I have written this to give some clarity on where risk management activities actually need to change, and where they do not.

Thanks for reading The Other Consultants: MedTech Quality & Regulatory Insights! Subscribe for free to receive new posts and support my work.

The journey to where we are

Thanks to Edward Ball for letting me know its worth clarifying between 34971 and 24971-2. This article is intended as a kind of where we’ve come from. I always liked BS/AAMI 34971, and thought it was a great document for manufacturers to get a copy of to aid them in their risk management journey. A lot of what I exemplify here will be with reference to that standard as a foundation.

Very recently (June 2026) Guidance on the application of ISO 14971 - ISO 24971-2 was released, which takes 34971 further. However, in this article we’re going to focus on the history of 34971 to where we are now, and we’ll cover 24971-2 later, but it’ll probably be updated by the time I get to that.

So what is so different about ML enabled medical device?

ISO 14971 has stabilised within industry. Most people are now comfortable with the chain from hazard to hazardous situation to harm, and with the link between that chain and post-market surveillance. If not, I will cover it elsewhere. So is the risk management process for these devices any different? What is unique about AI medical systems that creates particular difficulty?

Continuity. These systems can accumulate data to produce an output that could have a positive impact on patient health in any term defined by the intended purpose of the device, in vitro or otherwise, according to the relevant regulations.

Autonomy. These systems have the potential to modify processes and outputs in response to their learning, with reduced clinician oversight, or in some cases without it.

Explainability. Because of their computational ability, the statistics involved and the size and complexity of the datasets, the rationale for the output produced by such systems may not be easily understood by well-trained clinicians and other healthcare personnel, let alone by individuals without specialist knowledge.

Further, machine learning systems can introduce risks to safety by learning incorrectly, making wrong inferences, and then recommending or initiating actions that lead to harm.

If we compare this to a traditional sterilised medical device, a throwback to a simpler time, the differences are stark, and they change a few things:

• It changes the way regulators perceive these devices from a safety-profile perspective.

• Post-market surveillance needs to consider the performance metrics used in the initial evaluation, and design requirements must consider the capture of PMS data.

• The manufacturer needs to consider change through an alternative route. The PCCP is a more dynamic change and PMS process. See Good Machine Learning Practices (GMLP).

The general process for ISO 14971 risk management does not change. The risk management plan, risk analysis, evaluation, control and reporting, with the benefit-risk profile considered throughout, all remain. What changes is the context. In the same way that a risk management file for an IVD differs from one for a medical device because of the way harm is caused, with medical devices more attributable to direct harm and IVDs to indirect, ML enabled medical device sits in its own context.

So let us go through the traditional elements of the risk management file and call out the areas I would recommend considering as part of the development of an ML enabled medical device.

Intended use and reasonably foreseeable misuse

As with any other device, the description of the device should be driven from the design and development plan. The device should not simply appear.

BS/AAMI 34971 provides a very useful list of the following that should be considered:

• Does the software give diagnostic or treatment recommendations? If so, how strongly does that information influence the user? Does it inform the clinician, or does it drive how the patient is managed?

• What is the target population? Is the patient’s condition non-serious, serious or critical?

• How urgent is the information the device provides?

• Does the algorithm offer options and rank how appropriate each one is?

• Are errors detectable, for example where domain shift occurs, such as images taken with or without a contrast agent?

• Does the system offer a non-ML version of the same function?

• What autonomous functions does the system have, and at what level of autonomy? AAMI TIR 34971:2023 Annex D deals with the impact of autonomous functionality, and IEC/TR 60601-4-1 remains the reference point for degrees of autonomy.

• Can the device learn and adjust its performance over time? If so, what are the limits on those adjustments? Which performance thresholds are acceptable, and which must it never fall below? What mitigations apply if a threshold is breached?

• What are the potential off-label uses of the device? As users become familiar with a device they find uses beyond the intended one. Allow for reasonably foreseeable misuse and evaluate the use errors that could occur.

• Are there contra-indications because certain patient conditions were restricted in the data used to train, test and validate the model? If so, is there a risk the user ignores those contra-indications?

• Is the system intended to learn over time, and could that affect the intended use?

Identification of characteristics relating to safety

This is where we can leverage ISO/TR 24971-2 Annex A, which is where the questions from the old ISO 14971:2007 Annex C ended up. Who can remember anything anymore. AI is, ironically enough, probably to blame.

Joking aside, AAMI TIR 34971 is clear that the process for identifying characteristics relating to safety for ML enabled systems can and should follow the same methodology used for more traditional medical device systems. It’s critical to mention 24971-2 here, as this is an area that the new standard significantly goes further within the Annex C - Identification of hazards and characteristics related to safety, which gives a really comprehensive list.

It is again worth noting that the document specifies that Annex C is not exhaustive and should not be used as a checklist.

The draft IMDRF document I recently led a consultation response on, N93 Technical Framework for Artificial Intelligence Life Cycle Management, groups risks more broadly into four categories:

• Risks related to information, including inaccurate or misleading outputs and incomplete presentation of information, such as no explanation of the probability of error.

• Risks related to the human-AI interaction, including over-reliance and automation bias, under-reliance and dismissal, workflow disruption, verification fatigue, alert fatigue and the de-learning of clinical knowledge over time.

• Risks related to model training and data quality, including training data bias, data drift, incomplete data, annotation errors and out-of-distribution inputs.

• Risks related to deployment and post-market monitoring, including interoperability failures, degradation caused by changes in third-party general-purpose models, version control failures and misaligned calibration where the context of use differs from the context of validation.

The first two get attention because they look like conventional usability and information hazards. The others require the manufacturer to admit that the device’s safety depends on data it did not generate and infrastructure it may not own.

Examples of ML enabled medical device hazards

In the original BSI/AAMI 34971, the following was covered:

Performance-related hazards:

Data quality, covering incorrect data, incorrect handling of outliers and incomplete data.

Bias, covering selection bias, implicit bias, group attribution bias and experimental bias.

Data storage, cybersecurity and privacy, covering privacy failures and inability to contact the patient.

Overtrust and over-reliance, covering overconfidence, perceived risk, user workload, self-confidence and variation in social trust.

24971-2 Annex B goes further into specific types of events and circumstances, in particular with number 8 - ML model training, and 9 functionality. There is also the table of example relationships that should be used as primary place for examples:

Data quality - MLMD delivers insulin based on continuously measured input data. A loosely worn wearable medical device can interrupt the data flow, leading to incorrect conclusions by the decision-making MLMD.

Algorithm model: The MLMD does not learn enough training data and misses important features; underfitting; generalization error increases after training the ML model

ML enabled medical device and post-production activities

This is the other area where ML enabled medical device creates real difficulty for developers.

Take the EU MDR. Software under Rule 11 will, in almost all cases where it informs a diagnostic or therapeutic decision or monitors physiological processes, land at Class IIa or above, and with it comes the Periodic Safety Update Report under Article 86, annually for Class IIb and III and at least every two years for Class IIa. Great Britain has now followed, with the post-market surveillance amendments to the UK MDR 2002 introducing a broadly comparable reporting cadence.

Question time, and be honest.

Take away the regulatory requirement. If the sole purpose of post-market surveillance is to confirm that the information within your technical documentation is still valid, is it really enough to complete a PSUR every year, or every two years, when the device changes at the rate this one does?

The answer is no, and the reason is that the PSUR is a reporting artefact, not a surveillance activity. Article 86 tells you when to publish. Annex III tells you what to do. If your PMS plan says little more than that complaints will be reviewed and a PSUR produced every two years, you have no mechanism capable of detecting any of the failure modes described above.

N93 makes a distinction that I think is genuinely useful here, and one I would argue should be reflected in the structure of the PMS plan itself. It separates operations and monitoring, meaning the continuous and largely automated activity embedded in the QMS such as logging, alerting and incident handling, from real-world performance evaluation, meaning the structured analyses that use those data to answer specific questions about safety, effectiveness and clinical utility. One is a pipeline. The other is a study. Most PMS plans I see describe neither and instead describe a reporting schedule.

In practice that means a few things.

Define device performance indicators up front, framed by the intended purpose and, where feasible, using the same metrics you used to set acceptance criteria during verification and validation. If the pre-market and post-market metrics are not comparable, you cannot demonstrate that performance has been maintained, which is the whole point. This also has to tie into design requirements to ensure adequate capture of PMS data to prove performance.

Define those indicators for clinically relevant subgroups, not only in aggregate. Aggregate accuracy will hide differential performance across demographics, disease subtypes and deployment sites, and differential performance is precisely the failure mode these devices are prone to.

Pre-specify thresholds and trigger conditions, and state what happens when one trips. That is the link back into risk control, into corrective action, and into trend reporting under Article 88. A monitoring plan with no defined trigger is a data collection exercise, not surveillance.

Monitor the human-AI team, not just the model. Override rate is the one almost everybody misses. If clinicians are routinely overriding an output while your monitoring shows the model performing exactly to specification, your residual risk estimate for automation bias, under-reliance or workflow disruption is wrong. The model is fine and the device is not. No amount of model-level telemetry will surface that.

Monitor for drift explicitly, and distinguish it from expected output variability. For non-deterministic models this is not straightforward, and it needs to be designed into the infrastructure at the deployment stage rather than retrofitted when a signal appears.

Change, PCCPs and the file

Where a predetermined change control plan is implemented, the technical documentation will require updating and, at minimum, an impact assessment against the PMS documentation.

It is worth being precise about the jurisdictional position, because there is a lot of loose talk about PCCPs at the moment. The FDA has a defined route. The EU MDR does not currently have an equivalent mechanism, and a change that would otherwise trigger a significant change assessment still does; having anticipated it in a plan does not remove the notified body from the process. Great Britain has signalled an intention to introduce one.

Wherever you sit, treat a retraining event as an input to the risk management file rather than as a software release. The characteristics relating to safety may have changed. New hazards may have been introduced. The benefit-risk determination needs revisiting, and the clinical evaluation, PMS plan and transparency information provided to users all need an impact assessment. Appendix C of N93 sets out the labelling elements that ought to be revisited, and measured performance including subgroup performance sits squarely in that list.

Sunsetting

Now that we have a nice word for it from IMDRF, we can start to think about how to integrate it, or how it already integrates.

One thing N93 does that most risk management files do not is treat sunsetting as an explicit life cycle step. It is worth adopting. For cloud-hosted software, withdrawing a model version or terminating support is itself a risk-bearing event. Sites will have built workflow around the device, and removing it without a managed transition creates a hazardous situation that has nothing to do with the model’s performance and everything to do with the clinical process it has been absorbed into. Communicate the timeline, define what happens to retained data, and document the decision. It will be reviewed.

Where this leaves you

The process does not change.

What it requires is the same process applied honestly to a device whose characteristics relating to safety now include the data it was trained on, the people who labelled that data, the infrastructure it runs on, and the behaviour of the clinician using it.

Integrate these standards, guidance and regulations into the early phases of your design project and things will naturally flow from them.

Thanks for reading The Other Consultants: MedTech Quality & Regulatory Insights! Subscribe for free to receive new posts and support my work.

A few months ago, I wrote an article on leadership called Overcoming Inertia and Maintaining Momentum: Quality-Regulatory Strategy and Leadership.

You can find the article here - https://theotherconsultants.substack.com/p/overcoming-inertia-and-maintaining

Fast forward a few weeks after this, and I decided to reach out to someone who’s day to day is maintaining momentum, to give some further insight into this challenge.

Introducing, Michael Konings - Senior Director - Global Head of Regulatory Affairs - IGT Systems for Philips.

Michael and I have known each other for a while now, and whilst we are both at different sides of the spectrum in terms of our day to day roles (Michael being involved more in Leadership, and myself entrenched in technical details with no escape it seems), we both are extremely aligned in that maintaining momentum can be challenging in an every moving landscape.

Furthermore, we are both extremely interested in the role that Artificial Intelligence can play within gaining and maintaining momentum. Michael has kindly agreed to write a small piece for our network on his take.

We have attempted this piece to go out from the usual of “use AI to automate and make things faster, and as a result reduce the headcount”. Enjoy! And thanks Michael for taking the time.

1. The Shift from Information Control to Intelligence Orchestration

For many years leadership was strongly connected to access to information. Leaders often had more data, more overview, and therefore also more control over decision making. With the rise of AI this model is changing very quickly. Information itself is becoming available everywhere and AI can process huge amounts of data much faster than humans can do manually.

This changes the role of leadership. The value is no longer only in collecting information, but much more in connecting insights, setting priorities, and making sure organizations use intelligence in the right way. Leaders increasingly need to orchestrate how human expertise and AI-generated insights work together.

In MedTech and other regulated industries this becomes even more important. AI can support analysis, identify trends, or accelerate documentation activities, but organizations still need human oversight to ensure quality, patient safety, and regulatory compliance. Leadership therefore becomes more focused on coordination, alignment, and responsible decision making instead of pure control over information flows.

2. Why Leadership Must Evolve in the Age of AI

AI is not only introducing new technologies into organizations. It is also changing how organizations work, collaborate, and take decisions. Many repetitive or administrative activities can already be supported or partially automated by AI systems. This means employees and leaders will spend less time on transactional work and more time on AI outcome validation, strategic and cross-functional activities.

Because of this, leadership models that were successful in the past may not be sufficient anymore. Organizations need leaders that are comfortable working in environments with continuous technological changes, faster decision cycles, and increasing complexity.

