Regulatory Open Forum

 View Only
Expand all | Collapse all

ISO 14971

  • 1.  ISO 14971

    Posted 11-Oct-2019 13:02
    Work is now complete on ISO 14971, it is unchanged from published FDIS. The EN version will be published by CEN without them as a result of the discord in EC about Harmonized Standards. The Technical Report ISO TR 24971 is also complete and will be forwarded to ISO for publication along with the standard. The forecast is for publication in December 2019.

    Ed Bills
    843-810-2157
    Sent from my iPhone


  • 2.  RE: ISO 14971

    Posted 12-Oct-2019 08:07
    "Discord in EC about harmonized standards" is hilariously ironic. Thank you for the update!

    Jason Gorman
    Sr. Director Quality & Regulatory Affairs

    ------------------------------
    Jason Gorman
    Director, Quality Systems
    Madison WI
    United States
    ------------------------------



  • 3.  RE: ISO 14971

    Posted 12-Oct-2019 09:21

    Ed,

    Thank you for this exciting news. Could you clarify a few things for me?

    Will CEN publish 14971 without Annex ZA to ZE from the FDIS? Does CEN intend to add their own annexes? I infer that when CEN publishes, it will have been standardized but not harmonized.

    The forecast for publication is December 2019. Is this for 14971, 24971, or both? It would be great if they came out together.



    ------------------------------
    Dan O'Leary CQA, CQE
    Swanzey NH
    United States
    ------------------------------



  • 4.  RE: ISO 14971

    Posted 12-Oct-2019 10:39

    In response to your questions Dan:

    1.  There will be no Z Annexes due to the lack of agreement in the EC over a harmonization process within the MDR and IVDR.  The presently published "Harmonized" standards are not harmonized to the MDR and IVDR (only to the directives) so they have no status to support the new regulatory requirements in those documents.  Presently the manufacturer is "one his own" to demonstrate compliance with the new regulations, and may develop their own tables to show how their quality system meets those requirements.  CEN will not publish Z Annexes with the standard, it will look exactly like the ISO version with no deviations, just as AAMI does with the US versions of standards.  The new EN ISO 14971:2019 should replace the EN ISO 14971:2012 immediately, in my estimation, as it is a better document that addresses the issues that were found in the earlier version.

    The problems in the EC with the implementation of the MDR and IVDR continue with things like the lack of agreement on Harmonization, the lack of sufficient Notified Bodies and the lack of auditors and other experts within the Notified Bodies to support all product types.  Just because a Notified Body is appointed doesn't mean they can certify all device types, their certification must identify the types of devices they can support.  Then their are other aspects, like Eudamed that are necessary to complete the process for the manufacturer.

    I fear that the EC may release a lot of the elements right before the "drop dead date", and declare the process complete and question why that devices are not available in the EU.  Much like the furor over Brexit and the warnings being issued that there will be a drug shortage, the EC issued warnings in the summer to hospitals about the expected shortage of medical devices.  This has not been widely reported, but is expected to happen.

    2. The standard, ISO 14971 and the technical report, ISO TR 24971 are to be released together or within days of each other, as it will be vital because of the reorganization of the two to have them together. That was the focus of the efforts of the Joint Working Group in the last few months, to synchronize the release of the two documents.  The new technical report is over 100 pages, where the standard previously had 68 pages of informative annexes.  There are a few pages of the original informative annexes still in the standard, so you can see the amount of work that has been done to improve the risk management guidance without major revisions to the requirements.  The requirements page count is still about 15 pages.  But, for instance the production / post-production requirements went from a few paragraphs to 2 pages of requirements, and the supporting guidance in the technical report went from 1 page to 10 pages.  That aspect of the risk management process had lots of input from the regulators, like FDA to better explain the process.   



    ------------------------------
    Edwin Bills MEd, CQA, RAC, BSc, CQE, ASQ
    Principal Consultant
    Overland Park KS
    United States
    elb@edwinbillsconsultant.com
    ------------------------------



  • 5.  RE: ISO 14971

    Posted 12-Oct-2019 11:47
    Thank you for the update Edwin, glad to hear not any changes.  Regarding the EC and EN version of the standard ... sigh.  Oh well, at least we won't have those silly deviations to worry about anymore, because these are already incorporated into the EU MDR/EU IVDR GSPRs so there is really no reason to have Z Annexes anyway.

