Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Guest
If you have already marked medical device according to the MDD, your certificate is valid until the expiry date on the certificate, but not longer than May 2024.
Transition steps from MDD to MDR are as follows:
1) First, you need to check if the classification of your medical device changed. Go to Annex VIII – Classification rules - and check-in which rule your medical device falls now.
2) Take Annex I – General safety and performance requirements – and go through each requirement to check how is that requirement fulfilled for your medical device. Of course, not all requirements from this Annex I are applicable to all manufacturers. For example, if your medical device is not sterile, then requirements in section 11. Infection and microbiological cleanliness – are not applicable to you.
3) Then review your technical file and compare it with the documentation requirements from the Annex II Technical documentation and Annex III – Technical documentation on post-market surveillance. If you see that some documentation/information is missing, prepare those documents.
4) Review your QMS because there are some additional requirements regarding the QMS – MDR Article 10, paragraph 9, and Annex I. For example, there is a requirement that within QMS there should be a strategy for regulatory compliance. Also, there is a necessity to put as part of the QMS Clinical evaluation process (Chapter 6) and Post-market surveillance system (Chapter 7).
5) Assign for the UDI number - The UDI, in general, is provided by an official designated entity. On the MDCG 2019-1 guiding principle of issuing entities rules on Basic UDI-DI, there are some requirements to follow.
For periodic audit that will be conducted after May 2021, you need to have prepared a Post-market surveillance system, vigilance system, and defined economic operators according to the MDR (for more details see Article 120).
Here you can find all the information:
EU MDR Article 10 – General obligations of manufacturers https://advisera.com/13485academy/mdr/general-obligations-of-manufacturers/
EU MDR Article 120 – Transitional provisions https://advisera.com/13485academy/mdr/transitional-provisions/
EU MDR Annex I - General safety and performance requirements https://advisera.com/13485academy/mdr/general-requirements/
EU MDR Annex II – Technical documentation https://advisera.com/13485academy/mdr/technical-documentation/
EU MDR Annex III – Technical documentation on post-market surveillance https://advisera.com/13485academy/mdr/technical-documentation-on-post-market-surveillance/
EU MDR Annex VIII – Classification rules https://advisera.com/13485academy/mdr/classification-rules/
CAPA stands for Corrective Action and Preventive Action. It is usually a set of actions that an organization requires in manufacturing, documentation, procedures, or systems to correct and eliminate recurring non-conformities. Non-conformity is determined after a systematic evaluation and analysis of the root cause of the non-compliance.
Corrective actions include identifying, documenting, and removing the root cause of the nonconformity or problem to prevent the problem from recurring.
Preventive measures are taken to prevent the occurrence of such non-compliances, generally as a result of a risk analysis.
The best way to start with the CAPA system is to go through the following articles:
After you will study these articles, if you will have any other questions, do not hesitate to contact us.
1. I would like to know why in ISO 27001 there is a "Supplier Management" and there is no "Customer Management"?
Please note that ISO 27001 main objective is to protect the information, that belongs to the organization or is under its responsibility (e.g., customer information, partners information, etc.).
Considering that, the information to be protected may be accessed by suppliers (e.g., a SaaS provider, contractors, etc.), and the organization needs to ensure that information is also properly protected by suppliers (by means of contractual clauses, periodic service review, etc.), thus the need for “Supplier management”.
Now, customer management involves much more than information protection, so to include it in ISO 27001 would mean an unnecessary overhead for the information security management system.
2. How should I align or assure my clients within my implementation of ISO 27001?
For alignment of customers' interests and requirements with your ISO 27001 implementation, you must consider them when working clause 4.2 Understanding the needs and expectations of interested parties. Fulfilling this clause is enough for the standard to consider customers in your implementation.
For more information, see:
In case your organization considers it needs a more robust customer management approach, you may consider adopting concepts from ISO 9001, the standard for quality management.
For more information, see:
These articles will provide you a further explanation about ISO 27001:
These materials will also help you regarding ISO 27001:
Please note that ISO 27001 does not prescribe data retention requirements (for any type of information), only that these must be defined, based on results of risk assessment and applicable legal requirements (e.g., laws, regulations, and contracts).
Considering that, you should consider hiring legal expert advice, to help you identify relevant legal requirements applicable to your organization.
This article may provide you a starting point:
The starting point is to understand the purpose of the ISO 17025 Standard, the requirements and identify the benefit for your laboratory.
To assist, begin with the article What is ISO 17025?, available at https://advisera.com/17025academy/what-is-iso-17025/
Then have a look at the free Whitepapers available at https://advisera.com/17025academy/free-downloads/, particularly
Then there are some useful articles at https://advisera.com/17025academy/blog/, particularly
The ISO 17025 Toolkit at https://advisera.com/17025academy/iso-17025-documentation-toolkit/ has previews, including an Internal Audit Process Checklist you would use to populate all the requirements in (as from above) to determine the gaps and level of compliance for implementation and accreditation. You could also obtain the assessment checklist form the ISO 17025 accreditation body you would deal with.
Thanks for the information. Most appreciated
According to the definitions in the ISO 13485:2016, a medical device family is a group of medical devices manufactured by or for the same organization and have the same basic design and performance characteristics related to safety, intended use, and function. You can have one Technical documentation for the group of the medical devices with a complete list of the various configurations/variants.
To see how to structure the Technical file according to MDR, see this Technical file template: https://advisera.com/13485academy/documentation/technical-file-template/
Regarding the retention of records, the legal regulations and the periods specified by the customer-specific requirements are important. The first issue to be examined is these 2 places.
In addition, the IATF 16949: 2016 standard defined in clause 7.5.3.2.1 as follows.
"Production part approvals, tooling records including maintenance and ownership), product and process design records, purchase orders (if applicable), or contracts and amendments shall be retained for the length of time that the product is active for production and service requirements, plus one calendar year unless otherwise specified by the customer or regulatory agency."
Yes, you can outsource a person as a management representative. A management representative should be someone who is knowledgeable, trained, and have experience in dealing with the Quality Management System according to ISO 13485 of the company as well as familiar. Also, it would be preferable that that person has experience with your type of medical devices and technologies. This person must be available upon your request.
With an outsourced Management representative, you need to have a contract where mutual obligations will be defined.
For more information, please see the following articles: