Suppliers certified to ISO 13485, however, should exercise due diligence and upgrade to the 2016 revision, particularly if they are categorized as critical suppliers. “As an OEM, part of our certification when we gain CE marking or clearance requires that critical suppliers be identified and maintained as part of the certificate,” explained Conrad. “Critical supplier classification is based on the component they are producing or material or service they are delivering. It will be a little different for everybody.” Contract sterilizers would be considered critical suppliers, for example, and that classification could apply to a plastics processor to whom production is being outsourced, added Conrad.
For companies marketing medical devices in Europe this can be a do-or-die situation. After March 1, 2019, OEMs may not use components manufactured by suppliers that are not in compliance with ISO 13485:2016 until the non-compliance issue has been resolved. It is imperative for any medical device manufacturer doing business in countries that recognize CE marking to monitor the progress of their suppliers in obtaining ISO 13485:2016 certification.
Procrastination is not a viable strategy, even if the compliance deadline seems fairly distant. Auditors and Notified Bodies are stretched very thin right now, according to Conrad. Not only are they dealing with the ISO 13485:2016 revision, they are also wrapped up with MDSAP compliance, which is set to start next January, and the European Union’s Medical Device Regulation. “That’s further out—2020 to 2022—but the amount of work associated with that is immense,” said Conrad. “In our experience, the response time for audits and the certification update process has been 25 to 50% longer than in the past.”
As a final note, Conrad offered three key considerations for companies implementing the ISO 13485 revision.
First, it’s important to “perform a thorough gap assessment comparing the revised standard to your internal controls. That will set you on the right path for the things you need to do.”
Second, compliance is the beginning, not the end, of the process. “If you’re using the standard as a minimum compliance item and that’s all you do within your company, you’re missing the bar in terms of what the standard is trying to do, which is to drive a culture of improvement within your business. Use it as a guideline, but don’t stop there. Continue to improve the systems and processes you have.”
And the third thing is to do it now, stressed Conrad. “If you have gaps, you will have time to fix them before the compliance deadline.”
Conrad will discuss implementing ISO 13485:2016 at a conference session during the co-located Medical Design & Manufacturing (MD&M) and PLASTEC West event in Anaheim, CA, which runs from Feb. 6 to 8. Part of the Regulatory & Quality Update conference track, he will be joined by Jon Speer, founder and Vice President, QA/RA, at Greenlight Guru, and Royth von Hahn, Vice President, Medical and Health Services, at TUV SUD America. The session is scheduled for Feb. 6 from 9:15 to 11 AM. When registering for the conference, be sure to use the promo code PLASTICSTODAY to receive a 20% discount.