than 7 days for the same task.

Time required to update an Essential Requirements/GSPR table

Given their slightly better estimated performance when it comes to regulatory processes, respondents from the EU were less likely to express frustration with their roles and dissatisfaction with their productivity. We asked attendees at both conferences to rate their “regulatory frustration” and satisfaction with their productivity on a scale from 1 to 5 with 1 being very frustrated/unsatisfied, and 5 being very satisfied/not frustrated at all.

Frustration and productivity

EU respondents were noticeably more positive in their assessments than our North American respondents, although everyone generally had a favorable view of their productivity.

Implications

Looking at the survey results, there are some interesting discrepancies. Teams in both regions heavily use poorly-suited tools and manual approaches to regulatory processes, yet have generally favorable views of their productivity. This points to two likely conclusions. One, that regulatory affairs professionals are particularly comfortable with a lot of manual administrative work, and two, that they’re largely unaware of the new class of regulatory information management (RIM) solutions that are specifically designed to automate and streamline regulatory workflows.

RIM platforms (like Rimsys) provide a digitized central repository for regulatory information and content, allowing RA professionals to streamline product submission, authorization, and maintenance processes (such as updating GSPR tables that we discussed earlier). RIM platforms can reduce the time and resources required to complete regulatory activities by more than 50%.

To learn more: see how global leader in the in-vitro diagnostics market automated their GSPR processes to reduce their time to creation by 50% and their maintenance time by 99%.

RIM
Blogs

Building a business case for a RIM system

By

Michael Peach

May 13, 2021

4 min read

While the space is growing quickly, regulatory information management (RIM) systems are still relatively new to a lot of medtech companies. RIM systems help companies digitize and automate regulatory activities associated with their products. They provide a central information repository for all regulatory content and streamline activities like market registrations, data capture and transmission of unique device identification (UDI), and building essential principles tables while tracking associated standards.

Given that many regulatory affairs teams still manually manage these processes through complex spreadsheets and disjointed documents, the value of an automated solution is pretty obvious, but quantifying that value—especially for teams that aren’t seasoned software acquirers—can be a bit harder. This guide provides a framework for regulatory affairs teams to quantify the potential benefits of a RIM system, and build an internal business case for investment.

Challenges with the traditional approach to regulatory affairs

While functional, there are a number of painful inefficiencies that come along with traditional approaches to regulatory processes. Without an automated way to keep track of all the information and supporting documents associated with these processes, companies struggle with:

  • Lack of visibility into regulatory data, clearance/approval status for different markets, and time-to-market metrics
  • Compliance gaps driven by disconnects between go-to-market, distribution, and regulatory affairs teams
  • Difficulty assessing the impact of, and responding to changes in standards or regulations
  • Accumulation of “tribal” knowledge among individuals that limits continuity and visibility across the organization

These pains represent specific costs to MedTech companies in the form of:

  • Staffing: Companies must over-staff regulatory affairs teams to support highly-manual processes. Expensive consultants are often brought in to help address in-house resource shortages.
  • Productivity: Regulatory affairs teams lose huge amounts of time repeatedly hunting for information (up to 50% of their time spent).
  • Lost revenue: Long application times and lack of process visibility delay market entry for new products. Non-compliance can lead to fines, or the need to pull products out of specific markets.

The automation and data consolidation/integration provided by a RIM system can significantly reduce these costs, and provide a clear, measurable return on investment.

Additional benefits of a RIM system

In addition to the addressing the pains outlined above, RIM systems can provide valuable benefits across MedTech companies:

  • IT teams: Without a bespoke platform to manage regulatory processes, regulatory affairs teams rely on a broad collection of tools to support their day-to-day work. This can include specific software to create and manage UDIs and access regulatory intelligence, as well as use of software designed for other functions: enterprise resource planning (ERP), product lifecycle management (PLM), or quality management systems (QMS)—highly-configured to try and support regulatory activities. A comprehensive RIM system (like Rimsys) provides support for multiple regulatory functions, saving IT teams the cost of acquiring and maintaining separate systems. With functionality specifically designed for regulatory processes, a RIM system is easier to support than customizations to tools designed for other functions.
  • Go-to-market teams: Sales and marketing organizations can also benefit from the adoption of a RIM system. In addition to bringing new solutions to market more quickly, RIM systems can also help with planning and forecasting. Visibility into the time and cost required to enter different markets, and the specific regulations associated with each market, can help go-to-market teams better prioritize target markets, and set revenue projections for their product lines. RIM systems can also provide workflows for project requests, allowing go-to-market teams to better coordinate registrations to support planned product launches.
  • Distributors, in-country sponsors, and notified bodies: One-off email communications with external parties is not only time consuming for regulatory affairs teams, but inefficient for partners. RIM systems can provide controlled access for external parties, allowing them to login and directly access needed information without sending an email, and waiting (sometimes days) for a response. Streamlining these communications allows partner organizations to move more quickly, and ultimately accelerate the delivery of products into new markets. This helps to grow revenue while also improving the productivity of regulatory affairs teams who no longer have to interrupt their work for every internal or external information request.

