Chapter I: Quality management system
1. The manufacturer shall establish, document and implement a quality management system as described in Article 10(9) and maintain its effectiveness throughout the life cycle of the devices concerned. The manufacturer shall ensure the application of the quality management system as specified in Section 2 and shall be subject to audit, as laid down in Sections 2.3 and 2.4, and to surveillance as specified in Section 3.
2. Quality management system assessment
2.1. The manufacturer shall lodge an application for assessment of its quality management system with a notified body. The application shall include:
- the name of the manufacturer and address of its registered place of business and any additional manufacturing site covered by the quality management system, and, if the manufacturer's application is lodged by its authorised representative, the name of the authorised representative and the address of the authorised representative's registered place of business,
- all relevant information on the device or group of devices covered by the quality management system,
- a written declaration that no application has been lodged with any other notified body for the same device-related quality management system, or information about any previous application for the same device-related quality management system,
- a draft of an EU declaration of conformity in accordance with Article 19 and Annex IV for the device model covered by the conformity assessment procedure,
- the documentation on the manufacturer's quality management system,
- a documented description of the procedures in place to fulfil the obligations arising from the quality management system and required under this Regulation and the undertaking by the manufacturer in question to apply those procedures,
- a description of the procedures in place to ensure that the quality management system remains adequate and effective, and the undertaking by the manufacturer to apply those procedures,
- the documentation on the manufacturer's post-market surveillance system and, where applicable, on the PMCF plan, and the procedures put in place to ensure compliance with the obligations resulting from the provisions on vigilance set out in Articles 87 to 92,
- a description of the procedures in place to keep up to date the post-market surveillance system, and, where applicable, the PMCF plan, and the procedures ensuring compliance with the obligations resulting from the provisions on vigilance set out in Articles 87 to 92, as well as the undertaking by the manufacturer to apply those procedures,
- documentation on the clinical evaluation plan, and
- a description of the procedures in place to keep up to date the clinical evaluation plan, taking into account the state of the art.
2.2. Implementation of the quality management system shall ensure compliance with this Regulation. All the elements, requirements and provisions adopted by the manufacturer for its quality management system shall be documented in a systematic and orderly manner in the form of a quality manual and written policies and procedures such as quality programmes, quality plans and quality records.
Moreover, the documentation to be submitted for the assessment of the quality management system shall include an adequate description of, in particular:
(a) the manufacturer's quality objectives;
(b) the organisation of the business and in particular:
- the organisational structures with the assignment of staff responsibilities in relation to critical procedures, the responsibilities of the managerial staff and their organisational authority,
- the methods of monitoring whether the operation of the quality management system is efficient and in particular the ability of that system to achieve the desired design and device quality, including control of devices which fail to conform,
- where the design, manufacture and/or final verification and testing of the devices, or parts of any of those processes, is carried out by another party, the methods of monitoring the efficient operation of the quality management system and in particular the type and extent of control applied to the other party, and
- where the manufacturer does not have a registered place of business in a Member State, the draft mandate for the designation of an authorised representative and a letter of intention from the authorised representative to accept the mandate;
(c) the procedures and techniques for monitoring, verifying, validating and controlling the design of the devices and the corresponding documentation as well as the data and records arising from those procedures and techniques. Those procedures and techniques shall specifically cover:
- the strategy for regulatory compliance, including processes for identification of relevant legal requirements, qualification, classification, handling of equivalence, choice of and compliance with conformity assessment procedures,
- identification of applicable general safety and performance requirements and solutions to fulfil those requirements, taking applicable CS and, where opted for, harmonised standards or other adequate solutions into account,
- risk management as referred to in Section 3 of Annex I,
- the clinical evaluation, pursuant to Article 61 and Annex XIV, including post-market clinical follow-up,
- solutions for fulfilling the applicable specific requirements regarding design and construction, including appropriate pre-clinical evaluation, in particular the requirements of Chapter II of Annex I,
- solutions for fulfilling the applicable specific requirements regarding the information to be supplied with the device, in particular the requirements of Chapter III of Annex I,
- the device identification procedures drawn up and kept up to date from drawings, specifications or other relevant documents at every stage of manufacture, and
- management of design or quality management system changes; and
(d) the verification and quality assurance techniques at the manufacturing stage and in particular the processes and procedures which are to be used, particularly as regards sterilisation and the relevant documents; and
(e) the appropriate tests and trials which are to be carried out before, during and after manufacture, the frequency with which they are to take place, and the test equipment to be used; it shall be possible to trace back adequately the calibration of that test equipment. In addition, the manufacturer shall grant the notified body access to the technical documentation referred to in Annexes II and III.
The notified body shall audit the quality management system to determine whether it meets the requirements referred to in Section 2.2. Where the manufacturer uses a harmonised standard or CS related to a quality management system, the notified body shall assess conformity with those standards or CS. The notified body shall assume that a quality management system which satisfies the relevant harmonised standards or CS conforms to the requirements covered by those standards or CS, unless it duly substantiates not doing so. The audit team of the notified body shall include at least one member with past experience of assessments of the technology concerned in accordance with Sections 4.3. to 4.5. of Annex VII. In circumstances where such experience is not immediately obvious or applicable, the notified body shall provide a documented rationale for the composition of that team. The assessment procedure shall include an audit on the manufacturer's premises and, if appropriate, on the premises of the manufacturer's suppliers and/or subcontractors to verify the manufacturing and other relevant processes.