At the same time AI also creates new risks. Fast output does not automatically mean correct output. Leaders therefore need to understand both the possibilities and the limitations of AI-supported decision making. Especially in healthcare and MedTech, speed can never replace responsibility.

The future leader must therefore combine technology understanding with human capabilities such as judgment, communication, ethical thinking, and the ability to align different stakeholders around difficult decisions.

3. Human Judgment as the New Strategic Differentiator

As AI systems become more capable in generating analysis, summaries, predictions, and recommendations, the differentiating factor for organizations will increase toward human judgment. AI may support decisions, but it cannot fully understand organizational context, long-term consequences, or societal impact in the same way humans can.

This becomes highly visible in regulated environments where decisions often include trade-offs between innovation, compliance, patient safety, business priorities, and ethics. These are areas where human judgment remains essential.

Organizations that only focus on automation may improve short-term efficiency, but organizations that combine AI capabilities with strong human decision making will create more sustainable value. The role of leadership is therefore not only to implement AI, but also to ensure that critical thinking and accountability remain central in the organization.

In this environment, experience, interdisciplinary thinking, and the ability to challenge AI-generated conclusions become increasingly important leadership capabilities.

4. Leading in a World Where AI Accelerates but Humans Remain Accountable

One of the biggest changes AI introduces is speed. Activities that previously required days or weeks can sometimes now be performed within hours or minutes. This creates opportunities to accelerate innovation, improve responsiveness, and reduce administrative burden.

However, accountability does not move at the same speed as automation. In healthcare, regulatory, and quality environments, organizations and individuals remain responsible for the final outcome regardless of how much AI was involved in the process.

This creates a new leadership challenge. Leaders must stimulate innovation and efficiency while at the same time ensuring appropriate governance and oversight. AI should support humans, not replace organizational accountability structures.

For this reason organizations need clear frameworks on where AI can be used, where human review remains mandatory, and how responsibilities are documented. Leaders play an important role in creating trust around these processes. Without trust, even strong AI capabilities will not be successfully adopted inside organizations.

5. Building Organizations Where Humans and AI Augment Each Other

The future organization is likely not fully human-driven and also not fully AI-driven. The strongest organizations will probably be those that successfully combine the strengths of both.

AI is very strong in scaling information processing, identifying patterns, supporting documentation, and accelerating repetitive activities. Humans remain stronger in empathy, ethical reasoning, contextual understanding, relationship management, and complex judgment.

Organizations therefore need to redesign workflows around this collaboration model. Instead of asking how AI can replace humans, the better question is how AI can increase the effectiveness of people and allow teams to focus more on higher value activities.

This also requires changes in organizational culture. Employees should not experience AI as a threat only, but also as a tool that can support their work and development. Leaders have an important responsibility in guiding this transition carefully and realistically.

Successful implementation will depend not only on technology investments, but also on transparency, communication, training, and organizational trust.

6. The New Role of Leaders in Regulated Innovation

Innovation in regulated industries has always required balancing speed with control. With AI this balance becomes even more sensitive because technological development is moving faster than many existing regulatory frameworks.

Leaders therefore need to operate in an environment where not all rules are fully established yet. This requires organizations to become more proactive in engaging with regulators, standardization bodies, and external stakeholders.

In MedTech especially, leadership is increasingly connected to shaping responsible innovation instead of only responding to regulations after they are published. Organizations that actively participate in these discussions may help define future expectations instead of only reacting to them later.

This also means leaders need stronger cross-functional collaboration between Regulatory Affairs, Quality, Clinical, R&D, Software, Data Science, and Commercial functions. AI-related innovation can no longer be managed effectively inside isolated organizational silos.

The leadership challenge is therefore not only technological adoption, but also building governance models that allow innovation and compliance to evolve together.

7. Developing the Next Generation of AI-Enabled Leaders

Future leadership development will likely look different from traditional leadership models. Technical expertise alone will not be enough, but purely managerial capabilities may also become insufficient.

Organizations will need leaders who understand technology sufficiently to ask the right questions, while also being able to lead people through uncertainty and continuous transformation.

This means future leadership programs should include stronger focus on AI literacy, cross-functional collaboration, ethics, change management, and strategic thinking. Leaders do not need to become AI engineers, but they do need enough understanding to make informed decisions and challenge assumptions when needed.

Another important aspect is learning agility. Because AI technologies evolve rapidly, organizations cannot rely only on static expertise models anymore. Continuous learning becomes part of leadership itself.

Mentorship and knowledge transfer will also remain critical. Experienced leaders bring organizational context and judgment that AI systems cannot replicate. Combining this experience with newer digital capabilities from younger generations may create stronger and more balanced leadership teams.

Conclusion: Leadership Adapting as the Human Operating System Around AI

AI will become deeply integrated into many organizational activities during the coming years. It will influence decision making, operational processes, product development, customer interactions, and regulatory activities.

But despite these changes, organizations will still depend on human leadership to create alignment, accountability, trust, and direction. AI can generate information and recommendations, but it cannot fully replace human responsibility or organizational judgment.

Because of this, leadership may actually become more important in highly AI-enabled organizations, not less. The role of leadership shifts from controlling activities toward guiding systems, connecting people, managing risks, and ensuring technology is used responsibly.

Especially in regulated industries such as MedTech, the combination of innovation, compliance, ethics, and patient safety requires strong human oversight. Organizations that succeed will likely not be those with only the most advanced AI, but those that best combine AI capabilities with responsible and adaptive leadership.

In this sense leadership becomes the human operating system around AI. As important as it is for leaders to understand the capability of AI, it is equally as important for them to understand its limitations, while also understanding the capability of the humans within their teams.

You can register here - https://www.linkedin.com/events/medtechopenoffice-17444639830216445952/theater/

On Monday I had the privilege of speaking at the Innovation and Regulation: A Medical Device Dialogue event at the University of Glasgow. The talk was titled All Products Require Clinical Evaluation — Not All Require Clinical Investigation, and I want to share the core thread of it here for those who couldn’t make it. Before you say it, yes I know that IVDs have performance evaluation instead.

The distinction that trips people up

There’s a fundamental misunderstanding that surfaces regularly in early-stage device development: the conflation of clinical evaluation with clinical investigation. They’re not the same thing, and the regulatory consequences of treating them as interchangeable are significant.

Clinical evaluation is mandatory. Under EU MDR Article 61(1), every medical device — regardless of risk class, novelty, or technology type — requires a clinical evaluation. It is a continuous lifecycle activity, not a one-time document exercise. It uses scientifically sound methods to assess clinical and non-clinical data to verify safety, clinical performance, and clinical benefit.

Clinical investigation, on the other hand, is not automatically required. It only becomes necessary when existing clinical evidence is insufficient to support the benefit-risk conclusion — and that gap is identified through the clinical evaluation process itself.

The question hierarchy that determines your route

The decision of whether a clinical investigation is needed isn’t arbitrary. It flows from a structured set of questions:

Is your device well-established technology (WET) under Article 61(6)? If yes, a literature-only clinical evaluation route may be appropriate — but you still need a CER and a proportionate PMCF plan.

If not, can you demonstrate equivalence to another device under Article 61(3) and MDCG 2021-6? Equivalence requires justification across technical, biological, and clinical characteristics.

If neither applies, does existing clinical evidence demonstrate sufficient safety and clinical performance for your device? If yes, you proceed to a benefit-risk determination. If no — that’s when Article 61(4) or 61(10) applies, and a clinical investigation needs to be planned under ISO 14155.

What “sufficient” actually means

MEDDEV 2.7/1 Rev 4 defines sufficient clinical evidence as an amount and quality of clinical evidence to guarantee the scientific validity of the conclusions. That’s the bar. It’s proportionate to the device and its claims, but it’s the manufacturer’s job to identify, specify, and justify what that level is — against the relevant General Safety and Performance Requirements.

The new standard on the horizon

One slide I spent some time on was ISO/DIS 18969, the first dedicated ISO standard for clinical evaluation of medical devices. Voting closed on 9 March 2026 and publication is expected within the next six months. It maps directly to EU MDR Annex XIV via Annex ZA, and when it lands it will supersede MEDDEV 2.7/1 Rev 4 and IMDRF N56 as the primary reference.

A few things worth flagging now so you’re not caught off guard:

Clinical evaluation planning under 18969 is intended to run in parallel with design and development from the very start, not bolted on later. The benefit-risk profile assessment (§9.4) becomes a formal three-step requirement. Digital evidence — AI outputs, real-world data, computational models — is formally recognised. And perhaps most practically, the scope of alternatives you must compare against expands: you need to evaluate non-medical alternatives, not just similar devices.

The Glasgow scene

I also want to say — without being too sentimental about it — that what is happening in Glasgow around medical devices right now is genuinely worth paying attention to. The event brought together a strong mix of academic, clinical, regulatory, and industry perspectives. If you are developing a device and you’re not tapped into that network, you’re leaving value on the table.

Thank you to Pamela Sandu for the invitation and to everyone who contributed to the discussions on the day.

I know, I am sorry.

However, I am sure you weren’t that fussed about hearing about my Christmas and New Year, and how this year is going to be bigger and better than ever. So I thought I’d just skip it.

I’ve wanted to write about this topic for a while, but it is something that can be a bit hard to fit into a topic that is really more about technicality for me a lot of the time.

I wanted to discuss today is inertia, momentum and ultimately energy. Specifically, the momentum required to develop and place a medical device on the market.

Subscribe now

The sequentiality, parallelity and coordination of activities that must be completed is really remarkable. If only the everyday person knew all of the work it takes to get that device in front of them.

Devices often can end up with regulatory hurdles, from very early uninformed decisions that result in the business being in a bit of a difficult situation. The details of the situation are irrelevant. However, the circumstance and nature of maintaining momentum as a profession within a regulatory project while being constantly met with hurdle by hurdle is a real skill.

The real nuance with getting a device on the market, is that when the approval authorities have the files to review, they very much have a short period of time to understand things (unless competent authorities).

Therefore, it is always the case that there will be things they need clarity on.

Now, when we think about a regulatory authority raising deficiencies or queries on a device. The situation in a large medical device manufacturer can be drastically different to that of a small business. However, one thing remains a constant in both of these situations. Energy.

Anyone that has worked on a technical file submission knows that once it is submitted, the entire project team has a bit of time to back off from the pressure and intensity, and this naturally results in a bit of a quiet following week.

However, it is now the case, in both small and large medical device manufacturers that once one task is completed, it’s on to the next one.

Now, when we have a team of humans, how can we keep them motivated? How do we maintain energy?

Overcoming Inertia

When beginning any project, there is likely to be a burn in period. Where the team gels, plans are written and resources are allocated. This can really take a bit of energy to get things going at first in a device development project.

Leaders need to be engaged and driven to be able to influence the team in a positive project direction.

Pre-empt the “Post-Submission Slump”

The mistake most leaders make is treating the submission as the end of the marathon. In reality, it’s just the end of the first lap.

• The Strategy: Schedule a mandatory “reset week” immediately after filing. Not for more work, but for low-intensity administrative cleanup or professional development. By planning for the lull, you prevent the crash.

Accept and prepare for hurdles

When a regulator asks for more data, teams can often feel demotivated. As a result, it is important for these teams to understand that leadership is realistic with the time it takes to complete certain activities and key dependencies.

• The Strategy: Reframe queries not as “failures” of the initial file, but as part of the process. . It is key that leaders ensure that their teams know that the business understands that this is a part of the path to market.

The Power of Parallel Momentum

Momentum is lost if a team is purely waiting for feedback and it can often be hard to pick that back up:

• The Strategy: Maintain a “shadow backlog” of continuous improvement tasks—UX enhancements, post-market surveillance prep, or process optimizations—that keep the gears turning without the high-stakes pressure of the initial submission.

• Device change: Although the Pre-Determined Change Control Plan (PCCP) was initially discussed in the context of software devices, it is useful to think of this when designing your device from a general product development perspective and how it will evolve. This can form part of a good narrative and dialogue to ensure minimisation of the risk of fundamental device change hurdles.

Minimise switching priorities

One of the fastest ways to drain a team’s energy is the “whiplash” effect. Regulatory work requires immense cognitive load; jumping between a response to a deficiency notice and a new product development meeting doesn’t just take time, it is also the amount of knowledge that is required to cover the full lifecycle either in one person or across a team—it is a huge task.

People will argue that changing tasks is a part of the modern world, and I would agree. But it doesn’t mean it’s not helpful to be mindful that it takes a toll on the team.

• The Strategy: Create Regulatory “Sprints.” Instead of having the team juggle five different tasks poorly, give them the air cover to focus on one. If a deficiency notice comes in, that becomes the only priority for a dedicated “strike team” until it’s cleared. Establish periods where the team is shielded from non-urgent internal requests. Leaders have to be the filter here. When the business asks for a “quick pivot,” leaders must be the one to calculate the “switching cost.” and not just panic, and switch priority.

I am thinking to write a small series on Regulatory Leadership, so maybe this can be a part of the beginning. Or not.

Take care!

Adam

Share

Dr. Naveen and I now know each other through the wonderful LinkedIn MedTech community. I have followed his work for many years and I felt really honoured for him to invite me on to his wonderful weekly calls on Let’s Talk Risk!

