Featured
Rimsys Announces Rimsys AI to Eliminate Repetitive Tasks and Enhance Decision-Making for MedTech Regulatory Teams
Rimsys, the leading Regulatory Information Management (RIM) platform for the MedTech industry, today announced the launch of Rimsys AI, a suite of embedded artificial intelligence (AI) agents.
The ultimate guide to the medical device single audit program (MDSAP)
This article is an excerpt from The ultimate guide to the medical device single audit program (MDSAP) ebook.
Table of contents
- What is MDSAP?
- History of MDSAP
- Who is responsible for the MDSAP?
- How does an MDSAP audit work?
- Audit sequence
- You got a nonconformity – now what?
- What does an MDSAP audit cost?
- Why choose the MDSAP certification process?
- Potential disadvantages of the MDSAP
- Ready to participate? – Here’s how to get started
- Completing a successful MDSAP audit
The Medical Device Single Audit Program (MDSAP) was designed and developed to allow a single audit of a medical device manufacturer to be applied to all country markets whose regulatory authorities are members of the program. The MDSAP provides efficient and thorough coverage of the standard requirements for medical device manufacturer quality management systems, and requirements for regulatory purposes (ISO 13485:2016). In addition, there are specific requirements of each medical device regulatory authority participating in the MDSAP that must be met:
- Conformity Assessment Procedures of the Australian Therapeutic Goods (Medical Devices) Regulations (TG(MD)R Sch3)
- Brazilian Good Manufacturing Practices (RDC ANVISA 16)
- Medical Device Regulations of Health Canada (ISO 13485:2003)
- Japan Ordinance on Standards for Manufacturing Control and Quality Control of Medical Devices and In Vitro Diagnostic Reagents (MHLW Ministerial Ordinance No 169)
- Quality System Regulation (21 CFR Part 820), and specific requirements of medical device regulatory authorities participating in the MDSAP program.
This means that a report from a single MDSAP audit of a medical device manufacturer would be accepted as a substitute for routine inspections by all the member Regulatory Authorities (RAs) across the world. There are currently five participating Regulatory Authorities (RA) representing the following countries: Australia, Brazil, Canada, Japan and the USA.
In April, 2021, the RAs released an “Audit Approach” document (MDSAP AU P0002.006) that combines the formerly separate MDSAP Audit Model and Process Companion documents into a single guidance document. It includes guidance for assessing the conformity of each process and includes an audit sequence, instructions for auditing each specific process, and identifies links that highlight the interactions between the processes.
In March 2012 the US FDA announced that they had approved a final pilot guidance document “Guidance for Industry, Third Parties and Food and Drug Administration Staff: Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program.” This allowed the owner or operator of a medical device manufacturing facility to be removed from FDA’s routine inspection work plan for 1 year upon completing a ISO 13485:2003 audit. This guidance document went into effect in June 2012, and was intended as an interim measure while a single audit program was being developed.
This pilot program was not very successful and few companies signed up because they did not see any advantage in participating. The manufacturer had to pay for a third party to inspect their facilities, generate a report, and share the inspection results back to the FDA. Many companies were reluctant to contract “someone else” to perform their inspection when they could easily wait for the FDA to conduct an inspection for free.
During its inaugural meeting in Singapore in 2012, the International Medical Device Regulators Forum (IMDRF) appointed a working group to develop a set of documents for a harmonized third-party auditor system. Hence, the “Medical Device Single Audit Program” (MDSAP) was formed. The concept was similar to the FDA’s original idea of creating a third-party auditor to help reduce their workload of performing regulatory audits of medical device manufacturers’ quality management systems. This new approach would consist of a single audit that would review regulatory QMS compliance, conducted by a third-party, who would later be called an Auditing Organization (AO).
From January 2014 to December 2016, five countries participated in a Medical Device Single Audit Program Pilot. In June 2017, a report was generated summarizing the outcomes of prospective “proof- of-concept” criteria established to confirm the success of the program. The outcomes are documented in the final MDSAP Pilot Report and recommended that the program become fully active and open to any manufacturer who requested this type of audit.
The governing body of the MDSAP is the Regulatory Authority Council (RAC), which is composed of two senior managers (and a few other staff members) from each participating RA. They are responsible for executive planning, strategic priorities, setting policy, and making decisions on behalf of the MDSAP International Consortium. The RAC also reviews and approves documents, procedures, work instructions, and more. The mission of the MDSAP International Consortium is to jointly leverage regulatory resources to manage an efficient, effective, and sustainable single audit program focused on the oversight of medical device manufacturers on a global scale.
Other international partners that are involved in the MDSAP include:
MDSAP Observers:
- European Union (EU)
- United Kingdom’s Medicines and Healthcare products Regulatory Agency (MHRA)
- The World Health Organization (WHO) Prequalification of In Vitro Diagnostics (IVDs) Program
MDSAP Affiliate Members:
- Argentina’s National Administration of Drugs, Foods and Medical Devices (ANMAT)
- Republic of Korea’s Ministry of Food and Drug Safety
- Singapore’s Health Sciences Authority (HSA)
The observers and affiliate members are not the same as the participating member RA’s. The observers simply observe and/or contribute to RAC activities. Affiliate members, on the other hand, are interested in engaging in the MDSAP program and are subject to certain rules. They are only given access to a certain level of information about the manufacturers, audit dates, and information in audit reports.
They are also invited to attend sessions that are open to members, observers, and affiliates only.
Audits can also be conducted by MDSAP participating RAs at any time and for various reasons including:
- "For Cause" due to information obtained by the regulatory authority
- as a follow up to findings from a previous audit
- to confirm the effective implementation of the MDSAP requirements
The purpose of audits conducted by the RAs is to ensure appropriate oversight of the AOs MDSAP auditing activities. The AOs are appointed by the RAs and a list of the currently approved AO’s is published on the FDA website. Most AOs offer a broad range of management system certification services, beyond just medical devices. Manufacturers should verify that prospective AOs are clearly trained and perform MDSAP audits of medical devices.
