Annex IV (EC Declaration of Conformity – Full Quality Assurance System) of the IVDD (98/79/EC) is all about delineating specific regulatory requirement for devices falling under List A of Annex II. Since the regulatory gods in the European Union (EU) deem these devices to be high risk, their expectation is that: (a) the Quality Management System (QMS) is certified by a notified body; (b) the Chief Jailable Officer (CJO) completes and signs a Declaration of Conformity (DoC); (c) devices actually conform to the IVDD and their essential requirements; (d) adequate testing and trials are performed; (e) a design dossier is assembled; (f) ongoing surveillance audits are performed by the notified body; (g) a valid Design Examination Certificate (DEC) is issued; and finally (h) a CE mark is affixed to the product packaging. If an organization is familiar with the challenges associated with complying with the regulatory requirements associated with a Class III device under the MDD, understanding and complying with Annex IV of the IVDD should be a proverbial “cakewalk,” then again, maybe not.

In this week’s guidance, Dr. D will pursue my typical loquacious (look-it-up) approach; and hope the readers find the guidance provided useful. Enjoy!

The IVDD – 98/79/EC
Annex IV – EC Declaration of Conformity – Full Quality Assurance System

1. The manufacturer must ensure application of the quality system approved for the design, manufacture and final inspection of the devices concerned, as specified in section 3, and is subject to audit as laid down in section 3.3 and to the surveillance as specified in section 5. In addition, the manufacturer must follow, for devices covered by Annex II, List A, the procedures laid down in sections 4 and 6.

2. The declaration of conformity is the procedure whereby the manufacturer who fulfills the obligations imposed by section 1 ensures and declares that the devices concerned meet the provisions of this Directive which apply to them.

The manufacturer shall affix the CE marking in accordance with Article 16 and shall draw up a declaration of conformity covering the devices concerned.

3. Quality system

3.1. The manufacturer must lodge an application for assessment of his quality system with a notified body.

The application must include:

• the name and address of the manufacturer and any additional manufacturing site covered by the quality system,
• adequate information on the device or device category covered by the procedure,
• a written declaration that no such application has been lodged with any other notified body for the same device-related quality system,
• the documentation on the quality system,
• an undertaking by the manufacturer to fulfill the obligations imposed by the quality system approved,
• an undertaking by the manufacturer to keep the approved quality system adequate and efficacious,
• an undertaking by the manufacturer to institute and keep up to date a systematic procedure to review experience gained from devices in the post-production phase and to implement appropriate means to apply any necessary corrective action and notification as referred to in Annex III, section 5.

3.2. Application of the quality system must ensure that the devices conform to the provisions of this Directive which apply to them at every stage, from design to final inspection. All the elements, requirements and provisions adopted by the manufacturer for his quality system must be documented in a systematic and orderly manner in the form of written policies and procedures, such as quality programs, quality plans, quality manuals and quality records.

It shall include in particular an adequate description of:
(a) the manufacturer’s quality objectives;
(b) the organization of the business and in particular:

• the organizational structures, the responsibilities of the managerial staff and their organizational authority where quality of design and manufacture of the devices is concerned,
• the methods of monitoring the efficient operation of the quality system and in particular its ability to achieve the desired quality of design and of product, including control of devices which fail to conform;

(c) the procedures for monitoring and verifying the design of the devices and in particular:

• a general description of the device, including any variants planned,
• all documentation referred to in Annex III, section 3, indents 3 to 13,
• in the case of devices for self-testing, the information referred to in Annex III, section 6.1,
• the techniques used to control and verify the design and the processes and systematic measures which will be used when the devices are being designed;

(d) the inspection and quality assurance techniques at the manufacturing stage and in particular:

• the processes and procedures which will be used, particularly as regards sterilization,
• the procedures in relation to purchasing,
• the product identification procedures drawn up and kept up to date from drawings, specifications or other relevant documents at every stage of manufacture;

(e) the appropriate tests and trials which will be carried out before, during and after manufacture, the frequency with which they will take place, and the test equipment used; it must be possible to trace back the calibration.

The manufacturer shall carry out the required controls and tests according to the latest state of the art. The controls and tests shall cover the manufacturing process including the characterization of the raw material and the individual devices or each batch of devices manufactured.

In testing the devices covered by Annex II, List A, the manufacturer shall take into account the most recent available information, in particular as regards the biological complexity and variability of the specimens to be tested with the in vitro device concerned.

