COMMISSION RECOMMENDATION

of 24 September 2013

on the audits and assessments performed by notified bodies in the field of medical devices

(Text with EEA relevance)

(2013/473/EU)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 292 thereof,

Whereas:

(1) The proper functioning of notified bodies is crucial for ensuring a high level of health and safety protection, the free movement of medical devices in the internal market, and citizens’ confidence in the regulatory system.

(2) Council Directive 90/385/EEC of 20 June 1990 on the approximation of the laws of the Member States relating to active implantable medical devices (1), Council Directive 93/42/EEC of 14 June 1993 concerning medical devices (2), and Directive 98/79/EC of the European Parliament and of the Council of 27 October 1998 on

in vitro

diagnostic medical devices (3), contain certain provisions with regard to the audits, assessments and unannounced audits performed by notified bodies in the field of medical devices.

(3) The interpretation of those provisions and the behaviour of notified bodies designated in the field of medical devices differ. Therefore this Recommendation should set benchmarks for assessments and unannounced audits by notified bodies and respond to the most frequent shortcomings of the current practices.

(4) The Recommendation aims at ensuring that the notified body carries out a proper verification of the fulfilment of the legal requirements by the manufacturer.

(5) Subject to the respective conformity assessment procedure, notified bodies perform product assessments or quality system assessments. Accordingly, it is important to differentiate between these two types of assessments. To verify the continuous compliance with legal obligations, notified bodies should perform unannounced audits in addition to product assessments and quality system assessments.

(6) In order to satisfy the legal requirements laid down in Directive 90/385/EEC, in Directive 93/42/EEC and in Directive 98/79/EC, notified bodies should verify, where relevant, the fulfilment of the essential safety and health requirements contained in Directive 2006/42/EC of the European Parliament and of the Council of 17 May 2006 on machinery, and amending Directive 95/16/EC (4), of the requirements contained in Commission Regulation (EU) No 722/2012 of 8 August 2012 concerning particular requirements as regards the requirements laid down in Council Directives 90/385/EEC and 93/42/EEC with respect to active implantable medical devices and medical devices manufactured utilising tissues of animal origin (5) and of the common technical specifications for

in vitro

diagnostic medical devices laid down in Commission Decision 2002/364/EC of 7 May 2002 on common technical specifications for

in vitro

diagnostic medical devices (6).

(7) In order to avoid omissions and mistakes in the verification by the notified bodies of the important aspects of clinical evaluation or, in the case of

in vitro

diagnostic medical devices, of performance evaluation, and with regard to the post-market clinical follow-up, or, in the case of

in vitro

diagnostic medical devices, to post-market follow up, it is important to provide specific advice with regard to the control of those requirements.

(8) To facilitate the verification by the notified bodies of the technical documentation, the manufacturer’s device identification system and the declaration of conformity, it is important to provide specific advice with regard to the control of those requirements. Directive 90/385/EEC, Directive 93/42/EEC and Directive 98/79/EC do not provide any exceptions for outsourced production compared to in-house production. Accordingly, it is necessary to include in duly substantiated cases the most important subcontractors and suppliers in the conformity assessment procedures.

(9) Subcontractors or suppliers cannot fulfil in the manufacturers’ place crucial obligations of manufacturers, such as keeping available the full technical documentation, as this would void the concept of the manufacturer as responsible in accordance with Directive 90/385/EEC, Directive 93/42/EEC and Directive 98/79/EC. Therefore, the notified bodies should be advised on what they need to verify in case of outsourcing.

(10) Though regarded as two independent exercises, it is necessary to strengthen the link between the quality system review and the review of the technical documentation on a sampling basis.

(11) In the absence of established practice for unannounced audits it is important to determine the practicalities for such audits, as well as to provide advice on the arrangements needed for facilitating these audits,

HAS ADOPTED THIS RECOMMENDATION:

1. PURPOSE

To facilitate the consistent application of the conformity assessment provisions contained in Directive 90/385/EEC, Directive 93/42/EEC and Directive 98/79/EC, the notified bodies should apply the provisions of this Recommendation when they perform product assessments, quality system assessments and unannounced audits.