AOs have the final word as to whether a manufacturer has met the requirements for the MDSAP during the execution of the audit and generation of the associated reports summarizing the results. MSDAP RAC participating RAs have the final decision regarding all development, implementation, maintenance, and expansion activities associated with the program.
Although an unannounced visit by an AO is rare, it can happen in circumstances where high-grade nonconformities have been detected.
To continue reading this eBook including a detailed look at the MDSAP audit process and grading, pros and cons of the approach, and how to get started please register to download the full version.
The beginner's guide to the FDA 510(k)
This article is an excerpt from The beginner's guide to the 510(k) ebook.
Table of Contents
- Introduction
- 510(k) basics
- Contents of a Traditional 510(k)
- 510(k) submission and timelines
- Other 510(k) forms
Congratulations! You have successfully developed a new medical device. Now you need to take it to market. In the United States, this often means submitting a 510(k). A 510(k) is a structured package of information about your device and its performance and safety that you submit to the Food and Drug Administration (FDA) for “clearance” before you can sell your device in the U.S. In order to receive clearance from the FDA, your 510(k) will need to demonstrate that your medical device is substantially equivalent to another legally marketed device (called a predicate device). The substantial equivalence approval process is a simple equation that looks something like this:
The 510(k) is generally the most efficient route to market clearance in the U.S. because you show your device is safe and effective based on this substantial equivalence standard, instead of needing to present more extensive clinical trial data.
There are three types of 510(k): Traditional, Abbreviated, and Special. This eBook will begin with a general overview of the 510(k) process, including its purpose and benefits. Next, we will explore the Traditional 510(k) and the sections and components required in depth. Finally, we will look at the Special and Abbreviated 510(k).
FDA: background and device oversight
Before we explain what a 510(k) is let’s first talk generally about the FDA and device oversight. The FDA is the U.S. governmental agency responsible for overseeing medical devices, drugs, food, and tobacco products. When it comes to medical devices, the FDA’s mission is to “protect the public health by ensuring the safety, efficacy, and security of…medical devices.” At the same time, the FDA also has an interest in “advancing public health by helping to speed innovations.” In other words, the FDA’s goal is to make sure devices are safe and effective for public use, while also ensuring that devices have a quick and efficient path to market.
In order to achieve this balance of safety and efficiency, the FDA has three different levels of oversight depending on the risk level of the device: (1) exempt from premarket submission, (2) Premarket Notification, also known as 510(k), and (3) Premarket Approval (PMA).
When is a 510(k) required?
A 510(k) is required for medium risk devices that have a predicate on the market which can be used to demonstrate the safety and effectiveness of the new device. Meanwhile, a PMA is required for high-risk or novel devices which require a higher level of scrutiny to be confirmed safe and effective.
A 510(k) is not only required for new devices, but also for devices that have been modified in a way that could impact safety or effectiveness. This could include changes to the:
- Design
- Components
- Materials
- Chemical composition
- Energy source
- Manufacturing process
- Intended use
You must submit your 510(k) at least 90 days before marketing the device.
What Exactly is Substantial Equivalence?
Now that we know what a 510(k) is, let’s talk about the substantial equivalence standard. You’ll recall from the introduction that your 510(k) must show that the new (or modified) device is substantially equivalent to at least one other legally marketed device, called a predicate device. Substantial equivalence looks at the intended use and the technological characteristics of the two devices.
More specifically, you must show:
- that the new device has the same intended use as the predicate, and
- the differences between the two devices do not raise questions about the safety and effectiveness of the new device.
Now let’s take a closer look at intended use and technological characteristics.
Intended use
Intended use means the general purpose or function of the device. The FDA will look at your proposed labelling and your Indications of Use section of the 510(k) to determine the intended use of your device (this is covered in Chapter 2). Intended use includes:
Technological characteristics
Once the FDA has determined that a predicate device exists and that the new device and the predicate device have the same intended use, it will move on to compare the technological characteristics. Technological characteristics include:
- Materials
- Design
- Energy source
- Other device features
The two devices do not have to be identical, and in fact they almost never are. The key here is to demonstrate that any differences do not have a significant impact on safety or effectiveness. Here’s what to cover when you compare your device’s technological characteristics with that of the predicate device:
Overall description of the device design
- Engineering drawings or diagrams to explain the device and component parts.
- List of component parts and explanation of how each component contributes to the overall use and function of the device.
- Physical specifications: dimensions, weight, temperature, tolerances, etc.
Materials
- Detailed chemical formulation used in all materials of constructions (especially those that come into contact with a patient).
- Any additives, coatings, paint, or surface modifications.
- How materials have been processed and what state they’re in.
Energy Sources
- Use of batteries, electricity, etc.
Other technological features
- Software/hardware
- Features
- Density
- Porosity
- Degradation characteristics
- Nature of reagents
- Principle of the assay method
In deciding whether the differences in technological characteristics impact safety or effectiveness, the FDA will typically rely on descriptive information about the technological characteristics as well as non-clinical and clinical performance data.
Let’s look at an example: A manufacturer submits a 510(k) for a new type of contact lens. Both the new device and the predicate device are indicated for daily wear for the treatment of astigmatism. The predicate device is only available in a clear lens, but the new device comes in a line of colors, including purple tinted lenses.
Who is responsible for submitting a 510(k)?
The following four types of organizations may be responsible for submitting a 510(k):
Manufacturers
- End-of-line device manufacturers who will be placing a device on the U.S. market.
- Note: Does not apply to component part manufacturers unless components will be marketed independently.
Specification developers
- Companies that develop the specifications for a finished device which has been manufactured elsewhere
Repackers or relabelers
- Required to submit a 510(k) if they significantly alter the labeling or condition of the device, including modification of manuals, changing the intended use, deleting or adding warnings, contraindications, sterilization status.
- Note: This is rare. The manufacturer, not the repackager or labeler, is typically responsible for the 510(k) submission.
Importers
- Importers that introduce a new device to the U.S. market may need to submit a 510(k), if it hasn’t already been submitted by the manufacturer.
