Regulatory Open Forum

I cannot seem to find any references anywhere which describe exactly what type of standards a medical device company is required to maintain current copies of. For example, are we required to have a copy (digital or physical) of every standard we reference in an SOP, test report, clinical assessment, etc? Or is it enough that we can research the requirements of various standards and adhere to them? And at what point do we no longer need to maintain current copies? It makes sense that as long as we're selling a product we should keep all relevant standards up to date, but once design and development have passed, do we have to continue with up-to-date standards that we won't necessarily be using? 

My company has a standard's list a mile long and they are all out of date. I want to make the case to go with a subscription service that allows electronic access (i.e. Compliance Navigator) but it is expensive. If we are required to have copies of every standard we've ever cited, it's going to cost thousands anyway. I'm not trying to get out of doing things the right way; I'm just trying to determine what the right way is.

FDA 820 Sec. 820.70 Production and process controls states: Each manufacturer shall develop, conduct, control, and monitor production processes to ensure that a device conforms to its specifications...Where process controls are needed they shall include:
(1) Documented instructions, standard operating procedures (SOP's), and methods that define and control the manner of production;
(3) Compliance with specified reference standards or codes;

ISO 13485:2016 7.3.3 Design and development inputs states: 
Inputs relating to product requirements shall be determined and records maintained (see 4.2.5). These inputs shall include:
b) applicable regulatory requirements and standards;

Unfortunately this is vague to me and I'm not sure how to apply it. I'd really appreciate any advice or experience anyone else can share.

Thanks,

Lillian

------------------------------
Lillian Erickson
QA/RA Director
Salt Lake City UT
United States
------------------------------

Lillian,

Unfortunately the short answer is yes, you must have up to date copies of standards that you are referencing or using for compliance, testing, or maybe even as references.  On the FDA side, I have only had a couple round-about questions concerning testing to standards, and when standards change - what assessment took place or additional testing performed.  On the EU Notified Body side, they ask the questions pointedly to see your list of standards, that the organisation has the actual standard, and that if they change - again what assessment or new testing has been performed.

It can be very costly.  Not only to get a version of standard, but then keep up with revisions as they are released. (I will not get on my soap box that many of these standards are put together by volunteers and in our industry should be free ... discussion for another day.)  The long answer is there are creative ways to get up to date on standards however the expectation is there that if you reference standards, you have a copy so you know what you must comply with, and as revisions occur, also keeping up to date.  If you have a lot of standards, make sure all the standards you are referencing in your SOP are valid and applicable - go through the lists to make them appropriate, but even then you may still have a half-mile long list.

------------------------------
Richard Vincins RAC
Vice President Regulatory Affairs
------------------------------

Original Message:
Sent: 08-Mar-2018 12:32
From: Lillian Erickson
Subject: Standards Management Requirements

I cannot seem to find any references anywhere which describe exactly what type of standards a medical device company is required to maintain current copies of. For example, are we required to have a copy (digital or physical) of every standard we reference in an SOP, test report, clinical assessment, etc? Or is it enough that we can research the requirements of various standards and adhere to them? And at what point do we no longer need to maintain current copies? It makes sense that as long as we're selling a product we should keep all relevant standards up to date, but once design and development have passed, do we have to continue with up-to-date standards that we won't necessarily be using?

My company has a standard's list a mile long and they are all out of date. I want to make the case to go with a subscription service that allows electronic access (i.e. Compliance Navigator) but it is expensive. If we are required to have copies of every standard we've ever cited, it's going to cost thousands anyway. I'm not trying to get out of doing things the right way; I'm just trying to determine what the right way is.

FDA 820 Sec. 820.70 Production and process controls states: Each manufacturer shall develop, conduct, control, and monitor production processes to ensure that a device conforms to its specifications...Where process controls are needed they shall include:
(1) Documented instructions, standard operating procedures (SOP's), and methods that define and control the manner of production;
(3) Compliance with specified reference standards or codes;

ISO 13485:2016 7.3.3 Design and development inputs states:
Inputs relating to product requirements shall be determined and records maintained (see 4.2.5). These inputs shall include:
b) applicable regulatory requirements and standards;

Unfortunately this is vague to me and I'm not sure how to apply it. I'd really appreciate any advice or experience anyone else can share.