By providing general guidelines for such assessments and unannounced audits, this Recommendation should facilitate the work of the notified bodies as well as the Member States’ evaluation thereof. This Recommendation does not create any new rights and obligations. The legal requirements applicable to all types of devices and conformity assessments are set out in the Union legislation on medical devices.

2. GENERAL GUIDELINES FOR AUDITS AND ASSESSMENTS

The notified bodies should apply the following:

(a) Where the manufacturer has applied for a design dossier examination or for a type examination (hereinafter jointly referred to as ‘product assessment’), notified bodies should verify the conformity of the device under all product related aspects referred to in Directive 90/385/EEC, Directive 93/42/EEC and Directive 98/79/EC for detecting any non-compliance of the device and should apply Annex I.

(b) Where the manufacturer has applied for an assessment of its quality system, notified bodies should verify the conformity of the quality system with the quality-system related requirements contained in Directive 90/385/EEC, Directive 93/42/EEC and Directive 98/79/EC for detecting non-compliances of the quality system and should apply Annex II.

(c) To verify the day-to-day compliance with legal obligations, notified bodies should, in addition to the initial, surveillance or renewal audits, visit the manufacturer or, if this is likely to ensure more efficient control, one of its subcontractors in charge of processes which are essential for ensuring compliance with legal requirements (‘critical subcontractor’) or a supplier of crucial components or of the entire devices (both: ‘crucial supplier’) without prior notice (‘unannounced audits’) in accordance with Annex III.

3. FOLLOW-UP

Member States should draw this Recommendation to the attention of the notified bodies in the field of medical devices and should supervise the practice of notified bodies with respect to this Recommendation. They should evaluate the notified bodies’ readiness to apply this Recommendation and in particular to perform unannounced audits when deciding on designations of bodies and on renewal or withdrawal of designations.

4. ADDRESSEES

This Recommendation is addressed to the Member States.

Done at Brussels, 24 September 2013.

For the Commission

Neven MIMICA

Member of the Commission

(1)

OJ L 189, 20.7.1990, p. 17

(2)

OJ L 169, 12.7.1993, p. 1

(3)

OJ L 331, 7.12.1998, p. 1

(4)

OJ L 157, 9.6.2006, p. 24

(5)

OJ L 212, 9.8.2012, p. 3

(6)

OJ L 131, 16.5.2002, p. 17

ANNEX I

Product assessment

Notified bodies should verify if the device is correctly qualified as a medical device and, in particular, whether the manufacturer has assigned a medical purpose to the device. They should furthermore verify the classification of the device and whether the manufacturer has fulfilled the applicable conformity assessment obligations. They should satisfy the obligations of consultation for certain devices that incorporate a substance which, in case used separately, may be considered to be a medicinal product, a human blood derivative or an animal tissue (1).

Notified bodies should verify the compliance of the device with the relevant Essential Requirements set out in Annex 1 to Directive 90/385/EEC, Annex I to Directive 93/42/EEC and Annex I to Directive 98/79/EC and, if applicable, with the essential safety and health requirements (ESHR) set out in Directive 2006/42/EC. In the case of

in vitro

diagnostic medical devices, where applicable, they should also verify the compliance of the device with the common technical specifications laid down in Decision 2002/364/EC or, when duly justified, with other technical solutions of a level at least equivalent. Where doubts arise, in the framework of a design dossier examination, as to the conformity of a device, notified bodies should carry out or ask for relevant tests of the device.

