Requirements for Regulatory Authority Recognition of Conformity Assessment Bodies Conducting Medical Device Regulatory Reviews

Document: IMDRF/GRRP WG/N59 FINAL:2024 (Edition 2)

Official Source

https://www.imdrf.org/documents/requirements-regulatory-authority-recognition-conformity-assessment-bodies-conducting-medical-device-regulatory-reviews

---

Full Text

Requirements for Regulatory Authority Recognition of Conformity Assessment Bodies Conducting Medical Device Regulatory Reviews

Document Number: IMDRF/GRRP WG/N59 FINAL:2024 (Edition 2)

Source: https://www.imdrf.org/documents/requirements-regulatory-authority-recognition-conformity-assessment-bodies-conducting-medical-device-regulatory-reviews

---

Final Document

IMDRF/GRRP WG/N59 FINAL:2024 (Edition 2)
Requirements for Regulatory Authority Recognition of Conformity Assessment Bodies Conducting Medical Device Regulatory Reviews
Authoring Group
IMDRF Good Regulatory Review Practices

Preface

© Copyright 2024 by the International Medical Device Regulators Forum.

This work is copyright. Subject to these Terms and Conditions, you may download, display, print, translate, modify and reproduce the whole or part of this work for your own personal use, for research, for educational purposes or, if you are part of an organisation, for internal use within your organisation, but only if you or your organisation do not use the reproduction for any commercial purpose and retain all disclaimer notices as part of that reproduction. If you use any part of this work, you must include the following acknowledgement (delete inapplicable):

“[Translated or adapted] from [insert name of publication], [year of publication], International Medical Device Regulators Forum, used with the permission of the International Medical Device Regulators Forum. The International Medical Device Regulators Forum is not responsible for the content or accuracy of this [adaption/translation].”

All other rights are reserved and you are not allowed to reproduce the whole or any part of this work in any way (electronic or otherwise) without first being given specific written permission from IMDRF to do so. Requests and inquiries concerning reproduction and rights are to be sent to the IMDRF Secretariat.

Incorporation of this document, in part or in whole, into another document, or its translation into languages other than English, does not convey or represent an endorsement of any kind by the IMDRF.

Jeffrey Shuren, IMDRF Chair

Contents

Introduction 5

1. Scope 7

2. References 10

3. Definitions 11

4. General Requirements 14

4.1. Legal and Contractual Matters 14

4.2. Managament of Impartiality 15

4.3. Liability and Financing 16

4.4. Non-Discriminatory Conditions 16

4.5. Confidentiality 16

4.6. Publicly Available Information 17

5. Structural Requirements 18

5.1. Organizational Structure and Top Management 18

5.2. Mechanism for Safeguarding Impartiality 18

6. Resource Requirements 19

6.1. Certification Body Personnel 19

6.2. Resources for Evaluation 22

7. Process Requirements 24

7.1. General 24

7.2. Application 24

7.3. Application Review (Screening) 24

7.4. Evaluation 25

7.5. Review (Recommendation) 26

7.6. Certification Decision 26

7.7. Certification Documentation 26

7.8. Directory of Certified Products 27

7.9. Surveillance 27

7.10. Changes Affecting Certification 27

7.11. Termination, Reduction, Suspension or Withdrawal of Certification 28

7.12. Records 28

7.13. Complaints and Appeals 28

8. Management System Requirements for Medical Device CABs 30

8.1. Options 30

8.2. General Management System Requirements (Option A) 30

8.3. Control of Documents (Option A) 30

8.4. Control of Records (Option A) 31

8.5. Management Review (Option A) 31

8.6. Internal Audits (Option A) 31

8.7. Corrective Actions (Option A) 31

8.8. Preventive Actions (Option A) 31

9. Information Requirements 32

9.1. Information Exchange Between the CAB and Recognizing Regulatory Authority(s) 32

10. Revoking Recognition of a Medical Device CAB 33

Introduction

This is one document in a collection of documents produced by the International Medical Device Regulators Forum (IMDRF) intended to improve the efficiency and effectiveness of the regulatory review of medical devices, including in vitro diagnostic (IVD) medical devices.

IMDRF/GRRP WG/N47 (Essential Principles of Safety and Performance of Medical Devices and IVD Medical Devices) and IMDRF/GRRP WG/N52 (Principles of Labeling for Medical Devices and IVD Medical Devices) are complementary documents. These two documents are focused on the fundamental design, manufacturing, and labeling requirements for medical devices that, when met, provide assurance the device is safe and performs as intended, offers significant benefits to, among others, manufacturers, users, patients/consumers, and regulatory authorities.