Thanks,

Lillian

------------------------------
Lillian Erickson
QA/RA Director
Salt Lake City UT
United States
------------------------------

One way to minimize the costs is to participate in standards development (you get a version for free of the standards you develop) or buy them in places where they are cheaper (like in Estonia, for example).

------------------------------
Marcelo Antunes
Regulatory Strategy Consultant
São Paulo
Brazil
------------------------------

Original Message:
Sent: 09-Mar-2018 06:44
From: Richard Vincins
Subject: Standards Management Requirements

Lillian,

Unfortunately the short answer is yes, you must have up to date copies of standards that you are referencing or using for compliance, testing, or maybe even as references.  On the FDA side, I have only had a couple round-about questions concerning testing to standards, and when standards change - what assessment took place or additional testing performed.  On the EU Notified Body side, they ask the questions pointedly to see your list of standards, that the organisation has the actual standard, and that if they change - again what assessment or new testing has been performed.

It can be very costly.  Not only to get a version of standard, but then keep up with revisions as they are released. (I will not get on my soap box that many of these standards are put together by volunteers and in our industry should be free ... discussion for another day.)  The long answer is there are creative ways to get up to date on standards however the expectation is there that if you reference standards, you have a copy so you know what you must comply with, and as revisions occur, also keeping up to date.  If you have a lot of standards, make sure all the standards you are referencing in your SOP are valid and applicable - go through the lists to make them appropriate, but even then you may still have a half-mile long list.

------------------------------
Richard Vincins RAC
Vice President Regulatory Affairs

Original Message:
Sent: 08-Mar-2018 12:32
From: Lillian Erickson
Subject: Standards Management Requirements

I cannot seem to find any references anywhere which describe exactly what type of standards a medical device company is required to maintain current copies of. For example, are we required to have a copy (digital or physical) of every standard we reference in an SOP, test report, clinical assessment, etc? Or is it enough that we can research the requirements of various standards and adhere to them? And at what point do we no longer need to maintain current copies? It makes sense that as long as we're selling a product we should keep all relevant standards up to date, but once design and development have passed, do we have to continue with up-to-date standards that we won't necessarily be using?

My company has a standard's list a mile long and they are all out of date. I want to make the case to go with a subscription service that allows electronic access (i.e. Compliance Navigator) but it is expensive. If we are required to have copies of every standard we've ever cited, it's going to cost thousands anyway. I'm not trying to get out of doing things the right way; I'm just trying to determine what the right way is.

FDA 820 Sec. 820.70 Production and process controls states: Each manufacturer shall develop, conduct, control, and monitor production processes to ensure that a device conforms to its specifications...Where process controls are needed they shall include:
(1) Documented instructions, standard operating procedures (SOP's), and methods that define and control the manner of production;
(3) Compliance with specified reference standards or codes;

ISO 13485:2016 7.3.3 Design and development inputs states:
Inputs relating to product requirements shall be determined and records maintained (see 4.2.5). These inputs shall include:
b) applicable regulatory requirements and standards;

Unfortunately this is vague to me and I'm not sure how to apply it. I'd really appreciate any advice or experience anyone else can share.

Thanks,

Lillian

------------------------------
Lillian Erickson
QA/RA Director
Salt Lake City UT
United States
------------------------------

This very topic has become the bane of my existence.  

I wish something could be done to make it less of a cost burden, especially for small companies.  Recently we've had to purchase ISO and IEC versions of a standard just to have to turn around and purchase the EN versions that have come out after so we can have the annexes.

------------------------------
Kathaleen DeBarris, RAC
RAQA Analyst
Boulder CO
United States
------------------------------

Original Message:
Sent: 08-Mar-2018 12:32
From: Lillian Erickson
Subject: Standards Management Requirements

I cannot seem to find any references anywhere which describe exactly what type of standards a medical device company is required to maintain current copies of. For example, are we required to have a copy (digital or physical) of every standard we reference in an SOP, test report, clinical assessment, etc? Or is it enough that we can research the requirements of various standards and adhere to them? And at what point do we no longer need to maintain current copies? It makes sense that as long as we're selling a product we should keep all relevant standards up to date, but once design and development have passed, do we have to continue with up-to-date standards that we won't necessarily be using?

