Everything You Need To Know About ISO 13485

When manufacturing medical devices, no matter where you are in the supply chain, it’s crucial to adhere to the necessary rules and regulations so that the product is safe for end-users. But, with quality standards for products varying from country to country, it can be difficult to standardise these regulations. This is where ISO 13485 Medical Devices comes in. 

This internationally-recognised ISO standard provides stringent guidelines for manufacturers and distributors of medical devices. This kind of standardisation makes it possible for all devices to have the same level of internationally-recognised quality, as well as compatibility with similar products. 

This article explains everything you need to know about ISO 13485, from what it is and how much it costs, to who needs to be accredited to it and how this can be done. 

What Is ISO 13485?

ISO 13485 is a Quality Management System (QMS) for medical devices set out by the International Standardisation Organisation. It outlines an internationally-recognised QMS that all manufacturers and suppliers of medical devices must adhere to in order to demonstrate that:

• Best practices are being used throughout the manufacturing process
• They are dedicated to maintaining the quality and safety of medical devices 
• They are able to design or supply products in accordance to regulatory requirements
• They have the competency to manufacture or supply substances to the medical industry

ISO 13485:2016 is the latest revision of this standard. An organisation must comply with this version to be able to not only demonstrate its technical capability to supply medical devices, but also other related services like periodic maintenance for the device in question, as well as substances that are used in medical devices. This last is the reason that ReAgent is accredited to ISO 13485, as we manufacture chemicals for use in medical devices, such as biological buffers and diagnostic reagents.

Organisations or companies that are accredited to the ISO 13485 standard take part in at least one of the life cycle stages that occur when manufacturing a medical device. These stages typically include:

• Design or conceptualisation of the device
• Product development and prototyping
• Manufacture or mass production of the device
• Proper storage conditions and packaging
• Distribution and sale of the device 
• Correct and safe installation of the device 
• Servicing or maintenance of the device
• Supplying replacement parts as necessary
• Providing technical support and instructions for users

Suppliers and other external entities, such as third-party maintenance service providers, can also use ISO 13485:2016 in their operations in order to show that their systems and protocols are able to maintain quality at every stage of development. That way, the end-user is guaranteed that all companies throughout the supply chain are meeting ISO 13485 standards.

The requirements specified by the ISO are applicable to all organisations, big or small, as long as they’re engaged in at least one of the life cycle stages of medical device production. There are, however, some clauses in the standard that can be exempted if they don’t pertain to the type of work an organisation performs.

Is ISO 13485 Medical Devices A Legal Requirement?

While the ISO 13485 Medical Devices standard isn’t enforceable by law, many governments around the world, including in the UK, make it a legal requirement for organisations to comply with the Medical Devices Directive (MDD). This doesn’t necessarily require accreditation to ISO 13485, though many manufacturers prefer this set of standards because they’re harmonised to the MDD. In fact, many organisations enforce ISO 13485 as a mandatory process within their own organisation and to their suppliers.

In some countries, the regulatory requirements for medical devices aren’t as strict as those set out in the ISO standard. This means that manufacturers or suppliers who aren’t accredited to ISO 13485 cannot trade with organisations that impose these standards. 

There are some regulatory exclusions when it comes to the design specs and product development of medical devices, and these can be used as justification for non-compliance with the ISO standard. For example, clause 7.3 of ISO 13485:2016 specifies the rules and regulations surrounding design controls for medical devices. If you’re a manufacturer of lower-risk class 1 medical devices, which typically don’t require design controls, then you may be able to either request for this clause to be excluded from your accreditation, or seek accreditation from other international regulators for medical devices.

However, whatever regulatory requirements an organisation does adhere to must be sufficient to provide alternative quality standards. These must similarly address the product quality and management system of an organisation as it relates to designing, prototyping, manufacturing, storing, distributing, or maintaining the medical device product.

What Do Clauses 6, 7 and 8 Mean?

An organisation isn’t obliged to include a requirement in its Quality Management System if the requirement isn’t applicable to the operations of the organisation, as stated in Clauses 6, 7 and 8 of ISO 13485:2016.

Clause 6 – Resource Management

This clause states that the top management of a medical devices company is responsible for ensuring that ISO requirements, as well as local regulatory requirements, are adhered to by their Quality Management System. Clause 6 of ISO 13485 also mandates that top management must be able to provide sufficient resources so that the organisation can satisfactorily accomplish its functions. These resources include:

• Provisions for contingencies or risk management
• Manpower, or personnel with appropriate qualifications
• Necessary infrastructure, such as buildings, machineries, or equipment

Provisions for risk and contingency management may include work protocols and safety standards that are designed to prevent contaminations. Provisions for seamless, long-term operations and anticipation of personnel turnouts, such as retirements and resignations, are also important factors to consider. Top management’s commitment to the standard, as defined in Clause 6, is crucial to the success of an organisation or company that manufactures medical devices.

Clause 7 – Product Realisation

According to Clause 7 of ISO 13485 Medical Devices, an organisation must have a comprehensive plan for developing the product, from conceptualisation to mass production. The product journey of a medical device includes detailed documentation, like how ideas are initiated and how concepts have been verified, and includes how products have been designed and prototyped.