IMDRF/GRRP WG/N40 (Competence, Training, and Conduct Requirements for Regulatory Reviewers), this document, IMDRF/GRRP WG N59 (Requirements for Medical Device Conformity Assessment Bodies for Regulatory Authority Recogn ition) and IMDRF/GRRP WG/N71 (Medical Device Regulatory Review Report: Guidance Regarding Information to be Included), are complementary documents. IMDRF/GRRP WG/N40 and IMDRF/GRRP WG/N59 are focused on requirements for organizations conducting regulatory review(s) of medical devices and IVD medical devices and individuals performing regulatory reviews and other related functions under their respective medical device legislation, regulations, and procedures required in their regulatory jurisdiction.

Specifically, the purpose of IMDRF/GRRP WG/N59 is to define the requirements for CABs performing regulatory reviews and other related functions for medical devices, including IVD medical devices. Both the regulatory review process and the decisions made by a CAB may be subject to further review by the applicable Regulatory Authority in the countries and regions where the medical device is manufactured and/or placed on the market.

IMDRF/GRRP WG/N71 expands upon section 7.5.2 of IMDRF/GRRP WG/N59 by articulating exactly the type of information a regulatory review report should include to address the requirements of section 7.7 of N59.

Three additional documents, IMDRF/GRRP WG/N61 (Regulatory Authority Assessment Method for Recognition and Surveillance of Conformity Assessment Bodies Conducting Medical Device Regulatory Reviews), IMDRF GRRP WG/N63 (Competence and Training Requirements for Regulatory Authority Assessors of Conformity Assessment Bodies Conducting Medical Device Regulatory Reviews), and IMDRF/GRRP WG/N66 (Assessment and Decision Process for the Recognition of a Conformity Assessment Body Conducting Medical Device Regulatory Reviews) are complementary documents. These three documents are focused on how RAs will evaluate or “assess” a CAB’s compliance to the requirements in the IMDRF/GRRP WG/N59 and IMDRF/GRRP WG N40 documents.

This collection of IMDRF GRRP documents will provide the fundamental building blocks by providing a common set of requirements to be utilized by the Regulatory Authorities for the recognition and monitoring of entities that perform regulatory reviews and other related functions. It should be noted that in some jurisdictions the recognition process is called designation, notification, registration, or accreditation.

IMDRF developed these GRRP documents to encourage and support global convergence of regulatory systems, where possible, seeking to strike a balance between the responsibilities of Regulatory Authorities to safeguard the health of their citizens as well as their obligations to avoid placing unnecessary burdens upon medical device CABs or the regulated industry. IMDRF Regulatory Authorities may add additional requirements beyond this document when their legislation requires such additions.

Scope

Standards perform a key role in the conformity assessment process; however, utilizing existing standards for recognition of medical device CABs performing regulatory reviews presents challenges. Regulatory Authorities have identified shortcomings such as requirements being too generic and focused on commercial entities for commercial purposes. While there is utility of the requirements outlined in the standards, additional requirements need to be added to ensure that they meet the requirements of Regulatory Authorities and are appropriate for the regulated medical device industry.

The standard most commonly utilized for product certification is the ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) standard ISO/IEC 17065:2012 entitled, “Conformity assessment – Requirements for bodies certifying products, processes and services.” One of the challenges with this standard for Regulatory Authorities is that in many cases there are not enough explicit requirements.

Therefore, IMDRF Regulatory Authorities recognized the need for a different set of requirements for medical device CABs, using existing standards where possible.

The conclusion of the work group’s analysis was to allow ISO/IEC 17065:2012 to act as the generic base requirements and then utilize this IMDRF GRRP document to add prescriptive requirements for medical device CABs. CABs may be subject to other laws and requirements specific to each jurisdiction.

This document is not meant to apply to Regulatory Authorities that perform regulatory reviews. The contents of the document may be used by Regulatory Authorities in establishing their own regulatory review program or deciding whether to accept regulatory decisions made by other entities.

For the purposes of this document, “Exceptions to ISO/IEC 17065:2012” listed below mean that certain requirements in ISO/IEC 17065:2012 do not apply to regulatory review conformity assessment. “Specific requirements for medical device CABs” are requirements for regulatory review in addition to those outlined in the corresponding section of ISO/IEC 17065:2012.

ISO/IEC 17065:2012 is being utilized as a normative reference within this IMDRF document. When the ISO/IEC 17065 standard is revised, the IMDRF will have to assess the new version of the standard and determine if this IMDRF document also requires revision. Furthermore, there is an expectation that the Regulatory Authority assessment of medical device CABs includes both the generic normative requirements in addition to the specific requirements added or deleted by this document. Therefore, this document’s clause numbers are aligned with the relevant subsection in ISO/IEC 17065:2012. Specifically, Sections 4-8 of this document align with the requirements of the standard and additional requirements are added in Sections 9-10.