Notified bodies should examine the requirements regarding design and construction and the ESHR prior to examining the general requirements set out in Part I of Annex 1 to Directive 90/385/EEC, in Part A of Annex I to Directive 93/42/EEC and in Part A of Annex I to Directive 98/79/EC. They should apply special care to examine all the following aspects of the essential requirements:

(a) design, manufacture and packaging;

(b) labelling on the device, on the packaging for each unit or on the sales packaging and instructions for use.

The examination of the general requirements should ascertain that among others the following requirements have been met:

(a) all hazards have been identified;

(b) all risks associated with these hazards have been evaluated and have become part of the overall risk-benefit evaluation;

(d) all remaining risks have been subject to protection measures;

(e) safety principles have been applied in a way that is compatible with the state-of-the art.

For medical devices other than

in vitro

diagnostic devices, notified bodies should review all relevant preclinical data, the clinical evaluation and the post-market clinical follow-up undertaken or planned by the manufacturer. They should verify that the clinical evaluation is up-to-date. They should assess the need for and the appropriateness of a post-market clinical follow-up plan (2). If no clinical investigation has been undertaken, they should verify that the device type in question and all the different types of risks linked to the device design, its materials, and its use are appropriately assessed by means of scientific literature or other existing clinical data so that no clinical investigation is needed; they should furthermore examine the special justification (3) needed for implantable devices and devices classified within class III according to Annex IX to Directive 93/42/EEC.

In the case of

in vitro

diagnostic medical devices, notified bodies should review the performance evaluation undertaken by the manufacturer and post-market follow up undertaken or planned by the manufacturer.

Notified bodies should verify all documentation related to the device’s conformity assessment. To that end, they should verify that the technical documentation is correct, consistent, relevant, up-to-date and complete (4) and that it covers all variants and trade names of the device. They should furthermore verify that the manufacturer’s device identification system and its practice of defining which devices belong to the same type ensure that the notified body’s certificates, the manufacturer’s declarations of conformity and the manufacturer’s technical documentations can unequivocally be attributed to the device examined. They should finally verify that the draft declaration of conformity contains all the necessary items.

The notified body should clearly document the conclusions of its assessment and it should be clearly evidenced how the conclusions are taken into account as part of the notified body’s decision making process.

(1) See Section 10 of Annex 1, Section 4.3 of Annex 2 and Section 5 of Annex 3 to Directive 90/385/EEC, Section 7.4 of Annex I, Section 4.3 of Annex II and Section 5 of Annex III to Directive 93/42/EEC and Regulation (EU) No 722/2012.

(2) See Section 1.4 of Annex 7 to Directive 90/385/EEC and Section 1.1c of Annex X to Directive 93/42/EEC.

(3) See Annex 7 to Directive 90/385/EEC and Annex X to Directive 93/42/EEC.

(4) To be regarded as complete, a technical documentation should cover with appropriate depth the items listed in the document of the Global Harmonization Task Force ‘Summary Technical Documentation for Demonstrating Conformity to the Essential Principles of Safety and Performance of Medical Devices (STED)’ as well as additional items required by the European legislation or, for

in vitro

diagnostic medical devices, ‘Summary Technical Documentation (STED) for Demonstrating Conformity to the Essential Principles of Safety and Performance of In Vitro Diagnostic Medical Devices’ as well as additional items required by the European legislation, see for these documents http://www.imdrf.org/ghtf/ghtf-archives-sg1.asp

ANNEX II

Quality system assessment

In the case of full quality assurance system, the verification should ascertain that the application of the quality system assures the conformity of the devices (1) with the legal requirements set out in Directive 90/385/EEC, Directive 93/42/EEC and Directive 98/79/EC. In the case of production or product quality assurance, the verification should ascertain that the application of the quality system ensures the conformity of the devices with the device type (2).

The quality system assessment should include audits on the premises of the manufacturer and, if this is also necessary to ensure efficient control, on those of its critical subcontractors or of its crucial suppliers. Notified bodies should establish a risk-based approach to identify such subcontractors and suppliers and should clearly document this decision process.