There are six subclauses associated with product realisation for medical device manufacturers:

• 7.1 Planning of Product Realisation
• 7.2 Customer Related Processes
• 7.3 Design and Development
• 7.4 Purchasing
• 7.5 Production and Service Provision
• 7.6 Control of Monitoring and Measuring Equipment

The ISO 13485 standard should be incorporated at various stages of product development and research.  When doing this, communication with and feedback from the personnel involved is very important, especially during the process of product design and implementation, because it will ensure that everyone has a clear understanding of how to implement best practices.

There are various ways to verify and validate ISO compliance during the process of product realisation for a medical device. These involve adhering to the following steps:

• Input planning
• Outputs review
• Verification
• Confirmation
• Validation

Critical to the design process is the documentation process. This involves the transfer of ideas, the control of design, recording changes in the design, and the retention or storage of all files that are relevant to the product’s development and realisation. Other important aspects of documentation include defining and tracking the supplies, and deciding how to verify product compliance based on the company’s set of procedures.

Organisations should also monitor each component of the product development process to ensure a stringent compliance with the ISO standards specific to medical devices. This work includes:

• Monitoring and maintaining equipment used in product development
• Ensuring the cleanliness of the facility, machineries, equipment, and products
• Evaluating whether the product is effective in terms of its traceability, customer property management, and product preservation

Clause 8 – Measurement, Analysis, and Improvement 

Once the product has been developed and mass-produced according to ISO 13485 standards, it can then be sold to distributors, retailers, and end-users. The manufacturer now has the responsibility of ensuring that consumers will be satisfied with the final product. According to Clause 8 of ISO 13485:2016, a medical device must meet the expectations of end users in terms:

• Reliability
• Longevity
• User-friendliness
• After-market customer support

These are crucial if you want to establish credibility and have a competitive edge. However, complying with the ISO standards might not be the sole criterion for quality or customer satisfaction. How, then, will you continually improve your product? 

The simple solution is customer feedback. Whatever type of medical device you’re manufacturing or selling, you need to know the assessment of the end users; you cannot risk mass producing products that will just be rejected by the intended users due to issues with quality or functionality.

Based on Clause 8, the procedure for monitoring and assessing the success of medical device products must have the following components:

• Answering customer complaints, questions, or other concerns about the medical device
• Properly reporting significant product-related incidents or events to authorities
• Internal evaluations through product auditing to ensure everything is functioning properly
• Continually checking for products that are below the standards of the original design
• Conducting data analysis and customer feedback surveys to improve the overall process 

How Much Does ISO 13485 Certification Cost?

The cost of ISO 13485 certification varies depending on several factors, such as:

• The number of units and type of medical device
• The floor area of the manufacturing plant or facility
• The number of employees in the organisation or company
• The authorised body that will conduct the inspection and issue certification

However, there are some standard fees that you should expect to pay, including:

• The drafting of a quality manual for your organisation, usually around £345
• The drafting of mandatory procedures, usually around £645
• Drafting of important templates, usually around £266
• On-site visits, usually around £306 per person per day

Additionally, you should also expect to cover any costs incurred by the auditing process and ISO certification services, including things like travel and accommodation. 

While all of this may result in a steep upfront cost, earning accreditation to the ISO 13485 standard for medical devices will save you money in the long run. This is because the standards force you to optimise your production, leading to reduced operating costs and a more efficient manufacturing process. Holding this accreditation also widens the scope for your business, allowing you to target new customers, types of business, or whole new industries.

How Do I Get ISO 13485 Certification?

There are six basic steps for securing ISO 13485 certification. The exact details may vary depending on similar factors to those that determine cost, including the type of device and the size of the company. In general, though, there are six basic steps to an follow: 

Step 1: This involves planning the quality system – but merely writing a quality manual isn’t enough. An applicant must have detailed and documented quality plans that specifically relate to implementing relevant changes to the organisation’s QMS.

Step 2: Here you must demonstrate compliance with the requirements of the local, national, or regional regulatory authorities. 

Step 3: Implementing design controls is the next step you should take. Design controls will vary depending on the organisational operations and technical know-how.

Step 4: Provide essential documents, records, and training so that your employees are well-equipped for following protocols and safety procedures. This step includes the process interactions for the Quality Management System at various tiers of your organisation.

Step 5: You can now begin instituting the management process. The emphasis of this is to manage risks and potential hazards in the operations of the organisation.

Step 6: The final step is to conduct or schedule a certification audit. This involves providing all the necessary documentation to ISO auditors, as well as booking on-site audits so that the level of compliance can be assessed.  

How Long Does It Take To Get ISO 13485 Certification?

Obtaining ISO 13485 certification is a relatively long process because of the strict requirements it imposes. In general, it takes between four and ten months to move out of the application process and earn certification. Here’s a brief timeline overview to give you some idea:

• Queuing for the registrar takes around 1 to 4 months
• GAP analysis takes around 1 to 2 months
• Review of processes takes around 1 to 3 months
• Stage 1 auditing takes around 30 to 60 days
• Stage 2 auditing takes around 60 to 90 days

Who Needs ISO 13485 Certification?

ISO 13485 certification is intended for any organisation that designs, manufactures, distributes, installs, or services medical devices. Companies that manufacture substances for use in medical devices must also gain accreditation to this standard before their products can be used in the medical field.

A medical device refers to any sized instrument, machine, implant, or in vitro device (IVD), so long as it’s intended for medical purposes. Such devices help in the diagnosis, prevention, or treatment of diseases. This is why it’s so crucial to standardise the rules and regulations surrounding the quality control of these devices.