Regulatory Open Forum

 View Only
Expand all | Collapse all

Standards applied - harmonised version or latest version?

  • 1.  Standards applied - harmonised version or latest version?

    This message was posted by a user wishing to remain anonymous
    Posted 01-Feb-2021 18:32
    This message was posted by a user wishing to remain anonymous

    Hi All,

    In regards to the list of standards applicable to a particular type of medical devices, it is not unusual that the harmonised version is far earlier than the latest version. For instance, as per Commission Implementing Decision (EU) 2020/437 of 24 March 2020, BS EN ISO 11607-1:2009 is harmonised however in BSI shop the current version is shown as BS EN ISO 11607-1:2020.

    I understand that the manufacturer may prefer to use and quote the latest/current version of standards in their technical documentation to: (1) demonstrate their commitment to conform to the highest level of requirements; and (2) minimise the risk of having to carry out additional work when the new version becomes harmonised at a later date (especially if they are considering all the new requirements as part of a bigger project). However, in reality, it is the harmonised version that demonstrates conformity to EU legislation, e.g. MDD, IVDD etc. The manufacturer may be questioned by their notified body why they've not used the harmonised version instead.

    I am wondering what are the experts' views on this, and what's the common practice in the industry please? 

    Many thanks in advance.


  • 2.  RE: Standards applied - harmonised version or latest version?

    Posted 01-Feb-2021 20:15
    In a nutshell, the general rule of thumb at the moment, during this time where we await harmonized standards for Regulations 2017/745 and 2017/746, is to utilize the "state of the art" versions (meaning, ideally, the latest and greatest EN version, where available, but at least, the latest and greatest non-EN version when no EN version is available).  The Notified Bodies will generally accept that approach, as it is a European medical device legislative requirement to take account of the generally acknowledged state of the art, while in contrast, believe it or not, it is not a European legislative requirement to conform with harmonized standards.  It is recommended to consult the particular Notified Body involved (if any) in order to assure its agreement with that approach, as there could be instances where a particular Notified Body prefers the latest harmonized version, or latest unharmonized EN version, rather than the latest state of the art.  Stand by for a flurry of additional responses, as harmonized standards are a hot topic here in the Forum.

    ------------------------------
    Kevin Randall, ASQ CQA, RAC (Europe, U.S., Canada)
    Principal Consultant
    ComplianceAcuity, Inc.
    Ridgway, CO
    United States
    www.complianceacuity.com
    © Copyright 2020 by ComplianceAcuity, Inc. All rights reserved.
    ------------------------------



  • 3.  RE: Standards applied - harmonised version or latest version?

    Posted 02-Feb-2021 04:06

    Good day,

    Yes, of course I need to weigh in on this because indeed it is a hot topic and asked quite often.  One of the only regulatory agencies which keeps up their list of standards regularly is the U.S. FDA, followed by other countries like Japan and China.  The EU harmonised standard list has been out of date for a long time not even citing current EN ISO versions.  Though they did issue an updated list in March 2020 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32020D0437&from=EN.  However, this Decision notice makes me chuckle since this list in early 2020 was done to the MDD 93/42/EEC which in a matters of months will no longer be legally valid.  There is currently no harmonised standards list for the EU MDR or EU IVDR ... though communications have said, 'we are working on it'.

    Best practice is conforming with the latest version, publication, amendment or Corrigendum of a standard, regardless whether it is harmonised or recognised by a regulatory agency.  This is called State of the Art ... or if you prefer Good Manufacturing Practices.  If you read Annex I, General Safety and Performance Requirements there is some generalised statements concerning state of the art.  (I say generalised because this could be state of art of clinical, state of art of medical practice, state of art for technology, etc., or maybe all of the above.)  In the GSPR there are statements such as, '... acceptable risks when weighed against the benefits to the patient and are compatible with a high level of protection of health and safety, taking into account the generally acknowledged state of the art' and 'risk control measures adopted by manufacturers for the design and manufacture of the devices shall conform to safety principles, taking account of the generally acknowledged state of the art.'  When talking about safety and performance principles this can also refer to standards such as electrical safety, biocompatibility, or product specific performance standards.  Think of the situation, would you perform an EO sterilisation validation to ISO 11135 - amended version in 2018 - or would you follow the standard from 2007?  I would have to argue conforming to a standard from 2007 over 10 years old would not be considered 'acknowledged state of the art'.