3.3. The notified body must audit the quality system to determine whether it meets the requirements referred to in section 3.2. It must presume that quality systems which implement the relevant harmonized standards conform to the requirements.

The assessment team must have experience of assessments of the technology concerned. The assessment procedure must include an inspection on the manufacturer’s premises and, in duly substantiated cases, on the premises of the manufacturer’s suppliers and/or subcontractors to inspect the manufacturing processes.

The decision shall be notified to the manufacturer. It must contain the conclusions of the inspection and a reasoned assessment.

3.4. The manufacturer must inform the notified body which approved the quality system of any plan for substantial changes to the quality system or the product-range covered.

The notified body must assess the changes proposed and verify whether after these changes the quality system still meets the requirements referred to in section 3.2. It must notify the manufacturer of its decision. This decision must contain the conclusions of the inspection and a reasoned assessment.

4. Examination of the design of the product

4.1. For devices covered by Annex II, List A, in addition to the obligations imposed by section 3, the manufacturer must lodge with the notified body an application for examination of the design dossier relating to the device which he plans to manufacture and which falls into the category referred to in section 3.1.

4.2. The application must describe the design, manufacture and performances of the device in question. It must include the documents needed to assess whether the device conforms to the requirements of this Directive, as referred to in section 3.2(c).

4.3. The notified body must examine the application and, if the device conforms to the relevant provisions of the Directive, issue the application with an EC design-examination certificate. The notified body may require the application to be completed by further tests or proof to allow assessment of conformity with the requirements of the Directive. The certificate must contain the conclusions of the examination, the conditions of validity, the data needed for the identification of the approved design and, where appropriate, a description of the intended purpose of the device.

4.4. Changes to the approved design must receive further approval from the notified body which issued the EC design-examination certificate wherever the changes could affect conformity with the essential requirements of the Directive or with the conditions prescribed for use of the device. The applicant shall inform the notified body which issued the EC design-examination certificate of any such changes made to the approved design. The additional approval must take the form of a supplement to the EC design-examination certificate.

4.5. The manufacturer shall inform the notified body without delay if it has obtained information about changes to the pathogen and markers of infections to be tested, in particular as a consequence of biological complexity and variability. In this connection, the manufacturer shall inform the notified body whether any such change is likely to affect the performance of the in vitro diagnostic medical device concerned.

5. Surveillance

5.1. The aim of surveillance is to ensure that the manufacturer duly fulfills the obligations imposed by the approved quality system.

5.2. The manufacturer must authorize the notified body to carry out all the necessary inspections and supply it with all relevant information, in particular:

• the documentation on the quality system
• the data stipulated in the part of the quality system relating to design, such as the results of analyses, calculation, tests, etc.,
• the data stipulated in the part of the quality system relating to manufacture, such as inspection reports and test data, calibration data qualification report of the personnel concerned, etc.

5.3. The notified body must periodically carry out appropriate inspections and assessments to make sure that the manufacturer applies the approved quality system and must supply the manufacturer with an assessment report.

5.4. In addition, the notified body may pay unannounced visits to the manufacturer. At the time of such visits, the notified body may, where necessary, carry out or ask for tests in order to check that the quality system is working properly. It must provide the manufacturer with an inspection report and, if a test has been carried out, with a test report.

6. Verification of manufactured products covered by Annex II, List A

6.1. In the case of devices covered by Annex II, List A, the manufacturer shall forward to the notified body without delay after the conclusion of the controls and tests the relevant reports on the tests carried out on the manufactured devices or each batch of devices. Furthermore, the manufacturer shall make the samples of manufactured devices or batches of devices available to the notified body in accordance with pre-agreed conditions and modalities.

6.2. The manufacturer may place the devices on the market, unless the notified body communicates to the manufacturer within the agreed time-frame, but not later than 30 days after reception of the samples, any other decision, including in particular any condition of validity of delivered certificates.

What IVDD medical device manufacturers need to know
As previously stated in the introduction, compliance with Annex IV of the IVDD commences with the implementation of an effective QMS. For those of you not familiar with European QMS requirements, Dr. D strongly suggests obtaining a copy of EN ISO 13485:2003 and actually reading it, cover-to-cover. As part of the overall application process, the QMS will need to be assessed by a notified body to ensure it is capable of supporting the design, manufacturing, and inspection of finished medical devices. If the notified body finds the QMS to be in compliance with EN ISO 13485:2003, they will issue a certificate stating compliance. If not, the notified body will start writing deviations. A minor deviation should not prevent the issuance of the certificate; however, a major deviation will be a show-stopper. Yes, the doctor knows that harmonized standards such as EN ISO 13485:2003 are recommended; however, good luck obtaining notified body approval without basing the QMS on EN ISO 13485:2003.

