medical devices

Risk Control Selection – Deviation #5 in ISO 14971

2 Comments / ISO 14971:2019 (Risk Management) / By / , , , ,

ISO 14971:2012 deviation #5 is specific to selecting risk control options and protective measures for CE Marking medical devices.

%name Risk Control Selection Deviation #5 in ISO 14971If your company is CE Marking medical devices, you are required to satisfy the Essential Requirements for Safety and Performance as defined in the three European Directives: the MDD, the AIMD, and the IVDD. Throughout these Essential Requirements, there is a requirement to reduce risks “as far as possible” (AFAP) by implementing risk controls. At one time, the expectation was for companies to implement state of the art concerning risk controls, and “state of the art” was interpreted as the latest version of the harmonized ISO Standards. However, lawyers dominating the European Commission appear to disagree with the status quo.

Therefore, in 2012, the European National (EN) version of the Medical Device Risk Management Standard was revised. There is no change to the content of Clauses 1 through 9. Instead, the European Commission identified seven content deviations between the ISO 14971 Standard and the EU Directives. These deviations are identified and explained in Annexes ZA, ZB, and ZC. This blog is the fifth installment of Medical Device Academy’s seven-part blog series on this topic. The goal of the series is to identify solutions for meeting the Essential Requirements by suggesting changes to the current best practices of implementing a risk management process for medical device design.

Discretion as to the Risk Control Options/Measures

Essential Requirements 1 and 2 require that risk control options are implemented for all risks before determining the acceptability of residual risks. The 2nd Essential requirement also requires manufacturers to implement all risk control options—unless the risk controls do not further reduce risk.iso14971 deviation 5 Risk Control Selection Deviation #5 in ISO 14971

Clause 6.2 of the 14971 Standard suggests that you only need to use “one or more” of the risk control options, and Clause 6.4 indicates that further risk control measures are not required if the risk is acceptable. There is an apparent contradiction between the intent of the Standard and the Directives.

If risk acceptability has no impact on whether you will implement risk controls, there is no need for performing a preliminary risk evaluation. Therefore, I have three recommendations for changes to your current risk management process:

  1. Ignore Clause 5 of the 2007/2009 version of ISO 14971
  2. Eliminate the second step of risk assessment from your flow chart for risk management (see Figure 1 from the 14971 Standard)
  3. Define risk management policies upon clinical benefits, rather than absolute risks

Instead of performing a preliminary risk evaluation (Clause 6.5), risk/benefit analysis should be moved to Clause 7, where the evaluation of overall residual risk acceptability is required. By making this change, risk controls will be implemented, regardless of risk acceptability, and the acceptability of risks will be dependent upon the risk/benefit analysis alone.

Impact of this Deviation

Implementing changes to your risk management process to address this deviation has great potential to impact the design of devices—not just the risk management documentation. Design teams will no longer be able to stop the design process with an initial design that has an “acceptable risk.” Instead, design teams will be forced to implement additional risk controls and protective measures for device designs that already have a low risk of harm for specific failure modes.

The requirement to implement additional risk controls will increase the cost of devices that may have been relatively safe without the risk controls. For example, if a device is not intended to be implanted, it is a potential foreseeable misuse. Your company may have used the instructions for use to communicate the residual risk associated with misuse of the device. However, now your company will have to implement design controls (e.g., –a selection of materials suitable for implantation) to eliminate the risks associated with misuse and protective measures (e.g., – radio-opaque thread) to help retrieve product that was implanted in an “off-label” usage.

If you are interested in risk management training, Medical Device Academy offers a risk management training webinar.

Risk Control Selection – Deviation #5 in ISO 14971 Read More »

Which Countries Require CE Marking of Medical Devices?

1 Comment / CE Marking / By / , , ,

 

28 Member States 2013 Which Countries Require CE Marking of Medical Devices?

This blog serves as a reference guide with a discussion of information resources and a list of which countries require CE marking of medical devices.

You can locate the current list of countries requiring CE Marking of medical devices by visiting the list of Competent Authorities (CAs) on the Europa webpage (http://bit.ly/ContactPoints). That page has 33 national CAs identified. CAs are the US FDA equivalent in the European Union (EU). In addition to member states in the EU, the CAs list also includes signatories (i.e., – countries that have signed the 1985 Schengen Agreement to allow people to pass between countries with no border controls) and EU candidate member states. For the most current status of candidate member states and potential candidate member states, you can visit the following Europa webpage: (https://european-union.europa.eu/principles-countries-history_en). As of September 21, 2013, the status of the 33 CAs is categorized in the list at the end of this blog posting.

