Grant Ramaley
Co-Convener, IAF Working Group on Medical Devices (ISO 13485)

In February 2022, the IAF Medical Devices Working Group (WG) completed a four-year cycle of improving one of the most important documents that supports the medical device quality system ISO 13485. IAF MD 9: Application of ISO/IEC 17021-1 in the Field of Medical Device Quality Management Systems (ISO 13485) provides mandatory requirements for auditors to ensure that they are competent, impartial and spend enough time on-site, especially where medical devices present a higher risk to patient safety.

Solutions, then Problems within the Supply Chain

In 2017, IAF MD 9 was issued to support manufacturers and other organizations that were not making medical devices, but were supplying ‘parts and services’. This followed after the ISO 13485:2016 standard was revised, which opened up ISO 13485 for more casual use. Since then, thousands of companies have sought ISO 13485 certificates for what are essentially unregulated products and services.

The main change to IAF MD 9 in 2017 was the additional Table A1.7, which introduced a new ‘Main Technical Area’ to support suppliers of ‘parts and services’. Unfortunately, a couple of years into application of IAF MD 9:2017, concerns arose where auditors reported that some companies seemed to be taking advantage of this new scope ‘parts and services’.

The IAF Medical Devices WG was asked to resolve situations like these.

Examples of abuses IAF MD 9:2022 will now correct:

1. The organization manufactures ‘parts’ advertised for use in ‘implanted medical devices’.

• Some companies advertised they made medical device software under consulting ‘services’.

• Some companies made ‘near-complete medical devices’ and called them ‘parts’.

Although regulators rarely have a legal basis to audit these kinds of organizations, they have become a grave concern. Oftentimes some of the most important work concerning safety and effectiveness of medical devices is wrapped up in activities beyond the control of the ‘legal manufacturers’, which may do little more than register the device under their own name.

Some of these critical activities occur only with the supplier and are key to the safety and effectiveness of medical devices that are used in treatments. Regulators in some parts of the world sometimes refer to these as ‘critical suppliers’. In Europe, notified bodies (NBs) are expected to consider doing an additional audit of these ‘critical suppliers’, and can make the ‘legal manufacturer’ pay extra to cover the additional audit.

Improving Allocation of Auditors and their Competencies

Under IAF MD 9:2022, these supplier organizations may continue as they have, but the conformity assessment bodies (CABs) a.k.a. auditing organizations are now expected to check the company’s website and send in auditors that are competent enough to examine the quality management system (QMS), especially when they see claims by the company that indicate the ‘part’ or ‘service’ supports certain kinds of medical devices.

If a company is advertising they make screws for use in ‘implanted medical devices’, the ISO 13485 audit must be handled differently than for a company advertising fasteners used for general purposes. In the case of a company seeking ISO 13485 certification that advertises itself as providing ‘consulting services’ and markets itself as creating ‘medical device software’, the CAB will be expected to send auditors with competencies sufficient to assess the QMS in light of some expected practices that are unique to developing medical device software.

How Does This Help the Medical Device Industry?

Some regulators are now demanding that the ‘legal manufacturers’ pay much closer attention to ‘critical suppliers’. IAF MD 9:2022 improves audits of ‘critical suppliers’ by using audit teams that carry technical expertise related to medical devices. After the supplier has earned their certificate under these conditions, these ‘critical suppliers’ may be excused from further auditing, which might have been the burden of their customer, the ‘legal manufacturer’.

IAF-backed certificates are now recognized under the European co-operation for Accreditation. The improved audits could save a company thousands of dollars in additional fees, giving NBs a reason to excuse additional audits of properly certified ‘critical suppliers’, since they know that IAF mandatory requirements enforce better 13485 audits.

Critical suppliers of parts and services will likely learn that having a more seasoned and experienced audit team reviewing their quality systems is nothing to fear. Despite the usual fears that ‘they will know better where to look’, experienced auditors also know what can be ignored as inconsequential or ‘out of scope’ and are more prone to accepting reason, while pressing hard on the important areas of concern to patient safety and regulatory compliance.

Medical device regulators and the medical device industry will benefit from the added confidence provided by IAF MD 9:2022. The goal of the program is to provide confidence in medical devices made where the ISO 13485 QMS is expected to be applied. No longer is just one certificate good enough. Supply chains are complex and ISO 13485 is needed deep within them.  It is not merely the credibility of ISO 13485 certificates that is supported, but the well-being of those whose lives depend on billions of treatments worldwide, using the products made under the QMS ISO 13485.