Now that we’ve covered the basics, let’s explore what actually goes into your 510(k).
A Traditional 510(k) should contain all the following components in the list below. In some cases, a particular section may not apply to your device. When that happens, it’s a good idea to include the section anyway and just state “This section does not apply” or “N/A” under that heading.
To continue reading this eBook including a detailed walk-through of all the Traditional 510(k) components, submission requirements and timelines, and an overview of the other 510(k) forms including the Abbreviated 510(k) and the Special 510(k), please register to download the full version
The ultimate guide to the China UDI system and database
This article is an excerpt from The ultimate guide to the China NMPA UDI system and database ebook.
Table of Contents
- Overview
- UDI basics and benefits
- UDI format requirements and issuing entities
- UDI database and submission requirements
- Implementation of UDI and the UDI database in China
The current Chinese medical device regulatory regime kicked-off in 2014 with the Regulation on Supervision and Administration of Medical Devices. This core set of registration requirements, modeled after the United States and European Union systems, established a set of device classifications (class I, II, and III) based on risk and procedures for obtaining market clearance for each type of device.
Medical devices in China are regulated by the National Medical Products Administration (NMPA). Class I devices, such as clinical laboratory equipment or non-invasive skin dressings, require only notification to the NMPA for marketing authorization, and that authorization does not expire. Class II and III devices such as implantable devices or devices with a measuring function require full registration and a formal review before market clearance can be obtained.
These initial regulations have been expanded since their introduction, adding accelerated pathways to market for certain products in certain regions, easing acceptance of clinical data from overseas, and more specific roles and responsibilities for local agents of international manufacturers. In addition, in 2019, the regulations added a provision that medical devices carry a unique device identification (UDI). China’s UDI requirements are similar to those in the US and European Union. They establish specific device ID and labeling requirements, as well as a central, state-administered database of devices.
This eBook walks through the basics of medical device UDIs, the specifics of China’s implementation, and how MedTech companies who market their devices in China can prepare for the full rollout of these regulations in the coming years.
A UDI is a unique alphanumeric code that is designed to identify medical devices sold in a particular country/region from manufacturing, through distribution, to use by a patient. Like other aspects of the medical device regulatory regime, the UDI system in China follows the approach taken by the United States FDA and European Commission, and is based on the guidance from the International Medical Device Regulators Forum (IMDRF). Generally, UDI systems are designed to improve patient safety and optimize care by:
- Increasing the traceability of medical devices, including field safety corrective actions
- Providing an unambiguous identification method for medical devices throughout distribution and use
- Making adverse event reports more accessible
- Reducing medical errors by providing detailed information related to the device
- Simplifying medical device documentation and making it more consistent
There are three components to the UDI system in China:
- UDI code: The actual UDI code can be assigned by one of three (3) issuing agencies and contains information about the product, it’s expiration date, and the manufacturing batch/lot it’s associated with.
- UDI labeling: Put simply, medical devices must carry the UDI code on them. The regulations stipulate how devices and their packaging must be labeled for compliance.
- UDI database: In addition to labeling, all device UDIs must be submitted to a central database that is administered by the NMPA.
The following sections explore each of these components in more detail.
The UDI code
The first element of the UDI system is the code itself. The UDI code is the alphanumeric identifier that is associated with a specific medical device. UDI codes have two (2) elements to them, the UDI device identifier (UDI-DI) or static portion, and the UDI production identifier (UDI-PI) or dynamic portion. You can see the two components in the UDI diagram below:
The UDI-DI contains information about the issuing entity—the organization that is authorized to assign UDI codes. In China, this can be one of three entities: GS1, an international barcode and electronic data interchange standards organization, and two domestic organizations: the Zhongguancun Industry & Information Research Institute (ZIIOT), and AliHealth. Additional details about the issuing agencies are covered in Chapter 2. In addition, the UDI-DI contains information about the manufacturer and the specific model or version of the device.
The UDI-PI contains information about the manufacturing and production of the device. This typically includes information about the lot or batch number in which the device was manufactured, the manufacturing date and expiration date for the device (if applicable), and the specific serial number for the device. Here you can see all of the components marked up using the same UDI example:
Note that each packaging permutation and level for a given device will need to be assigned its own UDI. So for example, let’s say that a company manufactures 5ml enteral (oral) syringes in two packaging options: 1 – packaged individually and 2 – packaged in a box of 5. Each packaging option would need its own UDI, despite the fact that the underlying product is the same.
Now looking at packaging levels, let’s assume that the manufacturer packages the single syringe offering into boxes of 6, and again into larger containers of 24. Each of those packaging options needs its own UDI as well.
Labeling
In addition to obtaining UDI code for each device as outlined in the previous section, medical device manufacturers are required to ensure that devices are appropriately labeled with the assigned UDI. This label is called the UDI Carrier. The UDI is represented in two forms on the UDI Carrier: a machine-readable form and a human-readable form.
The machine-readable form or automatic identification data capture (AIDC) is a barcode or some other technology that can be used to automatically capture UDI information. The NMPA regulations support 3 types of machine-readable formats: 1-dimensional barcode, 2-dimensional barcode, and radio-frequency identification (RFID).
The regulations note that “use of advanced automatic identification and data collection technologies is encouraged”—prompting manufacturers to use more modern 2D and RFID machine-readable carriers where possible. Note, however, that if a device uses RFID, the UDI Carrier must also include the UDI in barcode format.
The human-readable form or human-readable interpretation (HRI) is the numeric or alphanumeric code for the UDI that can be read and manually entered into systems.
The UDI Carrier should be included on the device and on all levels of packaging. The UDI Carrier must be clear and readable during the operation and use of devices. If there isn’t room on the device for both the human and machine-readable forms of the UDI, then manufacturers should prioritize the machine-readable form.