This document applies to CABs that review medical device or IVD medical device regulatory submissions and may perform other related functions. The CAB requirements include evaluation of the essential principles of safety and performance of a medical device per the requirements established by the recognizing Regulatory Authority. In some cases, the final decision on a regulatory submission is made by the recognizing Regulatory Authority after the CAB completes their review. Figure 1 provides a general overview of the activities performed by CABs and, in some regulatory jurisdictions, subsequently by Regulatory Authorities related to the review of regulatory submissions. The scope of this document is limited to the regulatory review activities performed by CABs and not to any subsequent review activities or decisions made by Regulatory Authorities, as indicated by the dotted box in Figure 1.

Figure 1. Typical Roles and Responsibilities of CABs and Regulatory Authorities

The functions covered by a CAB within the scope of this document and the independence of the roles assigned are described in Table 1. Table 1 also maps these functions to the corresponding certification process steps outlined in Section 7 of ISO/IEC 17065:2012. Because the nomenclature ISO/IEC 17065:2012 uses for these steps may be confusing when the certification process being discussed is an actual review process (for example, ISO/IEC 17065:2012 uses “review” to refer to a distinct phase of the certification process, and not to the overall regulatory review process), Table 1 also lists alternative names proposed by IMDRF for the steps of the certification process that may be more suitable in this case. These terms are used throughout this document instead of the terms listed in ISO/IEC 17065:2012.

Table 1: Medical Device CAB Functions and Roles for Performing Regulatory Reviews

ISO/IEC 17065 Certification Process Requirements	Alternative Nomenclature Proposed by IMDRF	Functions	Regulatory Review	Decision Making
7.3 Application Review	Screening	Review the manufacturer’s submission to determine regulatory review team competence required, select the regulatory review team members	n/a	Program Administrator
7.4 Evaluation	Evaluation	Evaluation of: technical documentation demonstrating conformity with essential principles of safety and performance; and regulations	Regulatory Reviewer/ Technical Expert	n/a
7.5 Review	Recommendation	Final review of the evaluation of: safety and performance; product/ process-related technologies; regulations; and relevant QMS/GMP certification	Final Regulatory Reviewer[1]	n/a
7.6 Certification Decision	Certification Decision	Final submission decision	n/a	Final Regulatory Reviewer[2]/Other decision-granting authority

References

Normative Reference:

• International Organization for Standardization (ISO)/ International Electrotechnical Commission (IEC) ISO/IEC 17065:2012 - Conformity Assessment – Requirements for bodies certifying products, processes and services

General References:

• IMDRF/GRRP WG/N40:2024 Competence, Training, and Conduct Requirements for Regulatory Reviewers
• IMDRF/GRRP WG/N47:2024 Essential Principles of Safety and Performance of Medical Devices and IVD Medical Devices
• IMDRF/Standards WG/N51:2018 Optimizing Standards for Regulatory Use
• IMDRF/GRRP WG/N52:2024 Principles of Labelling for Medical Devices and IVD Medical Devices
• IMDRF/GRRP WG/N61:2024 Regulatory Authority Assessment Method for Recognition and Surveillance of Conformity Assessment Bodies Conducting Medical Device Regulatory Reviews
• IMDRF/GRRP WG/N63:2024 Competence and Training Requirements for Regulatory Authority Assessors of Conformity Assessment Bodies Conducting Medical Device Regulatory Reviews
• IMDRF/GRRP WG/N66:2024 Assessment and Decision Process for the Recognition of a Conformity Assessment Body Conducting Medical Device Regulatory Reviews
• IMDRF/GRRP WG/N71:2024 Medical Device Regulatory Review Report: Guidance Regarding Information to be Included
• GHTF/SG1/N78:2012 Principles of Conformity Assessment for Medical Devices.
• GHTF/SG1/N46:2008 - Principles of Conformity Assessment of In Vitro Diagnostic (IVD) Medical Devices.
• GHTF/SG1/N71:2012 - Definition of the Terms 'Medical Device' and 'In Vitro Diagnostic (IVD) Medical Device.'
• GHTF SG1/N077:2012 Principles of Medical Device Classification
• GHTF SG1/N045:2007 Principles of In Vitro Diagnostic (IVD) Medical Device Classification
• ISO/IEC 17000:2020 – Conformity assessment – Vocabulary and general principles
• ISO/IEC 17067:2013 - Conformity assessment -- Fundamentals of product certification and guidelines for product certification schemes
• ISO 9000:2015 – Quality Management Systems – Fundamentals and Vocabulary
• ISO 13485:2016 – Medical Devices – Quality Management Systems – Requirements for Regulatory Purposes

Definitions

Competence: Ability to apply knowledge and skills to achieve intended results.__(ISO 9000:2015, Clause 3.10.4)

