People frequently ask me where to find information about ISO 13485, but I always have trouble finding resources specific to certification. Therefore, I recently completed a white paper specific to ISO 13485 certification, and this article provides a brief overview of the sequential steps to the process.
There are six steps to preparing for ISO 13485 Certification:
1. Planning the Quality System
2. Meeting Regulatory Requirements
3. Implementing Design Controls
4. Documents, Records and Training
5. Management Processes
6. The Certification Audit
Step 1: Planning the Quality System
Section 5.4.2 of the ISO 13485 Standard includes a requirement for Quality Planning. Writing a Quality Manual is not sufficient to meet this requirement. You need documented Quality Plans for implementing changes to your Quality Management System, and creating a new Quality System from scratch is a big change. There is no required format for quality plans. Spreadsheets and Gantt Charts are the most common tools for quality planning.
As part of your Quality Plan, you should select a certification body. You are allowed to have a different certification body for each location, but I don’t recommend it. Instead, save yourself time and money by selecting one partner for all your locations.
In order to select a certification body, first you need to complete an application form and request a quote. Most Quality Managers contact a certification body they worked with in the past, or ask a friend for a referral. I recommend neither approach.
There is an official Europa page that helps you identify the complete list of “possible” candidates based upon the product category. If you’re licensing in Canada, you should refer to an even shorter list of possible certification bodies, which can be found on Health Canada’s website. The selection of your registrar is also an opportunity to create a record of supplier qualification.
Step 2: Meeting Regulatory Requirements
While developing your quality plan, you will need to define those global markets in which your company is going to seek regulatory approval. The most common markets for U.S.-headquartered device manufacturers are the U.S., Europe and Canada. Each of these markets has additional requirements:
1. In the U.S., medical device companies must comply with 21 CFR 820.
2. In Europe, device companies must comply with one of three directives: 1) the MDD for devices such as a knee implant, 2) the AIMD for active implantable devices or 3) the IVDD for in vitro diagnostic devices.
3. In Canada, the Canadian Medical Device Regulations (SOR/98-282) define the requirements for your company.
If your company is only interested in the U.S. market, certification is not required. In Europe, ISO 13485 Certification is the most common pathway for achieving CE Marking approval. In Canada, you will need a special type of ISO 13485 Certification called CMDCAS.
Step 3: Implementing Design Controls
Most clients have already implemented design controls. Therefore, that lies outside the scope of this article.
Step 4: Documents, Records and Training
One of the requirements for a Quality Manual is to define the process interactions for your Quality System. This is typically done by creating a process interactions diagram. The classical template for this diagram has three levels: 1) the bottom row includes support processes such as document control and training; 2) the middle row includes core processes such as purchasing, production and shipping and 3) the top row includes management processes. Each of these levels will have associated procedures, and these procedures will need to be controlled.