In early 2016, the International Organization for Standardization (ISO) released the update to the ISO 13485 standard which replaces the version from 2003. ISO 13485:2003 becomes obsolete on March 1, 2019 but companies should begin the transition process as soon as possible. There are many differences between the versions but the changes are easily implemented with AlvaMed’s help and support. Currently, ISO 13485:2003 and 2016 will coexist which allows time for everyone to transition to the new standard.
ISO 13485:2016 has an increased emphasis on regulatory requirements, risk management, validation/verification & design transfer, outsourced processes & supplier control, and feedback. Moreover, there is now a strong departure between ISO 13485:2016 and ISO 9001:2015.
ISO 13485:2016 still retains the same 8 clause structure and main clause numbering, however due to the addition of several new clauses, sub-clauses have been renumbered. It is important to note the significant emphasis on regulatory requirements and risk management, which should be translated into your updated quality system. In 2003 version, the words regulatory requirements appear 9 times in clauses 4 to 8 while in the 2016 version, they appear 37 times; the word risk appears 5 times in the 2003 version, however it appears 14 times in the 2016 version. Risk management is now applied to all processes including outsourced processes such as process control, purchasing, and software validation; risk-based approaches are now expanded beyond product realization. Besides the increased emphasis on regulatory and risk management, there is additional clarity regarding validation, verification, and design activities, strengthening of supplier control processes and increased focus regarding feedback mechanisms.
Transition Audit Options:
The ISO 13485:2016 transition must occur in conjunction with a regularly scheduled assessment either as a surveillance or recertification assessment:
- Surveillance: transition conducted over the course of two consecutive surveillance assessments.
- Recertification: transition conducted in conjunction with the recertification assessment.
- Off Cycle Recertification: transition conducted during another recertification assessment if the due date for the next recertification occurs after the ISO 13485:2003 obsolete date of March 1, 2019.
A recertification assessment is the preferred way and offers the most seamless transition to ISO 13845:2003. Furthermore, companies can combine the ISO 13485 recertification, the ISO 13485:2016 transition and the MDSAP audit; however, this must be planned out carefully and in advance.
Transition should be completed by September 2018. The reissue of the new ISO 13485:2016 certificate cannot be guaranteed if the transition occurs after September 2018; transitions cannot be conducted after December 31, 2018.
When preparing for your transition, it is important to review Annex A in the Standard which highlights the change between 13485:2003 and 2016.
Planning for the Transition:
- Identify resources and personnel to update your Quality Management System.
- Understand Annex A of ISO 13485:2016 which compares the old version to the new version.
- Learn the timing of current certification and transition requirements.
- Discuss timing and needs with Registrar/Notified Body in advance as well as explore the option of MDSAP audits at the same assessment.
- Generate a quality plan that details the activities needed to be completed.
- Train personnel to ISO 13485:2016.
- Perform gap analysis on your quality system to identify changes that will need to be made for the 13485 transition.
- Assure internal audits are incorporating the required changes.
- Prepare for the re-certification audit by your Notified Body.
If you are worried about your transition to the updated standard or want to have a seamless transition, please contact AlvaMed for support. Our experienced team of medical device experts can prepare a quality plan, perform a gap analysis on your QMS, and update your quality manual to reflect the new standard.