Conformity Assessment Body (CAB): A body other than a Regulatory Authority engaged in determining whether the relevant requirements in technical regulations or standards are fulfilled. (IMDRF/GRRP WG/N40:2024)

Medical device : any instrument, apparatus, implement, machine, appliance, implant, reagent for in vitro use, software, material or other similar or related article, intended by the manufacturer to be used, alone or in combination, for human beings, for one or more of the specific medical purpose(s) of:

• diagnosis, prevention, monitoring, treatment or alleviation of disease,
• diagnosis, monitoring, treatment, alleviation of, or compensation for, an injury,
• investigation, replacement, modification, or support of the anatomy, or of a physiologi­cal process,
• supporting or sustaining life,
• control of conception,
• cleaning, disinfection, and sterilization of medical devices,
• providing information by means of in vitro examination of specimens derived from the human body;

and does not achieve its primary intended action by pharmacological, immunological, or metabolic means, in or on the human body, but which may be assisted in its intended function by such means.

NOTE 1: Products which may be considered to be medical devices in some jurisdictions but not in others include:

• disinfection substances,
• aids for persons with disabilities,
• devices incorporating animal and/or human tissues,
• devices for in-vitro fertilization or assisted reproduction technologies.

(Modified from GHTF/SG1/N71:2012)

NOTE 2: For clarification purposes, in certain regulatory jurisdictions, devices for cosmetic/aesthetic purposes are also considered medical devices.

NOTE 3: For clarification purposes, in certain regulatory jurisdictions, the commerce of devices incorporating human tissues is not allowed.

Quality Management System : A QMS comprises activities by which the organization identifies its objectives and determines the processes and resources required to achieve desired results. The QMS manages the interacting processes and resources required to provide value and realize results for relevant interested parties. The QMS enables top management to optimize the use of resources considering the long and short term consequences of their decision. A QMS provides the means to identify actions to address intended and unintended consequences in providing products and services. (ISO 9000:2015, Clause 2.2)

Regulatory Authority: A government body or other entity that exercises a legal right to control the use or sale of medical devices within its jurisdiction, and that may take enforcement action to ensure that medical products marketed within its jurisdiction comply with legal requirements. (GHTF/SG1/N78:2012)

Regulatory Review: A review of a medical device that is conducted to assess conformity with regional regulations or standards.

NOTE 1: A regulatory review is performed by Regulatory Reviewer(s), and on occasion, the Regulatory Authority and/or recognized Conformity Assessment Body may consult with Technical Expert(s) to assist in specific aspects of the regulatory review process.

NOTE 2: Depending on the complexity of the medical device, it may be necessary for a team of regulatory reviewer(s) and/or technical expert(s) to conduct the regulatory review to ensure all required competencies are addressed.

NOTE 3: A regulatory review consists of an assessment of documentation and/or evaluation/testing of physical medical devices and includes the recommendation and associated decision-making processes. The scope of the review is dependent on the Regulatory Authority’s requirements.

(IMDRF/GRRP WG/N40:2024)

NOTE 4: In this document, a “regulatory review” is equivalent to the term “certification process” as referred to in ISO/IEC 17065:2012.

Regulatory Reviewer: An individual from a Regulatory Authority and/or their recognized CAB responsible for routinely performing regulatory reviews of medical devices. This may include for example, premarket reviewers, product specialists, assessors, etc. (IMDRF/GRRP WG/N40:2024)

Regulatory Submission : A regulatory submission can be any type of information related to a medical device regulatory process. This includes but is not limited to a request for approval/authorization to market a device, any communications relating to the original submission, and any request for modification to an existing approval. A regulatory submission includes the technical documentation and an explanation of how the technical documentation demonstrates that the medical device conforms with essential principles of safety and performance and other relevant regulatory requirements and guidelines. Guidance on contents for a regulatory submission is provided in IMDRF/RPS WG/N9 and IMDRF/RPS WG/N13.

Technical Documentation : The documented evidence, normally an output of the quality management system, that demonstrates compliance of a device to the Essential Principles of Safety and Performance of Medical Devices. (GHTF/SG1/N78:2012 and GHTF/SG1/N46:2008)

Technical Expert: For the purposes of this document, a technical expert is an individual who is consulted on an ad hoc basis to provide specific technical knowledge or expertise to the regulatory review process. This may include an individual employed by the Regulatory Authority or their recognized CAB or external to these organizations, as permitted by the Regulatory Authority.

Note 1:__ Areas of expertise could include, for example, clinical, design, manufacturing, etc.

(IMDRF/GRRP WG/N40:2024)

General Requirements

Legal and Contractual Matters

Country-specific laws and regulations, outside the medical device Regulatory Authority’s purview, may be applicable to the manufacturer for certain legal and financial responsibilities.

