Medical Device Link.

Originally Published IVD Technology May 2003

Regulations & Standards

Conformity assessment and the role of third parties

Harvey Rudolph and Charles Tonkin

Harvey Rudolph, PhD, is the global program manager for medical devices at Underwriters Laboratories Inc. (Northbrook, IL), and Charles Tonkin, PhD, is a technical expert and auditor at UL International Ltd. (Surrey, UK). They can be reached via harvey.rudolph@us.ul.com and charles.h.tonkin@uk.ul.com, respectively.

It goes without saying that every medical device manufacturer has the goal of marketing products that are safe and effective for their intended use. The marketplace and regulatory oversight present significant motivating factors for achieving this goal. In a highly competitive market, producing devices that can effectively diagnose or treat diseases at low cost is an obvious key to success. 

These devices must also be safe to use for both patients and healthcare professionals if a manufacturer wants to maintain its reputation and market share. In addition, the medical device market is one of the most highly regulated markets worldwide. With an increasing number of governments placing a premium on ensuring that safe and effective devices are marketed within their respective countries’ borders, manufacturers have to make sure their products comply with regulatory requirements. 

Of these two factors, medical device regulation has become especially important. Governments in the major world markets, such as the United States, Europe, and Japan, have implemented complex regulatory schemes and have increased their requirements for safe and effective devices. However, no uniform approach to medical device regulation exists yet, despite efforts by the Global Harmonization Task Force to bring about consensus. 

One similar aspect among the various medical device regulations is the assessment of conformity to established product requirements, which is essential to determining whether a device complies with the regulations. Conformity assessment may entail evaluating product performance, safety, or function as established by independent consensus standards or the regulations themselves. This article focuses on the need for conformity assessment for IVDs and the role of third parties in performing this task.

Standards and Assessing Conformity 

Conformity assessment means assessing conformity to a standard that reflects society’s expectations of a product, such as an IVD, or a process, such as a manufacturing or design process. While conformity assessment may not always be required by the regulations, it is often the primary means to satisfying regulatory requirements.

Conformity assessment can entail certifying that a product meets a standard, registering a process conforming to a standard, and even to accrediting organizations. Those bodies that inspect, test, certify, or register must also be accredited to demonstrate their competence to perform these activities and must conform to standards. These standards include ISO/IEC 17025 for testing and certification laboratories, and ISO/IEC Guide 62 for third parties assessing and certifying quality management systems.

For IVDs, conformity assessment is the analysis of a product or the measurement of its properties against norms established in relevant standards. For example, harmonized standards for IVDs have been published in the European Journal and may be used to ascertain conformity to the essential requirements of the IVD Directive (see Table I).¹ Other examples of standards for IVDs are IEC 61010 for lab equipment and ISO 15197 for blood glucose monitors. In the European Union (EU), the outward sign of assessing conformity to the requirements of the directive is the CE mark placed on the equipment. In the United States, the outward sign that conformity assessment has been met for laboratory equipment is a certification mark on the device’s labeling that belongs to a nationally recognized testing laboratory.

For assessing conformity of a process, an example of a relevant standard is ISO 13485, the medical device quality management system (QMS) standard based on ISO 9001:1994. This QMS standard is preferred by regulatory authorities throughout the world. It is currently being revised to conform to the format of ISO 9000:2000 and may be published as a final standard in 2003. Even the FDA quality systems regulation is harmonized to this standard. The outward sign of conformity to ISO 13485 is a certificate issued by an accredited registrar and inclusion of the fact of registration in the advertising of products manufactured under the QMS.

Another example of a process standard is ISO 14971, a medical device risk management standard. This standard is also becoming a standard of choice by regulatory authorities. Not only does FDA currently recognize ISO 14971, it is a harmonized standard in the EU, and Japan is adopting it as a national standard.

Different types of conformity assessment exist. In some instances, an IVD manufacturer may be allowed to establish, on its own, its product’s conformity to a standard. Doing so is called a supplier’s declaration of conformity. Such self-declaration happens, for example, for in vitro laboratory equipment marketed in Europe. Manufacturers may self-declare that their products have met the essential requirements of the IVD Directive.

In other instances, other parties get involved. This other party could be a regulatory authority that does the conformity assessment, such as FDA when it reviews premarket notifications in comparison with guidance documents. Market forces may play a role when purchasers require IVD manufacturers to have their products assessed. Manufacturers themselves may also need to assess the conformity of components or raw materials to assure that their products meet their specifications. They can conduct this conformity assessment themselves or rely on third parties.

Independent assessments may be needed or required, in which case a third-party conformity assessment organization gets involved. Sometimes this third party is called a third-party certifier when the assessment is done to a product standard. Third-party conformity assessment is required by law for:

• High-risk products identified in the EU’s IVD Directive.
• High-risk products marketed in Canada.
• Most electrically powered equipment used in a U.S. workplace, such as laboratory equipment.
• Moderate-risk devices marketed in Japan.

Regulations and Third Parties

Table I. Frequently used harmonized standards (Click to enlarge).