The topic was the Quality Management System Regulation (QMSR) that will be applied from February 2nd 2026. Really not far away. It feels like yesterday that they released the preamble, set the date and now it is right around the corner.

With everything that has changed in MedTech recently from a regulatory perspective, this is definitely one of the areas that has had the most attention.

I wouldn’t want to go onto Let’s Talk Risk! with Naveen and simply tell everyone that you should complete a gap assessment to QMSR against your current system, but instead, following the principles of Charlie Munger, who inspired by Carl Gustav Jacob Jacobi who when practicing the principles of inversion for anything remotely perceived as complex said:

"man muss immer umkehren”, or loosely translated, “invert, always invert.”

I like to ask the same type of question of:

If this was to be really simple, what would we do or how would we do it? 

So, since we’re talking about QMSR and the FDA, then let’s use the adopted principles of one of the greatest minds - Charlie (in my opinion) that America has produced.

So instead of talking about what is changing under QMSR, we spoke about what is NOT changing under QMSR that I believe manufacturers should stay attentive towards.

I should also say that this is being written at the time where these documents and the guidance referenced are current, and they could of course change at any time without notice to us.

Naveen and I discussed the following:

• the FDA will not simply accept an ISO 13485 certificate and leave:

  • As regulators such as the MHRA move toward international reliance, manufacturers should not to mistake alignment with equivalence. The FDA will still be the FDA. They’ll still conduct their own inspections, maintain their own registration requirements, and will not accept ISO 13485 certificates in lieu of their own verification and surveillance process.

  • As a result, the QMSR should still be considered as one in itself from EU, and UK markets as distinct conformity routes, even amid harmonisation efforts.

  • Reliance is very efficient from a regulators perspective because of resource constraints, so it can be a helpful way to reduce administrative burden. However, manufacturers need to be aware of the risks that reliance brings that one issue in one jurisdiction can greatly affecting several regulatory jurisdictions.

• premarket notification 510(k) submission process:

  • Manufacturers despite QMSR will still need to conform with the premarket notification 510(k) requirements if applicable to their device code without exemptions.

• the requirements around change control:

  • Deciding When to Submit a 510(k) for a Change to an Existing Device at the moment has still remained the same, so this is worth keeping an eye on whether is impacted as a result of any changing processes within the QMSR update.

  • Predetermined Change Control Plans (PCCPs) are still in place and still planned through the 510(k) process. Hopefully these are coming to Europe soon…under the revision of the EU medical device regulations expected on 16th December 2025.

• Design control system will still remain a key focus in regulatory inspections,

  • Although the requirements are different, you can count that the attention to design control, or now design and development will still very much remain the same, and or intensify.

  • If a customer complaint relates to a hazard that has a relating design input, then it will still be heavily scrutinised by FDA as to whether the risk control, or design or subsequent verification or validation is effective.

• The FDA will still provide brilliant auditors:

  • In my experience, the FDA staff have been amongst the most competent I’ve dealt with. Super risk based, super product and patient focused. Sure they will formally have to retrain to ISO 13485 incorporated within the QMSR, but in terms of risk based thinking, its always been there in the agency in my experience as an auditee and colleague of ex-FDA staff.

  • It also must be remembered that the FDA can remain at sites longer than your Notified Body (NB) or Certification Body (CB).

Share

You can check out the full discussion which will have more than what I’ve put in here, but I am really grateful to Naveen for inviting me into this conversation and for the work he continues to do to foster thoughtful dialogue across the MedTech community. If you haven’t joined one of his Let’s Talk Risk! sessions yet, I’d highly recommend it—they’re a rare blend of depth, generosity, and real-world insight.

Here’s to keeping things simple, staying proactive, and embracing the next chapter of QMSR with clarity and purpose!

Cheers,

Adam

Share The Other Consultants: MedTech Quality & Regulatory Insights

This week really feels huge for the medical device industry.

We’ve already got draft implementing regulation - Ares(2025)11081575 - requirements to be met by ‘notified bodies’ & now MDCG 2025-9 - Guidance on Breakthrough Devices (BtX) under Regulations 2017/745 & 2017/746. All of this before we’ve even seen the targeted evaluation and proposal that will be put forward to negotiations for the EU MDR and IVDR. I’ll link all of the documents at end.

Firstly we’ll go through the draft implementing regulation - Ares(2025)11081575 - requirements to be met by ‘notified bodies’.

This draft implementing regulation essentially looks to lay down more stringent requirements for NBs throughout the conformity process in terms of what they must include in their quotations, timelines they must adhere to, how they should manage interruption or re-certification.

This will certainly be a very welcome things by many manufacturers as this was always a big frustration for lots of people within industry, although I do understand what goes on at NBs sometimes that are totally unique and complex.

Share

The following maximum timelines are established:

• 30 days for the application review and the signature of the contract, starting on the day on which the notified body receives the complete application and ending on the day the contract with the manufacturer is signed

• 120 days for the quality management system auditing in accordance with Section 4.5.2 of Annex VII to Regulation (EU) 2017/745 or with Section 4.5.2 of Annex VII to Regulation (EU) 2017/746, as applicable, starting on the date the notified body initiates the audit programme’s first activity and ending on the day in which the final review referred to in Section 4.7 of Annex VII to Regulation (EU) 2017/745 or in Section 4.7 of Annex VII to Regulation (EU) 2017/746, as applicable, is completed;

• 90 days for the product verification in accordance with Section 4.5.3 of Annex VII to Regulation (EU) 2017/745 and Section 4.5.3 of Annex VII to Regulation (EU) 2017/746, starting on the day the notified body initiates the assessment of the technical documentation of the device or the representative device and ending on the day in which the final review referred to in Section 4.7 of Annex VII to Regulation (EU) 2017/745 or in Section 4.7 of Annex VII to Regulation (EU) 2017/746, as applicable, is completed;

• 15 days for the final decision and certification, starting on the day after the completion of the last relevant final review referred to in point (b) or (c), depending on the conformity assessment procedure requested, and ending on the day the certificates are issued in accordance with Section 4.8 of Annex VII to Regulation (EU) 2017/75 or with Section 4.8 of Annex VII to Regulation (EU) 2017/746, as applicable.

So overall, there is a total maximum timeline of 255 days allocate to NBs to complete the conformity assessment process.

Breakthrough Devices (Btx) MDCG 2025-9

This will be a very welcome document to many manufacturers, and for those that come into existence only after all of these pathways are defined, then they didn’t have to exist without them at least.

Criteria for breakthrough devices:

MD or IVD will be considered a breakthrough device if it meets each of the following criteria:

1. Novelty

The device introduces a high degree of novelty with respect to the device technology, the related clinical procedure, and/or the application of the device in clinical practice,

AND

1. 2. Positive clinical impact o Offering a significant positive clinical impact on patients or public health compared to available alternatives and the state of the art, OR

2. Fulfilling an unmet medical need where there is an absence or insufficiency of available alternative options for that purpose.

The device is expected to provide a significant positive clinical impact on patients or public health, for a life-threatening or irreversibly debilitating disease or condition, by either of the following:

The document is generally very interesting and hits all of the points industry has been calling for. Just because it’s looking like we’ve all got some reading to do over the Christmas break, the main bits that have stood out to me are:

• Section 10.1 - 10.1 Breakthrough status opinion / designation between NBs and expert panels - the document specifies that the manufacturer can file an application with an expert panel at any time in development, however this is likely to be facilitated by the NB. A key point here is that the type and extent of expert panel engagement will depend on the stage of device development, the nature of the evidence available, and the regulatory pathway applicable. For example, early-stage devices may benefit primarily from non-clinical or regulatory scientific advice under the pilot framework (section 10.3), whereas more advanced devices subject to notified body review may later enter a CECP process (section 10.4).

• 11.1 Prioritisation of BtX and access to structured dialogue with NB - NBs are informed to prioritise Btx, coordinate with expert panels, and be proportionate

• 11.4 Certification with Specific Conditions or Provisions - I’m a big fan of certification with conditions, so glad to see this put into writing as it is a very useful and risk based approach to be able to place a device on the market with conditions, monitor it’s safety and effectiveness through PMS, while gathering with PMCF and market data.

I’ll be really interested to see MDCG 2025-9 applied, manufacturers are expected to lead the designation activity through an application to expert panels, this will likely be done through NBs to consult expert panels in line with article 106 of 2017/745 & 2017/746. This may bring its own unique capacity challenges.

The document nicely highlights some benefits of being designation as a Btx:

• Scientific and Regulatory advice:

  • Priority in EMA expert panel early scientific advice

  • Scientific advice to non-Art.61(2) BtMD and BtIVD (pilot)

  • Regulatory advice

  • Early and priority structured dialogue with NBs

• CI/PS supports:

  • Dedicated CI/PS pre-submission meetings

  • Supports/advice for early feasibility studies

  • Priority selection in CI/PS coordinated assessments (MDR A.78 / IVDR A.70)

  • Proportionate fees for CI/PS authorisations

• Conformity assessment:

  • Enhanced predictability for conformity assessment timelines and expectations

  • Priority structured dialogue with NB

  • Proportionate fees for BtX conformity assessment

  • Accelerated conformity assessment timelines

  • Special considerations re pre-clinical evaluation

  • Certification with conditions to facilitate safe, early market access

• Pre-clinical and clinical evaluation

  • Additional considerations re standards, pre-clinical evidence for BtX

  • Guidance re meeting pre-clinical GSPRs in the absence of well-defined standards for BtX,

  • Guidance re clinical development strategies for BtX, including considerations for suitable CI designs in early, pre-market confirmatory, and post-market stages – see Appendix A.2

  • Guidance on sufficient clinical evidence for conformity assessment

  • Increased role of PMCF for post-market confirmation of safety and performance

• Cross-body recognition of BtX designation status for:

  • HTA assessments

  • EU and national grants and financial supports

Oh and we’re also just expecting the targeted evaluation...Thanks again!

Useful Links

NB Draft Implementing Regulation

MDCG 2025-9

However, while regulatory understanding forms the backbone of effective auditing, soft skills are the connective tissue that determines whether an audit truly adds value.

Increasingly, organisations are discovering that the most successful auditors aren’t just technically proficient—they are excellent communicators, collaborators, and critical thinkers.

So in this article, I will go through the various soft skills that I believe are really important for auditors to possess in order to get the best results for themselves and their auditees.

I could really write a whole piece on each one of these or more.

1. Continuous Communication

It is all too often that communication about the status of the audit only occurs at the opening meeting.

In real medical device style, communication should occur throughout the lifecycle of the audit.

Auditors must ask precise questions, listen actively, and communicate findings in a way that is factual yet constructive.

This can be really dealt with by scheduling regular check-ins with key auditees throughout the audit where you create opportunities to brief auditees on the status of the audit as well as communicate potential findings, overdue records, and understand audit team availability etc.,

A lack of constant communication can often result in a lack of rapport being built with auditees and therefore make for a less collaborative and effective audit.

2. Empathy: Consider the Stress Levels of Auditees

Auditing can create stress for auditees, especially in regulated environments where nonconformities carry significant consequences, or where organisations have cultures that may not receive nonconformities as ways of looking for improvement.

A key way to spot if there is more pressure on auditees, especially with Management Representatives is when Quality Objectives are things such as "No findings in internal and external audits".

Auditors with high emotional intelligence:

• Read the room and adjust their approach

• Navigate tensions calmly and respectfully

• Foster a sense of partnership rather than interrogation

• Understand when the person receiving the finding is not really the owner of the finding

This not only smooths the audit process but also supports a culture of openness—essential for identifying true systemic issues.

3. Adaptability in Dynamic Environments

Audits rarely go exactly as planned. Documents are missing, process owners are unavailable, or unexpected risks emerge.

Adaptable auditors remain composed, adjust their audit trail as they go, and maintain alignment with audit objectives despite shifting circumstances.

This adaptability is especially important in complex regulatory frameworks such as MDSAP where interdependencies require flexibility and a broader perspective.

4. Diplomacy in Delivering Findings

How a nonconformity is delivered can determine whether an organisation embraces or resists the message.

I always believe a diplomatic auditor will call the finding potential and give the auditees an opportunity to demonstrate that conformity to the requirement being assessed.

Diplomatic auditors:

• Focus on objective evidence

• Provide context for the finding

• Communicate in neutral, supportive language

• Encourage a solutions-oriented mindset

This softer approach of identifying potential nonconformities first, and giving auditees ample opportunity to demonstrate conformity shows to the auditees that you are auditing for conformity, not nonconformity.

5. Time Management for Efficient, High-Quality Audits

If only the audit plan was spot on every time. However, in true Murphy’s law spirit, what can go wrong will go wrong.

Firstly, the audit plan should be designed in mind with things deviating from it ultimately.

A well-planned audit respects both the auditor’s and the organisation’s time. Strong time-management skills ensure:

• Efficient evidence gathering

• Proper prioritization

• Adherence to the audit plan

• Sufficient time for analysis and reporting

Well-managed audits reduce disruption and help teams stay focused on their core responsibilities.

However, that being said, people will be absent, traffic will happen, records will not be available immediately, lunch will (or won’t) arrive or WIFI could go down. Do you get my point? Anything can happen on an audit, and anything probably will happen, so auditors must be excellent at managing time to ensure the audit stays on track.

6. Integrity

I’ve put integrity last, but it is certainly not least. It is one of the 7 key principle of ISO 19011 - Guidelines for Auditing Management Systems.