UDI database
The third component of the NMPA UDI system is the UDI database. This is a centralized database of UDI and product information, administered by the NMPA. Manufacturers are required to submit UDI information into the database within 60 days after a product is approved (for sale in China) and before it is commercialized. The database contains a more detailed product record than what is included in the UDI itself, and it is the responsibility of the manufacturer (and/or their in-country representative) to submit the information correctly, and ensure that it’s kept up to date.
Chapter 3 of this eBook goes into detail about the specific fields and data requirements for UDI database submissions.
To continue reading this eBook including information about UDI format requirements and issuing entities, implementation timelines, and affected device types, please register to download the full version.
Canada medical device regulations
Health Canada medical device regulations
Canada has one of the most stringent and well-respected regulation processes, not only for medical devices but for the overall health and safety of its citizens. Canada uses a risk-based approach to the regulation of medical devices, where the review before approval depends on the potential risk that the use of the device presents or could potentially present. Devices are categorized into four classes based on the risk, with Class I devices presenting the lowest potential risk (e.g. a tongue depressor) and Class IV devices presenting the greatest potential risk (e.g. a pacemaker). Class II, III, and IV medical devices must have a Medical Device License to be sold in Canada, while companies selling Class I medical devices in Canada are required to have a Medical Device Establishment License (MDEL).
The regulation of medical devices in Canada is driven by The Food and Drugs Act (R.S.C., 1985, c. F-27). This act includes food, drugs, cosmetics, and devices. The regulation specific to devices is the Medical Devices Regulations (SOR/98-282). The information within the regulations includes, but is not limited to, classification, manufacturer’s obligations, associated fees, labeling requirements, establishment license, incident reporting, recalls and much more. The most recent update to the regulation was Interim Order No. 3, Respecting the Importation and Sale of Medical Devices for Use in Relation to COVID-19.
Most countries have an established system in place for notifying the public (including manufacturers) of initiatives and actions that they plan to take to maintain and improve the safety of medical devices - and Canada is no different. As a department, Health Canada is responsible for administering Acts and Regulations, and for implementing government-wide regulatory initiatives. All the government's Acts and Regulations can be found on the Justice Canada website. Let’s look at some of their processes and review some of their initiatives and action plans through 2024.
Forward Regulatory Plan
Canada’s Forward Regulatory Plan is designed to share anticipated regulatory changes or actions. The forward regulatory plan gives consumers, businesses, and other stakeholders an opportunity to review and comment on anticipated changes. It should be noted though, that this forward regulatory plan can be modified at any point.
The Forward Regulatory Plan: 2022 - 2024 provides information about specific regulatory activities and initiatives that Health Canada aims to finalize through 2024. This plan sets up a timeframe for activities and initiatives to be completed. Pre-publication and final publication announcements are published in the Canada Gazette, the official newspaper of the Government of Canada.
There are currently several initiatives in this Forward Regulatory Plan including those that fall under the Consumer Product Safety Act, Hazardous Products Act, and Food and Drugs Act, to name a few. The following are major medical device initiatives included in the plan, which fall under the Food and Drugs Act.
- Amendments to the Fees in Respect of Drugs and Medical Devices Order (Natural Health Products Fee Proposal) [New 2022-04-01]
- Advanced Therapeutic Products Pathway for Adaptive Machine Learning-enabled Medical Devices [Updated 2022-10-01]
- Regulations Amending the Food and Drug Regulation, Natural Health Products Regulations and the Medical Devices Regulations (Modernization of the Regulation of Clinical trials) [Updated 2022-10-01] [Associated with the targeted Regulatory Review Sectoral Roadmap] [Associated with the stock review plan]
- Regulations amending the Medical Devices Regulations (Agile Regulations for Licensing Medical Devices) [Updated 2022-10-01] [Associated with the targeted Regulatory Review Sectoral Roadmap] [Associated with the stock review plan]
- Regulations Amending the Medical Devices Regulations (Interim Order No. 3 Respecting the Importation and Sale of Medical Devices for Use in Relation to COVID-19) [Updated 2022-10-01]
- Modernizing the Medical Device Establishment Licensing (MDEL) Framework [Updated 2022-10-01]
Stock Review Plan
The Stock Review Plan is a public list and description of planned reviews of existing regulations that Health Canada is proposing within a two-year period. As of the date of this article, the on-going and proposed reviews for medical devices include:
On-going Reviews:
- Regulations Amending the Medical Devices Regulations (Agile Regulations for Licensing Medical Devices), formerly referred to as Regulations Amending the Medical Devices Regulations (Agile Regulations)
- Modernizing Medical Device Establishment Licensing Framework including the recall of medical devices, formerly referred to as Modernizing Drug and Medical Device Establishment Licensing Frameworks – amendments to the Food and Drug Regulations and Medical Devices Regulations
Proposed new reviews:
Additional regulation updates
Regulatory Initiative Plan
Health Canada’s regulatory initiative agenda aims to provide more regulatory flexibility to support innovative research and health product development and to contribute to the country's biomanufacturing and life sciences strategy.
The 5 key pillars in the regulatory innovation agenda include:
- Modernizing clinical trial regulations
- Enabling advanced therapeutic products
- Agile regulations for licensing drugs
- Agile regulations for licensing medical devices
- Information to Canadians mobile strategy
UDI
Unique Device Identification (UDI) is a medical device requirement in most countries, but every country is at a different stage of implementing UDI requirements. So where does Canada stand with UDI? As of June 2021, Canada was exploring the feasibility of a UDI system, including options for development of a UDI database by using internal, existing infrastructures. They propose to develop this system based on the work and experience of the International Medical Device Regulators Forum (IMDRF), as well as the United States FDA’s UDI system, to help structure the principles and design of a UDI system for Canada. No further announcements have been made since the writing of this article.
COVID-19
February 2023, Canada announced a few updates relating to regulations about COVID-19 including:
- Amendments to Medical Devices Regulations to continue importation and sale of COVID-19 medical devices
- Medical devices for use in relation to COVID-19
- List of Medical Devices for an Urgent Public Health Need in Relation to COVID-19
Keep up to date with news and announcements from Health Canada by referring to our Medical Device Regulatory Market Profiles section on our website.
