Regulatory Open Forum

 View Only
  • 1.  Nonconformity ISO 13485 - Device not been sold yet

    This message was posted by a user wishing to remain anonymous
    Posted 13-Aug-2021 13:34
    This message was posted by a user wishing to remain anonymous

    I have a class I software as a medical device which was self-certified under MDD before 26 May, and was not yet sold. We intended to certify the QMS according to ISO 13485:2016, so we approached an accreditation body (which in this case is not also a Notified Body). We have received a NC that states "The product has not yet been sold. This fact limits obtaining evidence of the implementation of all requirements of the reference standard with emphasis on 7.5 Production and service provision." They did not allow certification yet and requested another half day audit in a couple of months to audit these parts concerning production.
    Do you think this is an acceptable nonconformity and requesting of another audit?
    I have dealt with companies certifying the QMS from a Notified Body at the same time they did the certification of the device (hence the device couldn't be on the market). 
    How would you deal with this situation?
    Thank you!

  • 2.  RE: Nonconformity ISO 13485 - Device not been sold yet

    Posted 13-Aug-2021 15:27
    Edited by Kevin Randall 13-Aug-2021 15:36

    The notion of a certification body refusing an ISO 13485 certification at the premarket stage due to lack of sales is contrary to the fundamental intent of ISO 13485, whose intent is the certification of a standardized level of quality assurance before the device is placed on the market.  Moreover, another bottom line for the European jurisdiction is that, as a general rule (there is one exception), the EU MDR does not require the placing on the market of a medical device (regardless of its class) to be held up by, nor contingent upon, an ISO 13485 certification.  I explain these assertions further below.

    Demonstration of conformity with applicable quality management system (QMS) requirements (among others) is a precondition for authorization to place devices on the European market.  For example, a European Notified Body (NB) (if one is required at all; I elaborate further on that below) won't issue an EU Technical Documentation Certificate (the most common type of EU MDR product marketing authorization) until after conformity with the QMS requirements has been achieved.  As an aside, Health Canada operates the same way, requiring certification against ISO 13485 (by way of MDSAP) before it will grant marketing authorization for the medical devices governed under the ISO 13485 QMS.  These are just a couple examples of many that we can cite showing that an ISO 13485 certification isn't intended to be contingent on device sales.

    In any case regarding Europe, a common misconception is that the EU MDR requires ISO 13485 certification.  But actually, the EU MDR does not require ISO 13485 QMS certification at all (unless the manufacturer voluntarily chooses to leverage Article 8 and a harmonized version of ISO 13485).  Instead, the real requirement is simply that the manufacturer must demonstrate conformity with the EU MDR's various QMS requirements [see EU MDR Article 10(9)].  Indeed, the manufacturer is free to decide whether it will demonstrate such conformity via an ISO 13485 certification or else instead via a non-certified approach.  Accordingly, the placing on the market of an EU MDR Class I self-declaration device (or any other class) need not be held up by, nor contingent upon, an ISO 13485 certification unless the manufacturer has voluntarily chosen to impose the ISO 13485 certification requirement on itself.

    Another key point is that ultimately, the standards governing conformity assessment bodies don't require device sales as a precondition for initial certification.  There is however a mandatory two-stage (i.e., two-audit) paradigm for initial certification whereby the manufacturer is required to demonstrate a certain degree of implementation of the QMS (such as performance of a management review).  But device sale is not an intent of the required two-stage audit paradigm governing the certification body and thus its clients.

    Kevin Randall, ASQ CQA, RAC (Europe, Canada, U.S.)
    Principal Consultant
    Ridgway, CO
    United States
    © Copyright 2021 by ComplianceAcuity, Inc. All rights reserved.

  • 3.  RE: Nonconformity ISO 13485 - Device not been sold yet

    Posted 14-Aug-2021 04:30
    Good day Anon,

    I would just like to add a thought to Kevin's nice explanation of how ISO 13485 quality system can be applied.  An area of focus for ISO 13485:2016 is processes in the quality system which would fundamentally ensure product safety and compliance.  I have experienced many audits were we achieved ISO 13485 certification before we were actually on the market.  Which leads to the next comment is ISO 13485 has surveillance audits every year which shows the progression, improvement, and activities associated with the quality system.  If after 3 or 4 years a company is still not on the market, I would probably question the need for certification audit at that point.

    Yes, the auditors want to see the quality system is "implemented" meaning it is being used.  If a product is not yet on the market this might be difficult such as post market activities or regulatory reporting.  However, if you are dealing with an certification body and not a Notified Body, you definitely have much more leverage because you can find another certification body who will work with you.

    I kind of had to laugh because already if you are selling a Class I SaMD, the section 7.5 in the standard is going to be a lot of "not applicable" so really quite a stretch to write such an observation.

    Richard Vincins RAC
    Vice President Global Regulatory Affairs

  • 4.  RE: Nonconformity ISO 13485 - Device not been sold yet

    Posted 18-Aug-2021 18:17
    I would also note I have worked for several medical device design consultancies where we held ISO 13485 certification with no intention of ever marketing/selling a product ourselves as our clients were the ones who were responsible for that.

    This does sound a spurious NC which needs further clarification as to why they raised it.


  • 5.  RE: Nonconformity ISO 13485 - Device not been sold yet

    Posted 19-Aug-2021 10:47
    Very odd response. 

    It would be rather funny if you opened a CAPA and investigation and found the root cause of "no sales." You would become an instant billionaire. 

    On a serious note, what portion of 13485 did the NC reference about sales? Can you file a complaint?

    Edward Panek
    VP, QA/RA
    Med Device
    USN Veteran
    Research into Neural Nets -

  • 6.  RE: Nonconformity ISO 13485 - Device not been sold yet

    Posted 20-Aug-2021 05:57
    I would file a complaint against the notified body.  It is indeed a very spurious finding.

    Mary Corcoran
    Regulatory Affairs Manager EMEA

  • 7.  RE: Nonconformity ISO 13485 - Device not been sold yet

    Posted 20-Aug-2021 12:57
    This sounds very odd. You should clearly explain if a section is not applicable to your product in the scope section. If it is applicable, then you can show the implementation of the requirements by having written procedures etc. (if required by the standard) or quality planning.

    I would suggest to take the issue to certification committee of the certification body (you refer them accreditation body but actually they are certification body). If you still think the decision is not fair and does not have a solid base, I would suggest to contact (issue a complaint) their accreditation body (e.g. ANAB, UKAS etc.).

    Reyhan MUTLU
    San Jose CA
    United States