I wanted to cement its importance by summarising previous points we’ve decided, such as constant communication, auditing for conformity not nonconformity, diplomacy and empathy.

Integrity is the foundation of an auditor’s credibility. It ensures that every conclusion is based solely on objective evidence—not assumptions, personal preferences, or external pressure. When auditors uphold integrity, they maintain independence, resist influence, and deliver findings that accurately reflect the true state of the system. This protects the organisation, supports regulatory compliance, and strengthens trust in the audit process.

A Balanced Skill Set Creates Better Audits

I really could write a whole piece on each one of these (I might). However, to conclude, regulatory and technical knowledge will always be essential, but soft skills determine how effectively that knowledge is applied. When auditors combine competence with communication, empathy, and integrity, audits become more transparent, collaborative, and impactful.

As the medical device industry continues to evolve—driven by more complex standards, increasing regulatory scrutiny, and automated systems—the importance of these human-centered skills will only continue to grow.

One of the most common inconsistencies seen across the medical-device industry is in sampling methodology.

A strong sampling methodology can really be the difference between a super effective audit that gives you a comprehensive understanding of the entire population and an audit that doesn’t really scrape the surface at all within overall amount of records.

When auditing, you need to be able to digest huge amounts of information within very short and most importantly restricted periods of time.

Unless your FDA - you probably aren’t able to camp at site or run your inspection for weeks on end.

So, this is where sampling becomes criticalI.

Although sampling is understood largely to be for time-saving, it is far more than a time-saving tool; it’s the statistical foundation of audit credibility.

In this article, we’ll walk through a practical lifecycle of sampling:

1. What sampling actually is.

2. Why it matters.

3. How it connects to validations and quality control.

4. The types of sampling available.

5. When to use each type.

6. What regulators — including Notified Bodies, MDSAP, and FDA — expect to see.

Subscribe now

What Is Sampling?

Sampling is the process of selecting a subset of records, products, or activities to draw conclusions about the whole.

If you know me by now, you know I don’t like to invent or recreate things, especially when standards committees have done so for us.
ISO 19011: 2018 - Guidelines for Auditing Management Systems puts forward a comprehensive description of sampling below:

Audit sampling takes place when it is not practical or cost effective to examine all available information during an audit, e.g. records are too numerous or too dispersed geographically to justify the examination of every item in the population.

Audit sampling of a large population is the process of selecting less than 100 % of the items within the total available data set (population) to obtain and evaluate evidence about some characteristic of that population, in order to form a conclusion concerning the population.

The objective of audit sampling is to provide information for the auditor to have confidence that the audit objectives can or will be achieved.

The risk associated with sampling is that the samples may not be representative of the population from which they are selected. Thus, the auditor’s conclusion may be biased and be different from that which would be reached if the whole population was examined. There may be other risks depending on the variability within the population to be sampled and the method chosen.

In practice, your “lot” might be:

• All CAPAs closed in a year.

• All supplier evaluations in a quarter.

• All complaint files within a product family.

Sampling converts an overwhelming population into manageable, defensible evidence.

Subscribe now

Why Sampling Is Important

Without structured sampling, audits drift into two extremes:

• Too shallow → token checks that miss systemic issues.

• Too deep → days lost reviewing dozens of records with diminishing value potentially reducing the linkages to other elements or lost time on other elements within the audit plan.

A documented, risk-based sampling plan:

• Demonstrates efficiency and proportionality.

• Enables repeatability between auditors.

• Provides traceable logic if challenged by a Notified Body or FDA investigator.

• Protects the auditor from “why didn’t you look at X?” moments.

✅ Auditing is a confidence exercise — sampling defines how much confidence you can legitimately claim.

Subscribe now

Types of Sampling

ISO 19011 within A.6 breaks sampling into two distinct methodologies:

Judgement-based sampling

Judgement-based sampling relies on the competence and experience of the audit team (see Clause 7).

For judgement-based sampling, the following can be considered:

a) previous audit experience within the audit scope;

b) complexity of requirements (including statutory and regulatory requirements) to achieve the audit objectives;

c) complexity and interaction of the organization’s processes and management system elements;

d) degree of change in technology, human factor or management system;

e) previously identified significant risks and opportunities for improvement;

f) output from monitoring of management systems.

A drawback to judgement-based sampling is that there can be no statistical estimate of the effect of uncertainty in the findings of the audit and the conclusions reached.

Subscribe now

Statistical-based sampling

If the decision is made to use statistical sampling, the sampling plan should be based on the audit objectives and what is known about the characteristics of overall population from which the samples are to be taken.

Statistical sampling design uses a sample selection process based on probability theory. Attribute-based sampling is used when there are only two possible sample outcomes for each sample (e.g. correct/incorrect or pass/fail). Variable-based sampling is used when the sample outcomes occur in a continuous range.

The sampling plan should take into account whether the outcomes being examined are likely to be attribute-based or variable-based. For example, when evaluating conformity of completed forms to the requirements set out in a procedure, an attribute-based approach could be used. When examining the occurrence of hazard safety incidents or the number of cybersecurity breaches, a variable-based approach would likely be more appropriate.

Elements that can affect the audit sampling plan are:

a) the context, size, nature and complexity of the organization;

b) the number of competent auditors;

c) the frequency of audits;

d) the time of individual audit;

e) any externally required confidence level;

f) the occurrence of undesirable and/or unexpected events.

When a statistical sampling plan is developed, the level of sampling risk that the auditor is willing to accept is an important consideration. This is often referred to as the acceptable confidence level. For example, a sampling risk of 5 % corresponds to an acceptable confidence level of 95 %. A sampling risk of 5 % means the auditor is willing to accept the risk that 5 out of 100 (or 1 in 20) of the samples examined will not reflect the actual values that would be seen if the entire population was examined.

When statistical sampling is used, auditors should appropriately document the work performed. This should include a description of the population that was intended to be sampled, the sampling criteria used for the evaluation (e.g. what is an acceptable sample), the statistical parameters and methods that were utilized, the number of samples evaluated and the results obtained.

To build upon the foundation set by ISO 19011: 2018 - we can’t talk about sampling without mentioning ISO 2859-1 - Sampling procedures for inspection by attributes - Part 1: Sampling schemes indexed by acceptance quality limit (AQL) for lot-by-lot inspection.

🧠 Pro Tip: ISO 2859-1 General Inspection Level II, AQL 2.5 % is a strong baseline for most audit sampling.
For high-risk systems, tighten to AQL 1.0 % or 0.65 %.

Subscribe now

Types of statistical-based sampling

Full Population (100% Inspection) - Every unit in the population or lot is inspected or tested. This approach eliminates sampling uncertainty and is typically used for critical or high-risk characteristics where failure cannot be tolerated (e.g., sterility, labeling of implantable devices). While resource-intensive, it ensures complete verification when the risk of defect is unacceptable.

Block / Cluster Sampling - The population is divided into clusters or groups (e.g., by production batch, machine, or time period), and entire clusters are selected for inspection rather than individual random samples. Useful when products are produced in batches or lots with expected within-cluster uniformity (e.g., same shift or same sterilization cycle). Reduces sampling costs but assumes minimal variation between clusters.

Haphazard Sampling - Samples are taken without formal randomization, but without conscious bias. It’s a non-statistical method used for exploratory checks, early process verification, or when formal random selection isn’t practical. It is not statistically valid for conformance verification but may be acceptable for informal in-process reviews or audits.

Attribute Sampling - Each unit is inspected for conformance/nonconformance against defined criteria (pass/fail, go/no-go). Commonly used in visual inspections, labeling, dimensional checks, and packaging integrity tests. The data are qualitative, and sampling plans are often based on ISO 2859-1 (AQL tables).

Random Sampling - Each unit in the population has an equal and independent chance of being selected. Ensures unbiased representation of the population and supports statistical validity of conclusions. Widely used in acceptance sampling, process validation, and stability studies. Typically implemented using random number generators or randomisation tables.

Sampling with Standards - Sampling conducted according to a recognized statistical standard, such as ISO 2859 (for attributes) or ISO 3951 (for variables). Provides defined sampling plans, acceptance/rejection criteria, and statistical confidence levels. This approach ensures regulatory defensibility and consistency in inspection methods.

Stratified Sampling - The population is divided into subgroups (strata) that share similar characteristics (e.g., production line, operator, shift, material lot), and random samples are drawn from each stratum. Improves representativeness and ensures all key process variables are covered. Commonly used in process validation and supplier quality audits.

Systematic Sampling - Items are selected at regular intervals (e.g., every 10th unit) after a random start point. Provides good coverage with practical efficiency. Effective for in-process inspections and continuous manufacturing, but only valid if there’s no hidden periodicity in the process.

Subscribe now

Sampling Situation Matrix

I’ve tried to pull together a bit of a matrix with some example situations mapped with potential ways of utilising sampling for each scenario:

• For small populations (≤30 records) or immature QMS processes, use judgement-based full population sampling, meaning you review 100% of all records because sampling adds no statistical value.

• When on-site audit time is limited — such as during surveillance audits, use judgement-based block or cluster sampling, where you select all records from a defined week, month, shift, or batch to gain meaningful depth within a shorter audit window.

• For human-factor-dependent or operator-driven processes, use judgement-based haphazard sampling, which involves picking records without formal randomisation, avoiding patterns while providing a broad exploratory check.

• When auditing a process with known previous nonconformities, apply statistical-based sampling with standards, intentionally selecting records linked to known weak points or prior NC trends to assess recurrence and control effectiveness (ISO 2859-1 Level II, AQL .65%).

• For binary or pass/fail conformity checks—such as signatures, approvals, or IFU completeness—use statistical attribute sampling, where sample size is determined using ISO 2859-1 Level II, AQL 2.5% and each record is assessed as conforming or nonconforming.

• For extremely large electronic datasets—such as audit trails, LIMS logs, or software event data—use statistical random sampling, selecting records using random number generators or automated randomisation tools to ensure unbiased coverage.

• For large, stable populations within a mature QMS, use statistical sampling with standards such as ISO 2859-1 Level II, AQL 2.5%, determining the sample size directly from the AQL tables to achieve approximately 95% confidence.

• For multi-site, multi-product, or multi-strata organisations, apply statistical stratified sampling, where the population is divided into strata such as site, product line, or shift, and samples are taken proportionally from each stratum to ensure representation.

• For uniform datasets with no known clustering, use statistical systematic sampling, selecting every nth record (e.g., every 10th) after a random starting point to achieve efficient and consistent coverage across the dataset.

Subscribe now

What Regulators Expect

FDA

Per the FDA’s Sampling Plans Guide:

• Inspectors select tables based on required confidence (e.g., 95 % vs 99 %).

• For populations ≤ 30, full review is recommended.

• When a sample is used, the lot size, table, row, and sample size must be recorded.

• Samples should be chosen at random whenever possible.

• If objectionable conditions are found, inspectors may expand to 100 % review.

Notified Bodies

• Use representative, risk-based sampling for both technical documentation and QMS audits in line with ISO 13485 and ISO 19011.

• Expect manufacturers to mirror this logic in internal audits: define the population, risk, and rationale.

MDSAP

The selection of samples during audits in order to obtain evidence of conformity or nonconformity with MDSAP audit criteria can be either statistically based or judgement based. Judgement based sampling using audit trails from one task or process to inform the selection of samples in other tasks or processes is preferred. Where possible, auditors should select samples of records representing all participating MDSAP jurisdictions applicable to the audit.

The audit of the processes and the sampling should focus on the following (based on risk):

- new or modified designs and new products

- previously identified potential and existing nonconformities

- new or modified processes

- areas not sufficiently covered during the surveillance period.

Bottom Line

Regulators all operate on the same principle:
risk-based representativeness, documented rationale, and expansion if findings appear.

Key Takeaways

• Sampling = statistical confidence, not guesswork.

• Ensure to define and document your audit sampling approach within audit plans, and confirm whether the sampling plan was covered within the audit report.

• Quote ISO 2859 and FDA Sampling Plans to show quantitative logic.

• Always state population, rationale, and expansion criteria.

However, at the TC 210 Working Group #1 Meeting this week in Arlington, VA it was announced that ISO 13485:2016 is reconfirmed unchanged until April 2030.

While some work will be needed around 2028 to align with the new ISO 9000:2026 revisions in the “Quality management systems — Fundamentals and vocabulary” standard which is a Normative Reference, stability in the core requirements of ISO 13485:2016 will be maintained for the next several years.

This is massive news for the global medical device community and I think is a really good element of stability added given the level of dynamism that everyone has experienced recently.

The Annual TEAM PRRC meeting, this year in the eternal city - Rome.

I was thrilled to be able to feature on the panel as a PRRC, and give some insight into my experience.

I’ll break this down into the sessions that were covered over the two days of the conference, mostly focusing on the main things for me.

I have put a few disclaimers below, but all of this information can and probably will change but this is just what we have been informed at the moment.

Italian Competent Authority PRRC Update and Findings from Industry

The Italian Ministry of Health briefed us on their findings in the implementation of Article 15.

Some of these that feel salient to mention are:

• The competent authority identified that PRRCs often lack sufficient authority, resources and autonomy - keep the word authority in mind.

• They also identified that there is also unclear management of outsourcing to micro and small enterprises.

• Regulatory burden and Workload -Complexity and responsibilities under MDR without proportional resource must handle conformity, post-market surveillance, vigilance, and documentation.

