ISO 13485 from zero, episode one: your role, your scope and your regulatory requirements.
ISO Cloud Consulting editorial teamStart an ISO 13485 project by writing down four short documents: a role statement, a scope with justified exclusions, a regulatory requirements register and a device classification record. Your role in the supply chain decides which requirements apply and how heavily, so settle it first, then run a proper gap assessment against the standard.
Where should an ISO 13485 project start?
This is the first episode of ISO 13485 from zero, a ten-part series on building a medical device quality management system from nothing. We start where every ISO 13485 project should start: with your role, your scope and your regulatory requirements.
What role does your company play?
ISO 13485 is used by organizations at every point in the medical device supply chain. Legal manufacturers design devices and place them on the market under their own name. Contract manufacturers make devices or components for someone else. Then there are distributors and importers, sterilization and service providers, and suppliers of critical components.
The standard is the same for all of them, but which requirements apply, and how heavily, depends on your role. Write it down in one sentence before anything else.
How do you write the scope statement?
State which devices or services the system covers, at which sites, and in which roles. Then list any requirements of the standard that you exclude or that do not apply, with a reason for each.
ISO 13485 is stricter than ISO 9001 about this. You can only exclude design and development where regulations allow it, and you can only treat other requirements as not applicable when the activity genuinely does not happen in your company. A distributor who relabels product, for example, has brought some production requirements back into scope.
What is a regulatory requirements register?
This is the step that most separates ISO 13485 from ISO 9001. The standard expects your quality system to meet the regulatory requirements of every market where your devices are sold. So list them. For each market, record which regulations apply, what they require of a company in your role, and which of your processes meets each requirement.
Think of registration, labeling, reporting of adverse events, recalls, record retention periods and unique device identification where required. You do not need to be a regulatory expert to start the register, but you do need someone with regulatory knowledge to check it.
Why does device classification matter?
In most markets, devices are classified by risk, and the class decides how much scrutiny your system and your device files will receive. Record the classification of each device or family and the reasoning. It affects everything from your design documentation to how often you will be audited.
What comes next after these four documents?
With your role, scope, regulatory register and classifications written down, you can run a gap assessment against the standard properly, because you know what the standard requires of you specifically.
By the end of this episode's work you should have four short documents: a role statement, a scope with justified exclusions, a regulatory requirements register and a classification record. Next episode: the quality manual and document control.
How can you check where you stand today?
The Free ISO 13485 Gap Assessment Lite checks twenty-five high-risk requirements and scores them automatically. For a full assessment use the ISO 13485 Gap Assessment Workbook, browse the ISO 13485 templates collection, or see our ISO 13485 consulting services.