MDR transition example under the extension
Medtech manufacturers cannot delay the preparation for transitioning devices to MDR. While the final deadlines were pushed, this was done primarily to address notified body capacity issues. The MDR transition period extension for legacy devices does NOT allow manufacturers to delay/deprioritize efforts until the end of the applicable extension period since many activities must be fulfilled now to utilize the extension. Read 6 reasons medtech companies shouldn’t delay MDR certification for additional information.
To illustrate the timeline, we are going to look at an example of a Class IIb non-implantable device.
Note: Dates within the diagram for tech file submission and certification are based on your signed agreement with your Notified Body and the outcome of the conformity assessment. The dates shown are only an example.
Apply for conformity assessment - May 26, 2024
Even with the extension, a quality management system (QMS) that is compliant with MDR is required by May 26, 2024. Manufacturers must submit an application for the device conformity assessment to a Notified Body (NB) before that date as well. There are significantly fewer Notified Bodies that are certified to MDR, and due to their limited resources, manufacturers should begin working with their NB immediately if they have not already done so. Note that the device technical file does not need to be submitted with the application, but a submission schedule must be.
Sign agreement with Notified Body – September 26, 2024
Before signing an agreement with the Notified Body, expect them to counter your application with a new submission date. Manufacturers can negotiate the date with their Notified Body, but a signed agreement must be in place before September 26, 2024. While in this negotiation phase, keep in mind the MDR compliance deadline for the device (Class IIb in this example) is December 31, 2028, and work backward accounting for the various activities that must take place and their durations. It is extremely important to define a realistic schedule because not meeting that schedule will cause significant administrative complications and raise the potential risk that a device is not certified before the required deadline.
Conformity Assessment
The Notified Body will begin the conformity assessment once they receive the technical file for your device. Technical files should be submitted to the Notified Body by the date defined in your agreement (Dec 2025 in our example).
We are hearing that conformity assessments for many devices are taking 12-18 months. During that period, be prepared to answer questions and participate in conversations with your NB. In some cases, there can be significant back-and-forth between the manufacturer and the NB during the conformity assessment. Once the conformity assessment is complete (Jun 2027 in our example) it can take up to another 3-6 months for certificate issuance.
MDR extension reference documents
- Q&A Document for Regulation 2023/607 – Published by the EU Commission, this document answers some of the common questions around the extension in “plain English.”
- Regulation 2023/607 amending MDR (EU) 2017/745 and IVDR (EU) 2017/746 in regard to the transitional provisions and removal of sell-off periods for medical devices and for in vitro diagnostic medical devices.
- Notified Body Confirmation Letter template published by Team NB. This is a confirmation letter created by the manufacturer for the Notified Body to sign. The letter is not mandatory but is strongly recommended to provide objective evidence that the conditions of the extension have been met extending the validity of the CE certificate.
For more information, watch the replay of our recent "Ask Us Anything" webinar on the EU MDR Transition Period Extension.
Declarations of Conformity
What is a Declaration of Conformity?
A Declaration of Conformity (DoC) is a required self-certifying document created by the medical device manufacturer to state that a device or a series of devices complies with the conformity requirements of a particular country’s regulations. If a DoC is required in a country, specifically in the European Union, the DoC confirms that a product is in compliance with all relevant European product safety requirements. DoC is required for each product and identifies the party responsible for market authorization activities in the applicable country.
Why is a Declaration of Conformity necessary?
Declarations of Conformity require the signee to take responsibility for a product’s compliance within that country’s rules and regulations. It also allows government authorities and regulatory bodies to identify who is legally responsible for a product and its regulatory activity, such as obtaining a CE mark.
Why are Standards often listed in the Declaration of Conformity?
Governments often use industry standards to define sections of the conformity assessment for particular devices. These standards are developed by standards organizations, such as ISO and IEC. For example, the ISO 13485:2016 standard defines quality management system (QMS) requirements for medical device organizations. Typically, highly developed countries use a particular version of a standard in their regulations. A manufacturer is then required to state that they are compliant to those standards when they submit their documentation – in the form of a DoC. Drafting a European Union DoC is an important part of the CE marking process and is the final step before affixing the CE mark to your product.
Countries that Require a Declaration of Conformity
Declarations of Conformity are required in many countries, though some refer to a “Certificate” of Conformity. Countries that currently have a DoC requirement:
- Australia
- Brazil – Still in development
- China
- European Union - All countries in the EU require a DoC, but you only need to create one document
- Malaysia
- Saudi Arabia
- Singapore – Singapore will accept an EU DoC in most cases, but in certain circumstances will require a Singapore DoC
- Thailand
- United Kingdom (UK)
In the United States, the FDA’s Declaration of Conformity is built into the eSTAR program.
What is required in a Declaration of Conformity?
While the requirements vary slightly by country, a DoC should be provided on company letterhead and general requirements typically include:
- Standards related to the product that are compliant to a country’s regulations
- Product Name
- Part Number
- Physical and legal manufacturer details
- ISO Certificate Information
- Classification of the device per the country regulations and the specific rule used to classify the device
- Notified Body details
- Distributor information
- A statement regarding the regulation that the responsible party is stating compliance to
- A signature from the responsible party
Using a Regulatory Information Management (RIM) system, like Rimsys, to manage your product data and related standards will allow your regulatory team to create and control declarations of conformity and other documents. Learn more here.
An overview of 21 CFR Part 812
This document is a summary of the regulation and does include wording taken directly from the regulation itself. The original regulation should be referenced directly, however, for complete information when submitting an IDE request.
What is an investigational device exemption?
An investigational device exemption (IDE) allows a device to be used in a clinical study prior to obtaining market approval to collect safety and effectiveness data. Clinical studies are typically required to support a Premarket Authorization (PMA), but a small percentage of 510(k) applications also require clinical data when a predicate device comparison is inappropriate for the submission.