To understand how conformity assessment is entwined in regulations and how third parties get involved, the current regulatory structures and requirements in some of the world’s major markets should be examined. 

The United States. The pertinent medical device regulations for the United States are contained in the Code of Federal Regulations (CFR). With very few exceptions, FDA requires IVD manufacturers to have a QMS in place.² The QMS that FDA requires is similar to what is established in ISO 13485 or ISO 13488, depending on whether design controls are required. FDA can therefore assess conformity to its QMS regulations by having government auditors inspect manufacturing sites. 

However, once the Medical Device User Fee and Modernization Act was signed into law, it mandated FDA to accredit third parties as qualified to perform FDA inspections.³ IVD manufacturers with good track records may hire these third parties to perform inspections in lieu of an FDA inspector. 

In addition, FDA requires premarket notification of “me too” devices, premarket approval for new devices, registration of manufacturing sites, listing of manufactured devices, and reporting of adverse events.^4–7 For premarket notifications, an IVD is compared, in essence assessed for conformity, to an existing legally marketed IVD. For most Class II devices, IVD manufacturers may choose to have FDA conduct this conformity assessment or contract with an FDA-accredited independent third party to conduct this task.⁸

The EU. The situation for IVDs is changing in Europe. The IVD Directive has standardized the relevant laws in all of the countries in the European Economic Area and has replaced individual national requirements.⁹ The directive specifies not only the essential requirements that IVDs must meet but also the ways in which manufacturers may comply with them. The directive also requires IVD manufacturers to register in the countries where they market their products, have an authorized European agent, and report adverse events under the vigilance system.

The deadline for compliance with the directive is December 7, 2003, which means manufacturers must apply a CE mark to their devices in order to market them in the EU. After December 7, 2003, only CE marked devices can be placed on the market; after December 7, 2005, only CE marked devices can be put into service.

The competent authorities in each EU member state are responsible for enforcing the laws in their countries. For example, the Medical Devices Agency in the UK is the competent authority responsible for enforcing the IVD Directive. The competent authorities also accredit independent third parties, or notified bodies, to do the conformity assessment required by the directive. According to the directive, high-risk devices listed in Annex II or those used for home use must have a conformity assessment done by a notified body. While IVD manufacturers may do their own conformity assessment for lower-risk products, the competent authorities provide oversight and have the authority to ask manufacturers for copies of their technical documentation. 

Canada. The Canadian medical devices conformity assessment system (CMDCAS) accredits third parties to do part of the conformity assessment for IVDs.¹⁰ In order to obtain a license to market IVDs in Canada, manufacturers of Class II, III, and IV devices must have their QMS assessed to ISO 13485 by one of these accredited third parties. In fact, after January 1, 2003, applicants for a license must already have undergone an assessment to ISO 13485 or 13488. IVD manufacturers must have their QMS assessed well in advance of November 30, 2003, which is the last date on which their license can be granted. Once manufacturers receive CMDCAS certification, they may then submit their product descriptions to Health Canada for final approval.

Japan. The regulatory system is also changing in Japan as a result of legislation passed by the Diet, the Japanese parliament, on July 31, 2002.¹¹ Under this new law, the Ministry of Health, Labor, and Welfare (MHLW) must within three years:

• Divide medical equipment into three categories: Class I (general medical equipment, which are low risk and require no approval); Class II (controlled medical equipment, which are moderate risk and require third-party certification); and Class III (highly controlled medical equipment, which are high-risk and require approval by the MHLW).
• Establish qualification requirements for third-party certification bodies.
• Conduct assessments of and accredit third-party certification bodies.
• Establish requirements and procedures for medical equipment approval.

Japan will therefore be requiring third-party conformity assessment for a large number of devices. These conformity assessment requirements will also include assessment of an IVD manufacturer’s QMS. Moreover, it appears that this new regulatory architecture will move Japan from its current FDA-like approval process to a more EU-like arrangement.

Common Traits and Similarities

Despite the differences, some common elements exist among the different regulatory schemes. For example, all of the schemes require a QMS to be in place. Most IVD manufacturers have accepted this regulation by having their QMS audited and certified to certain international and European standards (see Table I).

Suppliers of key raw materials have also been pressured by some IVD manufacturers to have a certified quality system. These demands have emerged not only to ensure a consistent supply of product but also to ease the regulatory path for the finished device, as manufacturers can then demonstrate control of their raw materials to their auditor. In the EU, notified bodies may extend auditing and inspection to key subcontractors, particularly if there is no evidence that a subcontractor has a quality system in place. While a certified quality system is not a requirement for suppliers, having one implemented helps them comply with their customer’s requirements.

All of the regulatory schemes also involve reviewing and analyzing device dossiers for higher-risk devices. Conformity assessment to certain standards can be key to getting approval for these devices. For example, in the United States, FDA recognizes many national and international standards, and conformity to them can ease the regulatory path to market access.¹² Conformity assessment by third parties is not essential in these cases, but it is usually convenient, especially if the assessment also satisfies other regulatory requirements. FDA guidance documents often rely heavily on ISO or NCCLS standards. FDA reviewers expect conformity to such standards to be stated in a submission, or they look for more-complete descriptions of how the manufacturer addressed pertinent issues of device safety and effectiveness.

