ISO 13485 version 2016 is your goal? You want to get certified for it?
But you ask yourself some basic questions. I collected questions that I received from people visiting EasyMedicalDevice.com and provide here the answers.
I hope this will help you.
Table of content
- What is ISO 13485 ?
- Video
- What other type of Quality Management System exists?
- Who needs this certification?
- Is ISO 13485 standard mandatory?
- ISO 9001 vs ISO 13485
- What is the exact name of ISO 13485?
- Where to buy ISO 13485?
- How long to create an ISO 13485 QMS?
- Is MDSAP recognizing ISO 13485:2016?
- Which Notified Body should you choose?
- Who can certify you for ISO 13485 new version?
- Is it easy to get certified?
- ISO 13485 certification cost?
- Other questions?
What is ISO 13485 ?
Ok, let’s say that you have a good idea for a medical device. And then you think that you can sell it. But when you ask how you should do that, people tell you that you need “[Bla Bla Bla Bla] ISO 13485 [Bla Bla Bla]”
[Replace “Bla Bla Bla” by a lot of things].
And one of this lot of thing is ISO 13485 new version. Technically there is a problem because you don’t know what is ISO 13485.
It’s like if you go to IKEA and someone tells you that you need to find the reference “Ikdabup”. (I don’t know if this is really an IKEA reference but I am sure that my invented name is close to one of their product. If it exists, put it on the comments)
Ok, so “What is ISO 13485 ?”
First of all, you need to know that you don’t need specifically “ISO 13485” but you need a Quality Management System. ISO 13485 is one type of Quality Management System. Let’s say, it’s the ISO for medical devices.
Computer example
I’ll make an analogy to your computer so you have a better understanding. To work on your laptop you need an Operating System (OS). You can choose Windows, Mac OS, Linux, MS-DOS, IRIS….
“P.S.: if you are a geek reading these lines, I know that you are maybe saying that you cannot use Mac OS on a PC but only on a Mac computer Bla Bla Bla… This is only an example. Don’t be so formal”
So to come back to our situation with our company using a Quality Management System. Your laptop is your company, your OS is your Quality Management System and your Windows is your ISO 13485. And to be more precise – Your Windows 7 is your ISO 13485 version 2016.
I hope this is more understandable. If not propose me another analogy on the comments.
Video
I propose you to watch this small video to learn more on “What is ISO 13485 ?”
Subscribe to my Youtube Channel to get notified of my next videos
What other type of Quality Management System exists?
The other famous Quality Management System type to follow comes from the USA. FDA requires that your Company complies with 21 CFR PART 820. Most of the other countries accept both of them.
ISO means International Organization for Standardization but it doesn’t mean that all countries in the world accept these standards.
Japan, Canada, China, Brazil have also their own requirements. But as we are moving to MDSAP (Medical Device Single Audit Program) these requirements are really similar. But most of these requirements are not coming from standards but from regulations.
- For example, for Environmental Management System you have ISO 14001.
- For occupational health and safety management systems you have OHSAS 18001.
But these are not ISO Medical Device Standard.
If you know another specific ISO version for a Quality Management System, don’t hesitate to help me update this section on the comments.
Who needs this certification?
ISO 13485 was specifically created for companies working on the Medical Device field. Companies that sell Medical Device products, or provide a service to those medical devices (Installation, maintenance, cleaning…) need to comply with this standard if they choose to have an ISO one.
To be clear, if you are selling Computers that are not specifically created for medical devices, you don’t need this certification. You can try with ISO 9001. See later the difference.
Is ISO 13485 standard mandatory?
A standard is not mandatory.
But I must say that in Europe, for Medical Device Companies, the ISO 13485 standard is recommended. Why?
First, I don’t see other solid alternatives.
Second, because to get a certified quality system, you need to find a Notified Body that will approve it. And on my research, I didn’t find a notified body capable to certify you for anything else than ISO 13485 for medical device companies. They can still review the Quality System that you built but I am sure they will find many reasons to say that it is not compliant.
So in reality, if you want to sell a Medical Device in Europe, ISO 13485 is your only choice. If I summarise, it’s your best choice.
But I am still open to receive comments if I am wrong.
ISO 9001 vs ISO 13485
Your ISO 9001 is a general standard for Quality Management Systems.
It’s called:
ISO 9001:2015 Quality Management Systems – Requirements
But when you are selling Medical Devices, there are some requirements that are specific to these products as sterilization, reporting of issues to the health authority, creation of a Medical Device File…
These requirements are not mandatory for some other industries.
You then understand that no notified body will certify you for ISO 9001 if you are selling medical devices.
What is the exact name of ISO 13485?
The name of the ISO 13485 standard version 2016 is
“Medical devices — Quality management systems — Requirements for regulatory purposes”
This standard specifies requirements for a Quality Management System for a Medical Device company. It helps you to constantly meet customer needs and also regulatory requirements.
ISO 13485 Gap Assessment Tool
You need a ready to use tool to make a Gap Assessment for the implementation of an ISO 13485 standard. Click on the link below to see the offer
Where to buy ISO 13485?
You can buy this standard on some websites
And you can have it on many versions
- EPUB
- Redline
- Paper
The cost is between 150 and 200$ This depends on the country, the currency…
This is interesting as the USA, for example, do provide it’s 21 CFR Part 820 for free.
And as MDSAP is now aligning all the Quality Systems, you logically can follow the USA standard to comply with the ISO standard. You see my logic or???
How long to create an ISO 13485 QMS?
