Do I really need ISO 13485:2016 certification?
There has been rapid growth in the area of custom-made medical devices, made for single known, patients and this has led to the authorities issuing additional guidance. Innovative companies around the world are producing devices and drugs such as Anatomics and Aprecia* using technologies such as 3D printing.
*Note: In March 2016, the FDA approved the first medicine manufactured using 3 D printing. It’s called Spritam.
These small high tech companies often approach us for help with implementing an ISO 13485 quality management system (QMS) and to navigate through the regulatory requirements. They come seeking a 13485 QMS that they can have certified by a third party because they think it will add credibility to their company, demonstrating to stakeholders and regulatory authorities that they can meet quality requirements, it is a complex question, as we often need to consider many jurisdictions other than just TGA and of course the rapidly changing international regulations.
Australian TGA Requirements for Custom Medical Devices
Broadly speaking in Australia, the TGA and many international agencies do not regulate (include in the Australian Register of Therapeutic Goods (ARTG)) custom-made medical devices that are made specifically for a single, known, patient. Typically TGA regulations only apply when components or devices are made for stock for mass distribution, however you should be aware, in accordance with the THERAPEUTIC GOODS (MEDICAL DEVICES) REGULATIONS 2002 – REG 10.3, Custom made medical devices – manufacturers must inform the TGA of the following –
(1) The manufacturer of a custom-made medical device that is manufactured in Australia must, within 2 months after the medical device is first manufactured in Australia, give the following information about the device to the Secretary:
(a) the manufacturer’s name and business address;
(b) a description of the kinds of medical devices being custom-made by the manufacturer (including the device nomenclature system code for any such devices).
(2) The sponsor of a custom-made medical device that is imported into Australia must, within 2 months after the medical device is first imported into Australia, give the following information about the device to the Secretary:
(a) the sponsor’s name and address;
(b) the manufacturer’s name and business address;
(c) a description of the kinds of medical devices being custom-made by the manufacturer (including the device nomenclature system code for any such devices)
So there is no regulatory requirement for these medical device companies to have an ISO 13485 system in place.
Read more about TGA’s requirements here.
US FDA Requirements for Custom Medical Devices
The US FDA regulations are different but they also have their “Custom Device Exemption” regulations, the guidance provides definitions of terms used in the custom device exemption, explains how FDA interprets the “5 units per year of a particular device type” language contained in section 520(b)(2)(B) of the FD&C Act.
In addition, they released a draft guidance titled “Technical Considerations for Additive Manufactured Devices” on the 10th May 2016, which indicates that they are also taking a low regulation approach to custom medical devices. The US Quality Management System QMS is similar to the ISO 13485 requirements and is detailed in the CFR 820’s, which are similar but differs to the ISO 13485 Quality Management System approach.
Whilst there are many business benefits in implementing an ISO 13485:2016 system, and within a custom medical device manufacturer there are often no regulatory requirements to have it independently certified. The complexity and compliance costs associated with implementing an ISO 13485:2016 system for a custom medical device company are considerable. The costs go up even more for a system that could survive an independent certification audit.
Example of a Custom Medical Device
If we take the example of a custom medical device made using a 3D printing process, we can soon see where the complexity lies, not only in the Quality System, but in the Validation and Design and construction of the clean room.
Each product has a unique CAD file, i.e. the Build Preparation Software, and the Design Manipulation Software. These will require computer systems validation.
The process validation of the build is also complex. Critical Control Parameters such as the temperature of the beam focus, the melt pool size, build-space environmental clean room conditions e.g., temperature, pressure and humidity, should have in process monitoring. Other parameters such as the power of the energy delivery system (e.g., laser, electron beam, extruder) and the status of mechanical elements of the printing system (e.g., recoater, gantry) would also need to be controlled.
Cleaning and sterilisation is difficult due to the complex geometries of the medical devices with possible porosity, channels and other voids. Of course, custom medical devices can be made safely and there are many companies already manufacturing complex 3D printed devices who are doing just that. It’s the complexity and compliance costs that should be fully understood and included in your total set up costs.
A voluntary request for your device to be included on the Australian Register of Therapeutic Goods (ARTG) might seem like a good idea. It may give your stakeholders confidence in your manufacturing capabilities and seem like a good risk mitigation strategy, but it introduces the extra cost of establishing, certifying and maintaining a ISO 13485 Quality Management System (QMS), as well as the costs of the initial validation and revalidation etc.
What are the TGA requirements for manufacturers of custom made medical devices?
The TGA requires manufacturers of custom made medical devices to apply appropriate conformity assessment procedures and should refer to the Australian regulatory guidelines for medical devices (ARGMD). In addition to this, the TGA provides the Essential principles checklist to assist manufacturers to ensure that any custom made devices meet safety and performance requirements.
If you are considering implementing an ISO 13485 system, a good place to start is one of our ISO 13485:2016 training courses. During the course, you’ll learn how to do a gap analysis that will allow you to scope the work, and the cost, that the implementation will require.
If you do decide to go ahead, we can also supply ISO 13485:2016 QMS template packs and professional consulting and contracting to support the implementation.
Post marketing requirements for recording and reporting adverse events
Our experience is that one needs to be careful of post marketing requirements too, our consultants have seen some major failures.
These reporting requirements are detailed in Schedule 3, Part 7(7.5)(4)(c) of the Therapeutic Goods (Medical Devices) Regulations 2002.
(4) A post‑marketing system complies with this sub clause in relation to a system or procedure pack if the post‑marketing system requires the manufacturer of the system or procedure pack:
(c) to notify the Secretary as soon as practicable after becoming aware of:
(i) information relating to:
(A) any malfunction or deterioration in the characteristics or performance of the system or procedure pack; or
(B) any inadequacy in the production, labelling, instructions for use or advertising materials of the system or procedure pack; or
(C) any use in accordance with, or contrary to, the use intended by the manufacturer of the system or procedure pack;
that might lead, or might have led, to the death of a patient or a user of the system or procedure pack, or to a serious deterioration in his or her state of health; or
(ii) information relating to any technical or medical reason for a malfunction or deterioration of a kind mentioned in subparagraph (i) that has led the manufacturer to take steps to recover system or procedure packs of that kind that have been distributed.
Note: See also paragraph 41FN(3)(d) and section 41MP of the Act in relation to the requirement to give certain information about a medical device to the Secretary.