My company has a standard's list a mile long and they are all out of date. I want to make the case to go with a subscription service that allows electronic access (i.e. Compliance Navigator) but it is expensive. If we are required to have copies of every standard we've ever cited, it's going to cost thousands anyway. I'm not trying to get out of doing things the right way; I'm just trying to determine what the right way is.

FDA 820 Sec. 820.70 Production and process controls states: Each manufacturer shall develop, conduct, control, and monitor production processes to ensure that a device conforms to its specifications...Where process controls are needed they shall include:
(1) Documented instructions, standard operating procedures (SOP's), and methods that define and control the manner of production;
(3) Compliance with specified reference standards or codes;

ISO 13485:2016 7.3.3 Design and development inputs states:
Inputs relating to product requirements shall be determined and records maintained (see 4.2.5). These inputs shall include:
b) applicable regulatory requirements and standards;

Unfortunately this is vague to me and I'm not sure how to apply it. I'd really appreciate any advice or experience anyone else can share.

Thanks,

Lillian

------------------------------
Lillian Erickson
QA/RA Director
Salt Lake City UT
United States
------------------------------

​​For voluntary standards, the easiest way to avoid the cost of maintaining them is not to rely on them for compliance.

------------------------------
Julie Omohundro, ex-RAC (US, GS), still an MBA
Principal Consultant
Class Three, LLC
Durham, North Carolina, USA
919-544-3366 (T)
434-964-1614 (C)
julie@class3devices.com
------------------------------

Original Message:
Sent: 09-Mar-2018 11:10
From: Kathaleen DeBarris, RAC
Subject: Standards Management Requirements

This very topic has become the bane of my existence.

I wish something could be done to make it less of a cost burden, especially for small companies.  Recently we've had to purchase ISO and IEC versions of a standard just to have to turn around and purchase the EN versions that have come out after so we can have the annexes.

------------------------------
Kathaleen DeBarris, RAC
RAQA Analyst
Boulder CO
United States

Original Message:
Sent: 08-Mar-2018 12:32
From: Lillian Erickson
Subject: Standards Management Requirements

I cannot seem to find any references anywhere which describe exactly what type of standards a medical device company is required to maintain current copies of. For example, are we required to have a copy (digital or physical) of every standard we reference in an SOP, test report, clinical assessment, etc? Or is it enough that we can research the requirements of various standards and adhere to them? And at what point do we no longer need to maintain current copies? It makes sense that as long as we're selling a product we should keep all relevant standards up to date, but once design and development have passed, do we have to continue with up-to-date standards that we won't necessarily be using?

My company has a standard's list a mile long and they are all out of date. I want to make the case to go with a subscription service that allows electronic access (i.e. Compliance Navigator) but it is expensive. If we are required to have copies of every standard we've ever cited, it's going to cost thousands anyway. I'm not trying to get out of doing things the right way; I'm just trying to determine what the right way is.

FDA 820 Sec. 820.70 Production and process controls states: Each manufacturer shall develop, conduct, control, and monitor production processes to ensure that a device conforms to its specifications...Where process controls are needed they shall include:
(1) Documented instructions, standard operating procedures (SOP's), and methods that define and control the manner of production;
(3) Compliance with specified reference standards or codes;

ISO 13485:2016 7.3.3 Design and development inputs states:
Inputs relating to product requirements shall be determined and records maintained (see 4.2.5). These inputs shall include:
b) applicable regulatory requirements and standards;

Unfortunately this is vague to me and I'm not sure how to apply it. I'd really appreciate any advice or experience anyone else can share.

Thanks,

Lillian

------------------------------
Lillian Erickson
QA/RA Director
Salt Lake City UT
United States
------------------------------

Marcelo is correct you can become a member of your National Committee for a specific series or set of standards like TC 62 (TC = Technical committee) for medical electrical equipment (IEC 60601 series plus others like IEC 62366, 62366-1, 62304, ISO 14971, IEC/ISO 80601-2-XX, etc.).  There is a major issue though in the US, which is you have to be an ANSI member (membership your company has to pay for) and then you also in many cases have to be a member of the actual standards writing organization.  In the case of the TC 62 it is AAMI membership which for companies can be quite pricey as a corporate membership (required for National Committee standards writing membership) is based on the gross income of the company (that is not a typo).  On top of that if you want to go to the meetings that is all out of your or your company's pocket.  Yes, it is volunteers that write the standards (like me).

