A
Regulatory Primer (Part 4): Understanding
Quality System Requirements
In the first article of this
series,Roger
Gray of Donawa Consulting
explained how device classification can play an important
role in determining not only the quickest route to market,
but also, potentially, in which of the major markets, United
States (U.S.) or Europe (EU), the product is likely to achieve
first clearance for sale.
The second article looked in more
detail at classification issues in the United States;
the third provided detail on the European classification
system.
This article focuses on the quality
system (QS) requirements for the United States
and Europe, highlighting the major differences between the
two.
The detail of the U.S. system is set
by law, with the basic QS requirements for medical device
manufacturers being included in Title 21 of the Code of
Federal Regulations, Part 820 (21 CFR 820), known as the Quality
System Regulation (QSR) or current Good Manufacturing
Practice (cGMP) requirements.
In Europe
In
contrast, the European system includes an outline of the
requirements in the Annexes of the medical devices directives,
but the majority of the detail is described in Harmonized
European Standard EN ISO 13485:2003, "Medical
devices — Quality management systems — Requirements
for regulatory purposes."
A History Lesson ISO 13485 is based on
the international general quality system standard ISO
9001:2000, whereas the QSR is more similar to the previous
versions of ISO 13485 and ISO 9001, as the U.S. requirements
were largely aligned with the international standards
in the late 1990s, before the international community
agreed to rewrite ISO 9001, which was effective from
2001.
Sections & Subsections
The QSR is divided
into 15 sections, whereas ISO 13485 has 8. See
Table 1 below for the section headings. The majority
of the EN ISO 13485 requirements are in section 7 of
the standard, which includes subsections for design
and development, purchasing, production and servicing,
all of which are considered under separate sections
in the QSR. Depending
on the classification of the device, all, some, or
none of the QS requirements are mandatory.
Table 1: QSR & ISO 13485 Sections
Fortunately, the European QS requirements are similar to
the U.S. QSR, however the wording used is sometimes
different. Some of the more significant differences
are shown in Table
2.
Design Controls
In the United States
Design controls are
not mandatory for Class
I devices, with the following
exceptions:
--Devices automated with computer software
--Tracheobronchial suction catheters
--Surgeons’ gloves
--Protective restraints (i.e., for limiting a patient's
movements to the extent necessary for treatment, examination,
or protection of the patient or others)
--Manual radionuclide
applicator systems
--Radionuclide teletherapy sources
In Europe
No QS is necessary for Class
I devices; design controls are optional for Class
IIa, IIb and III devices. For Class IIb and
III devices, however, in the absence of design
controls, it will be necessary for a notified
body to assess a representative sample of the
product in accordance with Annex III of the Medical
Device Directive (MDD), in order to issue an EC-type
examination certificate, or to carry out the EC
verification process in accordance with MDD Annex
IV.
Most companies, however, find that following the
QS approach, including design controls, provides
commercial and financial advantages, as well
as quality advantages and regulatory compliance.
An effective QS will minimize
the chances of releasing nonconforming product
into the marketplace and facilitate the effective
handling of complaints and quality problems,
should they arise.
Other Differences
There are a number of other
differences between the two systems. Table 2 (below)
highlights the differences from the overall approach
to packaging design.
Table 2: Comparison between QSR (21 CFR 820) and
ISO13485:2003
Meeting Company Objectives and Regulatory
Requirements
"Management Responsibility" The top management of a start-up company
needs to have an overview of the "management responsibility"
aspects of the QSR and ISO standard. In this respect, both
include a need for a "quality policy" to be established. The
QSR includes a requirement for "quality objectives," but doesn’t
expand on this, whereas ISO 13485 requires these to be "established
at relevant functions and levels
within the organization," and that they must be "measurable and
consistent with the quality policy."
Depending on whether new companies have decided
to focus their first marketing activities in the United
States or Europe, they should select and
install a QS that meets the company’s
objectives and regulatory requirements. If
this includes design controls, then clearly these particular
systems or processes should be in place sufficiently early
to allow manufacture of a device for which design controls
have been applied.
If device sale is to be extended to the other main
market, then a gap analysis should be carried out to determine
what has to be added to the QS to allow compliance with
both sets of requirements. It is perfectly achievable
to have one QS that fully meets both ISO 13485 and the
QSR.
The Difference Is in the Detail
Although many of the
same basic requirements are included in the QSR and
ISO 13485, there are specific differences that
must be taken into account when developing a quality
system that meets both sets of requirements. In addition,
although the requirements are similar, different emphasis
may be placed on certain aspects by ISO 13485 auditors
or FDA QSR inspectors. For example, process validation
is genrally reviewed more stringently by FDA inspectors,
whereas risk management will be a focus of ISO 13485
auditors.
It must also be remembered that the QS annexes of the
European device directives include particular "administrative
requirements" beyond ISO 13485, so these need to
be taken into account in a manufacturer’s QS.
Finally,
there are guideline documents in Europe that provide
non-binding guidance on certain aspects of regulatory
compliance, including post-market vigilance, equivalent
to 21 CFR 803, "Medical Device Reporting," which need
to be written into a manufacturer's QS."
About the author:Roger
Gray holds a B.Sc. in mechanical engineering and
is Director, Global Regulatory Affairs at Donawa
Consulting (Rome, Italy), where he is responsible for assisting
medical technology clients obtain marketing clearance
for both Europe and the USA, in addition to managing
the company’s
European Authorized Representative portfolio. He has
over 25 years' experience in the device industry and
was involved with the development of the Medical Devices
Directive during its formative stages.
