Regulatory Open Forum

 View Only
  • 1.  Serparate NB for QMS cert and CE cert - EU MDD / MDR

    Posted 19-Feb-2021 09:43
    ​Good morning,
    We are currently MDSAP certified by one notified body and also have a BS EN ISO 13485 / CE cert through another notified body. We need to renew our BS EN ISO 13485 cert before Dec 2021. We have products that will remain under MDD until April 2023 but we also are looking to obtain CE mark for a new device under EU MDR.

    In your experience, are we able to have one NB for the QMS cert and another that does a tech file review for CE marking? I'm getting conflicting information.

    Thank you in advance!

    ------------------------------
    Stacey Benser
    Senior Quality/Regulatory Manager
    York PA
    United States
    ------------------------------


  • 2.  RE: Serparate NB for QMS cert and CE cert - EU MDD / MDR

    Posted 19-Feb-2021 12:41
    Tough question.  For devices requiring the involvement of a Notified Body (NB), first remember that under the outgoing MDD and the incoming EU MDR alike, there are two different, but coupled, certificates involved:

     

    1. A quality management system-focused certificate (e.g., the EU MDR prescribes an 'EU Quality Management System Certificate' or 'EU Quality Assurance Certificate' depending on device class and the chosen conformity assessment route); and

     

    1. A product-conformity certificate (e.g., an 'EC Certificate' under the MDD, or, under the EU MDR depending on device class and the chosen conformity assessment route, 'EU Technical Documentation Certificates', 'EU Type-Examination Certificates', and 'EU Product Verification Certificates').

     

    Therefore the reference to a 'BS EN ISO 13485 / CE' certificate doesn't clearly illustrate this duality of different certificates and coupling, and thus may need clarification to be certain of the associated details.

    In any event, my experience and understanding is that a) the two certificates aren't allowed to be decoupled (they must be issued in tandem); and b) the two certificates must be issued by the same Notified Body.

    That said, in issuing the new certificate(s), the new Notified Body is permitted a certain amount of liberty to utilize the assessments and assessment data from a prior Notified Body.  I've seen that for example in the context of voluntary certificate transfers and in assessing subcontractors certified by a different Notified Body.  Ultimately, the new Notified Body shall remain fully responsible for such decisions.

    On that note, Europe is only an observer to the MDSAP process, and thus is not an official participant.  Therefore, there is no EU legislative basis for Notified Body acceptance of MDSAP reports outright.  However, the EU nonetheless encourages Notified Bodies to make use of the data and facts documented from an organization's prior MDSAP audit.  But that comes with the limitations that this is not allowed for initial quality management system audits, nor for unannounced audits; instead, it's only allowed regarding surveillance audits.

    It's advisable to consult the Notified Body(s) involved to assess precisely how they will approach these dynamics.



    ------------------------------
    Kevin Randall, ASQ CQA, RAC (Europe, U.S., Canada)
    Principal Consultant
    Ridgway, CO
    United States
    © Copyright 2021 by ComplianceAcuity, Inc. All rights reserved.
    ------------------------------



  • 3.  RE: Serparate NB for QMS cert and CE cert - EU MDD / MDR

    Posted 19-Feb-2021 13:23
    Thank you Kevin. And I too was under the impression that a CE certificate would not be issued without the same NB performing an assessment of the QMS. So then given our current situation with a legacy device able to be marketed under MDD until April 2023, what happens when our EN ISO 13485:2016 cert expires if that is not truly "linked" to the MDD / CE certificate? We no longer utilize that NB for our QMS (MDSAP) certification and want to avoid using them if possible.

    Scenario 2: If we obtained CE marking for a new device under MDR before Dec 2021, would this EU QMS cert then be able to be applied towards our legacy MDD items even if the audit was performed by a different NB than who issued the initial MDD CE cert?

    Thanks for your input!

    ------------------------------
    Stacey Benser
    Senior Quality/Regulatory Manager
    York PA
    United States
    ------------------------------



  • 4.  RE: Serparate NB for QMS cert and CE cert - EU MDD / MDR

    Posted 20-Feb-2021 03:20

    Hi Stacey,

    specific answer to one of your questions if notified bodies will force to do the full conformity assessment under MDR. 


    in our experience that is the case. In the past some notified bodies would accept the quality system assessment under MDD from another notified body provided the scope of the certificate also covered the product they received. And typically one would to have to organize that via annex V rather than annex II, to match the sampling not getting in the way. 


    we see notified bodies not wanting to even discuss the option under MDR at this stage. So that route seems not available. 


    what you can consider is different notified bodies for different groups of products. Best if their scope do not overlap. That will spread your risk a bit. But would mean overlap in audits. One of there notified bodies could add MDSAP to its scope. 


    iso 13485 certificates issued by any notified body remain having value in the selection of a notified body if and how often they would need to visit the supplier or subcontractor as part of their conformity assessment. 


    kind regards

    gert. 