Before a clinical study is initiated, an investigational device must have an approved IDE, unless it is exempt. Devices may be exempt from IDE requirements if they are noninvasive diagnostic devices, being used for consumer preference testing unrelated to device safety or efficacy, or intended solely for veterinary use or research with laboratory animals. Refer to the full text of 21 CFR 812 for details and additional exemptions.
Part 812 – General Provisions (Subpart A)
Scope
This regulation is applicable to all clinical investigations of devices used to determine safety and effectiveness, except where exempt.
Applicability
Abbreviated Requirements
Investigations are considered automatically approved for IDEs if the device is not considered a significant risk, unless the FDA has specifically notified the sponsor otherwise. In these cases, the sponsor must still obtain IRB approval for the investigation and must comply with other requirements of Part 812, including proper labeling, record keeping, and conformed consent requirements.
Exempted investigations
IDEs are not required for devices that fall into one of the following categories:
- Devices that were in commercial distribution prior to May 28, 1976 that were used or investigated according to requirements in effect at that time. Devices that were introduced after May 28, 1976 but which have been found to be substantially equivalent to devices introduced earlier may also be exempt. This exemption is limited for Class II and III devices from the date an FDA regulation or order calls for the submission of a PMA (in the case of an unapproved Class III device) or establishes a performance standard for a Class II device.
- Diagnostic devices for which the testing is noninvasive and without significant risk, and is not used as a diagnostic procedure without confirmation through another product or procedure.
- Devices undergoing consumer preference testing, or testing of a device modification or combination of already distributed devices, if the testing is not for purposes of determining safety or efficacy and does not put subjects at risk.
- Devices solely for veterinary use.
- Devices intended for research on or with laboratory animals.
- A custom device that is not being used to determine safety or efficacy for commercial distribution.
Definitions
21 CFR Part 812.3 provides definitions for many terms, some of which are listed here.
Institution: A person, other than an individual, who engages in the conduct of research on subjects or in the delivery of medical services to individuals as a primary activity or as an adjunct to providing residential or custodial care to humans. For example, a hospital, retirement home, confinement facility, academic establishment, and device manufacturer. The term has the same meaning as “facility.”
Institutional Review Board (IRB): Any board, committee, or other group formally designated by an institution to review biomedical research involving subjects and established, operated, and functioning in conformance with part 56. The term has the same meaning as “institutional review committee.”
Investigational device: A device, including a transitional device, that is the object of an investigation.
Investigator. An individual who actually conducts a clinical investigation, i.e., under whose immediate direction the test article is administered or dispensed to, or used involving, a subject, or, in the event of an investigation conducted by a team of individuals, is the responsible leader of that team.
Monitor: When used as a noun, this term means an individual designated by a sponsor or contract research organization to oversee the progress of an investigation. The monitor may be an employee of a sponsor or a consultant to the sponsor, or an employee of or consultant to a contract research organization. Monitor, when used as a verb, means to oversee an investigation.
Significant risk device means an investigational device that:
- Is intended as an implant and presents a potential for serious risk to the health, safety, or welfare of a subject;
- Is purported or represented to be for a use in supporting or sustaining human life and presents a potential for serious risk to the health, safety, or welfare of a subject;
- Is for a use of substantial importance in diagnosing, curing, mitigating, or treating disease, or otherwise preventing impairment of human health and presents a potential for serious risk to the health, safety, or welfare of a subject; or
- Otherwise presents a potential for serious risk to the health, safety, or welfare of a subject.
Sponsor: A person who initiates, but who does not actually conduct the investigation, that is, the investigational device is administered, dispensed, or used under the immediate direction of another individual. A person other than an individual that uses one or more of its own employees to conduct an investigation that it has initiated is a sponsor, not a sponsor-investigator, and the employees are investigators.
Sponsor-investigator: An individual who both initiates and actually conducts, alone or with others, an investigation, that is, under whose immediate direction the investigational device is administered, dispensed, or used. The term does not include any person other than an individual. The obligations of a sponsor-investigator under this part include those of an investigator and those of a sponsor.
Subject: A human who participates in an investigation, either as an individual on whom or on whose specimen an investigational device is used or as a control.
Labeling of investigational devices
An investigational device or its packaging requires a label with the following information:
- Name and place of business of the manufacturer, packer, or distributor (per 801.1).
- Quantity of contents.
- Statement: “CAUTION—Investigational device. Limited by Federal (or United States) law to investigational use.”
- Any additional relevant contraindications, hazards, adverse effects, interfering substances or devices, warnings, and precautions.
- If used for animal research, a statement of “CAUTION—Device for investigational use in laboratory animals or other tests that do not involve human subjects” must be on the label.
IDE Labeling cannot have any statement that is false or misleading and cannot represent the device as safe nor effective.
Prohibition of promotion and other practices
An investigational device is intended for use only within an investigation. Therefore, until a device is approved for commercial distribution by the FDA, the sponsor or investigator (or those working on their behalf) cannot:
To continue reading this Regulatory Brief, please download the full document here.
Content of FDA premarket submissions for device software functions
The Food and Drug Administration (FDA) recently released a final guidance document, “Content of Premarket Submissions for Device Software Functions.” This document is intended to provide information about the recommended documentation that medical device manufacturers should include in premarket submissions for the FDA's evaluation of safety and effectiveness of device software functions. This document replaces the FDA's “Content of Premarket Submissions for Software Contained in Medical Devices” document issued in May, 2005. Note: This new guidance does not apply to automated manufacturing and quality system software or software that is not a device.
In general, the FDA’s guidance documents do not establish legally enforceable responsibilities. Instead, guidance’s describe the FDA’s current thinking on a topic and should be viewed only as recommendations, unless specific regulatory or statutory requirements are cited.
Highlight of changes to FDA guidance on premarket submissions for device software
Since the last time this document was revised (2005), there have been many updates to this new guidance document that are certainly worth noting. Along with the multiple changes and additions, this guide will help with more clarity in the process of determining software documentation for premarket submission and review of software medical devices, or devices that have a software function.