Notified bodies should identify which products the manufacturer regards as covered by its application, whether these products fall under Directive 90/385/EEC, Directive 93/42/EEC and Directive 98/79/EC and whether there have been changes to these products or to the quality system since the last audit or since the application. Furthermore, notified bodies should identify the post-market information available to them or to the manufacturer, which might need to be taken into account when planning and executing the audit.

For medical devices of Class IIa or IIb, the notified bodies should review the technical documentation on the basis of representative samples with a frequency and depth following established best practices, taking account of the device’s class, risk and novelty. Samples chosen and reviews conducted should be clearly documented and justified. Over the period of certification of the specific quality system (i.e. for a maximum of five years) the sampling plan should be sufficient to ensure that every device category covered by the certificate has been sampled. Where doubts arise as to the conformity of a device, including its documentation, notified bodies should carry out or ask for relevant tests of the device. Where any non-conformity of a device is detected, they should investigate whether elements of the quality system or incorrect application thereof caused the non-conformity. Where a test has been carried out, notified bodies should provide the manufacturer with a test report and with an audit report which highlights in particular the link between quality system deficiencies and detected non-conformities of devices.

Notified bodies should verify whether the quality objectives and the quality manual or procedures developed by the manufacturer are appropriate to ensure the conformity of the devices falling under the application of the manufacturer.

Notified bodies should verify whether the manufacturer’s business organisation is appropriate for ensuring the conformity of the quality system and of the medical devices. In particular, the following aspects should be examined: the organisational structure, the qualification of managerial staff and their organisational authority, the qualification and the training of other staff, the internal auditing, the infrastructure, and the monitoring of the quality system in operation, including with regard to involved third parties such as suppliers or subcontractors.

Notified bodies should verify the existence of an unequivocal product identification system. This system should ensure that the notified body’s certificates, the manufacturer’s declarations of conformity and the manufacturer’s technical documentations can, in conjunction with that system, unequivocally be attributed to certain devices and not to others.

Notified bodies should verify the manufacturer’s procedures with regard to the product documentation. The procedures relating to the product documentation should ensure that all products intended to be placed on the market or put into service are covered by the necessary certificates issued or to be issued by the notified body. The procedures with regard to the product documentation should also ensure that all products intended to be placed on the market or put into service, regardless of their trade name, are covered by the declarations of conformity of the manufacturer and that these are contained in and are compatible with the technical documentation. Notified bodies should verify the correct execution of these procedures by sampling the product documentation of individual devices.

Notified bodies should verify that the manufacturer’s procedures aiming at the fulfilment of procedural legal requirements, in particular with regard to determining the appropriate class and conformity assessment procedure, are up-to-date, complete, consistent and correct. These procedures should take account of the necessity to provide data in order to allow the notified bodies to respect their consultation obligations for certain devices referred to in Section 1 of Annex I.

10.

Notified bodies should verify that the manufacturer’s procedures aiming at the fulfilment of device related legal requirements, are up-to-date, complete, consistent and correct. They should verify that the procedures on the risk management are in conformity with the legal requirements contained in Part I (general requirements) of Annex 1 to Directive 90/385/EEC, in Part I of Annex I to Directive 93/42/EEC and in Part A of Annex I to Directive 98/79/EC and that the procedures cover among others the aspects listed in Section 4 of Annex I to this Recommendation. They should verify the correct execution of these procedures by sampling the product documentation of individual devices.

11.

In case of manufacturers of medical devices other than

in vitro

diagnostic devices, notified bodies should verify that the manufacturer’s procedures on clinical evaluations and on the post-market clinical follow-up are complete and correct and that these are correctly implemented. To that end, they should examine clinical evaluations and the post-market clinical follow-up for some of the device types covered by the application, applying the principles described in Section 5 of Annex I to this Recommendation. They should verify the correct execution of these procedures by sampling the product documentation of individual devices.

12.