The one caution about Estonian standards and the other organizations that sell standards less expensively is there typically is a limit on the number of times you can print the standard (1 or 2 typically) and they can only be opened on one computer.  Yes, they are much cheaper but you need to be aware of these issues to make an informed decision what makes the most sense.  A lot of standards if you purchase thru IEC, ISO or a standards reseller website tend to charge $1.00 or more per page for individual copies and when you get a db you tend to get more than you need and you pay a huge price for the yearly subscription.  

One db I subscribe to every year is the AAMI db as there are many standards I use in the db and for an individual user subscription is reasonable (I am a member as I have to be a corporate member to be involved in the standards development work I am involved in for TC 62 among other committees).  If you or your company is not an AAMI member you still can get this db but will pay a higher price (not hugely higher but there is a savings being a member for this db and most other products/services they sell.


------------------------------
Leonard (Leo) Eisner, P.E.
Principal Consultant, Eisner Safety Consultants
Phone: (503) 244-6151
Mobile: (503) 709-8328
Email: Leo@EisnerSafety.com
Website: www.EisnerSafety.com
------------------------------

Original Message:
Sent: 08-Mar-2018 12:32
From: Lillian Erickson
Subject: Standards Management Requirements

I cannot seem to find any references anywhere which describe exactly what type of standards a medical device company is required to maintain current copies of. For example, are we required to have a copy (digital or physical) of every standard we reference in an SOP, test report, clinical assessment, etc? Or is it enough that we can research the requirements of various standards and adhere to them? And at what point do we no longer need to maintain current copies? It makes sense that as long as we're selling a product we should keep all relevant standards up to date, but once design and development have passed, do we have to continue with up-to-date standards that we won't necessarily be using?

My company has a standard's list a mile long and they are all out of date. I want to make the case to go with a subscription service that allows electronic access (i.e. Compliance Navigator) but it is expensive. If we are required to have copies of every standard we've ever cited, it's going to cost thousands anyway. I'm not trying to get out of doing things the right way; I'm just trying to determine what the right way is.

FDA 820 Sec. 820.70 Production and process controls states: Each manufacturer shall develop, conduct, control, and monitor production processes to ensure that a device conforms to its specifications...Where process controls are needed they shall include:
(1) Documented instructions, standard operating procedures (SOP's), and methods that define and control the manner of production;
(3) Compliance with specified reference standards or codes;

ISO 13485:2016 7.3.3 Design and development inputs states:
Inputs relating to product requirements shall be determined and records maintained (see 4.2.5). These inputs shall include:
b) applicable regulatory requirements and standards;

Unfortunately this is vague to me and I'm not sure how to apply it. I'd really appreciate any advice or experience anyone else can share.

Thanks,

Lillian

------------------------------
Lillian Erickson
QA/RA Director
Salt Lake City UT
United States
------------------------------

Original Message------

Marcelo is correct you can become a member of your National Committee for a specific series or set of standards like TC 62 (TC = Technical committee) for medical electrical equipment (IEC 60601 series plus others like IEC 62366, 62366-1, 62304, ISO 14971, IEC/ISO 80601-2-XX, etc.).  There is a major issue though in the US, which is you have to be an ANSI member (membership your company has to pay for) and then you also in many cases have to be a member of the actual standards writing organization.  In the case of the TC 62 it is AAMI membership which for companies can be quite pricey as a corporate membership (required for National Committee standards writing membership) is based on the gross income of the company (that is not a typo).  On top of that if you want to go to the meetings that is all out of your or your company's pocket.  Yes, it is volunteers that write the standards (like me).

The one caution about Estonian standards and the other organizations that sell standards less expensively is there typically is a limit on the number of times you can print the standard (1 or 2 typically) and they can only be opened on one computer.  Yes, they are much cheaper but you need to be aware of these issues to make an informed decision what makes the most sense.  A lot of standards if you purchase thru IEC, ISO or a standards reseller website tend to charge $1.00 or more per page for individual copies and when you get a db you tend to get more than you need and you pay a huge price for the yearly subscription.  