A legal entity is ineligible to be a medical device CAB if the entity has been found guilty of an offense against national laws or regulations related to medical devices, or relating to any fraudulent or dishonest practices.

Exceptions to ISO/IEC 17065:2012

In cases where the Regulatory Authority issues the final decision on the regulatory submission, the agreement between the CAB and the manufacturer shall require the manufacturer to notify the Regulatory Authority of changes affecting conformity with the certification decision discussed in 4.1.2.2(k).

Specific Requirements for Medical Device CABs

A CAB shall make available to the recognizing Regulatory Authority(s) information about organizational structure, ownership and the legal or natural persons exercising control over the CAB.

If the CAB is a legal entity that is wholly or partly owned by a larger organization, the CAB shall clearly document the activities, structure, and governance of that larger organization as well as its relationship with the CAB.

If the CAB wholly or partly owns other legal entities, the CAB shall clearly define and document the activities and responsibilities of those other entities, as well as their legal and operational relationships with the CAB.

In addition, a CAB that maintains multiple offices that perform some part of the regulatory review process shall ensure that the roles and responsibilities of the CAB and their other locations are defined and implemented.

The CAB shall have legally enforceable arrangements with medical device manufacturers allowing personnel from the Regulatory Authority, which authorized their recognition, to assess the CAB’s activities associated with performing regulatory reviews. The agreement shall allow personnel from the Regulatory Authority access to records and documents pertaining to the manufacturer that are relevant to the regulatory review and decision-making process upon request.

The CAB shall have legally enforceable arrangements with medical device manufacturers that will allow Regulatory Authorities to share all documents and records related to medical device regulatory reviews with other Regulatory Authorities, with which they have formal established confidentiality agreements covering provisions for protecting proprietary information and trade secret information.

The agreements shall specify the responsibilities of the manufacturer and CAB, as well as the authority or responsibilities held by the recognizing Regulatory Authority, consistent with the laws and regulations in the relevant regulatory jurisdiction.

Managament of Impartiality

The requirements of this section in no way preclude exchanges of technical or regulatory information between a CAB and a manufacturer.

Specific Requirements for Medical Device CABs

The CAB shall be an entity that is independent of the manufacturer of the medical device for which it performs the regulatory review. The CAB shall also be independent of any other individual or group with an economic interest in the product as well as of any competitor of the manufacturer, such as distributors, authorized representatives, or importers.

The CAB shall have documented and implemented a structure and procedures for safeguarding and promoting independence, objectivity, and impartiality throughout its organization, personnel, and regulatory reviews. These procedures shall effectively identify, investigate, and resolve any case in which a conflict of interests may arise. The CAB shall document any investigation, outcome, and resolution.

The CAB shall ensure that its top-level management, the personnel responsible for carrying out the regulatory reviews, and the spouses (including domestic partners) and children of all these parties:

are not involved in, or provide consultancy for, the design, manufacturing, assembly, marketing, supply, installation, distribution, import, purchase, or maintenance/servicing of the medical devices which they assess, nor act as an authorized representative of any of the parties engaged in those activities. They shall not engage in any activity that may conflict with their independence of judgment or integrity in relation to regulatory reviews, or undermine the confidence in their independence, impartiality, or objectivity; and

do not use the services of any organization or individual that has provided consultancy services to the manufacturer, their authorized representative or a supplier being reviewed by the CAB, within a period of three years (or longer, if required by the recognizing Regulatory Authority) since the last consultancy services were rendered. Individual regulatory jurisdictions may have their own requirements regarding the impact of the timing of consultancy or other activities.

Note: This does not preclude general training activities relating to medical device regulations, general regulatory review, or related standards that are not manufacturer-specific.

The CAB shall document any involvement in consultancy services in the field of medical devices undertaken by personnel prior to taking up employment with the CAB at the time of employment. The CAB shall monitor and resolve any potential conflicts of interest according to criteria set out in this document.

If a CAB’s top-level management or the personnel responsible for performing the regulatory review were former employees of a medical device manufacturer or provided consultancy services in the field of medical devices for a specific manufacturer prior to taking up employment with the CAB, such personnel shall not be assigned to activities for that specific manufacturer or companies belonging to the same organization for a period of three years. Individual regulatory jurisdictions may have their own requirements regarding the impact of the timing of past consultancy or other activities.

The CAB shall not advertise, commit to, guarantee, or imply the outcome of the regulatory review by the CAB on the basis of financial or other inducements.

If the CAB is a legal entity that is wholly or partly owned by a larger organization, the requirements for impartiality in this document are applicable to both the CAB and the organization to which it belongs.

Liability and Financing

Specific Requirements for Medical Device CABs

The CAB shall take out professional liability insurance unless the government, in accordance with national law, covers liability.

The justification for the scope and overall financial value of liability insurance shall be documented and include consideration of the level and geographic scope of activities of the CAB and the risk profile of the devices being assessed by the CAB.