    ------------------------------
    Richard Vincins RAC
    Vice President Global Regulatory Affairs
    ------------------------------



  • 6.  RE: ISO 14971

    Posted 12-Oct-2019 12:31

    Richard,

    I have not yet done a side by side comparison with the DIS and the EU-MDR. However, there is one area where there seems to be a difference.

    The requirements to disclose residual risks is now one requirement after the evaluation of the overall residual risk.

    Clause 8 says, "If the overall residual risk is judged acceptable, the manufacturer shall decide which residual risks to disclose …" I infer that the manufacturer may make a disclosure decision on each individual residual risk as well as the overall residual risk.

    EU-MDR Annex I(4) says, "Manufacturers shall inform users of any residual risks".

    I infer this overturn's the manufacturer's ability to make the decision. In the EU-MDR disclosure is mandatory, not optional.

    I'm in great hope that Annex I(4)(c) will prevent the NBs from confusing information for safety with disclosure of residual risk.



    ------------------------------
    Dan O'Leary CQA, CQE
    Swanzey NH
    United States
    ------------------------------



  • 7.  RE: ISO 14971

    Posted 13-Oct-2019 08:44
    On the Clause 8 issue on disclosure of residual risk, you must remember that ISO 14971 is an International standard and applies to the entire world, and not just a European standard.  We worked hard to allow manufacturers to comply with all regulatory schemes and not just to create a European standard.  We could have just made the EU regulations apply throughout the world.  There is the flexibility to meet the EU regulations as has been pointed out.  However, if you don't do business in the EU you do not have to meet this requirement, just the requirement in Clause 8.  This may be a small point, but auditors often cite based on interpretations of small points.


    ------------------------------
    Edwin Bills MEd, CQA, RAC, BSc, CQE, ASQ
    Principal Consultant
    Overland Park KS
    United States
    elb@edwinbillsconsultant.com
    ------------------------------



  • 8.  RE: ISO 14971

    Posted 13-Oct-2019 14:13
    Alongside this we heard that to add the Z Annexes for the MDR/IVDR there will likely be an amendment to take those in some time next year. This allows the standard to keep the 2019 date and AMD 1 for the EN version to be added when that is all sorted out. I commend CEN-CENELEC TC3 for their strong support of this path to help industry understand the change with much less confusion.

    ------------------------------
    Regards,
    Mark Swanson, ASQ CBA, CMQ/OE, CQE ASQ, MBA
    Becker MN
    United States
    ------------------------------



  • 9.  RE: ISO 14971

    This message was posted by a user wishing to remain anonymous
    Posted 21-Oct-2019 09:03
    This message was posted by a user wishing to remain anonymous

    I'm interested in how others are intending to implement the EU-MDR Annex I.4 requirement. ​

    One person I've talked to has suggested all FMEA risks should be disclosed, another feels that just the PHA hazards need stated, two others I've talked to point to EU-MDR Annex 1.3.23.1.23 "Residual risks which are required to be communicated to user ..." that suggests a contradiction in the regulation that all residual risks be communicated, and others have pointed to ISO 14971 requirements.

    I'll be watching to see how this is interpreted because it appears to me to have a significant impact if the CA/NB do intend for all residual risks to be disclosed.



  • 10.  RE: ISO 14971

    Posted 21-Oct-2019 13:00
    I would probably have said "...if someone involved in the MDR intended for all residual risks to be disclosed."  What was intended and what the CAs and NBs finally settle on are not necessarily, perhaps even rarely, what was intended. 

    On the US side, there is the mythology of "the intent of the legislature."  I am skeptical that legislatures can actually have intent, but even so, most legislation is an unfortunately compilation of agendas, some of individual legislators, some of various committees, and some of lobbyists, which are then folded, spindled, and mutilated by compromise into something that will pass both the House and the Senate and will be signed off by the Executive. This is why our laws get interpreted by our courts, rather than being sent back to the legislatures to explain their intent.

    What will be "required" under the MDR is unknown, and will remain unknown for years to come.  Currently, the more useful question is what will each (your) NB decide it requires, how much consistency there might be across NBs on these decisions, and then...what they will they tend to do about it if the requirements they decided on are not met.

    ------------------------------
    Julie Omohundro, ex-RAC (US, GS), still an MBA
    Principal Consultant
    Class Three, LLC
    Mebane, North Carolina, USA
    919-544-3366 (T)
    434-964-1614 (C)
    julie@class3devices.com
    ------------------------------



  • 11.  RE: ISO 14971

    Posted 22-Oct-2019 10:46
    But Julie,

    In many cases one of the factors the courts consider is the legislative intent. Which can be found in committee documents and background sections of actual legislation, among other places.

