How to find the applicable standards and stay compliant

Using applicable and recognized industry standards (such as ISO 14971 or IEC 62304) is a known best-practice in medical device development. Even though standards are voluntary for medical device manufacturers, they represent the current best practices and thus state-of-the-art and serve as a great mechanism to structure your development and documentation efforts. By complying to recognized standards, you take the shortest possible way to a swift regulatory approval and a rapid market entry.

But in the vast sea of available and continuously updated standards (ISO alone has issued more than 25000 standards), where do I find the correct ones, and how do I know which standards apply to my device?

Apart from a seemingly overwhelming task to sift through all possible standards, overseeing an important standard or applying an outdated version can have significant repercussions for your device. Failing to get your standards right might delay market-access by months, or even years, if a redesign is required.

Here is how you do it.

Identify the intended geographical markets for your device

First, decide on the geographical markets you intend to target with your device. Answering this question will give you the list of regulatory bodies that governs the market-access to these countries.

Now when you know where you will market your device, assess the following two types of sources for standards:

1. The standard databases of the regulatory bodies in your intended geographical markets
2. The standard databases of the standard publishers

Inspect the regulator's standard databases

Most local medical device regulators have a list or database of standards they recognize for conformity assessments, for example the FDA recognized consensus standards in the USA, the harmonized standards in the EU or the designated medical device standards in UK.

These lists include the standards and their versions, recognized by each local regulator. By being compliant to these standards, you show conformity in that geographical market.

In order to find out which of these standards that apply to your particular device, you will have to assess each standard separately. As some of these lists are fairly long, this may seem like a daunting task. When available, use the built-in search functions in these databases to narrow them down. The FDA list, for example, allows you to search for:

   > general standards applicable to all (or at least a many) devices, as well as

   > standards recognized for your three-digit product code (ex. QOT for emergency ventilators).

 The standards publisher’s databases

There is usually a time-gap between the publication of a standard and the time it is accepted by the regulators, as a recognized standard. This time gap can sometimes cause problems, especially for emerging technologies. What happens if you work with a technology for which no recognized standard exists?

In such situations, it is a good practice to consider existing published standards that are not yet recognized. These standards represent state-of-the-art and therefore, complying with them will future-proof your design and documentation.

These standards will simplify market access, as they are acceptable proof of safety and/or effectiveness for most regulators, importers, distributors and in the end, customers.

Therefore, after having consulted the standard lists of the regulators, I also check the databases and/or web stores of the publishers of standards such as ISO and IEC.

Note that the regional / local standardization bodies such as CEN and CENELEC for Europe, ANSI and AAMI for US or CSA for Canada are valuable sources to find additional standards.

Wait! There are different versions of the standards?

It might happen that you find different versions of the standard in different databases. In this case, I always prioritize the newest version as being state-of-the-art. However, I would recommend to check with the regulator whether they accept a newer version of the standard in the conformity assessment or not.

Some regulators insist on using an older version of the standard. In this case, you will have to show compliance with the old version of the standard for this market.

One pitfall to avoid: when an international standard is published, it might take some time until the regional equivalent is published, and therefore it gets another year-number. Even there is another publication year, check whether the regional standard is based on the same international standard by reading the cover page and foreword. For example:

Even they have a different version-date, the normative content is equivalent and only the European foreword and annexes have been added.

Ensure compliance with product standards

As a next step, I recommend to map any product related requirements derived from, or explicitly mentioned in the standards into the ALM / requirements
management tool. By doing that I can now link them to the technical requirements of the device.

This process ensures that all requirements of the standard are implemented. Further, it provides a powerful rationale to the derived technical requirements and minimizes the risk of becoming non-compliant by inadvertently changing a technical requirement based on the requirement from a standard.

Tests reports from test laboratories to show compliance

The last step is to demonstrate documented proof of compliance for each standard. This can be done in several ways, depending on the standard in question.

You can refer to one of your certifications (e.g. ISO 13485 certificate), or by documenting it explicitly, for example in a dedicated report. Writing such reports are generally done either in-house (e.g. within the V&V (Verification & Validation) department) or outsourced to an external test laboratory.

The latter approach is particularly useful when you as a manufacturer do not have the necessary equipment (e.g. for electrical safety, EMC, biological tests etc.) in house. A test report from an external, independent laboratory is the way to go in these situations.

When selecting an external lab, pay attention to the requirements of your target markets for the test lab. Some regulators require that you use a laboratory with a IECEE CB (Certification Body) certificate, or that the laboratory is accredited or even that the test lab is located in the specific country you have targeted for market-access.

For IEC standards (such as IEC 60601-1 for basic safety and essential performance of medical electrical equipment): the testing branch of IEC, the IECEE, has issued dedicated test report forms (TRF) for most IEC standards. These contain multiple tables mapping the tests to the clauses in the standard.

These allow you to document whether this standard requirement is applicable, fulfilled, and what measurement results have been taken.

If you prefer to do these tests in-house, these test report forms (TRF) can also be purchased at the IEC web store.

If you need to show compliance with a standard for which no TRF can be acquired from IEC/IECEE, I recommend you set up an equivalent mapping table using four columns such as this example, demonstrating how to find the corresponding proof of compliance in your own documentation.

Conclusion

In summary, managing medical device standards is key to ensuring compliance and market success. Although the number of standards can be overwhelming, a clear approach—starting with identifying your target markets and checking both regulatory and standards databases—helps you find the right ones for your device.

Staying up-to-date with standards, linking requirements to your design, and obtaining proper proof of compliance will minimize risks and avoid delays. By following these steps, you can streamline the regulatory process and bring your product to market faster, giving you a competitive advantage in the medical device industry.

About the Expert

Beat Keller is an electronics engineer with specialization in Regulatory Affairs and Quality Management. He is founder and CEO of Swiss Medical Device Consulting GmbH.

Mr. Keller assists medical device manufacturers getting their medical devices to the market swiftly and efficiently through compliance with international regulations and standards. You can reach him on LinkedIn at https://www.linkedin.com/in/beat-keller/