Non-Discriminatory Conditions

Specific Requirements for Medical Device CABs

No specific requirements.

Confidentiality

Specific Requirements for Medical Device CABs

The CAB shall have documented procedures, and where applicable, equipment and facilities that ensure the secure handling of confidential information. The procedures shall ensure the confidentiality of information which comes into its possession during the regulatory review process.

Except in relation to information which may be requested by a Regulatory Authority, the personnel of a CAB and any external regulatory reviewers, external technical experts, or outsourced organizations, shall not disclose information obtained in carrying out their tasks with respect to regulatory reviews with those who are not involved in the process.

Publicly Available Information

Exceptions to ISO/IEC 17065:2012

For jurisdictions where the CAB issues the final decision on the regulatory submission without the need for Regulatory Authority involvement, CABs shall make the status of the decision regarding individual medical devices available upon request.

Specific Requirements for Medical Device CABs

The information specified in ISO/IEC 17065:2012 Clause 4.6(a),(c), and (d) shall be made publicly available in all the geographical areas in which the CAB operates (e.g., web site), and not just available upon request.

The CAB shall also maintain and make publicly available their regulatory review processes and their policy on impartiality, as well as the types of management systems in which it operates (see ISO/IEC 17065:2012 Clause 8).

Where appropriate, the CAB must comply with specified Regulatory Authority requirements for the method of making information on the certified medical devices and manufacturer publicly accessible.

Structural Requirements

Organizational Structure and Top Management

Specific Requirements for Medical Device CABs

The requirements listed in ISO/IEC 17065 Clause 5.1.3(d) and (e) also apply to implementation and oversight of any certification activities and requirements established by Regulatory Authorities.

The CAB shall ensure that its personnel are current in practices and knowledge in relation to medical device technologies and regulatory requirements for conducting regulatory reviews of medical device regulatory submissions.

The CAB shall have the organizational capacity, including management, administrative support, and infrastructure, to undertake all contracted activities.

The CAB shall actively participate in any regulatory coordination group activities established for the purpose of keeping the CAB’s personnel current regarding medical device legislation, guidance documents, standards, and best practice documents adopted in the applicable regulatory systems. The CAB shall identify a point of contact within their organization for each such activity.

The CAB shall identify and apply relevant guidance and best practice documents, and justify why any documents that were identified and not applied were not considered relevant.

The CAB shall establish a code of conduct for CABs in the field of medical devices (see Section 6.1.13 of this document). The code of conduct shall provide a mechanism for monitoring and verification of its implementation. Violations to the code of conduct must be investigated and appropriate action taken.

The CAB shall have documented processes and procedures to ensure that personnel in the CAB do not make the final decision on their own evaluation. The recommendation and certification decision functions shall be performed by a person or persons independent of the evaluation team.

Mechanism for Safeguarding Impartiality

Specific Requirements for Medical Device CABs

No specific requirements.

Resource Requirements

Certification Body Personnel

The resource and competence requirements for certification body personnel outlined in this section are general requirements. There may be more specific requirements for the regulatory authority having jurisdiction, including requirements related to:

• specific types of experts (e.g. clinical reviewers);
• whether certain types of personnel are internal or external resources;
• review; and
• the role of the reviewers and the final decision makers.

General

Specific Requirements for Medical Device CABs

A CAB shall comply with the specific requirements for the competence and maintenance of competence that can be found in IMDRF GRRP WG/N40 – “Competence, Training, and Conduct Requirements for Regulatory Reviewers,” and maintain current personnel records that include relevant competence, training, and conduct requirements as outlined therein.

The CAB shall ensure that each regulatory reviewer, technical expert, or other personnel involved in the regulatory review process understands their duties, responsibilities, and authorities.

The CAB shall have established processes for selecting, training, and formally authorizing regulatory reviewers and for selecting and familiarizing technical experts used in the certification activities. The initial competence evaluation of a regulatory reviewer shall include the ability to apply required knowledge and skills while performing regulatory reviews, as determined by a competent evaluator assessing the regulatory reviewer’s review.

The CAB shall have a process to achieve and demonstrate effective regulatory reviews, including the use of regulatory reviewers possessing generic review skills and knowledge (see Section 7 of IMDRF/GRRP WG/N40), as well as technical experts possessing skills and knowledge appropriate for performing reviews in specific technical areas.

The CAB shall ensure that regulatory reviewers and technical experts demonstrate competency regarding the CAB’s review processes, certification requirements and other relevant requirements, including regulatory requirements. The CAB shall give regulatory reviewers and technical experts access to an up-to-date set of documented procedures giving review instructions and all relevant information on the certification activities， including technical reference materials and relevant publications, regulations, standards, and guidelines.