In case of manufacturers of

in vitro

diagnostic medical devices, notified bodies should verify the manufacturer’s working procedures on performance evaluations, on the identification of certified reference materials or reference measurement procedures to allow for metrological traceability. They should verify the correct execution of these procedures by sampling the product documentation of individual devices.

13.

Notified bodies should verify that the procedures regarding the design and product development, including any change control procedures, are appropriate to ensure the compliance of the devices.

14.

Notified bodies should verify that the manufacturer controls the manufacturing environment and processes so as to ensure the conformity of the devices with the legal requirements. Notified bodies should pay special attention to critical processes such as design control, establishment of material specifications, purchasing and control of incoming material or components, assembling, software validation, sterilisation, batch-release, packaging, and product quality control, regardless of whether they are subcontracted or not.

15.

Notified bodies should verify the manufacturer’s system ensuring traceability of materials and components, from the entry into the manufacturer’s, suppliers’ or subcontractors’ premises to the delivery of the final product. In particular where risks might be caused by the exchange of raw materials, notified bodies should check the coherence between the quantity of produced or purchased crucial raw material or components approved for the design and the quantity of finished products.

16.

Notified bodies should verify that experience gained in the post-production phase, in particular user complaints and vigilance data, is systematically collected and evaluated for the devices covered by the application of the manufacturer and that the necessary improvement of the devices or of their production has been initiated. They should in particular verify that the manufacturer has in place distributor, user or patient related business processes which are suitable for providing information indicating the need for reviewing the design of the device, its manufacturing or the quality system.

17.

Notified bodies should verify that the documentation and records with regard to the quality system and its changes, the procedure of management review, and the respective documentation control are up-to-date, consistent, complete, correct and properly structured.

18.

At each annual surveillance audit, the notified bodies should verify that the manufacturer correctly applies the approved quality management system and the post-market surveillance plan.

19.

General advice in case of outsourcing of the production via subcontractors or suppliers

Critical subcontractors or crucial suppliers may be suppliers of suppliers or even suppliers further down the supply chain. Notified bodies should refrain from signing arrangements with manufacturers unless they receive access to all critical subcontractors and crucial suppliers and thus to all sites where the devices or its crucial components are produced, regardless of the length of the contractual chain between the manufacturer and the subcontractor or supplier.

Notified bodies should note that manufacturers:

(a) have to fulfil their obligations themselves regardless of any partial or total outsourcing of the production via subcontractors or suppliers;

(b) do not fulfil their obligation to have at their disposal the full technical documentation and/or of a quality system by referring to the technical documentation of a subcontractor or supplier and/or to their quality system;

(d) need to control the quality of services provided and of components supplied and the quality of production thereof regardless of the length of the contractual chain between the manufacturer and the subcontractor or supplier.

(1) See first sentence of Section 3.2 of Annex 2 to Directive 90/385/EEC, first sentence of Section 3.2 of Annex II to Directive 93/42/EEC and first sentence of Section 3.2 of Annex IV to Directive 98/79/EC.

(2) See first sentence of Section 3.2 of Annex 5 to Directive 90/385/EEC, first sentence of Section 3.2 of Annex V and first sentence of Section 3.2 of Annex VI to Directive 93/42/EEC and first sentence of Section 3.2 of Annex VII to Directive 98/79/EC.

ANNEX III

Unannounced audits

Notified bodies should carry out unannounced audits at least once every third year. Notified bodies should increase the frequency of unannounced audits if the devices bear a high risk, if the devices of the type in question are frequently non-compliant or if specific information provides reasons to suspect non-conformities of the devices or of their manufacturer. The timing of the unannounced audits should be unpredictable. As a general principle an unannounced audit should not take less than one day and should be executed by at least two auditors.

Notified bodies may, instead of or in addition to visiting the manufacturer, visit one of the premises of the manufacturer’s critical subcontractors or crucial suppliers if this is likely to ensure more efficient control. This applies in particular if the main part of the design development, manufacturing, testing or another crucial process is located with the subcontractor or supplier.