    ------------------------------
    Gert Bos FRAPS, PhD
    CTO, Executive Director & Partner at Qserve Group
    Baarn
    Netherlands
    Gert.bos@qservegroup.com
    ------------------------------



  • 5.  RE: Serparate NB for QMS cert and CE cert - EU MDD / MDR

    Posted 19-Feb-2021 14:37
    Hi Stacey,

    If I were in your boat, I would be thinking about transferring all of the existing certifications (QMS certificates and MDD certificates alike) to a new Notified Body.  The standards (e.g., the ISO 17021 series) by which the Notified Bodies are governed provide a standardized, and somewhat abbreviated, approach for such transfers.  That paradigm is longstanding and thus viable regarding the MDD aspect.  Likewise, Article 58 of the EU MDR reiterates this moving forward.

    The Notified Bodies are overloaded at the moment regarding new certifications, but I have successfully achieved such transfers over the last couple years due to the abbreviated and, in my experience, rather subjective, nature of the transfer-assessment process.

    Ultimately, if a coupled QMS certificate expires before its paired EC certificate(s), then that puts the EC certificates in jeopardy.  So either the existing Notified Body must renew the QMS certificate, or a new Notified Body must be brought in to assume responsibility over the certificate tandem [either by starting over from scratch (not recommended), or by leveraging the aforementioned transfer mechanism].

    ------------------------------
    Kevin Randall, ASQ CQA, RAC (Europe, U.S., Canada)
    Principal Consultant
    Ridgway, CO
    United States
    © Copyright 2021 by ComplianceAcuity, Inc. All rights reserved.
    ------------------------------



  • 6.  RE: Serparate NB for QMS cert and CE cert - EU MDD / MDR

    Posted 21-Feb-2021 05:32
    Hello Stacey,

    I would also like to clarify - unfortunately people use the term "notified body" across the board which is incorrect.

    If you are certifying under the MDSAP scheme: this is referred to as an Auditing Organisation
    If you are certifying to ISO 13485:2016 with no other needs: this is referred to as a Certification Body
    If you are obtaining CE Marking for placing product in the EU: this is referred to as a Notified Body

    Indeed under the IAF guidelines you can have multiple certificates by different Certification Bodies, but what this means is you will also have multiple audits, multiple non-conformities to deal with, and thus also a much increased cost.  As an example. you can have ISO 13485:2016 certification by BSI and have an ISO 9001:2015 certification by QMS International (disclaimer: no recommendations as these are just examples).  In this type of scenario, neither certification body most likely would not recognise the others "work" and reports, so you will have 2 full certification audits every 3 years, and two surveillance audits every year.  That is a lot of time, resources, and money.

    The EU MDR under Article 53 indicates there can only be one Notified Body (NB) per conformity assessment route, which we imply means one per manufacturing site.  It is going to be more difficult to pick and choose a NB based on your product obtaining CE Mark.  (This goes back directly to coupling your QMS audit with CE Certificate, so we do not how more than one NB can be per manufacturing site.)  However, this does not mean you can not have a Certification Body for ISO 13485 and have a separate EU MDR Notified Body for CE Marking.  Just like the previous scenario this means you will be having 2 full certification audits, paying for 2 audits, as the NB most likely never accept your certification body's audit report.  Now, it gets a bit more tricky if you have a Certification Body do ISO 13485 which is also a Notified Body, in that regard not sure it would be feasible or even allowed.

    Kevin is right, there is a QMS certificate and a product CE Certificate, these can not be mutually inclusive - they must go together by the same NB.  Gert is also correct, under the MDD Notified Bodies were more willing to accept a Certification Body ISO 13485 certificate, even ones for contract manufacturers, but this really does not seem the case under EU MDR.  The main reason is their roles, responsibilities, and authority over ensuring regulatory requirements are being met.  Because ISO 13485:2016 (and even current EN ISO version) does not address requirements of EU MDR fully, there would still need to be a QMS audit performed by the Notified Body, and not just accepting another's ISO 13485 audit report.

    To answer your questions, you do need to have your QMS certification linked to your transition to EU MDR.  We have been talking about this for years in our training, companies need to be ready after May 2021 (now instead of May 2020) to have their ISO 13485:2016 renewed not just for ISO 13485, but also against the EU MDR QMS requirements ... even if you have a MDD certificate which expires in 2023 or 2024.  The regulation is clear, and NB have made it clear in public forums, after May 2021, the QMS will be audited to EU MDR requirements, i.e. post market surveillance, vigilance reporting.  Because also after May 2021, they will not have legal ability to audit against the MDD as it will no longer be valid.

    Just going back to discussion of ISO 13485 certification, MDSAP, and CE Marking, it would be less drain on resources, less audits performed, and definitely less money if all your QMS certifications were under one entity.  As Kevin said, EU does not have anything to do with MDSAP currently.  This means again if you have an AO doing your MDSAP audits and a NB doing CE Marking, you will have 2 audits every year ... at a minimum.  And the QMS assessment and technical documentation for the EU MDR do go together.