One of the doctor’s favorite topics is the creation and signing of the DoC. The DoC is a declaration stating the manufacturer’s compliance with all of the applicable provisions of the IVDD. It must be signed by the CJO. Additionally, the manufacturer must ensure that the CE mark, containing their notified body’s registration number, is affixed to the outermost product packaging. Please do not affix the CE mark until your notified body has issued the approval to do so.

The QMS approval process commences with the selection of a notified body (if your organization does not have one) and the completion of the application process for the initial assessment of the quality system. If the device manufacturer is in the start-up mode, a pre-assessment may be in order. For organizations with a mature QMS, a pre-assessment is probably not necessary. If your organization already has an approved QMS, certified by a notified body, no worries. As a minimum, the following pieces of information will need to be included into the application process:

• Name and the address of all manufacturing sites falling under the QMS umbrella.
• Detailed information on the device(s).
• A written declaration that no other applications exist (device manufacturers are not permitted to have multiple applications for the same device with different notified bodies – one app for one device).
• All of the documentation associated with the QMS (focus on SOPs).
• Commitment by management to ensure the QMS is actually used and remains effective.
• A written procedure for post-market surveillance activities.

Additionally, the QMS must be supported by all of the basic requirements such as written procedures, forms, quality manual, accurate records, etc. Annex IV specifically requires adequate descriptions for (a) quality objectives (b) organizational structure; (c) design control; (d) inspection; and (e) product testing and trials. The key is to ensure adequate written procedures exist for a through e.

Furthermore, the notified body will pay the device manufacturer a friendly visit.  Can you say QMS audit? Remember, there are no free passes. Besides, the notified bodies have to make a living too. The concept in regards to this requirement is pretty simple. If a device manufacturer passes the audit, they receive a QMS certificate stating compliance. If they fail, they receive a long laundry list of deviations that will require correction. The good news is that in any event, the notified body is required to provide a report detailing the audit results.

Finally, manufacturers are required to contact their notified bodies when substantial changes to the QMS are planned. Device manufacturers cannot arbitrarily make significant changes to their QMS. The notified bodies are required to evaluate the impact of QMS changes to ensure such changes support ongoing compliance to the Directive. A salient point (broken-record time) that needs to be made is that device manufacturers must receive approval before substantial changes are implemented. One more broken-record time, device manufacturers cannot make changes first and then inform their notified bodies (extremely important concept).

Devices delineated under List A of Annex II require a DEC. In short, device manufacturers must “lodge” an application for the examination process. The notified body will ask the device manufacturer to submit a design dossier that contains sufficient granularity for the notified body to determine if a device meets the requirements of the Directive and specifically, Annex IV. As a minimum, the design dossier must contain supporting evidence that the device has been designed, manufactured, and tested in support of ensuring a device is safe and effective in its intended use. Additionally, design changes, once approval has been received from the notified body and the DEC has been issued, require the approval of the notified body. The device manufacturer is also required to inform the notified body ASAP when the device manufacturer becomes aware of information relating to “changes to the pathogen and markers of infections to be tested.” Simple stated, device changes or performance issues, once they become known, need to be reported to the notified body.

As part of ongoing compliance with Annex IV of the IVDD, notified bodies are required to exude some level of surveillance over device manufacturers that rent their CE Mark (excuse me – affix their CE Mark) onto their product. Can you say surveillance audits? Can you say device manufacturers must pay for these surveillance audits? All kidding aside, device manufacturers are required under Annex IV to permit their notified bodies to perform audits of their facility. Now granted, these audits are scheduled in advance 99% of the time; however, one percent of the time there may be a surprise visit. Remember, in accordance with Annex IV unannounced visits can occur. Please do not mention the one percent to the Occupy Wall Street (OWS) crowd. For some reason, the term “one percent” drives people wild.

Manufacturers are required to provide the results of ongoing testing, and the test reports to the notified body. When requested, samples of devices shall be given to the notified body as well. The key here is to ensure a written agreement ‘contract” is in place that delineates the specific deliverables. Finally, Annex IV delineates a “30-days after receipt of samples” requirement in which a manufacturer may release devices into commerce, unless the notified body communicates the decision not to release.    