Australia-EU Mutual Recognition Agreement

In addition to the 33 countries listed below, the Australia Therapeutic Goods Administration (TGA) has a mutual recognition agreement with the EU—the EC MRA (http://bit.ly/TGA-EU-MRA). This agreement, however, has limitations. The deal includes a rule of origin clause that excludes products manufactured outside the EU and Australia. Other restrictions include:

  • Radioactive medical devices
  • High-Risk, Class III devices
  • Excluded barrier contraceptives, including condoms
  • Devices, including medicinal and those of biological origin

Kingdom of Saudi Arabia

In the Kingdom of Saudi Arabia (KSA), you can begin the medical device registration process if your company has regulatory approval from one of the founding members of the Global Harmonization Task Force (GHTF). The five founding members are 1) the USA, requiring a 510(k) or PMA; 2) Canada, requiring a Medical Device License; 3) Europe, requiring CE Marking; 4) Australia, requiring Australian Register of Therapeutic Goods (ARTG); and 5) Japan, requiring Japanese Pharmaceutical Affairs Law (JPAL) certification or approval. The next step is to select an Authorized Representative in the KSA and submit a Medical Device Marketing Authorization (MDMA) application. For low and medium-risk device classifications (i.e., – Class I, IIa, and IIb), you may begin marketing your device in the KSA before obtaining formal regulatory approval (this regulation is subject to potential change) for higher-risk devices (i.e., – Class III), you must first obtain MDMA certification before distribution of the device in the KSA. The medical device regulations for the KSA are interim regulations. You can verify the current regulations by visiting the Saudi Food and Drug Authority (SFDA) website (http://bit.ly/SFDAMedicalDevices).

Other Countries

Many other countries have alternate, abbreviated processes similar to Australia and the KSA if your medical device is already approved by one of the GHTF countries. Often, this is stated as “country of origin approval.” Countries recognizing country of origin approval that offer an abbreviated approval process include Argentina, Singapore, China, etc. These countries do not merely “rubber stamp” the approval, but the approval process is less rigorous.

A CE certificate is insufficient if your product is manufactured in the US but you do not have a PMA or 510(k) issued by the US FDA. Your company must establish a country of origin status in Europe to take advantage of the abbreviated approval processes. This is sometimes done by establishing a European facility, but the CE certificate must be issued to the European facility. Other workarounds have been developed, but that is beyond the scope of this blog.

2 EU Candidate Member States with Competent Authorities

These two countries below are candidate member states for joining the EU. These countries are not signatories, but both countries have established a competent authority for reporting recalls and vigilance related to medical devices distributed within their borders. Turkey has also established four Notified Bodies.

  1. Iceland
  2. Turkey

3 EEA Signatories with Competent Authorities

For a long time, Switzerland was neither a member of the EU nor a signatory. However, in 2008, Switzerland became the 25th country to sign the Schengen Agreement, allowing people to pass between countries without border controls. All three countries below have established a competent authority. Switzerland has established five Notified Bodies, and Norway has two.

  1. Liechtenstein
  2. Norway
  3. Switzerland

28 EU Member States with Competent Authorities

The list below identifies the 28 members of the EU. The date in parenthesis is the year that each member joined the EU. These countries have competent authorities that regulate medical devices, and many of these countries have established Notified Bodies. Germany, Italy, and the UK have the most significant Notified Bodies.

  1. Austria (1995)
  2. Belgium (1952)
  3. Bulgaria (2007)
  4. Croatia (2013)
  5. Cyprus (2004)
  6. Czech Republic (2004)
  7. Denmark (1973)
  8. Estonia (2004)
  9. Finland (1995)
  10. France (1952)
  11. Germany (1952)
  12. Greece (1981)
  13. Hungary (2004)
  14. Ireland (1973)
  15. Italy (1952)
  16. Latvia (2004)
  17. Lithuania (2004)
  18. Luxembourg (1952)
  19. Malta (2004)
  20. Netherlands (1952)
  21. Poland (2004)
  22. Portugal (1986)
  23. Romania (2007)
  24. Slovakia (2004)
  25. Slovenia (2004)
  26. Spain (1986)
  27. Sweden (1995)
  28. United Kingdom (1973)

Which Countries Require CE Marking of Medical Devices? Read More »

Scroll to Top