Regulatory Open Forum

This message was posted by a user wishing to remain anonymous

​​A hypothetical:  Company received FDA clearance for a Class 2 medical device some years ago.  A risk analysis was done but documentation was sparse and did not include all of the documentation now required by ISO 14971.  FDA has since adopted ISO 14971 as a consensus standard.  Company is now making a change to the device and there is some disagreement about whether the risk management documentation needs to be updated to contain all documents required by the current version of ISO 14971.  Some say there is no need to meet the current standard's documentation requirements - you just update the documents that are in the file.  Others believe the risk management file does need to be updated to comply with the current standard.  Let's assume that a new 510(k) is not required for this change based on the recently issued guidance.
The question:  Does anyone here know of a documented statement or a formal opinion from FDA about when a company must comply with revised standards if a change is made to a cleared device, assuming no new 510(k)?

Thanks for your help.

​

Although adoption of standards is generally voluntary, some standards are referenced within statutes or regulations, to relieve the regulators from citing extensive technical details ('technical regulations').  Adoption of such standards provide a 'presumption of conformance' with essential requirements (e.g. EU harmonized Standards) and serve as one means of demonstrating reasonable assurance of safety and/or effectiveness for applicable aspects of medical devices (e.g. FDA recognized consensus standards). 

Standards are periodically revised to better reflect the 'state-of-the-art' and typically offer improved product safety and/or performance. Therefore, when a product is substantially changed, it is advisable to conform to the latest revision of the standard valid at the time.  However, for a device with a proven history of safe use there is no compulsion ("must") to comply with the latest revision of a standard, especially if a change to the cleared device results in 'documentation' (i.e. Letter To File).

Having said that, the second edition of ISO 14971 (2007) introduced considerable changes to the framework and management of device risks, including the product life-cycle approach, so a cleared device with sparse documentation would probably benefit from review against the second edition. The standard is at pains to point out that "…the manufacturer makes judgments relating to safety of a medical device, including the acceptability of risks, taking into account the generally accepted state of the art, in order to determine the suitability of a medical device to be placed on the market for its intended use."

------------------------------
Homi Dalal RAC
Regulatory Affairs Leader
Dynamic Controls
Christchurch
New Zealand
------------------------------

Original Message:
Sent: 02-Nov-2017 11:48
From: Anonymous Member
Subject: Compliance with updated standards

This message was posted by a user wishing to remain anonymous

​​A hypothetical:  Company received FDA clearance for a Class 2 medical device some years ago.  A risk analysis was done but documentation was sparse and did not include all of the documentation now required by ISO 14971.  FDA has since adopted ISO 14971 as a consensus standard.  Company is now making a change to the device and there is some disagreement about whether the risk management documentation needs to be updated to contain all documents required by the current version of ISO 14971.  Some say there is no need to meet the current standard's documentation requirements - you just update the documents that are in the file.  Others believe the risk management file does need to be updated to comply with the current standard.  Let's assume that a new 510(k) is not required for this change based on the recently issued guidance.
The question:  Does anyone here know of a documented statement or a formal opinion from FDA about when a company must comply with revised standards if a change is made to a cleared device, assuming no new 510(k)?

Thanks for your help.

FDA does not require the use of ISO 14971:2007. In §820.30(g), design validation requires "risk analysis" and the preamble, circa 1995, says this is the appropriate term. Today, we use the term "risk management", recognizing that "risk analysis" is part of risk management.

 

If you didn't implement ISO 14971:2007 initially, there is no obligation that you do it for a design change. However, a design change under §820.30(i) requires you to update the design validation as necessary. Regardless of the method you use for "risk analysis" you need to ensure it reflects the version or model of the device after the design change. The records of the "risk analysis" documentation should be in the design history file related to the design change.

 

For a 510(k) device, the rules don't change. For the design change, evaluate the need to submit a new 510(k). The new final guidance documents will help you make the decision, but you don't need to follow them, they are guidance. They don't require ISO 14971:2007, but do cast some issue in terms of risk management. However, they have a tendency to misuse the ideas and process of ISO 14971:2007, which further supports the concept that ISO 14971:2007 is not a requirement.

 

There are two things to check. First, if your most recently cleared 510(k) submission included a declaration of conformity to ISO 14971:2007, AAMI/ANSI 14971:2007, or an earlier version then you obligated yourself to follow these standards.

 

Second, if you put the CE Mark on the device, then you are "required" to follow EN ISO 14971:2012. While it is a harmonized standard and not actually a requirement, you will have a difficult time with your Notified Body if you don't implement it.

------------------------------
Dan O'Leary
Swanzey NH
United States
------------------------------

Original Message:
Sent: 02-Nov-2017 11:48
From: Anonymous Member
Subject: Compliance with updated standards

This message was posted by a user wishing to remain anonymous

​​A hypothetical:  Company received FDA clearance for a Class 2 medical device some years ago.  A risk analysis was done but documentation was sparse and did not include all of the documentation now required by ISO 14971.  FDA has since adopted ISO 14971 as a consensus standard.  Company is now making a change to the device and there is some disagreement about whether the risk management documentation needs to be updated to contain all documents required by the current version of ISO 14971.  Some say there is no need to meet the current standard's documentation requirements - you just update the documents that are in the file.  Others believe the risk management file does need to be updated to comply with the current standard.  Let's assume that a new 510(k) is not required for this change based on the recently issued guidance.
The question:  Does anyone here know of a documented statement or a formal opinion from FDA about when a company must comply with revised standards if a change is made to a cleared device, assuming no new 510(k)?

Thanks for your help.