How to reconcile the conflict between ISO 13485 and ISO 9001
This blog explains how to reconcile the conflict between ISO 13485 and ISO 9001, and discusses whether you should maintain dual certification.
The previous version of ISO 13485 was released in 2003. That standard was written following the same format and structure of the overall quality system standard at the time (i.e., ISO 9001:2000). In 2008, there was an update to the ISO 9001 standard, but the changes were minor, only clarified a few points, and the periodic review of ISO 13485 in 2008 determined there was not a need to update 13485 at that time. Unfortunately, the proposed structure of the ISO 9001 standard was radically different, and this forces companies with dual certification to reconcile the conflict between ISO 13485 and ISO 9001.
On December 1-5, 2014, the working group for the revision of ISO 13485 (i.e., TC 210 WG1), met at AAMI’s Standards week to review the comments and prepare a first Draft International Standard (DIS). We should have some updates on the progress of the DIS later in December, but hopefully, the news will not be a delay of publication until 2016. The following is a summary of the status before last that meeting.
Updated ISO 13485 and ISO 9001 Standards Being Released
In 2015, there will be a new international version of ISO 9001 released. This new version will have dramatic changes to the standard–including the addition of a new section on risk management and adoption of the new High-Level Structure (HLS) changing from 9 sections to 11. The ISO 13485 standard is also anticipated to have a new international version released in 2015, but the ISO 13485 standard will maintain the current HLS with nine sections. Timing of the ISO 9001:2015 release and the ISO 13485:2015 release will likely be around the same time (Correction: the ISO 13485:2016 standard was released in February 2016). Both standards are expected to have a three-year transition period for implementation. The combination of the three-year transition and lessened requirements in the new version of ISO 9001 for a structured quality manual should allow most manufacturers to wait until the ISO 13485 release before they begin drafting a quality plan for compliance with the new standards. Some of my clients have already indicated that they may drop their ISO 9001 certification when it expires, instead of changing their quality system to comply with the ISO 9001:2015 requirements. However, my clients will not have the ability to allow their ISO 13485 certification to lapse. Will Health Canada be updating GD210 and continue to require ISO 13485 certification for medical device licensing? What should companies do?
Update on the reconciliation of ISO 13485:2016 and ISO 9001:2015 on May 29, 2020:
- GD210 was never updated, and instead, it was replaced the MDSAP
- ISO 13485:2016 certification, under the MDSAP program, is required for Canadian Medical Device Licensing
- Many device companies have dropped the ISO 9001 certification.
From the experience of preparing for the ISO 13485:2016 and ISO 9001:2015 releases, I learned that obtaining draft versions of the standards before publication is invaluable. I was able to use the drafts to help prepare quality plans for the transition. Second, companies need to train their management teams and auditors on the differences between the current and the new standards to enable a gap analysis to be completed. Any manager that is responsible for a procedure required by the current version of a standard should receive training specific to the changes to understand how they will meet the requirements for documented information. Most companies will need to improve their risk management competency (which was updated again in December 2019). I recommend that companies begin drafting their quality plans and enter discussions with their certification body for quality system changes as early as possible. I also recommend that medical device companies maintain a quality manual structure that follows the ISO 13485:2016 standard rather than the ISO 9001:2015 standard. Following ISO 13485:2016 will help everyone locate information faster.
There is also specific text in the introduction of ISO 9001:2015 that states it is not the intent of the standard to imply the need to align your quality management system to the clause structure of the standard. Companies that maintain ISO 9001 certification should consider including cross-references between the two standards in their quality manual.
There are also European National (EN) versions of each standard (e.g., EN ISO 13485:2012). The EN versions are harmonized with the EU directives, but the content of the body or normative sections of the standards are identical. Historically, the differences were explained in Annex ZA, and that was the last Annex in the EN version of the standard. In 2009 the harmonization annex for ISO 14971 (i.e., the medical device risk management standard) was split into three parts to match up with the three directives for medical devices (i.e., the MDD, AIMD, and IVDD). The new annexes (i.e., ZA, ZB, and ZC) were moved to the front of the EN version of the standard. The changes to ISO 14971 consisted of a correction and the change to Annex ZA. In 2012, there were new harmonization annexes created for ISO 13485 to follow the same format that was used for the EN ISO 14971 annexes. It is expected that these “zed” annexes will be released with a new EN version of the standard shortly after the international standard is published.
I doubted the value of claiming both standards already in the old structures, because the different requirements may lead to conflicting goals. Continual improvement of customer satisfaction drives another approach to changes than maintaining compliance with regulatory requirements. ISO 13485 is the tailor made standard for the medical device industry and should create the same or even a better confidence level to the organization than ISO 9001. The diverging structures in the 2015 releases are an additional argument for omitting 9001.
The clients that have indicated that they plan to drop the ISO 9001 certification are doing so because customers and regulators require ISO 13485–not ISO 9001. The additional work to perform a gap analysis and make changes to your quality system in order to comply with ISO 9001:2015 has a poor ROI for a device manufacturer with CE marking and Canadian licensing. However, I disagree that these two standards create conflicting goals. I have found that it is extremely helpful to have a customer-focused quality system with a goal of continuous improvement. I also find that maintaining compliance and regulatory requirements is an ever-changing set of requirements. I believe that the risk-based approach recommended by ISO 9001:2015 can really help a lot of manufacturers and contract manufacturers that have struggled with how to apply risk throughout their quality system. Therefore, I anticipate that we will see fewer ISO 9001 certificates, but any company that makes the effort to upgrade will realize great benefits from the improvements. The high-level structures will matter very little for those companies, and each company will develop a way to communicate how each requirement in ISO 9001 and ISO 13485 is met. My vision is a cross-reference table comparing the requirements–much like we see in the back of ISO 13485:2003 and in the GD210 guidance from Health Canada.