    What is important is within your quality management system there is a process defined for identification and notification of new standards, regulations, guidances, etc., so these are reviewed, assessed, and evaluated for impact on the QMS processes and/or product conformity (general safety and performance).  The process in the quality system should identify methods for how new and revised external origin documents (standards) are known and the process for how a risk-based approach is taken to assess these.  As an example, just recently with ISO 14971 published in 2019 there would be an assessment and then most likely a quality plan defined for how the organisation transitions to the new version - maintaining state of the art.  If a company has 1 or 2 risk management files, this is probably manageable in a short period of time.  However, if a company has 86 risk management files there should be a plan for how all of these are managed, updated, or revised to current conformance.



    ------------------------------
    Richard Vincins RAC
    Vice President Global Regulatory Affairs
    ------------------------------



  • 4.  RE: Standards applied - harmonised version or latest version?

    Posted 02-Feb-2021 09:13

    Kevin is right on target with his response. There are NO standards harmonized to the MDR / IVDR, only to the directives. So, you have to do as Kevin indicated, choosing the "state of the art" version of the appropriate standards.


    Your Notified Body will determine if you meet the GSPR and other requirements in the regulation, so you need to go through the regulation and determine how you meet each requirement. Hopefully, by using appropriate standards you can reduce the effort and quickly show how you meet each requirement. 

    One note on state of the art standards, BSI identified EN ISO 14971:2019 as the "state of the art" medical device risk management standard in its Compliance Navigator publication. Haven't seen any other standards so identified.

    A side note, the term "state of the art" is defined in only one place, ISO 14971:2019 3.28. Not in any regulation or other standard. And it is not, "bleeding edge" but rather "generally accepted as good practice".



    ------------------------------
    Edwin Bills MEd, CQA, RAC, BSc, CQE, ASQ
    Principal Consultant
    Overland Park KS
    United States
    elb@edwinbillsconsultant.com
    ------------------------------



  • 5.  RE: Standards applied - harmonised version or latest version?

    Posted 02-Feb-2021 09:46
    Regarding EN ISO 14971:2019:
    We received a non-conformance during a EC design review according to MDD because we still referenced PrEN ISO 14971:2018. Our Notified Body crittized it because they thought that it would not be the state of the art in risk management. EN ISO 14971:2012 is still harmonized.

    Our notified body clearly wants to see the most current version of a standard in use, not the harmonized one.

    ------------------------------
    Britta Cyron
    Bochum
    Germany
    ------------------------------



  • 6.  RE: Standards applied - harmonised version or latest version?

    This message was posted by a user wishing to remain anonymous
    Posted 02-Feb-2021 17:08
    This message was posted by a user wishing to remain anonymous

    Thank you all for your valuable comments! 

    It seems that different notified bodies may have slightly different views/positions on this subject. Opposite to Britta's experience, our notified body actually questioned us during an ISO 13485 audit why our risk management reports quote BS EN ISO 14971:2019 instead of 2012 which is the harmonised version. I was surprised to hear the question, and that was what led me to come here to seek experts' advice.

    I have a further question from here - if the newer version of the standard, i.e. the state of art, brings a set of new requirements that involve additional and/or more stringent testing of the device, when would be the trigger point for the manufacturer to start planning and acting upon it? In theory, it should be as soon as possible; however in reality most of the manufacturers have to consider the business budgets, resources, other projects ongoing, etc. So what could potentially make it a business priority to take action? 

    Looking forward to hearing your suggestions.


  • 7.  RE: Standards applied - harmonised version or latest version?

    Posted 02-Feb-2021 18:05
    Edited by Kevin Randall 02-Feb-2021 18:04

    Remember that the application of the harmonized version of a standard is not a European legislative requirement.  Rather, the use of a harmonized standard is instead generally intended to be leveraged by Manufacturer and/or Notified Body alike as a vetted/trusted mechanism for streamlining the logistics and rigor of the conformity assessment process.  Indeed, the Commission states that, "Harmonised standards never replace legally binding essential requirements. A specification given in a harmonised standard is not an alternative to a relevant essential or other legal requirement but only a possible technical means to comply with it...The application of harmonised standards is not the only means to demonstrate the conformity..." 26 July 2016 [emphasis added].