• Inconsistent updating of regulatory reports and records (EUDAMED).

Furthermore, do you also know that in Italy, the PRRC can be held liable with financial penalties?

PRRC Breach of Obligations (Italy, Legislative Decree 137/2022, Art. 27, comma 17) • Unless the offence constitutes a crime, a PRRC who fails to comply with the obligations set out in Article 15(3) MDR is subject to an administrative fine from €20,000 to €120,000.

Wild eh?

Sandra Ferretti, Lead Representative for Italy, TEAM-PRRC & Piero Costa, Representative for Italy, TEAM-PRRC took us through an excellent country by country summary of the financial penalties that the manufacturer may face if they do not appoint a PRRC. Sean Smith covers this wonderfully in this article - https://www.linkedin.com/pulse/national-legal-frameworks-sanctions-prrcs-europe-sean-smith-nzkoe/?trackingId=K5HoR65uL5JzkwSWeTlsug%3D%3D

Regulatory Targeted Evaluation

Furthermore, the Italian Competent Authority gave an update on their role within the targeted evaluation that is currently underway and their wish list. I will summarise the main things that stood out to me below:

DISCLAIMER: none of these are confirmed currently

1. Reducing Administrative Burdens

   1. Streamlining reporting by manufacturers - SSCP and PSURs

   2. Extend reporting timelines for “ordinary” vigilance notifications (from 15 to 30 days)

2. Improving predictability and cost-efficiency of certification

   1. Introduce preliminary dialogue between manufacturers and notified bodies

   2. Expand the possibility of remote audits

   3. Ease the assessment of technical documentation for low/medium risk devices through sampling

   4. Differentiate between changes requiring notified body approval and those implementable directly by the manufacturer - particularly salient for SAMD

   5. Conduct unannounced audits only “for cause”, not every 5 years

   6. Reduce consultation times with medicines and human-origin substances (SoHO) authorities

3. More proportional MDR/IVDR requirements

   1. Removing maximum validity period of certificates while maintaining surveillance

   2. Define specific criteria for WET devices

   3. Reduce of eliminate the involvement of notified bodies for low risk devices such as class 1 reusables

   4. Adapt conformity assessment procedures for orphan devices

   5. Review classification rules

   6. Introduce exemptions for devices needed in health emergencies

   7. Allow exemptions from UDI and Eudamed registration based on device characteristics

4. Supporting innovation

   1. Adapt conformity assessment procedures for innovative (breakthrough) technologies

   2. Introduce designation by expert panels

   3. Provide for priority assessment by selected notified bodies

   4. Offer support from expert panels for pre- and post-market clinical evidence

   5. Define specific conditions for certification (e.g., limited validity, PMCF activities)

   6. Monitor progress through the MDCG

   7. Introduce national-level regulatory sandboxes for regulatory experimentation

   8. Simplify requirements for in-house devices manufactured and used by healthcare institutions

It was also laid down that we can expect a significant update on the targeted evaluation by 16th December 2025, which may or may not address that covered above.

EUDAMED

Richard Hoolihan took us through some updates on EUDAMED.

Things are looking positive and we can can expect the Official Journal of the European Commission (OJEC) to be published with the UDI module in November 2025, therefore it will be mandatory in 6 months of this being published.

On the Vigilance module, at the moment is looking like November 2026.

For Market Surveillance, this looks like it may be mandatory Q2 2026.

For Clinical Investigations, this looks like it may be mandatory by Q4 of 2027.

Massive disclaimer again that all of these can change by the time you finish this sentence.

TEAM NB Update

Francoise Schlemmer from TEAM NB provided a great update on their role within the targeted evaluation, here is a summary of what was discussed and what has been tabled.

6 task forces were established covering the following, I’ll go into some detail on the main ones I find most interesting and aligned with other elements mentioned by the Italian Ministry of Health:

• Early dialogue

• Article 61.10 & WET

• Digitalisation

• Coding for MD and IVD

• Designation and recertification

• Breakthrough

Article 61.10 & WET

• The proposal aims to redefine the criteria for applicability of Article 61 (10) and clarify its application.

• Broaden the definition of clinical data (Article 2(48)) to include real-world evidence, post-market data, and relevant international sources.

• Redefine clinical evaluation (Article 2(44)) and clinical evidence (Article 2(51)) to include clinical relevant non-clinical data.

• Clarify that clinical evaluations and typically based on clinical data but may incorporate other relevant data.

• Issue MDCG guidance to reflect a more holistic understanding of “sufficient clinical evidence”

Digitalisation

• Establish legal basis for a digitalised MDR/IVDR

• Data instead of documentation; but maintain flexibility - both documentation and/or data accepted

• Open access to digial formats - data definitions, data models etc.,

• Mode “inclusive” wording to encourage use of digital tools for QMS, Technical Documentation

• Enable future data-based conformity assessments - AI tools for conformity assessment but with a human in loop

• Enable use of remote and hybrid audits where appropriate

• Explicit mentioning of in silico methodologies for simulation

• Development and use of regulatory sandboxes for testing ideas and/or devices

Recertification

• Unlimited certificate validity with periodic checkpoints:

  • Certificates uploaded to EUDAMED and will display only the issuance date, no expiry.

  • At predefined intervals (5, 10 years for example after issuance), certificates will automatically become invalid in EUDAMED unless revalidated by NB.

  • EUDAMED will maintain complete certificate history

  • The maximum interval between issuance and first checkpoint and subsequent checkpoints is 5 years

  • NBs may set shorter intervals, especially for Special Pathway Devices (innovative, orphan or breakthrough)

Breakthrough

• Legal text to include definitions of Breakthrough, Orphan and Paediatric devices in Article 2 of MDR/IVDR, or into guidance.

• Introduction of new text in relevant conformity assessment articles and potentially introduce a new annex for special pathways covering:

  • Eligibility criteria for devices in special pathway.

  • Minimum data requirements acknowledging that sufficient pre-market data under MDR/IVDR collection may not be feasible.

  • Optionally, criteria and datasets may be tailored per device group.

  • Conditional approval of devices with expert panel roles included

AI ACT

Proposal by TEAM NB is a harmonised assessment of high risk AI products/devices to avoid duplication of conformity assessment and increase cost efficiency for these devices.

All very logical if you ask me.

Liability

Alex Denoon and Erik Vollebregt took us through a liability case, in the context of the PRRC.

This is always a very interesting topic, considering the role of the PRRC and brings up the real nuance details of conflicts of interests, responsibilities vs authorities and negligence vs criminal damage.

The PRRC in many circumstances has their hands tied.

The emphasis on having a strong insurance policy as the PRRC was highlighted, as well as a run off period post-termination of the contract to ensure nothing can come back on the PRRC.

This was extremely engaging, as per any talk that you will attend by Alex and Erik.

More to come on all of this.

Ciao!

These are your critical suppliers, and understanding who they are — and how to audit them — can make the difference between a compliant, resilient QMS and one that fails under scrutiny.

One of the most common misconceptions I see in industry is that “critical supplier” is a universal regulatory term. It isn’t. The only regulatory framework that formally defines the concept of a critical supplier is the Medical Device Single Audit Program (MDSAP). Within the foreword of MDSAP, it specifies the following:

For the purposes of MDSAP, “critical suppliers” include, but are not limited to;

• those entities that supply the organisation with finished devices, i.e. a device, or accessory to any device, that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized;

• suppliers of products, including services, that impact design outputs that are essential for the proper functioning of the device; and

• suppliers of products and services that require process validation.

This definition matters because it shifts the emphasis from simple purchasing control to risk-based evaluation. A supplier who provides sterile barrier systems, software used in safety-related functions, or validated sterilisation services is clearly “critical.” A printer supplying instruction-for-use leaflets may not be.

It means that many manufacturers create a scoring criteria for “critical” suppliers. Making it easier to communicate with NBs as they typically ask for this on registering.

Other regulatory frameworks do not use the term “critical supplier” explicitly. ISO 13485:2016 requires organisations to “establish criteria for the selection, evaluation, and re-evaluation of suppliers” (§7.4.1) and to control outsourced processes (§4.1.5), but leaves the terminology open. EU MDR 2017/745 and IVDR 2017/746 expect manufacturers to demonstrate adequate supplier control, particularly for suppliers in the context of Notified Body assessments under Annex IX, but the term itself appears only in guidance, not law. The upcoming FDA QMSR aligns with ISO 13485 language and similarly stops short of defining supplier criticality.

To identify which suppliers fall into this category in your own QMS, ask three key questions:

1. Does this supplier’s output directly affect the safety or performance of our device?
2. Does this supplier perform a process required by regulation or essential to conformity assessment?
3. Would a failure at this supplier result in a significant quality, regulatory, or patient safety impact?

If the answer to any of these is yes, that supplier is functionally critical — regardless of whether the term appears in your QMS.

Once identified, critical suppliers must be treated differently from general vendors. This applies not only to supplier qualification but also to ongoing oversight and auditing. The audit depth, frequency, and follow-up expectations should all scale with the risk they present.

Audits of critical suppliers typically require:

- On-site visits rather than purely remote assessments.
- Process witnessing — observing production, testing, or sterilisation steps directly.
- Validation evidence review, including equipment qualification, software validation, and process capability data.
- Change-control scrutiny, especially where changes could affect device conformity.
- Traceability checks, ensuring supplier documentation integrates cleanly into your device master records.

What should a supplier audit look like?

When auditing a critical supplier, the focus shouldn’t be on carrying out a broad, textbook-style quality management system audit — that’s rarely the most effective use of time. Instead, the most valuable audits are those that are specific, targeted, and product-focused.

In practice, that means concentrating on the elements that directly affect your product line. When I conduct a supplier audit, I’m not reviewing every single process in their QMS — I’m examining the areas that link directly to the manufacture, assembly, or handling of our specific medical device. I’d also be reviewing the terms and conditions set in our quality agreement and any environmental conditions we specify to assess the suppliers adherence to our purchasing information.

Opening Meeting

An often underlooked part of audits is the opening meeting. I’ve spoken about this before many times. But this is where you can sit with the senior management of the supplier, and ensure there are no issues with the audit plan in terms of staff availability, access and arrangements.

It also allows you to communicate your audit approach, this allows me to cover off the following type of items depending on the type of audit:

• An auditee should never get to the end of an audit without knowing about how the findings that have been generated.

• Inform your auditee that you will call out potential nonconformances as you see them and that you will cite the specific requirement you are looking for conformity to. This will give them a chance to demonstrate conformity. We’re auditing for conformity not nonconformity.

• Inform the auditee that audits are based on a sample, and there may be nonconformances detected that were not done so previously, and vice versa.

• Discuss pre-arranged confidentiality agreements relating to the audit.

Conducting the Audit

Since we are looking at critical supplier audits.

The absolute first thing I would typically look at would be following up on corrective actions relating to any Supplier Corrective Action Requests (SCARs) or nonconformities (NCRs) we’ve previously raised on the supplier. I want to see not only that these have been addressed, but that the actions taken are effective and sustained. This tells me whether the supplier has genuinely tackled the root cause or simply applied a quick fix. Furthemore, I’d also want to look at a list of internal NCs relating to my product in particular to understand any impact that I may need to consider.

If there are no NCs internally, I’d consider looking at scrap rates…lots of scrap, no NCs? What is going on here?

From here, depending on the scope of my audit, I would select some product serial numbers that the manufacturer has recently received from the supplier and utilise these as samples to go backwards with. This can be used to assess traceability, validation of software used within the production of the batch, training of operators, assess procedural compliance, check calibration of equipment used, control of suppliers that form part of the product, environmental conditions, cleaning controls as well as general document control and record management.

By keeping the audit focused on our product and its associated risks, the process becomes much more meaningful. Instead of a generic audit report that ticks off clauses, you walk away with real evidence about how well the supplier is controlling the parts of their operation that matter most to you — and ultimately, to the safety and performance of your medical device.

Wash Up Meetings

If a supplier audit is scheduled over a few days, it is extremely beneficial for all parties involved to have wash up meetings at the end of each day.

This is where the auditees and auditors come together to summarise the output from today, so we have found X number of nonconformances, or ideally 0 nonconformances have been detected. This is also where the auditor can go through what records we may be waiting on. Finally, we can use this moment to plan the next day of auditing to make it as smooth as possible and ensure we are on track to complete the audit objectives, or identify if we are not.

Closing Meeting

At the end of the scheduled audit time, the formal closing meeting shall be conducted.

These are essentially a more formal wash up meeting, that is attended by more senior management.

The auditor shall communicate whether the audit agenda and audit objectives were satisfactorily assessed.

The auditor shall communicate the level of conformance and nonconformance detected, or any other audit objectives.

Finally, the auditor shall specify any confidentiality requirements as well as a sampling disclaimer for audits as we discussed earlier and when the supplier shall deal with nonconformances and when they can expect to receive the audit report.

Auditing critical suppliers is more than a compliance requirement — it is a strategic exercise. These audits often reveal systemic weaknesses, hidden risks, and opportunities for improvement that would never emerge from a paper-based review. They also strengthen your regulatory position: demonstrating proactive supplier control is a key expectation under ISO 13485 and MDSAP.

In short, knowing which suppliers are truly critical — and auditing them accordingly — transforms supplier management from an administrative activity into a core part of risk management and product safety.

If you would like a hand conducting any supplier audits, or planning these audits, feel free to reach out!