The CAB shall offer or provide access to specific training to ensure its regulatory reviewers, technical experts and other personnel involved in the regulatory review process are competent for the functions they perform. Additional guidance on training requirements are identified in IMDRF GRRP WG/N40.

The final regulatory reviewer that makes the decision on granting, refusing, maintaining, renewing, suspending, restoring, or withdrawing certification, or on expanding or reducing the scope of certification, shall understand the applicable standard and certification requirements, and shall have demonstrated competence to evaluate the outcomes of the evaluation and recommendation of the review team.

The personnel responsible for identifying competence requirements for the regulatory reviewer to perform specific regulatory reviews, and the final regulatory reviewer responsible for final review and decision-making on certification, shall be employees of the CAB and shall have proven knowledge and experience in the following:

1. the medical devices legislation, relevant guidance documents and standards adopted in the applicable regulatory system;
2. the types of qualifications, experience and expertise relevant to medical device regulatory reviews;
3. a broad base of medical device technologies, the medical device industry and the design and manufacture of medical devices;
4. the CAB’s quality management system, related procedures and the required qualification criteria; and
5. the training requirements for personnel involved in medical device regulatory reviews identified in IMDRF GRRP WG/N40.

Management of Competence for Personnel Involved in the Certification Process

Specific Requirements for Medical Device CABs

A CAB shall have access to the necessary administrative, technical, and scientific personnel with technical knowledge and sufficient and appropriate experience relating to medical devices and the corresponding technologies.

The management of the CAB shall have appropriate knowledge and processes to: set up and operate a system for the selection of the regulatory reviewers, technical experts, and other personnel involved in the regulatory review process; the verification of their competence; the assignment of their tasks; their initial and ongoing training; and, their instruction and monitoring to ensure that personnel who administer and perform the regulatory reviews are competent to fulfill the tasks required of them.

The CAB shall identify at least one individual within its senior management having overall responsibility for all medical device regulatory reviews, within the scope of this document.

A CAB shall be capable of carrying out all the tasks assigned to it with the highest degree of professional integrity and the requisite technical competence in the specific field, whether those tasks are carried out by the CAB itself or by other groups on the CAB’s behalf and under its responsibility.

CABs are to ensure that regulatory reviewers, technical experts, and other personnel involved in regulatory reviews understand the importance of a code of conduct in maintaining integrity as discussed in IMDRF/GRRP WG/N40, Section 6.0. CABs are to keep signed statements of adherence to a code of conduct for personnel involved in regulatory reviews. The signed statement shall attest to at least the following elements included in the CAB’s code of conduct:

1. To act in a professional and ethical manner at all times.
2. To faithfully represent the interests of the recognizing Regulatory Authority(s) and CAB.
3. Not to act in any way prejudicial to the interests or reputation of the recognizing Regulatory Authority(s) and CAB.
4. Not to act in any way prejudicial to the integrity or objectives of the recognizing Regulatory Authority(s) and CAB.
5. To disclose any relationship, or financial interest, past or present, that may create a conflict of interest, or the appearance of a conflict of interest, and to notify management of any new conflicts of interest or potential conflicts of interest as soon as the case may arise.
6. Not to participate in any activity or relationship that may impair, or may appear to impair, one's objectivity, impartiality, or professional judgment.
7. Not to accept any inducement, gift, commission, discount or any other benefit not available to the general public from medical device manufacturers, their agents, their representatives, or economic operators.
8. To record and report truthfully and accurately regulatory review assessments in an impartial and unbiased way.
9. To record and report truthfully and accurately any material facts that may affect the reliability of the regulatory review process.
10. Not to provide any consulting services to manufacturers whose products are under regulatory review.
11. Not to disclose, verbally or written, any information obtained in the course of regulatory reviews to any third party, not including the recognizing Regulatory Authority(s), unless authorized in writing or required by law.
12. Not to use information obtained in the course of performing regulatory reviews for any personal gain.
13. Not to undertake any regulatory reviews for which one does not possess the required skills, knowledge or experience, formal designation or responsibility.
14. Not to undertake any regulatory reviews in a language where one is not proficient without the support of a translator and/or interpreter.
15. To continually improve one's proficiency, effectiveness, and quality of work.
16. To disclose to management, without delay, any breach of this statement by oneself or a colleague and to cooperate fully in the investigation of such a breach.

Contract with Personnel

Specific Requirements for Medical Device CABs

CABs shall require regulatory reviewers, technical experts, and other personnel involved in the regulatory review process to sign a contract or document that declares any circumstances that could represent a potential conflict of interest, such as any association with the designer, manufacturer, supplier, installer, distributor, importer, purchaser, owner, or maintainer/servicer of the medical devices which they assess, or the authorized representative of any of those parties.

