When it comes to current good manufacturing practices (cGMP) for medical device manufacturers and other companies involved in the medical device lifecycle, the regulations in the United States differ from some of the international standards preferred or mandatory in other countries.
In addition to adhering to FDA 21 CFR 820 regulations for quality systems, all companies involved in the medical device lifecycle — from initial conception to decommissioning and disposal — should strongly consider adopting international quality system management standards to enhance and fully embrace cGMP, even if only manufacturing and selling devices in the U.S.
To better demonstrate the benefits of adopting international standards, we’re highlighting two relevant ISO standards for medical devices: ISO 13485 and ISO 9001. Learn why these standards were established and how they differ from and can enhance FDA 21 CFR 820.
What is ISO 13485?
ISO 13485 is an international standard that “specifies requirements for a quality management system that can be used by an organization involved in one or more stages of the life-cycle of a medical device, including design and development, production, storage and distribution, installation, servicing and final decommissioning and disposal of medical devices, and design and development, or provision of associated activities (e.g. technical support).”1
In addition to device manufacturers, these standards can also be adopted by third-party suppliers that provide products and services along the device lifecycle, including raw materials, subassemblies, sterilization services, distribution services, and quality management system-related services, among others.
In a nutshell, ISO 13485 goes a step beyond 21 CFR 820, which regulates finished medical devices to be sold in the U.S., by setting a global standard with specific guidance on how quality systems shall operate.
While ISO 13485 is based on ISO 9001, it excludes certain elements of ISO 9001 that are not deemed as regulatory requirements — such as the emphasis on continual improvement and customer satisfaction. Therefore, a quality management system that conforms to ISO 13485 does not automatically conform to ISO 9001, which would require separate certification.
Manufacturing Medical Devices in the United States: Which Standards to Follow?
It can be tempting for medical device manufacturers, suppliers, and other involved parties to stop at 21 CFR 820 compliance. After all, that is the only quality systems standard required to comply with U.S. regulations to sell medical devices in the U.S.
However, the advantages of obtaining international compliance certifications in addition to the U.S. regulations are many, including:
- A basic framework to pursue any other country-specific certifications
- The ability to more quickly enable distribution and sales in other countries
- Demonstration of overall credibility as a company, showing dedication to cGMP to companies, partners, and investors
- An accepted approach with regulators
- Assurance that the company meets certain Quality Management System expectations defined within each standard
- An improved likelihood that a medical device will meet all customer and regulatory requirements
21 CFR 820 vs. ISO 13485 vs. ISO 9001
| 21 CFR 820 | ISO 13485 | ISO 9001 | |
|---|---|---|---|
| Purpose | Demonstrate medical devices are safe and effective | Demonstrate the quality system is effectively implemented and maintained | Demonstrate continual improvement |
| Required in U.S.? | Required | Voluntary | Voluntary |
| Required in EU? | No | Preferred | Preferred |
| Customer Satisfaction Requirement? | No | No | Yes |
While we are focusing on 21 CFR 820 due to its application in the U.S., it is important to note that other countries and regions have specific guidance for quality management system regulations, including:
- European Union’s Medical Device Directive 93/42/EEC (to be replaced by EU 2017/745 on May 26, 2021)
- European Union’s Directive for In Vitro Diagnostic Medical Devices 98/79/EC (to be replaced by EU 2017/746 on May 26, 2022)
- European Union’s Directive for Active Implantable Medical Devices 90/385/EEC (to be replaced by EU 2017/745 on May 26, 2021)
- Canada’s Medical Devices Regulations SOR/98-282
- Mexico’s Norma Oficial Mexicana NOM-241
An ISO 13485 certification is not a stand-in for the FDA’s or any foreign government’s region- or country-specific regulations but does serve as a common base for achieving specific compliance required by various customers and regulatory agencies.
Still, there are some use cases for ISO 13485, even within country-specific requirements. For example, the FDA allows manufacturers to utilize ISO 13485 audit reports, and Health Canada requires device manufacturers to have an ISO 13485 certification for devices marketed in Canada.
When to Seek ISO 13485 Certification
U.S.-based medical device manufacturers seeking to enhance their cGMP adherence with an ISO 13485 certification should begin the process as soon as possible, which includes the following documentation:1
- Documented statements of a quality policy and quality objectives
- A quality manual
- Documented procedures and records required by this International Standard
- Documents, including records, determined by the organization to be necessary to ensure the effective planning, operation, and control of its processes
- Other documentation specified by applicable regulatory requirements
Certification Timeline
First establish a formal development plan and confirm feasibility before engaging with the FDA for advice on developing a quality management system.
It is wise to sync your certifications schedule with your Plan for Clinical Studies. Plan to achieve ISO certification before you manufacture the first clinical lot.
As part of developing your documentation strategy prior to seeking certifications, consider the following:
- Quality Manual
- Training Program
- Document Control
- Purchasing Procedures
- Incoming Quality Procedures
- Manufacturing Procedures
- DMR and DHR
- Release Testing Procedures
- Facility Validation Procedures
- Vendor/Supplier Quality Procedures
Note that you can apply for ISO 13485 and 21 CFR 820 certifications simultaneously, but both should be achieved before applying for any EU Directives.
An experienced CQV consultant can help to ease and expedite the process.
Sign up for our newsletter to get more commissioning, qualification, and validation insights like these delivered to your inbox.