Within the context of such unannounced audits, the notified bodies should check a recently produced adequate sample, preferably a device taken from the ongoing manufacturing process, for its conformity with the technical documentation and with legal requirements. The check of the conformity of the device should include the verification of the traceability of all critical components and materials and of the manufacturer’s traceability system. The check should encompass a file review and, if necessary in order to establish the conformity, a test of the device.

To prepare the test, notified bodies should request from the manufacturer all the relevant technical documentation including previous test protocols and results. The test should be undertaken in accordance with the testing procedure defined by the manufacturer in the technical documentation which has to be validated by the notified body. The test may also be performed by the manufacturer, its critical subcontractor or crucial supplier under observation of the notified body.

Notified bodies in charge of product assessment (1) should, in addition to the steps foreseen in Sections 1, 2 and 3, sample devices belonging to at least three different device types and, where the manufacturer produces more than 99 device types, devices belonging to at least every hundredth type at the end of the production chain or in the manufacturer’s warehouse with a view of testing the conformity of the device types. Variants containing a technical difference which might affect safety or performance of the device should be counted as a separate device type. Dimensional size variants should not be regarded as different types unless specific risks are linked to the dimension. These samples should be tested by the notified bodies or by qualified personnel under their observation on their own premises, or on the manufacturer’s premises, or on the premises of the manufacturer’s critical subcontractor or crucial supplier or in external laboratories. Sampling criteria and testing procedures should be defined in advance. In particular if a sampling in the manufacturer’s premises is not possible, notified bodies should take samples from the market, if necessary with support by the competent authorities, or should perform testing on a device installed at a customer location. To prepare the test, notified bodies should request from the manufacturer relevant technical documentation including final batch testing reports, previous test protocols and results.

Notified bodies in charge of verifying the quality system of the manufacturer (2) should, in addition to the steps foreseen in Sections 1, 2 and 3, verify whether the manufacturing activity ongoing at the time of the unannounced audit is in line with the manufacturer’s documentation relevant for the manufacturing activity and that both are in conformity with legal requirements. In addition, these notified bodies should check in more detail at least two critical processes such as design control, establishment of material specifications, purchasing and control of incoming material or components, assembling, sterilisation, batch-release, packaging, or product quality control. Amongst the suitable critical processes, notified bodies should select one which has a high likelihood of non-conformity and one which is particularly safety relevant.

General advice with regard to contractual arrangements between the notified body and the manufacturer for the organisation of unannounced audits

In order to ensure that notified bodies are in a position to perform unannounced audits, some modalities, such as the following ones, should be considered.

Unannounced audits in premises of the manufacturer or its critical subcontractors or crucial suppliers should be foreseen in the contractual arrangements between the notified bodies and the manufacturers. If a visa is needed to visit the country where the manufacturer is located, the contractual arrangements should contain, as an annex, an invitation to visit the manufacturer at any time and an invitation which leaves the date of signature and the date of visit open (to be filled-in by the notified body). The contractual arrangements should also contain, as an annex, similar invitations issued by the critical subcontractors or crucial suppliers.

The contractual arrangements should foresee that the manufacturers continuously inform the notified bodies on the periods when devices falling under the notified bodies’ certificates will not be manufactured. The contractual arrangements should authorise the notified bodies to end the contract as soon as their permanent unannounced access to the premises of the manufacturer or its critical subcontractors or crucial suppliers is no longer assured.

The contractual arrangements should furthermore cover the measures to be taken by notified bodies to ensure the security of their auditors. The contractual arrangements should provide for a financial compensation for the unannounced audits including, where applicable, the device acquisition, its testing and security arrangements.

(1) According to Section 2(a) and Annex I to this Recommendation.

(2) According to Section 2(b) and Annex II to this Recommendation.