Building your business case

Putting together the challenges and benefits outlined in the previous section (as applicable to your team), will feed the primary content of your business case. Next we’ll take a look at how to structure the content.

Part 1 – Your current situation and challenges

One of the best places to start when putting together a business case for a RIM system is to look at your current situation. What are the challenges that your organization faces? How much time is spent looking for information, submitting marketing applications, completing regulatory impact assessments, creating and maintaining the new MDR / IVDR GSPRs? How long does it take your team to complete new registrations? How well do internal teams communicate and coordinate go-to-market activities for new products and markets? How many products and countries does your team support today? What would happen if that number increased significantly?

Next, look at the business implications of the current situation. Does your team have a backlog of requests from go-to-market or other management teams? How often do you bring in external consultants to help with workload? Note the associated costs of your project backlog (delays in receiving market clearance), and the amount spent each year on consultants. Are there any other business risks such as continuity or non-compliance that are associated with your current approach? Does your team have the ability to identify regulatory roadblocks associated with markets you’re planning to enter?

Part 2 – Recommended solution

Here’s where you make the primary case for a RIM system. Highlight the specific capabilities and benefits of your solution of choice, and how it will address the challenges of your current situation. Highlight areas where other teams will benefit from the solution, and opportunities to drive greater organizational alignment.

Part 3 – Costs and expected ROI

Estimating costs and returns can be difficult, but it’s one of the key ways to improve the credibility of your business case. If you’re unsure about costs you can generally assume that a full-featured RIM system will cost the equivalent of 1 to 3 full-time regulatory affairs professionals, and use that as a starting point.

When calculating returns start with time-savings. If regulatory activities could be completed 50% more efficiently, how would that impact the number of consulting hours you use or hiring plans? If you could reduce pre-market clearance time by 6 weeks, how much additional revenue could be generated? Have you had instances where you incurred fines or had to remove products from a market due to compliance issues (i.e. shipping to markets where the product hasn’t been approved)? What were the associated costs?

Next, look at what your RIM system is replacing. Do you have individual tools for UDI or other functions that could be replaced? What about other tools? Does your team have seats in ERP or QMS tools that won’t be needed any more? All of these are relevant cost savings. In most cases, a RIM system will show strong ROI once you’ve estimated all of these savings.

Part 4 – Alternatives

Here’s where you want to demonstrate that you’ve done your due diligence in support of your recommendations. Have you evaluated multiple software solutions? Enumerate the specific capabilities or approach that led you to recommend your preferred vendor. Are there other ways to address your current challenges: expanding the regulatory affairs team, or implementing other types of software (rather than a RIM system)? Explain why you think these solutions will be less effective.

Putting it together

RIM systems can provide significant benefits specifically to regulatory affairs teams and broadly across MedTech companies. With a bit of legwork, it’s easy to put together a compelling case for investment in a solution. What can sometimes lead to difficulty in quantifying potential benefits—the fact that many MedTech companies don’t have a robust measurement framework for Regulatory affairs processes—means that you’ll be in a much better position to assess the performance of your team and impact of your investment once the analysis is complete.

Ready to get started? Download our RIM business case template. Questions? Our team is happy to work through the process with you and validate your estimates based on the experiences of our clients.

RIM
Blogs

5 ways a RIM system can accelerate time-to-market for MedTech companies

By

Michael Peach

May 5, 2021

4 min read

Like all products, time-to-market is a critical success factor for medical technology (medtech). Product research and development ties up capital investment that can only be recouped when products start selling. For start-up and early stage companies, time-to-market can be the difference between success and failure. With a limited capital runway, they must demonstrate market success to access additional funding and growth opportunities. Unlike other products, however, medical devices have an added hurdle of regulatory clearance that must be obtained before products can be marketed and sold.