In Europe, a series of harmonized standards is published in the Official Journal of the European Union. If an IVD manufacturer can show conformity to these standards, it is presumed the device is in conformity with the essential requirements of the IVD Directive that the standards address. High-risk IVD devices must also conform to the common technical specifications that set the number and type of patient samples, standards and acceptance criteria for performance testing and batch release.¹³ The European Commission also publishes guidance documents on the requirements of the directive.¹⁴

Conclusion

Although medical device regulatory schemes around the world differ in many respects, they are moving closer to having common requirements. In particular, almost all require conformity assessment in some sense to establish device safety and effectiveness. The regulations in the major markets have at least one common feature: they accredit and utilize independent third parties to perform conformity assessment to the regulations. However, even when regulatory authorities do not require third-party conformity assessment, such an assessment can still provide value. IVD manufacturers may use third-party conformity assessment to develop information for their technical files and can use conformity assessment of their suppliers to ensure the controls they need under their QMS. Independent third parties also provide confidence in the safety or effectiveness of the product or process.

References

1. “Standards of CEN/TC 140 – In Vitro Diagnostic Medical Devices,” in Comprehensive List of Harmonized Standards in the Official Journal Pursuant to 98/79/EC [on-line] (Hanover, Germany: mdi Europa GmBH, 2000 [cited 31 March 2003]); available from Internet: http://www.mdieuropa.com/ivd_pages/ivddharmonized.htm. 
 
2. 21 CFR Part 820, “Quality System Regulation,” [on-line; cited 4 April 2003]; available from Internet: http://www.access.gpo.gov/nara/cfr/waisidx_02/21cfr820_02.html.  

3. “Medical Device User Fee and Modernization Act (MDUFMA) of 2002: About the Act,” [on-line] (Rockville, MD; FDA, Center for Devices and Radiological Health [cited 4 April 2003]); available from Internet: http://www.fda.gov/cdrh/mdufma/. 

4. 21 CFR Part 807.81–807.100 Subpart E, “Premarket Notification Procedures,” [on-line; cited 4 April 2003]; available from Internet: http://www.access.gpo.gov/nara/cfr/waisidx_02/21cfr807_02.html. 

5. 21 CFR Part 814, “Premarket Approval of Medical Devices,” [on-line; cited 4 April 2003]; available from Internet: http://www.access.gpogov/nara/cfr/waisidx_02/21cfr814_02.html.    

6. 21 CFR Part 807 Subparts A–D, [on-line; cited 4 April 2003]; available from Internet: http://www.access.gpo.gov/nara/cfr/waisidx_02/21cfr807_02.html. 

7. 21 CFR Part 803, “Medical Device Reporting,” [on-line; cited 4 April 2003]; available from Internet: http://www.access.gpo.gov/nara/cfr/waisidx_02/21cfr803_02.html.  

8. “Third Party Review,” [on-line] (Rockville, MD: FDA Center for Devices and Radiological Health [cited 4 April 2003]); available from Internet: http://www.fda.gov/cdrh/thirdparty/.  

9. “Directive 98/79/EC of the European Parliament and of the Council,” in Official Journal of the European Communities [on-line] (Luxembourg, Germany: European Union, 27 October 1998 [cited 4 April 2003]); available from Internet: http://europa.eu.int/eur-lex/pri/en/oj/dat/1998/l_331/l_33119981207en00010037.pdf.  

10. “Notification of Passage of Schedule,” [on-line] (Ontario, Canada: Health Canada, 8 May 1998 [cited 4 April 2003]); available from Internet: http://www.hc-sc.gc.ca/hpb-dgps/therapeut/zfiles/english/schedule/gazette.ii/sch-1101_e.html.   

11. Ministry of Health, Labor, and Welfare Official Web site [on-line] (Tokyo: Ministry of Health, Labor, and Welfare, 2003 [cited 4 April 2003]); available from Internet: http://www.mhlw.go.jp/english/index.html. 

12. “Standards Program,” [on-line] (Rockville, MD: FDA, Center for Devices and Radiological Health, 1 August 2002 [cited 4 April 2003]); available from Internet: http://www.fda.gov/cdrh/stdsprog.html. 

13. “Commission Decision of 07.05.2002 on Common Technical Specifications for in Vitro Diagnostic Medical Devices,” [on-line] (Brussels: Commission of the European Communities, 5 July 2002 [cited 4 April 2003]); available from Internet: http://europa.eu.int/comm/enterprise/medical_devices/c2002_1344final.pdf. 

14. “Medical Devices: Guidelines Relating to Medical Devices Directives” in Europa Web site. [on-line] (Brussels: Commission of the European Communities, 17 December 2001 [cited 4 April 2003]); available from Internet: http://europa.eu.int/comm/enterprise/medical_devices/guidelinesmed/baseguidelines.htm.  

Copyright ©2003 IVD Technology