Moreover, in the case of class IIa and class IIb devices, the quality management system assessment shall be accompanied by the assessment of technical documentation for devices selected on a representative basis as specified in Section 4. In choosing representative samples, the notified body shall take into account the published guidance developed by the MDCG pursuant to Article 105 and in particular the novelty of the technology, similarities in design, technology, manufacturing and sterilisation methods, the intended purpose and the results of any previous relevant assessments such as with regard to physical, chemical, biological or clinical properties, that have been carried out in accordance with this Regulation. The notified body in question shall document its rationale for the samples taken.
If the quality management system conforms to the relevant provisions of this Regulation, the notified body shall issue an EU quality management system certificate. The notified body shall notify the manufacturer of its decision to issue the certificate. The decision shall contain the conclusions of the audit and a reasoned report.
2.4. The manufacturer in question shall inform the notified body which approved the quality management system of any plan for substantial changes to the quality management system, or the device-range covered. The notified body shall assess the changes proposed, determine the need for additional audits and verify whether after those changes the quality management system still meets the requirements referred to in Section 2.2. It shall notify the manufacturer of its decision which shall contain the conclusions of the assessment, and where applicable, conclusions of additional audits. The approval of any substantial change to the quality management system or the device-range covered shall take the form of a supplement to the EU quality management system certificate.
3. Surveillance assessment
3.1. The aim of surveillance is to ensure that the manufacturer duly fulfils the obligations arising from the approved quality management system.
3.2. The manufacturer shall give authorisation to the notified body to carry out all the necessary audits, including on-site audits, and supply it with all relevant information, in particular:
- the documentation on its quality management system,
- documentation on any findings and conclusions resulting from the application of the post-market surveillance plan, including the PMCF plan, for a representative sample of devices, and of the provisions on vigilance set out in Articles 87 to 92,
- the data stipulated in the part of the quality management system relating to design, such as the results of analyses, calculations, tests and the solutions adopted regarding the risk-management as referred to in Section 4 of Annex I, and
- the data stipulated in the part of the quality management system relating to manufacture, such as quality control reports and test data, calibration data, and records on the qualifications of the personnel concerned.
3.3. Notified bodies shall periodically, at least once every 12 months, carry out appropriate audits and assessments to make sure that the manufacturer in question applies the approved quality management system and the post-market surveillance plan. Those audits and assessments shall include audits on the premises of the manufacturer and, if appropriate, of the manufacturer's suppliers and/or subcontractors. At the time of such on-site audits, the notified body shall, where necessary, carry out or ask for tests in order to check that the quality management system is working properly. It shall provide the manufacturer with a surveillance audit report and, if a test has been carried out, with a test report.
3.4. The notified body shall randomly perform at least once every five years unannounced audits on the site of the manufacturer and, where appropriate, of the manufacturer's suppliers and/or subcontractors, which may be combined with the periodic surveillance assessment referred to in Section 3.3. or be performed in addition to that surveillance assessment. The notified body shall establish a plan for such unannounced on-site audits but shall not disclose it to the manufacturer.
Within the context of such unannounced on-site audits, the notified body shall test an adequate sample of the devices produced or an adequate sample from the manufacturing process to verify that the manufactured device is in conformity with the technical documentation, with the exception of the devices referred to in the second subparagraph of Article 52(8). Prior to unannounced on-site audits, the notified body shall specify the relevant sampling criteria and testing procedure.
Instead of, or in addition to, sampling referred to in the second paragraph, the notified body shall take samples of devices from the market to verify that the manufactured device is in conformity with the technical documentation, with the exception of the devices referred to in the second subparagraph of Article 52(8). Prior to the sampling, the notified body in question shall specify the relevant sampling criteria and testing procedure.
The notified body shall provide the manufacturer in question with an on-site audit report which shall include, if applicable, the result of the sample test.
3.5. In the case of class IIa and class IIb devices, the surveillance assessment shall also include an assessment of the technical documentation as specified in Section 4 for the device or devices concerned on the basis of further representative samples chosen in accordance with the rationale documented by the notified body in accordance with the third paragraph of Section 2.3.
In the case of class III devices, the surveillance assessment shall also include a test of the approved parts and/or materials that are essential for the integrity of the device, including, where appropriate, a check that the quantities of produced or purchased parts and/or materials correspond to the quantities of finished devices.
3.6. The notified body shall ensure that the composition of the assessment team is such that there is sufficient experience with the evaluation of the devices, systems and processes concerned, continuous objectivity and neutrality; this shall include a rotation of the members of the assessment team at appropriate intervals. As a general rule, a lead auditor shall neither lead nor attend audits for more than three consecutive years in respect of the same manufacturer.
3.7. If the notified body finds a divergence between the sample taken from the devices produced or from the market and the specifications laid down in the technical documentation or the approved design, it shall suspend or withdraw the relevant certificate or impose restrictions on it.