Some of the highlights that are important to mention include:
- Changes in terminology to more current trends. For example, the Hazard Analysis is now referred to as the Risk Management File.
- The table of contents has been extended and divided into several sections, broken down even further to include documentation type and Documentation Level.
- Level of Concern is now referred to as Documentation Levels. Although still guided by the level of product “risk," instead of major, moderate, and minor levels, they are now identified as Basic or Enhanced Levels. Basic is any premarket submission that includes device software function(s) where Enhanced Documentation does not apply. Enhanced includes device software function(s) where a failure or flaw of any device software function(s) could present a hazardous situation with a probable risk of death or serious injury, either to a patient, user of the device, or others in the environment of use.
- The Recommended Documentation section (formerly the Software-related Documentation) section has expanded to include more detail and subsections about software requirements, software architecture, software design, software development, software testing, software version history, and unresolved software anomalies.
- The Software Description has been revised to add reference to guidance about Multiple Function Device products that extends into software operation, software specifics, and software inputs/outputs.
- The Hazard Analysis is now the Risk Management file and continues to recommend ISO 14971 for guidance. It’s also been extensively revised to include the risk management plan, the risk assessment and risk management report.
- Newly added Appendix A provides many Documentation Level examples intended to demonstrate the implementation of the Documentation Level risk-based approach. Over 20+ product examples are included in this list.
- Newly added Appendix B provides examples of diagrams for the purpose of demonstrating how the System and Software Architecture Diagram could be implemented into diagrams, and to help show a clear understanding of the system and software.
In addition to this new guidance, the FDA recommends reviewing the following guidance documents (which is not an exhaustive list) for additional support in determining premarket software documentation for submission.
- Multiple Function Device Products: Policy and Considerations
- Off-The-Shelf Software Use in Medical Devices
- Design Considerations and Premarket Submission Recommendations for Interoperable Medical Devices
- General Principles of Software Validation
- Content of Premarket Submissions for Management of Cybersecurity in Medical Devices
- Cybersecurity for Networked Medical Devices Containing Off-The-Shelf (OTS) Software
- Applying Human Factors and Usability Engineering to Medical Devices
Selecting a RIM system for your medical device company
Software for medical device regulatory teams
Many regulatory affairs (RA) teams within medical device organizations are still managing their activities through spreadsheets, in-house custom-built software, or systems designed for other purposes. We believe that regulatory teams deserve purpose-built software that allows them to ensure compliance across products and markets, and provides them with the opportunity to contribute directly to revenue-driving activities.
Regulatory Information Management (RIM) solutions provide the centralized regulatory functionality needed by today’s RA teams. RIM solutions such as Rimsys are product-centric, allowing regulatory professionals to track all product-specific information and then create market submissions, link standards and essential principles, manage registrations by product by market, and control all regulatory approvals and projects. However, not all RIM solutions are created equal. If you have complex products, devices that include software, or other requirements that not all medical device companies will have, be sure to carefully evaluate potential systems for their ability to address those needs.
Justifying the need for RIM
Any software selection project begins with analyzing the need for the new software, creating a justification for the project, and obtaining the approval and budget to move forward. RIM solutions will allow your RA team to find information more quickly and operate more efficiently, which means that justification for a new RIM system typically comes from four areas:
- Cost savings – RA teams can operate more efficiently, reducing the need for outside consultants or contractors and enabling new RA team members to onboard more quickly. Better information also allows RA teams to better forecast projects in order to optimize the internal team size.
- Reduced regulatory risk – A centralized RIM system reduces multiple risks, including missing an expiration date or supplying incorrect information to a regulatory body. Even a small misstep can cause an audit finding, removal of a product from a market, or a delay in entering a new market.
- Improved competitive advantage – RIM systems significantly reduce the time that RA teams spend finding data and reacting to last-minute “emergency” requests. This advantage allows the team to drive competitive advantages and greater revenue growth through participation in market planning, product roll-out decisions, and other strategic planning. One Rimsys customer was able to improve the time for a product release by 88%. By increasing speed to market, medtech companies can recognize revenue sooner and capture more market share more quickly.
- Data harmonization – Medtech companies dealing with duplicated data and systems due to mergers or acquisitions can point to a centralized RIM system as a way to harmonize important regulatory data to ensure compliance and optimize go-to-market activities.
You will likely need to develop a comprehensive business case to support any RIM investment. This will include detailing the limitations of current approaches (including spreadsheets and costs to maintain in-house systems), quantifying the expected benefits, and explaining the evaluation process to arrive at your preferred vendor. Building this as you work through the early stages of RIM selection will prevent delays as you move into the purchase process.
Should I use external consultants to help with RIM selection?
RIM selection projects are sometimes managed by in-house teams and sometimes managed by 3rd-party consultants. How do you decide which is right for your selection project?
Does your team have experience with large system selection projects?
If your organization has a large IT team and/or digital transformation team, they likely have the responsibility of overseeing the selection of any new software systems. Be sure to understand their capabilities – have members of the team managed large system selection projects before, such as ERP or PLM selections? The regulatory team and others within the organization can provide subject matter expertise, but you will be relying on the technical team to oversee the project, define requirements, help set a budget, and more.
If the right level of expertise does not exist within your organization, an outside consultant with medical device regulatory experience and with business system selection projects should be considered. This type of consultant can be extremely helpful during the system implementation and adoption phase of the project as well.
Does our team have the bandwidth to manage a RIM selection project?
Even if your organization has an internal team with the expertise to manage a RIM selection project, they may not have the time to do so within the desired project timeframe. In this case, an external consultant can augment your existing team to get the project completed as required.
Do we need a new perspective?
Selecting a RIM solution is as much about digital transformation and process optimization as it is about ensuring you find a system with the right features. Do you have a vision of where you want the RA team to be? Have you looked at the characteristics of top-performing RA teams? If you think you might need a new perspective and an outside voice, an outside consultant may be the right choice for your project.
