by Josée Adam
If the thought of adapting
your quality management system to meet every nation’s
individual code of regulations scares you, it shouldn’t.
Since ISO Technical Committee 210 launched the ISO 13485:2003
standard, getting your medical devices to customers without
jumping through numerous time-consuming regulatory hoops
has become more possible than ever before.
ISO 13485:2003 Medical devices--Quality management systems--Requirements
for regulatory purposes was written for organizations that
design, develop, produce, install or service medical devices.
It’s intended to promote global harmonization for
medical devices and set a basis for quality system regulations
The standard’s practical benefits include reducing
barriers between international manufacturers and customers.
Moreover, increased competition between medical device manufacturers
could well lead to higher quality, lower prices and greater
availability in developing countries.
ISO 13485:2003 is the single standard for all classes of
medical devices. Its scope includes design and manufacture,
but where regulatory requirements permit, design and development
controls can be excluded from a company’s management
Whether it’s called CAN/CSA-ISO 13485:2003 in Canada,
EN ISO 13485:2003 in the European Union or another ISO-copyrighted
name elsewhere, it’s the same standard. It replaces
ISO 13485:1996 and ISO 13488:1996, standards currently used
within the medical device industry.
ISO 13485/88:1996 was used in conjunction with ISO 9001/2:1994.
The revised standard is aligned with ISO 9001:2000 and includes
process management principles. Because many components of
ISO 9001 are excluded from ISO 13485:2003, management can’t
claim ISO 9001:2000 registration unless it seeks this QMS
The Global Harmonization Task Force, a committee of medical
device manufacturing representatives and governmental regulation
bodies, convened in 1992 to consider how to converge regulatory
practices. To this end, the GHTF worked with ISO TC 210
to facilitate the convergence and assist international trade.
ISO 13485:2003 is the successful result of ISO TC 210 teamwork.
Representatives from 29 countries participated in the process
to develop the revised standard.
Although the U.S. Food and Drug Administration maintains
its independent quality system regulations, it recognizes
the importance of maintaining consistency with ISO 13485
requirements. Accordingly, the FDA has changed regulations
in response to comments received from those in the industry.
Because the two systems are closely related, medical device
manufacturers can develop a quality management system that
blends FDA requirements with ISO 13485:2003.
In Canada, ISO 13485/88 was adopted in 1998. The Canadian
Medical Devices Conformity Assessment System required medical
device manufacturers to conform to ISO 13485/88 by Nov.
1, 2003, although not all suppliers were able to make this
Because of administrative restrictions, Health Canada demands
compliance with ISO 13485:2003 by March 14, 2006, four months
ahead of ISO’s deadline. Most medical device manufacturers
selling to Canada are expected to quickly convert to ISO
In the European Union, EN ISO 13485:2003 will gradually
replace the EN ISO 13485/88:2000 standards. Medical devices
sold in the European Union must bear the CE Mark in conformity
with the Medical Device Directives.
The EU adopted ISO 13485 as a harmonized standard for quality
system requirements, replacing the European standard EN
One component of ISO 9001:2000 excluded from ISO 13485:2003
is customer satisfaction, which ISO TC 210 decided is inappropriate
for medical devices. Customer satisfaction is subjective,
not always placing device safety and efficiency above other
factors, including price, convenience or availability.
ISO 13485:2003 demands that manufacturers specify requirements
for all aspects of the product, including delivery and post-delivery
activities, requirements necessary for the device’s
intended use, and statutory and regulatory requirements.
Continuous improvement is another component of ISO 9001
missing from ISO 13485:2003. Instead, companies monitor
their QMSs regularly to determine whether they maintain
effectiveness. Consistent with regulations around the world,
this component is intended to ensure the QMS’s effectiveness
and its ability to produce safe and effective products consistently.
Registration to ISO 13485 means that a third-party registrar
recognizes that the company consistently designs, produces,
installs or services the product in accordance with documented
procedures. Now, registrars are obligated to judge effectiveness
of the company’s QMS in meeting criteria for the operation
and control of the various processes as well.
ISO 13485:2003 mandates 18 documented procedures in specific
areas. These areas include control of documents, control
of records, design and development, purchasing, validation
of computer software, validation of sterilization processes,
identification, traceability, preservation of product, control
of monitoring and measuring devices, feedback system, internal
audits, control of nonconforming product, analysis of data,
issue of advisory notice/adverse event reporting, corrective
action and preventive action.
These documentation requirements mirror the demands of
ISO 13485:2003 specifically notes and refers to ISO 14971:2000
for guidance regarding risk management.