    ------------------------------
    Richard Vincins RAC
    Vice President Global Regulatory Affairs
    ------------------------------



  • 7.  RE: Serparate NB for QMS cert and CE cert - EU MDD / MDR

    Posted 22-Feb-2021 02:20
    Nicely described Richard I think you did a great job describing all the players and the links.  There are a couple of Notified Bodies that are also MDSAP that are Auditing Organisations, as well.

    ------------------------------
    Leonard (Leo) Eisner, P.E.
    The "IEC 60601 Guy"
    Principal Consultant, Eisner Safety Consultants
    Phone: (503) 244-6151
    Mobile: (503) 709-8328
    Email: Leo@EisnerSafety.com
    Website: www.EisnerSafety.com
    ------------------------------



  • 8.  RE: Serparate NB for QMS cert and CE cert - EU MDD / MDR

    Posted 22-Feb-2021 03:39
    Dear Stacey

    Several firms employ more than one notified body to lower business risk. MDD/ MDR medical device CE certification at one notified body and ISO 13485 at another notified body is a model that is not uncommon. The use of this model expanded due to the uncertainty which notified bodies would receive MDR designation.

     

    The official definition of the EU notified body:

     "an organisation designated by an EU country to assess the conformity of certain products before being placed on the market"

    https://ec.europa.eu/growth/single-market/goods/building-blocks/notified-bodies_en

    A notified body is employed not just for medical devices, e.g. personal protection equipment.

     

    Please note ISO 13485 certification can also be issued by a Conformity Assessment Accreditation Body

    See https://www.iaf.nu; https://www.iaf.nu/articles/ISO_13485_Medical_Devices_Introduction_Br/321; https://www.iaf.nu/upFiles/IAF__ISO_13485_0512.pdf.

     

    Under the Medical Device Directive (MDD), ISO 13485: 2016 is a harmonized standard. Thereby, ISO 13485: 2016 certification demonstrates conformity with the MDD in terms of the requirement of having a QMS system.

    MDD harmonised standards

    https://ec.europa.eu/growth/single-market/european-standards/harmonised-standards/medical-devices_en

     

    Presently, there are no harmonized standards under the EU medical device regulation (MDR) framework. As a result, ISO 13485:2016 certification does not imply conformity with the QMS requirements of the MDR.

     

    Nevertheless, national regulatory authorities in Europe as well as in North America and elsewhere require that the medical device manufacturers provide evidence of a QMS system. Internationally, ISO 13485: 2016 is recognized and considered by many regulatory agencies (e.g. Malaysia, Canada) as the QMS standard for the medical device industry. Portions of this standard have also been adopted in national regulation as well, e.g. Japan.

     

    Responding to other comments in this forum with regards to MDSAP.

    There is a MDR MDCG guidance for notified bodies, indicating that they may consider the MDSAP findings to optimize the audit process.

    Please refer to the following link:

    https://ec.europa.eu/health/sites/health/files/md_sector/docs/md_2020-14-guidance-mdsap_en.pdf

    Direct quote from this MDCG guidance

    "In that regard, notified bodies designated under the MDR/IVDR fulfil roles, which correspond to combined functions of both MDSAP auditing organisations and MDSAP participating regulatory authorities. Therefore, the roles performed by notified bodies and MDSAP auditing organisations differ as the latter solely perform quality management system audits which are then utilised by regulatory authorities in their evaluation of a product's safety and performance for the purpose of issuing a marketing authorisation."

    Furthermore

    "The use of MDSAP audit reports within the EU legislative framework is possible only where the MDSAP audit covers similar or equivalent MDR/IVDR requirements. Designated notified bodies maintain the full authority over their judgement, conclusion and final decision about the conformity of quality management systems to the relevant provisions of the MDR/IVDR and the safety and performance of medical devices and IVDs intended to be placed on the market in the EU."



    Best Regards,
    Stephanie


    ------------------------------
    Stephanie Grassmann
    Managing Director of MedTechXperts Ltd
    Biberstein
    Switzerland
    ------------------------------



  • 9.  RE: Serparate NB for QMS cert and CE cert - EU MDD / MDR

    Posted 22-Feb-2021 05:21
    Dear Stacey;
    There is no obligation whatsoever from a regulatory / legal perspective to have an ISO13485 certificate for the QMS in EU.
    Conformity assessment has 2 parts, a quality system part and a technical documentation part. ISO 13485 is backed up by an ISO17021 accreditation, CE certifiicate (any of them under the directives or the regulations) is backed up by a notification.

    Diescuss with your NB and find one that does conformity assessment without obliging you to have an EN ISO13485 cert, especially under the regulations it is article 10 and linked references that account for the quality system part of the conformity assessment.

    For MDSAP you choose the the AO that best fits your needs, this may eventually be the same organisation as your NB in the end.

    ------------------------------
    Michael Maier
    Senior Partner - Medidee Services AG
    Switzerland
    michael.maier@medidee.com
    ------------------------------