RIM selection project steps
Once you have determined the need for a RIM system, a selection project should include the following major steps:
Build the selection team
Put together a core selection team that consists of:
- A project leader that is typically at a manager level or above within the organization and comes from the regulatory or IT teams.
- An executive sponsor who may not participate in all aspects of the project, but who will ensure that resources are made available to the team as needed and that the project is kept on track and is aligned with overall company goals.
- IT team member(s) who will provide feedback on technical system requirements, including security and data privacy, and will support customization and integration discussions.
- Subject matter experts representing each department and team who will be using or interacting with the software.
You will add team members once you begin to implement the system, but selection teams typically consist of fewer than 10 members.
Determine requirements and selection criteria
One of the primary responsibilities of the selection team is to define the requirements for the new system, and the criteria on which systems will be judged. Requirements usually fall into multiple categories, including:
- Business requirements – These are broad requirements based on business needs. They will typically answer the question “Why do we need a RIM system?” For example, reducing the administrative burden on the regulatory team with functionality that allows the team to track registration expiration dates, create submission dossiers, and quickly report on registration status by product and market. Include project timeline and budgetary constraints here as well.
- Functional or user requirements – Functional requirements are a more detailed list of specific functions that users will need to perform in the system. For example, the ability to link standards to essential principles, manage multiple approvals for submission documents, or track UDI product data. DO include requirements that are essential for users to complete their work within your defined quality procedures. DO NOT include requirements that are unnecessarily specific (ex: the product description must contain at least 50 characters) or are so common that all systems will meet the requirement (ex: there must be a product number and description in the product record).
- System and technical requirements – Your IT team may already have a list of the overall technical requirements that all software must meet within your organization. These will likely include data security requirements and features that support system validation. Include any specific requirements regarding system availability, upgrade management, and technical support guarantees. See SaaS 101 for medtech regulatory professionals for a list of questions that you should ask a SaaS solution provider. Also include here any procurement requirements that your organization has, such as insurance requirements.
- Vendor resources and vision – You want to work with a vendor that shares your vision, not only for this system implementation but also for future growth. Evaluate each vendor’s product roadmap and plans for innovation against your organization’s digital transformation plans for the next 2-5 years. Does the vendor share your vision? Do they have the resources to support your organization and that future vision?
Establish project goals and timelines
Establish project goals and an overall project timeline. Is there a hard deadline by which the system needs to be live? What are the goals and metrics with which the success of the project will be measured? Be sure to get written agreement from the project team and executive team on the goals, timeline, and how the information will be reported.
Research RIM vendors (build your initial list)
If you are working with an experienced regulatory consultant, they may be able to get you to your short list without this step. However, if you are unsure of which systems may meet your needs, begin by:
- Researching Regulatory Information Management systems online.
- Talking to other regulatory professionals for suggestions and referrals.
- Consulting with industry analysts. Gartner's annual RIM market guide, and Gens & Associates World Class RIM report both provide an overview of RIM vendors. (Note, however, that both include both pharma and medtech-focused solutions within their respective guides.)
Build vendor short list
Based on the information gathered in the previous step, you should be able to create a short list of two to six vendors. This may require short conversations with prospective vendors, but you should have your short list before you schedule product demos and/or send out a request for proposal (RFP).
Tip: If you communicate with vendors that don’t make your short list, let them know so that they don’t continue to contact you!
Evaluate vendor capabilities
This part of the project varies greatly from company to company, but your process should ensure that all of your stated requirements are being evaluated against each vendor’s capabilities. Not all team members need to evaluate all requirements – individuals should be assigned based on their understanding of the area being evaluated. The same people, however, should evaluate the same requirements across all vendors to ensure a fair comparison.
If your organization requires an RFI (request for information) or RFP (request for proposal), those need to be compiled and sent to the vendors as the starting point for vendor evaluations. These documents allow your team to gather the same information from all vendors. Put simply, these are documents that list your requirements and ask the vendors to indicate if they address them natively within their software, through third-party integrations, or not at all. Our RIM Buyer’s Guide provides a template that can be used as a starting point.
Whatever your evaluation process looks like, your team needs to see the software. For systems as large as RIM solutions, you may need multiple demonstrations with the vendor and your team. Work with the vendor to determine how the process will work, but typically you will have an overview demonstration and then separately schedule individual sessions, if they are needed, to cover specific features or answer additional questions. While everyone on the evaluation team should attend the initial demo, additional sessions should be scheduled only when needed and only with those team members required. The following can help ensure a smooth process:
- Communicate clearly to your team what they are responsible for during the demo. Who is taking notes? Are different team members responsible for evaluating features in different areas of the software?
- Set expectations with the vendor ahead of time and maintain control of the demo agenda. The software vendor will know what sequence works best for their product, and you should allow them to guide you. However, you will want to steer them away from spending too much time on features that are not important to your team.
- Ask the vendor to keep track of unanswered questions or features that you were unable to see. The vendor should be expected to follow-up on these items.
Rate and rank vendors
Using your requirements list, each vendor should be rated for each requirement. Require vendors to clearly indicate if a requirement is met “out of the box,” requires custom development work, or is not supported at all. Consider a scale of 0-5, with 0 being a feature the vendor does not support. Multiplying the rank by the importance of the feature (3 – Critical to have, 2- Important to have, 1- Nice to have), will give you a good picture of where each vendor ranks.
There should be some subjective items that are used in rating, also, such as how easy you believe the vendor will be to work with. Once the vendors are rated, the team should meet to discuss differences between team members' ratings and then to agree on where each vendor ranks. It is important that all requirements are considered and weighed appropriately while ranking vendors. For example, selecting the system with the best price may leave you with a vendor that doesn’t have the resources to support your implementation.
Negotiate and purchase
Hopefully, you will be able to successfully (and quickly) negotiate with your top-ranked vendor. However, it does sometimes happen that an agreement cannot be reached with the initial vendor for reasons that may include pricing adjustments or unexpected changes to the availability of their resources. In this case, you will need to move on to your second choice.
For more information on specific criteria for purchasing a RIM system, read our RIM Buyer’s Guide.