ISO 14971 distinguishes the manufacturer’s management
commitment as critical for an effective risk-management
process. In particular, ISO 14971 demands that management
identify and use individuals trained in risk-management
The personnel hired to perform these tasks should have
knowledge of how the device is constructed, how the device
works, what its intended use will be and how to apply the
risk management process.
Manufacturers must analyze risk, evaluate probability for
failure, make all possible attempts to control risk and
then evaluate residual risks throughout the product life
cycle. If a risk is identified during the design phase of
a class III medical device, for example, it might be managed
through actions taken at theproduction phase later in the
A risk can be identified during the production phase of
a class I medical device and managed through actions taken
during the post-production phase, once the product is on
Risk management doesn’t stop when the device goes
into production, either. Manufacturers must monitor post-market
information for events that might affect risk-management
decisions. In this way, risk management becomes a closed-loop
The process approach works because it’s easier to
manage processes than elements of a quality system. A QMS
ensures products are designed and manufactured in a consistent
manner. Because some manufacturers might be unfamiliar with
the process approach identified in ISO 9001:2000, a gap
analysis might be a beneficial first step.
Imagine yourself outside the world of ISO 13485, ISO 9001
and all other regulations. Adopt the process approach, and
you add value to the organization. In almost all cases,
it also improves the product’s quality. Simply put,
the process approach is popular because it’s successful.
By examining processes, manufacturers can identify deficiencies
that lead to medical device failure. ISO 13485:2003 can
serve as a model for government regulators developing QMS
requirements for medical devices. This means that in any
country in the world, you’re in perfect harmony.
Trudell Medical International, based in London, Ontario,
designs, develops, manufactures and distributes aerosol
drug-delivery products around the world. Previously registered
to ISO 9001:1994, the company chose to upgrade to ISO 13485:1996
to satisfy customer demands and government regulations.
According to John Straatman, director of quality assurance
for Trudell, the company has already adopted the process
format and its QMS is fully prepared to upgrade to ISO 13485:2003
well before the deadline.
“The process approach doesn’t break the system
into 20 separate elements because one process flows into
every other process to enhance the entire quality system,”
explains Straatman. “All employees, from engineers,
to technologists to the people building the product on the
assembly line, are aware of the benefits of our QMS.”
Customers also expressed pleasure with the QMS, Straatman
notes, after auditing the company. “Our QMS integrates
ISO 13485, FDA quality system regulations, Canadian Medical
Devices Regulations and the European Medical Device Directive.”
Regulations might not always require registration to ISO
13485. Just as manufacturers selling class I medical devices
in Canada choose to register their QMSs on a voluntary basis,
so too do distributors of class I, II, III and IV medical
devices. But although the standard might be voluntary in
these cases, it’s universal. These companies can work
in harmony with customers across the planet.
Sometimes, the client demands ISO 13485 registration. In
other cases, medical device companies seek new business
opportunities and pursue the benefits of registration before
attempting to penetrate a market. Customers often rely on
ISO standard registration as a qualifier when choosing a
When comparing potential suppliers, customers commonly
analyze medical device products for price, reliability and
quality--not necessarily in this order. ISO 13485:2003 registration,
especially voluntary registration, clearly identifies a
QMS focused on quality.
Smith & Nephew, a multinational corporation that develops
and markets medical devices, implemented ISO 13488 because
it facilitates communication among its three divisions and
customers, according to Janine Lepage, the company’s
technical director in Montreal.
“It’s a regulatory requirement in Canada and
now in Europe, but registration to this standard also allows
us to set common objectives and speak the same language
as importers,” says Lepage. “Customers may not
always know we’re registered to ISO 13488, but when
we tell customers we’re ISO-registered, they have
a positive reaction.”
The company’s orthopedics, wound management and endoscopy
divisions had been registered to the ISO 9001:1994 standard,
and therefore a migration to ISO 13488 caused few problems
for its QMS.
ISO 13485:2003 is destined to serve as a catalyst for multinational
trade. Although it’s not the only regulatory hurdle,
ISO 13485:2003 does improve the chances for any medical
device provider, from any country, to successfully compete
for a share in the global market.
According to the Advanced Medical Technology Association,
the medical device industry grows at a 7 percent annual
rate and will reach $314 billion by 2010. Clearly, a strategic
investment in ISO 13485:2003 registration is well worth
the tangible benefits of a $314 billion market.
Josée Adam, internal sector expert on medical
devices for QMI, a division of the CSA group, is a professional
engineer and National Quality Institute-certified lead auditor
with more than 10 years of experience as a quality systems
auditor. She has audited medical device manufacturers to
the ISO 9001:1994, ISO 9001:2000, ISO 13485/8:1996 and ISO
13485:2003 standards. Adam acts as QMI’s representative
on Health Canada Registrars’ Forums and CSA Canadian
Advisory Committee to ISO TC 210.