    Moreover, there may be cases where there is no harmonized standard that would sufficiently achieve conformity with the corresponding general safety and performance requirement(s). On a similar note, there may be atypical cases, commensurate with the risk and complexity of the subject device, where a justification might be made for not fully conforming with the state of the art.  The merit and sustainability of such a justification would hinge on the specific differences between the alternative approach vs. the state of the art.  Yet, though not absolutely prohibited, such an approach is still generally going to raise the Notified Body's hackles (especially if the auditor is relatively new to the job and only parroting the textbook, or parroting what was learned the week before in training); thus, such a strategy requires careful attention.

    At the end of the day, it can't be overemphasized that the legislative requirement (as distinguished from a logistical/technical option), is to take sufficient account of the generally acknowledged state of the art.  Therefore, aside from the aforesaid atypical scenarios, if I were questioned by a Notified Body about why I applied the state-of-the-art version rather than the harmonized version, then I would politely and diplomatically cite the MDD's and/or EU MDR's legislative requirement for taking proper account of the generally acknowledged state of the art as distinguished from the fundamentally optional nature of harmonized standards pursuant to MDD Article 5 / EU MDR Article 8.

    I'll step aside and let others comment further, and in particular on the outstanding question about transitional provisions for revised standards.



    ------------------------------
    Kevin Randall, ASQ CQA, RAC (Europe, U.S., Canada)
    Principal Consultant
    ComplianceAcuity, Inc.
    Ridgway, CO
    United States
    www.complianceacuity.com
    © Copyright 2020 by ComplianceAcuity, Inc. All rights reserved.
    ------------------------------



  • 8.  RE: Standards applied - harmonised version or latest version?

    Posted 02-Feb-2021 20:49

    In response to the "how soon" question, consider the US FDA's position. They realize companies cannot switch instantly, especially for products already in development. They established a date of December 25, 2022 (a Christmas gift?) when all premarket applications should use ISO 14971:2019 instead of the 2007 edition. 


    BSI Has already identified EN ISO 14971:2019 as the "state of the art" risk management standard for medical devices, so I assume they expect manufacturers to be using the latest edition. 

    I don't think an instant switch is possible, but a manufacturer undergoing audit should at least have an active quality plan for moving their risk management system to the new 3rd Edition. That goes for both the US and EU and the rest of the world.


    Identify the gaps in your system and how they are going to be resolved by whom and by what date. And update the plan regularly. Remember if no one is responsible for the entire project and the individual elements and measured for those activities in the plan, then no one is responsible. Don't be surprised when nothing happens. 



    ------------------------------
    Edwin Bills MEd, CQA, RAC, BSc, CQE, ASQ
    Principal Consultant
    Overland Park KS
    United States
    elb@edwinbillsconsultant.com
    ------------------------------



  • 9.  RE: Standards applied - harmonised version or latest version?

    Posted 03-Feb-2021 18:01

    This topic is a recurring event and is, I suspect, the most frequently occurring device topic.

    I write, because the question mystifies me. I intend to offer my thoughts in simple terms, mostly avoiding technical issues.

    The overarching issue for medical device manufacturers to make the "best" devices possible. Here "best" means safe, effective, etc.

    The overarching issue for medical device regulators is to ensure the manufacturers make the "best" devices possible. The whole reason, in the EU, for the shift from the directives to the regulations is to help ensure the "best" devices possible. The EU view is that the directives didn't provide the necessary requirements and that the regulations provide the necessary structure.

    Device manufacturers typically rely on standards to help assure the "best" approach. Current standards provide the necessary information to implement the "best" approach.

    The EU set up a system to help protect device manufacturers, the harmonized standards. In this system, the harmonized standards are voluntary, but if implemented provide a "presumption of conformity" that includes legal protection for the manufacturer.

    There is an implicit assumption that the harmonization process would keep up with the current standards so, perhaps with some minor lag, the current standards and the harmonized standards align. In addition, the harmonization process includes a phase-out period for older standards.

    So far so good. Harmonized standards align with current practice, devices are "best", manufacturers have legal protection, and older versions of standards fade away.

