'An Unnecessary Editorial Revision': In Letter, MDSAP Council Rails Against ISO's Push To Change 13485 Quality Standard

The chair of the Medical Device Single Audit Program (MDSAP) Regulatory Authority Council is warning of "instability" in industry if the International Organization for Standardization (ISO) Technical Management Board has its way and makes changes now to international quality systems standard ISO 13485.

In a stark warning to the International Organization for Standardization (ISO), the head of the group that oversees the Medical Device Single Audit Program (MDSAP) says "instability" could come to the device industry if international quality systems standard ISO 13485 is retooled right now.

In a Nov. 5 letter, David Boudreau – chair of the MDSAP Regulatory Authority Council (RAC) – says a recent push by the International Organization for Standardization (ISO) Technical Management Board to modify ISO 13485 to incorporate its so-called "high-level" structure (HLS) is a bad idea.

"The ISO HLS may not currently meet the needs of the medical device sector, and revising ISO 13485 to follow the ISO HLS at this time will not only cause instability for the medical device sector but can result in fundamental changes to the requirements of ISO 13485," writes Boudreau, who also is executive director for Health Canada's Medical Devices Bureau.

Canada is requiring certification to MDSAP beginning Jan. 1. MDSAP, which maps to ISO 13485, allows firms to undergo one audit by an accredited third party to satisfy quality regulations in the US, Canada, Brazil, Japan and Australia.

Rewriting ISO 13485 would "add costs and disruption to a highly regulated industry that is already going through some very significant changes," MDSAP RAC Chair David Boudreau wrote.

Boudreau's letter was sent to the chair of ISO Technical Committee 210, Working Group 1, the ISO subcommittee that oversees ISO 13485 revisions. The standard was last revised by TC210/WG1 in 2016, and device firms still have until March 1, 2019, to become certified to the new version, which does not use ISO's high-level format.

Adopted by ISO in 2012, the format requires all published standards to be harmonized in construct, text, terms and definitions.

Because TC210/WG1 believed it would be troublesome to use the high-level structure for a device-related standard, the group asked for – and received – a waiver from ISO's Technical Management Board to revise ISO 13485 based on the 2008 version of ISO 9001, which does not use the high-level approach. ISO 9001 is the general quality systems standard applicable to all industries and is the base standard of ISO 13485; it was last revised in 2015.

But now it seems the ISO technical board is having second thoughts about handing out that waiver and is pushing for TC210/WG1 to rewrite ISO 13485 at that high level. (Also see "ISO Wants To Tinker With Quality Systems Standard 13485:2016. Let ISO Know What You Think By Nov. 9" - Medtech Insight, 2 Nov, 2018.)

In response, TC210 has asked device-makers and other stakeholders to share their opinions on any potential changes in a survey that closes on Nov. 9, found at surveymonkey.com/r/3T7Z2DF.

"One of the challenges with moving to the HLS is that it introduces concepts and potentially requirements (e.g. business risk) that fall outside the purview or the authority of regulatory authorities," Boudreau writes.

"Introducing such concepts and/or requirements could make it problematic for regulators that use (or plan to use) ISO 13485 as a regulatory requirement, since these regulators could be seen to be overreaching beyond their authority," he adds. "This could lead to regulators needing to either exclude portions of the standard from regulatory requirements, or to develop their own version of the standard that exclude the objectionable concepts and requirements.

"Therefore, it is imperative that the medical device sector is engaged in any future revisions of the ISO HLS, if there is a desire by [the ISO Technical Management Board] that the standard continue to be used for regulatory purposes."

Boudreau points out that it can take years for device-makers to become compliant to changes made to a standard.

"For example, the transition period for ISO 13485:2003 certificates will end in March 2019," he writes. "With the transition period ending, many medical device manufacturers and other organizations in the medical device supply chain will have only just updated their quality management systems to the current version of ISO 13485 when this systematic review is scheduled to begin."

"By providing stability in the standard until 2024, experience can be gained in the application of ISO 13485:2016 and its use in MDSAP," Boudreau wrote.

Because "the transition to the 2016 version of the standard is not yet complete, and industry and regulators only have limited experience with its application, it is unlikely that a revision at this time would deliver any meaningful technical improvements," he notes, pointing out that any changes to the standard could be "perceived as an unnecessary editorial revision" if its only goal is to align to the high-level format.

That would "add costs and disruption to a highly regulated industry that is already going through some very significant changes," Boudreau writes.

Such changes include the EU's impending implementation of its Medical Device and IVD Regulations in 2020 and 2022, respectively, as well as US FDA's plan to harmonize its Quality System Regulation with ISO 13485. (Also see "QSR Author Kim Trautman Predicts What A Mash-Up Of FDA's Quality System Regulation And ISO 13485 Might Look Like" - Medtech Insight, 15 Aug, 2018.)

"In addition, if changes are implemented to ISO 13485:2016, the Audit Model for MDSAP, which was just recently revised, will have to be completely revised, training of the auditing organizations will need to be conducted, and transition periods will need to be implemented, leading to instability in the MDSAP at a critical time," Boudreau writes.

His letter goes on to ask ISO to stick to the original plan of reviewing the standard after a period of five years following full implementation.

"By providing stability in the standard until 2024, experience can be gained in the application of ISO 13485:2016 and its use in MDSAP," Boudreau writes.

From the editors of The Gray Sheet