After interviewing Jason Lim from Stendard.io on my podcast, I decided to test his solution and see how long it would take me to create a QMS that fits any organization.
I made a video out of it so you can see in real time that within less than 30 minutes, it’s possible to get all the necessary documents ready. You can also test it with a free version.
But remember, this is only the step 1 of the QMS certification. There are 5 steps described by Jason Lim on my podcast interview.
You don’t believe that we can create a QMS within 30 Minutes?
So check now the video and you can also test the solution by yourself.
Is MDSAP recognizing ISO 13485:2016?
What is MDSAP?
MDSAP is a “Medical Device Single Audit Program”. This is a program that allows you to get audited only one time and the benefit is to sell your products in many countries:
- USA
- CANADA
- JAPAN
- BRAZIL
- AUSTRALIA
Recognized?
And yes this is recognizing ISO 13485 version 2016. Do you know that even FDA is thinking to transition from 21 CFR part 820 to this ISO standard?
This program is key for you if you plan to reduce your audits from many countries.
When you are selling to different countries, those countries have the right to come and audit you. But with MDSAP it’s finished. You just show them that you are certified MDSAP and they will not come anymore. You save time, money, burden…
Audit management
If you don’t know anything about audits now, you should understand that this is not easy.
- Preparation
- Training of your people
- Welcoming the auditors
- Answering the non-conformities…
This process can be tough. If you have to make that multiple times per year then you’ll really suffer and your team will be overwhelmed.
Summary
So the MDSAP (Medical Device Single Audit Program) is important and even mandatory for CANADA as of January 1st, 2019.
If you want to know more on MDSAP I propose you to go to my article.
Video: What is MDSAP
Subscribe to my Youtube Channel to get notified of my next videos
Follow me for more information
Which Notified Body should you choose?
This question is really important as many changes are now happening to the regulation. The New ISO 13485 version 2016 standard is out and is also becoming different from ISO 9001:2015.
The other changes that are happening are the new Medical Device Regulation (EU MDR 2017/745) and the new In-Vitro Diagnostic Regulation (EU IVDR 2017/746) are coming in force.
And lastly, MDSAP is now live. As mentioned before it is the new Medical Device Single Audit Program.
So knowing all this, how should you choose your Notified Body?
First, because of the new MDR and IVDR, some Notified Bodies will not be able to comply with the new requirements. So they will not exist anymore. This makes a short list to choose. [Check MDR Transition Timeline for more information]
But, with the MDSAP program, the list gets shorter.
My advice is to choose a Notified Body that is approved for ISO 13485:2016, MDR, IVDR and MDSAP. If they are complying to all this it’s most likely that they are a solid Notified Body.
As I am a nice guy, here is the list of Notified Body that are qualified for MDSAP audits.
But keep it for you as the list is really short. Year to date 14 companies Worldwide are able to certify you for MDSAP.
Who can certify you for ISO 13485 new version?
ISO 13485:2016 is a standard and not a regulation. And only accredited Certification Bodies or Notified Bodies for this standard are eligible to certify you.
I teach you how to verify that the Certification Body you choose is really accredited for what he claims.
Look at this article “How to verify your Certification Body accreditation”.
Is it easy to get certified?
Ok. Let’s summaries.
- You have created your Quality System following the ISO 13485 version 2016 standard.
- You even tested it through a Mock Audit and all works.
- You carefully looked at which Notified Body you will contact.
And now what?
Now it’s time for the serious work. I know this is not easy to understand but, on this process, you’ll become upset.
Why?
Because there will be less Notified Bodies but more Medical Device companies (New actors enter the game).
If you want a case study about that, I wrote an article that is really interesting and my true story. It’s called “Poor notified body … Poor us”
As on every market, when there is less offer but a lot of demand you get frustrated.
I suppose that if you call a Notified Body from the short list, you will get the same answer. “We have no availability until XX months”. I put 2 “X” so it means between 1 month (lol) until 99 months. Ok, until 20 months.
So if your project is urgent, call them all and try to see the one that can help you. But don’t be surprised if it takes time.
ISO 13485 certification cost?
The best answer I can provide is “It depends”.
You’ll ask me then “It depends on what?”. It’s a good question. Thanks for asking it to me.
It depends on:
- The size of your company
- The class of your products
- If there is a need for an off-site review
What will follow is only regarding the Certification Audit. It doesn’t include all the costs related to the preparation for the audit and all the things you need to have to pass the audit (Softwares, Trainings of your team, Consultants…)
Usually, the cost for a CE mark + ISO 13485:2016 audit is between 7000€ for a small company to 30’000€ for a big one. But this is only on average.
The Notified Body that you choose will calculate that when you’ll answer a small survey.
- How many people on your company?
- How many devices?
- How many devices of different classes?
- …
So don’t be surprised if this is slightly higher or smaller. Try to benchmark but don’t take too much time.
As I told before the power is currently with the Notified Bodies.
Another thing this amount is per year. As you’ll be audited every year. So take that into account when you’ll decide on the budget for the following year.
In the case the Notified Body is performing an off-site review of some documents, this is also additional cost. You’ll have to clarify that.
So don’t hesitate to check with different Notified Bodies.
Other questions?
Share your questions with me by writing them on the comment section. I will do my best to answer them.
Please ! Don’t make them too difficult just to challenge me.
Medical Device expert. Monir founded Easy Medical Device to help Medical Device companies to place compliant products on the market. He proposes his consulting services so don’t hesitate to contact him at info@easymedicaldevice.com or +41799036836
My objective is to share my knowledge and experience with the community of people working in the Medical Device field.