“Does Technical Documentation need to be audited?”

”The Notified Body/UK Approved Body (NB)/(UKAB) audit it, so do we really need to?”

Look, these questions are fair and the answer as always is it depends, right.

But, yes you should be auditing your technical documentation.

Many NBs/UKABs only give manufacturers three opportunities to effectively close Technical Documentation deficiencies before you are considered “failed review” and start all over again. In the grand scheme of the QMS, your technical documentation is absolutely worth spending some time on as it is a significant part of your passport to the market.

Many manufacturers stay away from it as the NB cover this, so everything should be fine. However, NB/UKAB reviews are a snapshot in time. They’ll check your documentation against the relevant regulatory requirements, but that doesn’t take away your responsibility to keep technical documentation complete, accurate, and integrated into your QMS. If you wait until the NB flags issues, you’re creating problems for yourself.

One thing that is extremely hard to account for with UKABs and NBs is the difference in review competency, personal preference and expectations. Some reviewers are really focused on biocompatibility, other reviews will raise deficiencies on your List of Applied Standards (LOAS), some will dig into your clinical data very deeply to understand whether the subjects match your target population.

Auditing your own technical documentation puts you in control. You can use this to put different specialities on the review, so one time you can get someone who has much more of an engineering focus, and next time perhaps more of a QMS person.

It means you find the gaps first, not the regulator - which is all that any regulatory body is looking for. That you know about gaps before they do.

When to Audit Technical Documentation

You don’t need to do a full-blown audit every month, but you should build technical documentation checks into your internal audit plan. Times to pay special attention include:

• Before NB surveillance or FDA inspections

• After design or intended use changes

• When implementing new standards or guidance (e.g., ISO 14971:2019, MDCG docs)

• In response to complaints, PMS/PMCF findings, or CAPAs

• When new critical suppliers come on board and others have been terminated

• If it is a device that has been on the market for some time (caution: Not necessarily a legacy device)

• If you have several devices, you can base Technical Documentation audits on risk factors such as device classification, sales/usage or deficiencies previously raised.

Like any other audit in the audit schedule, it should consider the status and importance of the processes and area to be audited, as well as the results of previous audits.

Important note: Technical Documentation audits are not always standalone. You can weave it into larger system audits — for example, when you’re auditing design controls, risk management, or PMS, it makes sense to check that the outputs are properly captured and aligned in the technical documentation.

Who Should Audit the Technical Documentation?

This is where many companies are unfortunately their own undoing sometimes.

With the best intent in the world, if you want an audit to be effective, in line with clause 8.2.4 of ISO 13485:

Now that is pretty clear, so if you scheduled a Technical Documentation audit, and it is on your audit schedule, this really applies.

To really get the most out of Technical Documentation audits, the person conducting audits should have some distance from authoring, reviewing and approving the particular Technical Document at hand.

A few practical tips:

• Use auditors who understand MDR/IVDR/FDA requirements but aren’t directly responsible for the product or file.

• Always document auditor independence in your audit records. It shows you’ve thought about impartiality.

• If your team is small and independence is impossible, bring in an external resource.

(And if that’s your situation — talk to me)…

How to Conduct a Technical Documentation Audit?

Here are the areas I always recommend focusing on:

• Intended Purpose: Is it consistent throughout the Technical Documentation?

• List of Applied Standards: Is this up to date with everything recent?

• Traceability: Can you follow the chain from design inputs → outputs → risk controls → verification/validation evidence?

• GSPR compliance: Is every requirement supported by clear and current evidence?

• Clinical/Performance evaluation: Is it up to date, device-specific, and linked with PMS/PMCF?

• Risk management: Are residual risks justified, monitored post-market, and consistent with clinical data? Does the RMF evolve with complaints and PMS or is it standalone?

• Labeling and IFU: Do they match the claims in the file? Is UDI and symbol use compliant?

• EUDAMED Registration: Is the device registered in EUDAMED?

• Manufacturing validations: Are sterilization and packaging validations still current and device-specific?

• Software and cybersecurity (if relevant): Do you meet IEC 62304 and current cybersecurity expectations?

• PMS/PSUR/PMPF - Are plans available and in place, in line with the requirements?

Common Gaps I See

• Hazard analysis’ in risk management that don’t effectively consider the introduction of hazards as a result of risk controls

• Poor clarification and justification on the “lifetime” of a device - simply saying 10 years without substantiating material degradation, or servicing etc.,

• Lack of effective usage data for PSURs

• Outdated references in the GSPR checklist

• CERs that haven’t been properly updated with new PMS data

• IFUs that say something different to the technical file

• Contraindications, warnings, claims or side-effects that appear to come from nowhere as opposed to resulting from clinical evaluation(s)

• Lack of an assessment of the state of the art for therapeutic alternatives

• PMS outputs that don’t feed back into risk or clinical

Best Practices

• Build a checklist that follows MDR Annex II/III or FDA 21 CFR 820.181.

• Use a risk-based approach — spend time where it matters most (high-risk devices, legacy files or those devices that change more (AI/SAMD)).

• Involve the right functions (RA, QA, clinical, design, manufacturing).

• Keep references current with the latest harmonized standards and MDCG guidance.

• Document independence of the auditor every time.

• And if you don’t have anyone independent — get outside help.

Closing thoughts

Auditing technical documentation isn’t about duplicating the notified bodies work. It’s about staying in control, catching problems early, and showing regulators and management that you’re serious about compliance.

As I said earlier, you only get around 3 chances to close technical documentation deficiencies, so if you fail these rounds, and don’t have adequate time for a fresh submission, you may all of a sudden be faced with a device that can’t be placed on the market.

If your team doesn’t have someone independent to audit your technical documentation, reach out to The Other Auditors. We can provide experienced, independent reviews that keep you ahead of your NB/UKAB, reduce audit findings, and give you the confidence that your files are truly inspection-ready.

With that being said, here we are here to discuss what is better; system wide or focused audits.

System Wide audits are evaluations that provide a comprehensive and thorough assessment of the QMS or a complete device technical file.

These audits aim to:

• Verify compliance across multiple clauses of ISO 13485 or MDR Annex IX

• Hit multiple legislation that one QMS complies with

• Assess interdependencies between processes (e.g., design control, CAPA, production, and post-market surveillance)

• Super high level sampling of technical documentation: focus on structure, integrity of the entire technical documentation — including GSPRs, clinical evaluation, risk management (per ISO 14971), and labeling (per ISO 15223)

Ideal Use Cases:

• Resource limitations: when an organisation has a limited amount of internal auditors available for example.

• If the QMS is “immature”, and data is limited in terms of prioritising the areas that should be focused on.

• Pre-certification or re-certification audits.

• Management review inputs or quality maturity assessments.

Focused or For Cause Audits

Focused audits are often called For Cause audits, for particular things.

These are narrow in scope but deep in analysis. These audits target specific processes, product lines, or clauses and are often triggered by:

• CAPAs, non-conformities, or internal audit findings

• Changes in regulations (e.g., IVDR updates) or standards (e.g., ISO 14971:2019 implementation)

• High-risk processes like sterilization validation (ISO 11135/ISO 11137) or complaint handling

• Supplier qualification or performance issues

• Trends identified by QMS trending

Ideal Use Cases:

• When there are a number of internal auditors to select from to prevent conflicts of independence.

• Within mature QMS’ where plentiful data is available to identify areas that are a cause for concern.

• Verifying the effectiveness of new procedures

• As a result of specific deficiencies raise from customers, NB/UKABs (Isn’t it so annoying to constantly have to differentiate between these).

Duality: A hybrid audit schedule

The most effective audit programs integrate both broad and focused audits using a risk-based approach, and are dynamic throughout the audit cycle.

System wide audits mimic more the inspections that an organisation will receive from 3rd party audits, so this can be good preparation for audit teams in handling audit trails, audit creep as well as understanding how auditors conducting system wide audits will behave.

Focused audits are generally not representative of the 3rd party audit experience, however they will most definitely have an impact due to the limited and focused nature of it.

Here are some tips I can give to get the most out of your audit schedule:

• Utilise a blend of both system and focused audits.

• Leverage Past Data: Use QMS trending metrics to understand NC trends, CAPAs, and audit history to guide scope and frequency.

• Cross-functional Involvement: Get other departments apart from QARA trained on how to audit.

• Document the 'Why': Always record the rationale for system and focused audits—this is key during regulatory inspections or NB assessments.

Closing thoughts for now

In the medical device industry, we are not just working to ISO 9001. Not even just 13485. QMS have became really complex, with so much activity being driven through it.

In times where we have limited data, or someone needs to get a strong and independent understanding of the QMS, system wide audits are great for this. On the other hand, our focused audit provides us a real detailed insight into a particular area of the QMS.

What’s better? The answer as usual…it depends.

If you need a hand planning your audit schedule you can have a look at my AI audit scheduling tool here - https://www.theotherconsultants.com/internal-audit-schedule-tool.

Or if you need a hand conducting some audits - feel free to reach out on LinkedIn - https://www.linkedin.com/in/adam-isaacs-rae/

Thanks!

Adam

Firstly, I want to say thank you to all of you for subscribing to my emails, this means a lot to me.

I’ve been quiet on here recently, but I’ve been working on something I’m pleased to be able to show you first.

I’ve recently wrote a lot about the problems I see with internal audit schedules, and the effects this has on the QMS:

• Increased risk of findings from certification bodies, notified bodies and regulatory authorities

• Lack of effective use of (limited) resources that all QARA teams have

• Not focusing on the real problem areas within the QMS

So I have built a free internal audit scheduling tool that you can use to help build an audit schedule based upon what’s going on in your QMS.

How does this work?

You simply answer a few questions about your QMS, these answers will be verified by The Other Consultants and you’ll receive a risk-prioritised audit schedule - aligned with ISO 13485 requirements within 24 hours.

You can find it here:

https://www.theotherconsultants.com/internal-audit-schedule-tool

Any feedback is most welcome, I really hope you find this helpful!

Thanks,

Adam

My good friend Monir at Easy Medical Device and I discussed this topic on his podcast which is now released, but I thought it was also a good idea to document it here as there is quite a lot of information. It is sometimes hard to fit into a 30 minute podcast, or a small newsletter like this. As usual nothing would be simple in the medical device world…

Firstly, I want to say thank you to you all for your continued support. It really does mean a lot to me. With that being said, on to the topic…

Why Malaysia?

Firstly, Malaysia has recently been accepted as a member of the International Medical Device Regulators Forum (IMDRF) in March 2025 at the 27^th Session of the IMDRF in March 2025. So a massive congratulations to the team that worked relentlessly no doubt to make that happen on both sides.

Secondly, I’m half Malaysian on my mothers side, so why not? + everything is always about the USA, EU or UK. So I’m okay with focusing on somewhere else. Especially when you consider the opportunity:

• Projected revenue in Malaysia's Medical Devices market: USD $3.39bn by 2025.

• Cardiology Devices expected to be the largest segment with USD $582.22m in 2025.

• Projected annual growth rate (CAGR 2025–2029): 7.12%, reaching USD $4.46bn by 2029.

Regulatory Framework in Malaysia

Competent Authority

In Malaysia, the Competent Authority (CA) is the Medical Device Authority (MDA), which was established by the Medical Device Authority Act of 2012 (Act 738).

The role of the MDA is to enforce the Medical Device Act 2012 (Act 737).

The authority also produces an excellent amount of guidance on complaint handling, device recalls, advertising, labelling etc., that is available using this link - https://www.mda.gov.my/index.php/doc-list/guidance-document.

The authority have interestingly, done something that is not extremely common in EU or UK legislation within their Medical Device Advertising Regulations 2019.

If any person advertises any registered medical device without the approval from the authority. So, advertising material must be approved by the MDA and if you don’t do that you’ll get a fine of maximum two hundred thousand ringgit or imprisonment for a term not exceeding two years or to both.

Association of South Eastern Nations (ASEAN) Membership

Malaysia are one of ten members of ASEAN, this members are; Brunei, Cambodia, Indonesia, Laos, Malaysia, Myanmar, Philippines, Singapore, Thailand, and Vietnam.

Under this membership, exists the ASEAN Medical Device Directive (AMDD), which is the medical device legislation that these member nations apply much like the EU Medical Devices Directive (EUMDD) with EU member states. National law with specifics on devices such as above, Singapore for example fine up to $20,000.

But certain things are aligned such as Technical Documentation requirements through the Common Submission Technical Document (CSTD).

Registration Process for Medical Devices in Malaysia if you are a non-local manufacturer

Classification of the Device:

• Four risk-based classes: A (low risk) to D (high risk).

• Aligns with Asean Medical Device Directive (AMDD) and GHTF guidelines.

Appoint a Local Authorised Representative (AR):

• Mandatory for foreign manufacturers.

• Must be a Malaysian-registered legal entity.

• Responsibilities:

  • Registration submission

  • Legal contact with MDA

  • Safeguarding technical documentation

  • Post-market compliance (vigilance, reporting)

  • Renewals and variations

• Appoint an importer

It is worth considering that the AR should be independent from importers and Distributors for the following reasons:

• Protect confidentiality and IP

• Maintain regulatory control

• Prevent unauthorized local manufacturing

• Flexibility in distributor arrangements

Engage a Conformity Assessment Body (CAB) - if necessary:

• Required for Classes B, C, and D.

• Class A is exempt. Class A still requires registration via the Medical Device Centralised Application System.