    There are, unfortunately, (at least) two problems.

    First, the harmonization process has failed. Many standards harmonized to the MDD, AIMD, or IVDD have been obsolete for years. In practice, this is not a problem, because using harmonized standards is voluntary. A device manufacturer should move to the current standard.

    Second, there are Notified Bodies, that seem to require manufacturers to use only harmonized standards, not current standards. Cast in a different view, these NBs require that the devices are NOT the "best", but must lag behind.

    Forever the optimist, I don't believe that there is an NB under either the directives or the regulations that has an official position that requires the use of only harmonized standards. However, I expect that individual auditors write invalid nonconformances in this area. A valid nonconformance states both the requirement and how the auditee failed to meet. Since there is no requirement to use a harmonized standard, there could not be a valid nonconformance.

    I suggest two actions.

    First, RAPS should collect and publish each NBs policy statement on the use of harmonized standards for the three directives and the two regulations.

    Second, collect, unofficially, cases in which an auditor wrote a nonconformance outside the NBs policy for the use of a harmonized standard.

    For the second action, please send me, through RAPS, the statement of the nonconformance and the name of the NB. I would like the full statement of the nonconformance. I'll collect them, summarize them, and provide reports. A report will not include the company name, auditor's identity, or similar identification. It would identify the NB.



    ------------------------------
    Dan O'Leary CQA, CQE
    Swanzey NH
    United States
    ------------------------------



  • 10.  RE: Standards applied - harmonised version or latest version?

    Posted 03-Feb-2021 18:17
    Thanks for volunteering to take the "bull by the horns" on this one Dan.  It is a huge mess, prompted by misunderstandings of personnel in device manufacturers, but worst of all by NB auditors.  I would hope that the auditors are better trained by the Notified Bodies, but I guess I am overly optimistic!

    Of course the problem started with the EU regulators failing their obligations on harmonizing standards, which was aggravated by the imposition of unrealistic deadlines of the new regulations, which were incomplete, along with the supporting mechanisms when released.  So the blame can be shared.  But this mess needs to be cleaned up.  There is not enough time in my estimation, if the EU markets are not to be impacted by these unfortunate decisions.

    Keep up the good work in your efforts on the EU Regulations, your postings have been very thoughtful and most helpful!

    ------------------------------
    Edwin Bills MEd, CQA, RAC, BSc, CQE, ASQ
    Principal Consultant
    Overland Park KS
    United States
    elb@edwinbillsconsultant.com
    ------------------------------



  • 11.  RE: Standards applied - harmonised version or latest version?

    Posted 04-Feb-2021 10:43
    A lot of the harmonization process mess comes from the lack of support from the Commission not providing enough HAS consultants in the first place even under the MDD/ AIMDD / IVDD.  The HAS consultants typically were involved in the development of the standards but typically very late in the process and not jointly with the IEC and ISO standards development and I think that is the same now under the MDR & IVDR from what I am hearing.  Even worse I hear there are only a few HAS consultants now for medical where there used to be at least more previously. So, the system has slowed down to a total crawl is my understanding.  Ed Bills - do you want to comment here?

    A great example of a series of standards that "died on the vine" was the 60601 series of standards some of those standards are more than one generation old on the Harmonization list than what is currently what I would call "state of the art".  For over 5 or 6 years a huge majority of the series was never approved to move forward as a Harmonized Standards to the next version which was very problematic.

    Now for Notified Bodies (NB) under the MDR and the IVDR I only know of one NB that has published a policy for the MDR & IVDR officially to their clients.  NSAI basically is saying that until there are Harmonized Standards to the Directives (we have had now 2 Standardization Requests that have failed sent from the EU Commission to CEN & CENELEC in 2020) and/or Common Specifications (no one has mentioned those yet in this thread - that is something you need to remember is part of the Directives) that are officially published and announced thru the EUOJ to use "State of the Art" standards.  What do they mean by "State of the Art" standards.  Basically, one from the date of publication is the bottom line.  So, for ISO 14971 which was published Dec 2019 that would mean would be "State of the Art" as of end of Dec 2020 and expected in all audits and product reviews of NSAI clients.  Not all other NBs are looking at Harmonization or "Stae of the Art" the same way so please check with your NB (your auditor and your product reviewers) for their understandings).