Underestimating the regulatory burden

It’s easy to underestimate the amount of time and effort required for regulatory activities related to New Product Introductions (NPI), especially during the development process. Policies, procedures, and submission processes can vary significantly between countries and regions, and almost all of them require government clearance before devices can be marketed. For larger companies it’s not unusual to operate in 100+ countries, creating an enormous array of standards and applications that must be manually managed.

These challenges are exacerbated by unclear lines of communication and siloed information across systems. Product development and testing information is stored within Product Lifecycle Management (PLM) and Quality Management System (QMS)  solutions. Sales forecasting, marketing, and production information is stored within Enterprise Resource Planning (ERP) and Customer Relationship Management (CRM) systems. And regulatory, standards information, and compliance documents are stored across various file systems.

Regulatory submissions must synthesize information from R&D, QA, and go-to-market teams, and data from across all of these systems. Any mis-steps, or missing information can result in significant go-to-market delays, and even rejections from regulatory bodies. Coordinating regulatory status between go-to-market regulatory affairs teams can be a particularly vexing challenge. Without clarity about what markets have been cleared/approved, companies run the risk of moving too quickly ahead of the regulatory process, or unnecessarily delaying market entry.

What is a RIM system?

Despite all of the complexity associated with regulatory submissions, many teams rely on rudimentary approaches to coordinate and manage them. Submissions and associated data are managed via individual documents or complex color-coded spreadsheets, with no central repository of submission records or status.  

Regulatory Information Management (RIM) systems are software solutions designed specifically to help companies streamline the submission, authorization, and maintenance process. They provide a digitized central repository for all regulatory information and content, allowing companies to automate and maintain compliance in the global market.

Using a RIM system to manage regulatory submissions and compliance can improve efficiency and productivity, reduce the risk of rejected submissions and noncompliance, and provide greater visibility into ongoing registration processes and status across the organization. While RIM systems provide specific benefits to regulatory affairs teams, they also provide company-wide benefits—specifically when it comes to accelerating time-to-market for new products.

5 ways a RIM system can accelerate time-to-market for new products

Full-featured RIM systems (like Rimsys) provide a number of capabilities that MedTech companies can take advantage of to get new products to market more quickly—and keep them there.

  1. Regulatory intelligence. Medical device registration requirements and standards vary across regions and countries. Understanding market entry requirements and timelines for regulatory submissions are necessary for any go-to-market planning, but finding and keeping track of this information can be challenging—especially for early-stage companies. RIM systems can provide up-to-date information about regulatory requirements without a lot of manual research and document management. Go-to-market teams can leverage the breadth of regulatory information in the system to develop rollout strategies for different markets, and identify the most attractive markets based on size and regulatory complexity.
  2. Digital forms and templates. Each regulatory submission requires multiple templates and forms, many of which aren’t available digitally. Finding the correct, current form, and manually filling it for each country/region can add significant time to the regulatory submission process. RIM systems can take the guesswork out of finding forms, by providing a library of digital templates for different markets that companies can easily access and fill. Even offline forms can be loaded into the system for digital filing and storage. With a modern RIM system, regulatory teams can easily access, fill, and track progress for submission forms in all the markets they’re looking to enter.
  3. Centralized visibility and information storage. RIM systems can function as a “digital hub” and single source of truth for all of the information associated with the regulatory process. Submissions require detailed product information, testing results, labeling, and other information that is often stored in other systems. Rather than sourcing this information over and over again, RIM systems provide regulatory teams with an organized repository that they can reuse across global applications. RIM access can be extended to other teams, and even external partners (like in-country distributors) to provide visibility into regulatory information and the status of submissions, making it easier to drive alignment around the process and coordinate go-to-market plans.
  4. Process integration across systems. Market authorization is one of the most critical pieces of information that go-to-market teams need. Maintaining that information across multiple products and multiple markets, and keeping it visible to go-to-market teams is a consistent challenge. RIM systems can integrate directly with ERP or CRM systems to feed authorization information directly into sales and distribution processes. Automating the in-country authorizations across systems can prevent noncompliance, and ensure that go-to-market teams are able to launch as soon as authorization is obtained. The same integration capabilities can be used to automatically retrieve product information from PLM and QMS systems, further speeding the application process.
  5. Automated regulation and standards tracking. This doesn’t necessarily directly impact time-to-market for new products, but it can definitely impact time in the market. Regulations and standards aren’t static, and regulatory affairs teams must keep on top of pending changes to ensure that products remain compliant and retain selling authorization. RIM systems can help to track changes, and flag products for potential compliance issues or that are at risk of losing authorization.In addition to regulatory changes, RIM systems can track authorization expirations, and other important events, helping companies maximize the revenue potential of their products by avoiding regulatory disruptions.