• You can find the list of CABs here - https://docs.google.com/document/d/1s3ILR5rOs5T6tF8zL-oBSm99G2x_HCxa/edit?tab=t.0

• MDA/GD/0031 - documents the conformity assessment requirements per classification - https://www.mda.gov.my/index.php/documents/guidance-documents/1852-31-conformity-assessment-for-medical-device-1

• For the purpose of medical device registration, the following conformity assessment elements shall be assessed by the CAB:

  • Quality management system (QMS);

  • A system for post-market surveillance;

  • Technical documentation; and

  • A declaration of conformity.

I’ve tried to summarise it below for you here for Class B devices as an example:

Since the requirement to have ISO 13485 is defined, MDA/GD/0031 defines criteria for acceptance of existing certification that includes the following:

• QMS certificate issued by MDA registered CAB;

• QMS certificate issued by any notified body listed in New Approach Notified and Designated (NANDO);

• QMS certificate issued by certification bodies from recognised countries (US, Canada, Australia, Japan, EU);

Decision to accept or not to accept QMS certification by certification bodies from other countries may be decided by the CAB with valid justification.

What about Recognised Countries or if I already have a QMS certificate?

Furthermore, the MDA has developed a verification process for medical devices that have been subjected to conformity assessment and approved by regulatory authorities or notified bodies recognised by MDA.

There are eligibility criteria specified:

The medical device;

• has obtained an approval from at least one of recognised competent authority; and

• has been marketed for at least one year in the respective agencies’ jurisdictions; and

• has the same design, intended purpose with the medical device approved by the recognised competent authority; and

• has no safety issues globally associated the use of medical device when used as intended by the manufacturer, in the last one year, defined as:

  • no reported deaths;

  • no reported serious deterioration in the state of health of any person; and

  • no open field safety corrective actions (including recalls) at the point of submission; and

  Note: All incident reporting and corrective and preventive actions have been closed.

  • • has not been rejected or withdrawn by any recognised competent authorities.

These recognised bodies are summarised below:

This enables non-local manufacturers to utilise a “simplified” conformity assessment route that operates upon verification.

Verification Process by CAB

The activities assessed as part of the verification by the CAB is covered in MDA/GD/0068 Mac 2025 appendix 2 which I’ve attached here below, I have attempted to summarise some of it below, but I’d recommend looking at the full appendix 2:

1. Quality Management System (QMS): Validation of the manufacturer's QMS certification, such as ISO 13485, ensuring its authenticity and current validity.​

2. Post-Market Surveillance (PMS): Review of the manufacturer's PMS system, including incident reports and audit histories.​

3. Technical Documentation: Assessment of the Common Submission Dossier Template (CSDT), device labeling, and any relevant change notifications.​ They’ll look at things such as is the intended use in the CSDT the same as what is cleared under the recognised country.

4. Declaration of Conformity (DoC): Evaluation of the DoC to confirm it aligns with Malaysian regulatory requirements.

Guidance Document Conformity Assessment Body Cab Guide For Conducting Conformity Assessment By Way Of Verification (4)

697KB ∙ PDF file

Download

Download

Guideline For Cab On Re Registration Of Registered Medical Device (first Edition) Nur Syaza Binti Mohamad Robani (mda)

215KB ∙ PDF file

Download

Download

Registration Process

If all is well with your conformity assessment, then you will be recommended for registration with the MDA. The MDA require applications and registrations to be conducted using their MeDC@St (MEDCAST) Portal for Establishment Licensing and Medical Device Registration.

If you are non-local, this will be managed through your Authorised Representative. The MDA will review and communicate any issues through the portal.

If approved, you’ll receive your registration and listing number allowing legal marketing in Malaysia. The registration is valid for five years.

Costs of Registration (Subject to change) with MDA are:

Final Thoughts

As we’ve seen above, Malaysia is a booming market. As is South East Asia. The entire region has developed significantly in previous years as has the regulatory framework within Malaysia.

Common areas that can catch organisations out with registering in Malaysia are using the same importer, distributor and authorised representative to conduct different roles. This creates a risk of IP lock.

Further, many organisations underestimate the requirements within Malaysia. There has been A LOT going on in the past few years, and it shows with the growth of devices being placed on the market.

I hope that this has been helpful!

Cheers,
Adam

Introduction

Team-NB has rolled out Version 3 of its Best Practice Guidance for the Submission of Technical Documentation under MDR (EU) 2017/745. This updated edition, which is a huge 79 pages, further develops the Notified Bodies (NBs) expectation and requirements for clear, consistent and compliant Technical Documentation (TD).

The main thing that stood out to me in this guidance was that of claims.

This document goes way more into claims management than many others (if not all) other than the MDR itself. However, the role of claims as we know applies to all economic operators such as importers and distributors - section 2.8 of the document specifies:

• Only marketing literature that mention that the device fulfils the requirements of CE marking or includes the CE mark itself is required to be provided” followed by

• Supporting evidence should be provided in the relevant pre-clinical and clinical sections to substantiate any claims made in the labelling or marketing literature.

So when we apply the understanding that we know article 7 contains a prohibition so it applies to all economic operators, therefore even economic operator material must be supplied if it meets this criteria.

Manufactures can ready their importers and distributors for example under their role of Article 13 and 14 respectively by providing them with a sample register for example, providing the basis for a contractual agreement and having an introduction/training workshop if required to align distributors to the regulatory expectations. Or they can find someone that already knows what needs to be done.

This will also require to be reflected contractually to allow you to have some enforcement power as the “legal manufacturer”.

Do you not think it’s weird that term still doesn’t exist in a legislative format so far for MDR or IVDR? I think it is so weird.

Updates from v2 to v3

I’ve tried to keep things really concise here and give a brief overview of some changes in the document as it is pretty summarised in the guidance.

You can find the full guidance here of course - https://www.team-nb.org/team-nb-position-paper-on-best-practice-guidance-for-the-submission-of-technical-documentation-under-annex-ii-and-iii-of-medical-device-regulation-eu-2017-745-v3/

1. Streamlined Structure & Expanded Content

• Version 3 is a major expansion from the 47-page Version 2 to 79 pages.

2. Pre-Submission Communication (Page 4)

• Manufacturers are now encouraged to engage in structured dialogue with their notified body. Reference to MDCG 2019-6 outlines expectations around early engagement.

3. Enhanced Submission Structure (Page 5)

• Emphasis on organised, searchable documentation with hyperlinks.

• Guidance includes tips on folder structure and translation quality control.

4. Device Description Deep Dive (Page 8)

• Now requires EMDN, MDA/MDN/MDS codes and details on device function principles. Explicitly mandates stating whether the device has novel features, or affirming if it doesn't.

5. Material Disclosure & Specifications (Page 12)

• New expectations around CAS numbers, nanomaterial identification, and coatings.

6. Accessory & Product Compatibility (Page 11)

• Detailed classification rationale for accessories, Inclusion of non-device products and their compatibility evidence.

7. Electronic IFUs Expanded (Page 15)

• Compliance with EU Regulation 2021/2226 is now clearly outlined.

• Requirements around access, updates, and language versions have been clarified.

8. Common Pitfalls (Page 13+)

• New sub-sections call out frequent errors in submissions, from incorrect UDI assignments to misused terminology, to risk management issues and more.

9. Abbreviation Reference Added (Page 7)

• Over 40 key terms now listed to standardise language and reduce ambiguity.

  Thanks for reading The Other Consultants: MedTech Quality & Regulatory Insights! This post is public so feel free to share it.

  Share

The International Medical Device Regulators Forum (IMDRF) had it’s inaugural meeting in Singapore in 2012 about a Medical Device Single Audit Program (MDSAP).

Here we are 13 years later, and there are 5 MDSAP members (in alphabetical order - OF COURSE):

• Therapeutic Goods Administration of Australia

• Brazil’s Agência Nacional de Vigilância Sanitária

• Health Canada

• Japan’s Ministry of Health, Labour and Welfare, and the Japanese Pharmaceuticals and Medical Devices Agency

• U.S. Food and Drug Administration

The beauty of MDSAP, and it’s original intentions were indeed focused around harmonisation.

Any recognised Auditing Organisation is enabled to conduct a single regulatory audit of a medical device manufacturer that satisfies the relevant requirements of the regulatory authorities participating in the program.

Who are the auditing organisations? Well it just so happened here is a link - https://www.fda.gov/medical-devices/medical-device-single-audit-program-mdsap/auditing-organization-availability-conduct-mdsap-audits

These are your BSIs, GMEDs, DEKRAs etc.,

So, BSI could inspect your facility and give assurance to the rest of the MDSAP members that you comply. One audit, one report…so life is easier if you’re a manufacturer, right?

This does genuinely make things easier from a pure auditing perspective. The manufacturer only needs to schedule and host one audit.

As an auditor, it also makes things a bit easier to verify all of the individual country requirements.

How does MDSAP work? (If you know feel free to skip this bit)

A key document for MDSAP is MDSAP AU P0002 Audit Approach. This document outlines the MDSAP criteria for the MDSAP members including criteria of ISO 13485 + specific in country regulatory requirements is identified within this audit approach document.

MDSAP consists of 7 chapters:

1. Management

2. Device Marketing Authorisation and Facility Registration

3. Measurement, Analysis and Improvement

4. Medical Device Adverse Events and Advisory Notices Reporting

5. Design and Development

6. Production and Service Controls

7. Purchasing Controls

Each chapter is made up from a number of tasks, starting at 1 and the last task always ends with an assessment to top management commitment for the chapter.

How are nonconformances managed within MDSAP?

The MDSAP grading system is a bit like arithmetic, you can keep your simple major or minor grading as that’s not welcome here.

Firstly, the nonconformance is broken into Indirect or Direct QMS Impact. These are defined as follows:

• Indirect QMS Impact: ISO 13485:2016 clauses 4.1 through 6.3 (with the exception of 4.2.3 – Medical device file, which is considered to have Direct QMS impact) are seen as “enablers” (making it possible or feasible) for the QMS processes to operate. These clauses are therefore considered to have indirect influence on medical device safety and performance and are generally analogous to “minor” nonconformities as defined in ISO 17021-1:2015 clause 3.13.

• Direct QMS impact: ISO 13485:2016 clauses 6.4 through 8.5 (with the exception of 8.2.4 – Internal audits, which is considered to have indirect QMS impact) are seen as having direct influence on design, and manufacturing controls. These clauses are therefore considered to have direct influence on medical device safety and performance and are more likely to be analogous to “major” nonconformities as defined in ISO 17021-1:2015 clause 3.12 when there is a significant doubt that effective process control is in place, or that products or services will meet specified requirements.

Indirect impact is assigned a 1 and direct impact is assigned a 3.

Furthermore, there are additional sets of rules for grading:

• Repeat nonconformity (yes: 1 or no: 0)

• Combination of the absence of a documented process or procedure and failure to implement (yes: 1 or no: 0)

• Release of nonconforming devices (yes: 1 or no: 0)

The grading is out of 6.

What is the current state with MDSAP?

I’ve worked with a good number of manufacturers with MDSAP, so I know that it is actually used and that it is actually beneficial.

In my experience, however, it is more typically used by large organisations.

I’ve never worked with an Small to Medium Enterprise (SME) that has gained MDSAP, or had any interest beyond finding out the perceived fee’s, as I think these can just sometimes be too offputting to SMEs.

If the fees of MDSAP are something people would like me to provide further info on I’d be happy to bring something out on this. This one of the usual suspects that is answered with “it depends’, but it really does, I promise.

The time for an MDSAP audit depends predominantly number of tasks to be audited.

You can make a rough determination out from the MDSAP Calculator that is provided:

MDSAP AU F0008.2.002 Audit Duration Calculation Form (Audit Model 2017)

As if by magic it is here.

When using this example, we can see that if all tasks are applicable (90 out of 90) for an initial certification audit that the calculator defines it will take approximately 49 hours and 58 minutes worth of auditing to verify the MDSAP requirements. Now if you think of this, in terms of fees associated just with the auditing time of this, things add up.

Again, it is worth considering that in this case this is around 6 days, which would then be able to verify across each country. So it is beneficial as you wouldn’t have to host the other MDSAP members.I’d really recommend any manufacturers considering MDSAP to utilise the audit duration calculator and gap assess this against their current or expected certification durations.

But back to the current state, we’ve got Australia, Brazil, Canada, Japan and the USA that form the MDSAP members.

So, out of the entire world, all the countries, all the medical device regulations, we only have 5 countries.

I am not sure about you, but when I think about the name of the program MDSAP -Medical Device Single Audit Program - (That only applies to 5 countries). I think it slightly misses the mark. I don’t mean to come across as harsh and I know there are lots of reasons as to why. However, enter the EU. The main jurisdiction that comes to mind was the initiator for this newsletter - the European Union and MedTech Europe.

In February of this year (2025), MedTech Europe and COCIR published a joint reflection paper calling on the European Union to join the Medical Device Single Audit Program (MDSAP) as a full member, and to enable the recognition of MDSAP certificates for the purpose of CE marking medical devices and In vitro medical devices.

You can find their paper here - https://www.medtecheurope.org/news-and-events/news/european-medical-technology-industry-calls-for-the-eu-to-join-the-medical-device-single-audit-program-as-a-full-member/

As I’m in the UK, I often see there is a lot of focus on the EU regulatory framework, as well as the UK and MDSAP members. The EU will add a massive amount of access for manufacturers in MDSAP and vice versa, but my thought just keeps going towards the world is much larger than these 7 territories.