    Yes, the courts also consider case law, constitutional law etc, but legislative intent does exist and can be a factor.

    g-

    ------------------------------
    Ginger Glaser RAC
    Chief Technology Officer
    MN
    ------------------------------



  • 12.  RE: ISO 14971

    Posted 22-Oct-2019 14:10
    Getting into too complex a topic, but, yes, you can find intent articulated in committee documents and legislative background sections, but whose intent you find there, that's a different question.  Whether it is actually anyone's intent, or just an intent that everyone agreed upon as being politically acceptable, is another question yet.

    I think of it like IQ and intelligence.  We actually have little to no idea what intelligence is, but we need something to hang our hats on, so everyone agrees that an IQ score will be treated as a measure of intelligence.  Some people think it actually is a measure of intelligence, but most of the people doing serious work in this field know better, so it serves its purpose.  We have all agreed that, whatever the courts decide, that is the intent, whether it was the intent or not is a moot point, unless you want to appeal.  In that case, when you exhaust that process, we have all agreed that the final ruling is the intent, whether it was ever the intent or not.

    Regardless, I come back to the most useful question is what will your NB decide.  Whether this will be consistent with the EC's intent is not especially relevant or a useful question to ask, I don't think.  In fact, I think that's sort of the NB's role, much like that of the courts...to decide, since in most cases, it will be a decision, rather than a conclusion.  I also think it's the role of lawyers to worry about the legislative intent and the ruling of the courts, and RA's role to worry about what the NB wants.



    ------------------------------
    Julie Omohundro, ex-RAC (US, GS), still an MBA
    Principal Consultant
    Class Three, LLC
    Mebane, North Carolina, USA
    919-544-3366 (T)
    434-964-1614 (C)
    julie@class3devices.com
    ------------------------------



  • 13.  RE: ISO 14971

    Posted 22-Oct-2019 09:16

    To address this issue, break it down into two parts. The first part is the EU-MDR requirements and the second is application of ISO 14971:2019 to the EU-MDR requirements.

    The first requirement is in Annex I(3)(b) which requires analysis of hazards both known and foreseeable. Because hazards can occur in both normal and fault conditions, an FMEA is the wrong tool. It analyzes failures and their modes. Patient or user harm can occur without a device failure. Also, FMEA is for single point failures. Hazards typically require a sequence of events.

    For medical device risk management, shift from analyzing failures and modes to analyzing hazards and sequences of event.

    Develop a risk management plan for each device. Since risk management is a life-cycle activity, the plan must cover the life-cycle, not just the design phase. [Ann. I(3)(a)]

    Estimate risks in both intended use and reasonably foreseeable misuse. [Ann. I(3)(c)]

    Evaluate the risks; evaluate means to compare the acceptability with the acceptability criteria in the risk management plan to determine the need to eliminate or control the risk. [Ann. I(3)(c)]

    Eliminate or control risks following the hierarchy in Annex I(4). [Ann. I(3)(d)]


    Apply production information and PMS system information to update the risk estimates and, if necessary, revise the control measures. [Ann. I(3)(e)&(f)]

    Disclose all residual risks. [Ann. I(4) last paragraph]

    Most of this maps over nicely to ISO 14971:2019. As I understand the current situation, EN ISO 14971:2019 will not have any Z annexes, so each manufacturer who wants to use the standard, need to map their own implementation.

    There are a few points to look for. ISO 14971:2019 adds another element to the risk management plan about evaluating overall residual risk. The requirement was in the previous edition, but not  stated explicitly.

    The risk reduction measures in the EU-MDR are not the same wording as in ISO 14971:2019. The EU-MDR prevails in Europe. In practice, there is no difference.

    The requirement to disclose residual risk in the EU-MDR is not the same as in the ISO 14971:2019. The standard gives the manufacturer an option on what to disclose and how to disclose it. The EU-MDR requires residual risk disclosure, including overall residual risk.

    I don't see a contradiction with Annex I(23.1)(g). It tells where to disclose residual risks, now which ones to disclose. Again, this is different from ISO 14971:2019 which gives the manufacturer an option on where to disclose. I suppose there could be residual risks that are not communicated to the user or other person, but I can't think of any. Perhaps, in the life cycle sense, the person that disposes of the device is not a user, so those residual risks would not have to be included. However, the disposal person is an "other person", so I don't think this works.



    ------------------------------
    Dan O'Leary CQA, CQE
    Swanzey NH
    United States
    ------------------------------