What IVDD medical device manufacturers need to do
It all starts with the QMS. Dr. D can climb onto the top of his pulpit and pontificate until the cows come home on the virtues of an effective QMS. In the EU, their idea of a QMS begins and ends with EN ISO 13485:2003 and not the FDA’s Quality System Regulation (QSR); Japan’s Ministry of Health, Labor, and Welfare’s Ministerial Ordinance 169, or other approaches to quality employed outside of the EU. Remember, their sandbox, their rules. If you do not have the resources to establish a compliant QMS, you can always give Dr. D a call.

As stated earlier, the submission of a design dossier, as part of the application process, is a salient requirement. The doctor suggests, contacting your notified body for their template. Dr. D’s experience is that each notified body likes to have the dossier formatted to their individual liking. I can tell you first hand of the joys of working in an organization that has five notified bodies, with each having their own idea in regards to dossier structure. It will make your head spin just like Linda Blair’s did in The Exorcist. Additionally, start compiling the dossier sooner than later. Since the dossier is going to contain a substantial amount of granularity and data, it makes little sense waiting until the last minute.  Furthermore, some friendly advice from the doctor, once the design dossier has been reviewed and approved by the notified body please do not forget to maintain it. Pulling the dossier off the shelf and blowing the dust off the cover once every three to five years (typical approval period of a DEC) is just not going to work. Each and every time a standard claimed in the Essential Requirements Checklist (ERC) changes, impact to the device must be assessed and if appropriate, some level of testing performed to support ongoing conformance with that standard.

The notified body is required to perform surveillance audits. The doctor suggests developing a close-working relationship with your notified body so there are never any surprises. Speaking of surprises, providing a device manufacturer’s products are not racking up vigilance reports, there should never be a surprise visit from the notified body. Besides, who wants to pay their notified bodies for additional unannounced visits?

Finally, the prize, at the end of the long application process, is really the DEC. The DEC is that piece of paper that provides the device manufacturer with the authority to affix the CE Marking of conformity to their products. Remember, no CE Mark equates to no revenue stream coming from the EU. Make sure the CE mark, containing the notified body’s registration number, is affixed to the outermost device packaging. Some more advice from Dr. D, if you have multiple notified bodies, please ensure that the correct CE mark gets affixed to each product.  

Takeaways
Dr. D will leave the readers with three takeaways for this week’s guidance. (1) Having a QMS that is compliant with EN ISO 13485:2003 is immensely important. If a device manufacturer cannot invest the time and money into the QMS, then they are in the wrong business. (2) Assembling a design dossier that contains sufficient granularity to support the application process is also immensely important. The work on the dossier does not stop after the application process. The design dossier is a living document that needs to be maintained. (3) The real prize is the DEC. A device manufacturer cannot affix the CE mark until the DEC is received from their notified body. In closing, the doctor is a big proponent of an effective QMS. The foundation needed to support the design and manufacture of medical devices that are safe and effective in their intended use; begins with the establishment of the QMS.

Until the next installment of DG, when Dr. D provides insight and guidance into complying with Annex V (EC Type-Examination) of the In Vitro Diagnostic Medical Device Directive, a.k.a., IVDD – cheers from Dr. D and best wishes for continued professional success.

References:

1. Council Directive 93/42/EEC. (1993, June). Council Directive 93/42/EEC concerning medical devices. Retrieved December 21, 2010, from http://eur-lex.europa.eu
2. Devine, C. (2009, July). Exploring the effectiveness of defensive-receiving inspection for medical device manufacturers: a mixed method study. Published doctoral dissertation. Northcentral University. Prescott Valley, AZ.
3. Devine, C. (2011). Devine guidance for complying with the European medical device directive – MDD. Charleston, SC: Amazon.
4. Devine, C. (2012). Devine Guidance series on complying with the IVDD. Published in The Medical Device Summit.  
5. Directive 98/79/EC. (1998, October). Directive 98/79/EC of the European Parliament and of the Council of 27 October 1998 on in vitro diagnostic medical devices. Retrieved September 12, 2011, from http://eur-lex.europa.eu
6. EN ISO 14971:2009. (2010, March). Medical devices – application of risk management to medical devices (ISO 14971:2009).
7. ISO 13485:2003. (2004, February). Medical devices – quality management systems – requirements for regulatory purposes (ISO 13485:2003).