One db I subscribe to every year is the AAMI db as there are many standards I use in the db and for an individual user subscription is reasonable (I am a member as I have to be a corporate member to be involved in the standards development work I am involved in for TC 62 among other committees).  If you or your company is not an AAMI member you still can get this db but will pay a higher price (not hugely higher but there is a savings being a member for this db and most other products/services they sell.


------------------------------
Leonard (Leo) Eisner, P.E.
Principal Consultant, Eisner Safety Consultants
Phone: (503) 244-6151
Mobile: (503) 709-8328
Email: Leo@EisnerSafety.com
Website: www.EisnerSafety.com
------------------------------

Original Message------

Interesting Leo, about there being an AAMI standards dbase. They don't advertise that feature a lot. I am a member and haven't seen that; I have only seen the member discount on purchase-is this what you are tell ing about? I have typically just purchased the standards myself as a cost of doing business.

Ginger Cantor, MBA, RAC

Centaur Consulting LLC centaurconsultingllc@gmail.com

(+1) 715-307-1850

The AAMI standards db can be found on the AAMI website under the Products & Subscription link and then the eSubscription link or just click here to got here directly.  Then read about the service and on the right side of the page has links to the db login, a demo, & subscription options.

Hope this answers your question Ginger!

Cheers,

------------------------------
Leonard (Leo) Eisner, P.E.
Principal Consultant, Eisner Safety Consultants
Phone: (503) 244-6151
Mobile: (503) 709-8328
Email: Leo@EisnerSafety.com
Website: www.EisnerSafety.com
------------------------------

Original Message:
Sent: 12-Mar-2018 05:17
From: Ginger Cantor
Subject: Standards Management Requirements

Interesting Leo, about there being an AAMI standards dbase. They don't advertise that feature a lot. I am a member and haven't seen that; I have only seen the member discount on purchase-is this what you are tell ing about? I have typically just purchased the standards myself as a cost of doing business.

Ginger Cantor, MBA, RAC

Centaur Consulting LLC centaurconsultingllc@gmail.com

(+1) 715-307-1850

Original Message------

Marcelo is correct you can become a member of your National Committee for a specific series or set of standards like TC 62 (TC = Technical committee) for medical electrical equipment (IEC 60601 series plus others like IEC 62366, 62366-1, 62304, ISO 14971, IEC/ISO 80601-2-XX, etc.).  There is a major issue though in the US, which is you have to be an ANSI member (membership your company has to pay for) and then you also in many cases have to be a member of the actual standards writing organization.  In the case of the TC 62 it is AAMI membership which for companies can be quite pricey as a corporate membership (required for National Committee standards writing membership) is based on the gross income of the company (that is not a typo).  On top of that if you want to go to the meetings that is all out of your or your company's pocket.  Yes, it is volunteers that write the standards (like me).

The one caution about Estonian standards and the other organizations that sell standards less expensively is there typically is a limit on the number of times you can print the standard (1 or 2 typically) and they can only be opened on one computer.  Yes, they are much cheaper but you need to be aware of these issues to make an informed decision what makes the most sense.  A lot of standards if you purchase thru IEC, ISO or a standards reseller website tend to charge $1.00 or more per page for individual copies and when you get a db you tend to get more than you need and you pay a huge price for the yearly subscription.

One db I subscribe to every year is the AAMI db as there are many standards I use in the db and for an individual user subscription is reasonable (I am a member as I have to be a corporate member to be involved in the standards development work I am involved in for TC 62 among other committees).  If you or your company is not an AAMI member you still can get this db but will pay a higher price (not hugely higher but there is a savings being a member for this db and most other products/services they sell.


------------------------------
Leonard (Leo) Eisner, P.E.
Principal Consultant, Eisner Safety Consultants
Phone: (503) 244-6151
Mobile: (503) 709-8328
Email: Leo@EisnerSafety.com
Website: www.EisnerSafety.com
------------------------------

Original Message------

The AAMI standards db can be found on the AAMI website under the Products & Subscription link and then the eSubscription link or just click here to got here directly.  Then read about the service and on the right side of the page has links to the db login, a demo, & subscription options.

Hope this answers your question Ginger!

Cheers,

------------------------------
Leonard (Leo) Eisner, P.E.
Principal Consultant, Eisner Safety Consultants
Phone: (503) 244-6151
Mobile: (503) 709-8328
Email: Leo@EisnerSafety.com
Website: www.EisnerSafety.com
------------------------------