Accelerating regulatory approval and product go-to-market

MedTech companies are keenly aware of the role regulation plays in getting new products to market, but they aren’t always aware of the time and effort required to reach all of their target markets. Manual processes, disjointed information, and lack of coordination and visibility across teams can make it hard to obtain marketing authorization in a timely manner. This can significantly impact time-to-market—delaying return on investment, and even putting companies, themselves at risk.

RIM systems can eliminate a lot of the inefficiencies that slow down regulatory processes. By providing insight into regulatory requirements, access to digital templates, and integration across tools, they make it easier for companies to complete timely, successful regulatory submissions, and accelerate time-to-market.

RIM software from Rimsys

Rimsys is the only holistic RIM software designed specifically for medical technology companies. It helps companies digitize regulatory management by bringing together global UDI requirements, Essential Principles/GSPR, and regulatory registrations while monitoring products at the SKU level.

To learn more about RIM software from Rimsys, read our benefits datasheet.

RIM
Blogs

Arena Solutions and Rimsys announce partnership to offer an end-to-end quality and product-centric regulatory solution

By

James Gianoutsos

January 15, 2021

4 min read

Foster City, Calif., January 12, 2021Arena Solutions, a leader providing cloud-based product development solutions for high tech, consumer electronics, and medical device industries, today announced a new partnership with Rimsys Inc., a world-leading provider of a holistic Regulatory Information Management (RIM) software platform designed specifically for medical technology (medtech) companies.

The Arena and Rimsys partnership offers a secure cloud-based, product-centric regulatory solution for the medtech industry. Rimsys seamlessly integrates with Arena’s QMS and PLM solutions by pulling product and documentation information directly into Rimsys to create, manage, and maintain marketing applications such as 510(k), Summary Technical Documentation (STED), and Table of Contents (ToCs).

The Arena product development platform connects product and quality processes allowing dispersed teams throughout the product design and manufacturing process to work together. Rimsys integrates with Arena’s platform by syncing product information so companies can better manage global registrations and selling status at the SKU level. Rimsys has the capability to pull in QMS records and documentation to create and compile regulatory applications from approved documentation. The integration automatically monitors for documentation changes and alerts users when updates occur with additional reporting based on document location ensuring a single and accurate source of truth.

"The seamless and deep integration between Rimsys and Arena solutions reduces the day-to-day regulatory management," said James Gianoutsos, Founder and President of Rimsys. "The administrative burden of compiling marketing applications and the maintenance of product data is completely eliminated, allowing for increased compliance, efficiency, and visibility throughout the organization."
"Our partnership with Rimsys makes it easier for MedTech companies to address regulatory affairs, product registration, and standards management more effectively," said George Lewis, VP of Business Development and Strategy for Arena Solutions. "This new integration streamlines regulatory compliance processes by accelerating the notification of updates to critical quality records and documents."

About Arena Solutions

Arena Solutions helps innovative electronic high tech and medical device companies create products that change the world. Arena unifies product lifecycle (PLM) and quality management (QMS) processes, allowing every participant throughout the product realization process from design to manufacturing to work together. With Arena, teams accelerate product development and delivery to increase profits. For more information, visit ArenaSolutions.com.

About Rimsys

Rimsys is a world-leading provider of Regulatory Information Management (RIM) software for medical technology companies. Built by and for regulatory affairs professionals, Rimsys digitizes, automates, and creates regulatory order to ensure products adhere to changing global regulations. It is the only holistic RIM software for medical devices, in-vitro diagnostics, and medical device software that makes it easy to manage global UDI requirements and navigate the pillars of regulatory affairs, including product registration, standards management, essential principles/GSPR, and regulatory intelligence. rimsys.io


Company
I agree to the privacy policy including to Rimsys using my contact details to contact me for marketing purposes.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Hand holding smartphone showing email app with 12 unread messages notification.