    Realize since we are in a transition with the MDD and other directives the NBs are not putting quite as much focus on the Directives as they are on the Regulations as they are getting scrutinized by the Competent Authorities on the Regulations more but also how they are dealing with the transition time on the Directives so there are some issues they need to deal with the Directives obviously.  A few NBs have lost their authorizations for the Directives because they didn't keep their eyes and details on the full scope of what was needed to keep their approvals.  Their is a huge amount of effort/personnel and quality system support needed nowadays to keep a NB running to support the transition from the Directives to the Regulations and for all the details of the Regulations your head would spin. 

    That is enough for this post for now.  I will let others talk on this topic as it could go so many different ways.

    ------------------------------
    Leonard (Leo) Eisner, P.E.
    The "IEC 60601 Guy"
    Principal Consultant, Eisner Safety Consultants
    Phone: (503) 244-6151
    Mobile: (503) 709-8328
    Email: Leo@EisnerSafety.com
    Website: www.EisnerSafety.com
    ------------------------------



  • 12.  RE: Standards applied - harmonised version or latest version?

    Posted 04-Feb-2021 11:51
    No, Leo, the process has not slowed to a crawl.  It is NON-EXISTENT.  Currently there are no Standardization Requests accepted by CEN and CENELEC to create new Harmonized Standards for the regulations.

    Manufacturers are entirely on their own currently, and should, as Dan O'Learly suggested in a much earlier post, do a gap analysis for the product in question with the regulation, and determine how they are going to fulfill the requirements of the MDR / IVDR.  You have to identify all the places where Risk and Benefit-Risk appear in the regulations and determine how, under your risk management system you meet those requirements.  If you don't then you must change the process or the product to meet the new requirements on your own.  The NB can no longer consult, so they can't tell you where you are falling short, except with an audit finding.  And that is too late in the process.

    ------------------------------
    Edwin Bills MEd, CQA, RAC, BSc, CQE, ASQ
    Principal Consultant
    Overland Park KS
    United States
    elb@edwinbillsconsultant.com
    ------------------------------



  • 13.  RE: Standards applied - harmonised version or latest version?

    Posted 04-Feb-2021 12:00
    I agree with you Ed.  Maybe I didn't say it as clearly as what you just said but I totally agree.

    Thx for clarifying more. The process is broken currently.

    ------------------------------
    Leonard (Leo) Eisner, P.E.
    The "IEC 60601 Guy"
    Principal Consultant, Eisner Safety Consultants
    Phone: (503) 244-6151
    Mobile: (503) 709-8328
    Email: Leo@EisnerSafety.com
    Website: www.EisnerSafety.com
    ------------------------------



  • 14.  RE: Standards applied - harmonised version or latest version?

    Posted 05-Feb-2021 11:54
    Just to echo what so many of my very experienced colleagues have said...

    I have been called out for using the latest standard and I have been called out for using the harmonized standard. Given the emphasis on 'state of the art', likely latest version of standard is safest, but you might want to have a documented rationale.

    It's not just Notified Bodies. I have been called out by FDA both for using a draft guidance and for NOT using a draft guidance. Good times.

    ------------------------------
    Corey Jaseph RAC
    Director of Regulatory Affairs
    Wheatland CA
    United States
    ------------------------------



  • 15.  RE: Standards applied - harmonised version or latest version?

    Posted 05-Feb-2021 12:10
    Documented justification is always appropriate in this situation.  Totally agree with Corey's comment.  Remember even with FDA Recognized Consensus Standards are voluntary are voluntary and the last 2 lists have not been published thru the Federal register yet (which is about 6 months since July '20 List 54 & 55) but have been pushed out thru the database) so you need to be always checking the db.  The last update to the db was issued on 12/21/2020 with List 055.  You can search the Recognition db at https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfStandards/search.cfm

    ------------------------------
    Leonard (Leo) Eisner, P.E.
    The "IEC 60601 Guy"
    Principal Consultant, Eisner Safety Consultants
    Phone: (503) 244-6151
    Mobile: (503) 709-8328
    Email: Leo@EisnerSafety.com
    Website: www.EisnerSafety.com
    ------------------------------