The entirety of south east Asia for example, who have their own ASEAN Directive - which is close to the directives we previously had in the EU.

I don’t think it’sfair to say MDSAP has failed, as it is a very complex thing with lots of moving parts. However, I am most definitely not alone in thinking it’s a shame that we haven’t expanded it faster or wider and I am in support of it’s expansion.

Mutual Recognition, International Reliance and/or Recognition

So why don’t we see more harmonisation?

Politics is ultimately the answer, unfortunately.

Respective countries all have their own method of recognition / reliance. I’ve put some examples and links for some of the countries we’ve mentioned throughout to their latest news on recognition:

• Mutual Recognition Agreements - EU - https://single-market-economy.ec.europa.eu/single-market/goods/international-aspects/mutual-recognition-agreements_en

• International Recognition UK - https://www.gov.uk/government/publications/implementation-of-the-future-regulation-of-medical-devices/statement-of-policy-intent-international-recognition-of-medical-devices https://www.gov.uk/government/publications/implementation-of-the-future-regulation-of-medical-devices/statement-of-policy-intent-international-recognition-of-medical-devices

• Mutual Recognition USA - https://www.fda.gov/international-programs/international-arrangements/mutual-recognition-agreements-mra

• Mutual Recognition Agreement - Canada - MDSAP countries and EU.

• Recognised Countries Malaysia - QMS certificate issued by certification bodies from recognised countries (US, Canada, Australia, Japan, EU);

We all will have seen the drama between America and Canada recently - that’s why we’re not seeing them on each others recognised list…awkward.

What does a merger of MDSAP with the EU look like?

Well, if we look at the harmonised EN ISO 13458: 2016 + A11: 2021 Annex ZA and ZB, this provides a comparison between the standard and the regulation already.

So firstly, for each respective point of the section in EN ISO 13485, it can be mapped against the current MDSAP and the reference to the respective section of MDR be applied.

This covers it from a perspective of ISO 13485 against the regulation article 10, but it needs to be ensured that gaps are covered specifically. For example, requirements from EU regulations within MDR or IVDR such as PMCF / PMPF shall be specifically mentioned within MDSAP to ensure the requirements are driven from within the QMS.

My closing thoughts

MedTech Europe have real influence and generally when they speak up about topics like this that do make complete sense, I imagine we will see something progressing.

I do think MDSAP is at the moment, despite that it doesn’t include the EU, is the closest thing to the idea of the all encompassing one medical device regulation that we have. If expanded to the EU, it will become a far more significant model than it already is.

Big fan of this.

I have also joined the British In Vitro Diagnostics Association (BIVDA) and will be closely involved in their working groups, so I hope to be able to bring more information with that.

Starting with the latest.

Government response to the consultation on medical devices regulations: Assimilated EU Law

This government response only covers one part of a larger consultation that ran from 12:01am on 14 November 2024 to 11:59pm on 5 January 2025 covering International reliance, UKCA marking, In vitro diagnostics and Assimilated law.

The governments latest response only covers assimilated law, this was chosen to be addressed individually as the consultation topic is considered time sensitive - mostly due to the the dilemma of whether the four pieces of assimilated law are continued to be retained or not as they are currently planned to be sunsetted on 26th May 2025.

Government Proposal

The majority of the respondents agreed with the government's proposals to remove the revocation date of the four pieces of assimilated law so that they continue to apply in Great Britain, until such time as they are replaced with updated UK law. Doing so will avoid disruption to the regulatory framework and ensure continuity for manufacturers and all who use medical devices.

Guidance on Clinical investigations for medical devices

The MHRA have updated and changed text for optimisation in both 'Serious adverse event (SAE) reporting’ sections.

Register medical devices to place on the market

The web page now includes guidance for the EU IVDR transition extension under Article 110 for the registration of IVD devices with the MHRA. Additionally, MHRA made some minor updates to current guidance for medical device registration, specifically for devices captured under the EU MDR transition extension under Article 120.

Registration of certain medical devices which are reusable Class I devices, upclassified Class I devices, and/or reliant on expired/expiring CE certificates

There is nothing really that new here, if you’ve been paying attention to what has been going on in the regulatory-sphere in the UK. However, I’ll summarise it as MHRA believe there is something worth writing about. Perhaps this is just about reiterating.

The guidance reconfirms the transitional arrangements under Regulation 2023/607, that EU MDD, IVDD and AIMDs will continue to be accepted past 26th May 2024.

CE certificates with extended validity under the extended EU MDR transitional arrangements (Article 120) are valid for placing devices on the GB market for the period in which EU AIMDD and EU MDD CE marked medical devices are accepted on those markets.

MHRA has introduced measures which provide that CE marked medical devices may be placed on the GB market to the following overall timelines:

a) general medical devices compliant with the EU medical devices directive (EU MDD) or EU active implantable medical devices directive (EU AIMDD) with a valid declaration and CE mark can be placed on the GB market up until the sooner of expiry of certificate or 30 June 2028

b) in vitro diagnostic medical devices (IVDs) compliant with the EU IVD directive (IVDD) can be placed on the GB market up until the sooner of expiry of certificate or 30 June 2030, and

c) general medical devices compliant with the EU medical devices regulation (EU MDR) and IVDs compliant with the EU in vitro diagnostic medical devices regulation (EU IVDR) can be placed on the GB market up until 30 June 2030

This is definitely worth looking at if you want some clarity on your market access strategy - https://www.gov.uk/government/publications/registration-of-reusable-or-upclassified-class-i-devices-andor-expiring-ce-certificates/registration-of-certain-medical-devices-which-are-reusable-class-i-devices-upclassified-class-i-devices-andor-reliant-on-expiredexpiring-ce-certif#upclassified-class-i-medical-devices-and-class-i-reusable-surgical-instruments

Digital Mental Health Technology (DMHT) - Regulation and Evaluation for Safe & Effective Products

This is a really great guidance document that focuses on three elements of DMHT:

1. Device characterisation

The guidance details this is around definining intended purpose and functionality, and acts as the preceding steps for qualification as Software As a Medical Device (SaMD), risk assessment, evidence generation and market adoption.

Further guidance is provided within the International Medical Device Regulators Forum (IMDRF) Medical Device Software: Considerations for Device and Risk Characterization definitely worth checking this out.

1. Determining qualification as SaMD

Within Figure 2, two questions are posed to determine whether a DMHT qualifies as SaMD:

• Does the DMHT have a medical purpose?

• Does the DMHT have sufficient functionality?

If the answer to both of these is yes, it is considered to likely be a SaMD.

Medical Purpose

DMHT is considered to have a medical purpose if they are intended as part of the broad process involved in the management of mental ill health including DMHTs that:

• help with assessing risk. diagnosing, predicting, monitoring, treating or preventing mental health conditions and / or symptoms;

• where the conditions and / or symptoms are at levels considered diagnosable or clinically relevant;

• and are either intended for patients, the public and / or healthcare professionals.

The document also provides a list of examples of DMHT clinical tasks that are likely covered by the EU MDD medical device definition

• ‘Diagnosis’ - Helps determine initial/indicative/working/full diagnosis, enables self-assessment, symptom checker, risk assesses, profiles, triages, screens, provides health information measures, calculates, scores

• ‘Monitoring’ - monitors, tracks, presents progress, creates graphs, detects, flags, alarms, indicates severity, provides prioritisation

• ‘Treatment of alleviation’ - treats, blended theapy, self-guided, recommends therapeutic options. clinical decision support, enables parents to support their children

Sufficient Functionality

The document also provides further information on functionality and it’s relationship to the qualification as a device. This is considered within Figure 4. If a function only performs computational tasks such as A-D in Figure 4, it would be considered low functionality, and therefore would unlikely be SaMD.

If a function performs computational tasks other than those described in A-D, such as those described in E-F in Figure 4, it would be considered high functionality and likely SaMD. Those functions that have a medical purpose and high functionality are likely to be SaMD and the manufacturer can regulate each function as separate SaMD or join many functions together and regulate as one SaMD.

Medical purpose + low functionality = not SaMD

Medical purpose + high functionality = SaMD

Device Classification

MHRA define the most applicable UK MDR and EU MDD classfication rules for DMHTs:

• Rule 9

• Rule 10

• Rule 12

They also provide an appendix within the document under Appendix 1 which gives a good checklist for manufacturers to characterise their DMHT.

Firstly, before I get into things - I should do what everyone on LinkedIn, and any social media is doing and wish you a Happy New Year. That’s not because everyone else is doing it, it’s because I mean it…

I do though, and again, I would like to say thank you so much for your support on this newsletter, it really means a lot to me.

Anyway, enough of that and let’s continue diving into internal auditing as this has been a theme of mine for a wee while.

ISO 13485 clause 8.2.4 specifies the following:

The selection of auditors and conduct of audits shall ensure objectivity and impartiality of the audit process. Auditors shall not audit their own work.

With that being said, I introduce my latest creation…

This is unfortunately the reality for many organisations, particularly SMEs as a result of resource and cultural elements.

The quality department end up conducting the audits.

My disclaimer is that the type of audits we’re talking about typically have audit objectives based upon demonstrating conformity to ISO 13485.

This can create a scenario where audits are not necessarily as effective as they should be, therefore, the organisation is unable to identify areas of nonconformance, or utilise the QMS to manage areas that it knows are nonconforming.

This is the result of a number of things:

1. Quality team members are individuals, who have professional relationships to maintain with colleagues, and sometimes there is a naturally occurring conflict that comes consequently of having to raise findings on people you know well. It can be departmentally alienating, and personally challenging.

2. Another element is that Quality often have fairly critical and fundamental roles in key processes that will be audited. Therefore, how can they really be independent and objective when they play a role within that process?

So what’s the answer, Adam, you may be asking?

It becomes difficult when you try and understand what independence is, though…

ISO 19011: 2018 specifies the following auditing principle (e):

Independence: the basis for the impartiality of the audit and objectivity of the audit conclusions

Auditors should be independent of the activity being audited wherever practicable, and should in all cases act in a manner that is free from bias and conflict of interest. For internal audits, auditors should be independent from the function being audited if practicable. Auditors should maintain objectivity throughout the audit process to ensure that the audit findings and conclusions are based only on the audit evidence.

For small organizations, it may not be possible for internal auditors to be fully independent of the activity being audited, but every effort should be made to remove bias and encourage objectivity.

At the end of this paragraph, is the key statement as it shows the standard understands the difficulty that small organisations may experience.

What are the consequences of not using objective and impartial auditors?

The fact that the standard understands and mentions it does not mean the organisation should allow the QM to do all of the audits all the time. If this is the case, and the auditor detects that overall the interal audit sub-system is ineffective, this could lead to bigger issues detected within audits, but also more importantly, it could cause other issues in the QMS such as an ineffective customer complaints handling process, or unaligned vigilance and reporting requirements for example.

Furthermore, it is a waste of the organisations resource. Auditing is a high resource activity. To name some things in the process, we have the auditees involved, the auditor, writing the plan, writing the report, following up and closing actions for example. This isn’t to mention that auditing or being audited (the unfortunate role) is often not someones day job, so the day job they are away from is often then running behind.

Having said that, the best way to answer this question is with another question:

Given that auditing is a mandatory part of the standard, do you really want to do that and still leave nonconformances on the table that may flag during inspections, or not cause you to know the areas of the QMS that could use improving?

How can I try and demonstrate independence?

Responsibility, Accountability, Consulted and Informed (RACI) Matrix is often used, however that can be a very complex thing sometimes.

One of ways I think is good, is to leverage the responsibilities (which should already be defined in the QMS), and link these to your list of internal auditors. So when you are developing your audit schedule, you can select Process / Procedure X with Auditor 1 - and you can justify that the auditor has no direct role in that procedure for example as per the roles and responsibilities.

This is where it comes back to using a planning document to substantiate and defend your audit programme assignment.

Thanks and Bye!

I really do believe that utilising well trained, competent auditors that are truly completely independent of the Quality department is the best and most effective solution. These can be team members that are within separate departments, or they can be external auditors that are conducting internal audits on your behalf.

The benefit of this is that it removes the responsibility of quality to be that voice that is always raising risks. The voice of externals can be a really powerful factor.

Before I go into this article, I wanted to say thank you to all of you to subscribe to my ramblings. It really means a lot, and I’m extremely grateful for it.

I will always put you as my newsletter subscribers first, so I am providing this document here in a downloadable format to save you having to do anything else to access it, and you also have it before anyone else.

This one has taken a while to write, and is focused on Economic Operators. The role of different economic operators within the regulatory framework of the blue guide, MDR (Medical Device Regulation) and IVDR (In Vitro Diagnostic Regulation) can make things pretty complicated.

Things can become complicated when organisations consider the roles of economic operators after supply chains have been set up.

So, with Ian Sealey, founder of Vertexian Limited, we have co-authored a paper containing a number of completely hypothetical scenarios.

These can hopefully act as a training/guidance aid for organisations on how to organise economic operator arrangements.

I’ve attached the document below to save you having to download anything as well - hopefully that helps.

As always, let’s use this to drive conversations and make things simpler. So feel free to reach out.

Leave a comment

Adam

Economic Operators Case Studies

5.52MB ∙ PDF file

Download

Download