Resources for Evaluation

Internal Resources

Specific Requirements for Medical Device CABs

In addition to the specific standards listed in ISO/IEC 17065:2012 6.2.1 for testing, inspection, and management system auditing, the CAB shall meet additional applicable requirements such as regulatory, legal, and international standards; jurisdiction-specific and multilateral guidelines (including IMDRF documents); and the requirements outlined in this document.

External Resources (Outsourcing)

For the purposes of this clause, an external organization is one that is not subject to the CAB's quality management system.

Specific Requirements for Medical Device CABs

In addition to the specific standards listed in ISO/IEC 17065:2012 6.2.1 for testing, inspection, and management system auditing, the bodies to whom the CAB outsources evaluation activities shall meet additional applicable requirements such as regulatory, legal, and international standards; jurisdiction-specific and multilateral guidelines (including IMDRF documents); and the requirements outlined in this document.

Where a CAB uses an external organization for performing evaluation of regulatory submissions, the CAB shall be responsible for identifying competence requirements for any regulatory reviewer, technical expert, or any other personnel involved in the evaluation process assigned to perform specific activities.

Where a CAB uses an external organization for performing evaluation of regulatory submissions, the CAB shall have adequate competence in such product areas to verify the appropriateness and validity of objective evidence provided by the external organization, to make the final review and decision on conformity to regulatory requirements.

The CAB shall document all arrangements with external organizations involved in the regulatory review process and provide that information to the recognizing Regulatory Authority(s) on request. The CAB shall ensure that the external organizations allow the recognizing Regulatory Authority(s) to assess activities outsourced by the CAB.

It is the CAB’s responsibility to ensure that all individuals utilized by an external organization that are involved in a regulatory review are directly assessed by the CAB to ensure consistency with IMDRF GRRP WG N40 and any assessment requirements.

External resources shall not be responsible for the recommendation and certification decision.

Process Requirements

General

Specific Requirements for Medical Device CABs

7.1.1 The CAB shall establish procedures covering at least:

1. the manufacturer’s request for conducting a regulatory review;
2. the processing of such request, including the screening of the documentation, the qualification of the product as a medical device and its classification;
3. the acceptance or rejection of regulatory submissions;
4. the language of the request, of the correspondence and of the documentation to be submitted;
5. where appropriate, the terms of the agreement with the manufacturer or authorized representative;
6. where appropriate, any fees to be charged for the regulatory review;
7. any requirement to perform a quality management system audit as part of the regulatory review;
8. the assignment of regulatory reviewers to a specific activity based on the regulatory reviewer’s competence to perform the regulatory review;
9. the decision-making process on the conformity of the regulatory submission to applicable technical, legal, and regulatory requirements, including, where appropriate, the decision about issue, refusal, suspension, reinstatement, restriction, modification, or withdrawal of certificates as well as possible conditions or limitations to certificate validity;
10. the criteria for determining whether any change to the medical device is reportable to the Regulatory Authority having jurisdiction, and the assessment of reportable changes; and
11. where appropriate, the renewal of any certifications.

Application

Specific Requirements for Medical Device CABs

No specific requirements.

Application Review (Screening)

Specific Requirements for Medical Device CABs

The CAB shall screen the regulatory submission to ensure that it contains the following:

1. information establishing the qualification of the product as a medical device;
2. the risk classification of the medical device;
3. the conformity assessment procedures applied by the manufacturer; and
4. sufficient information to demonstrate conformity with essential principles of safety and performance (per IMDRF GRRP WG/N47:2018 Essential Principles of Safety and Performance of Medical Devices and IVD Medical Devices), and any additional requirements specified by the recognizing Regulatory Authority(s).

The CAB shall also ensure that the information provided is relevant for the medical device under review.

The CAB shall ensure that they have the necessary competence to review the regulatory submission, including sufficient familiarity with all relevant regulations, standards, and guidelines related to the medical devices included in the regulatory submission.

Evaluation

Exceptions to ISO/IEC 17065:2012

In addition to the conditions described in ISO/IEC 17065:2012 Section 7.4.5 that state that the CAB can accept information related to certification completed prior to the submission for certification, the CAB can also accept information after the submission is received if agreed upon between the CAB and manufacturer.

Specific Requirements for Medical Device CABs

The CAB shall evaluate the regulatory submission according to the requirements specified by the recognizing Regulatory Authority(s). This evaluation can involve:

1. regulations, technical standards, and guidelines that are relevant to the medical device under review; and
2. relevant**** published IMDRF documents, including IMDRF GRRP WG/N47:2024 Essential Principles of Safety and Performance of Medical Devices and IVD Medical Devices and __ IMDRF GRRP WG/N52:2024 Principles of Labelling for Medical Devices and IVD Medical Devices , demonstrating conformity of the medical device under review with the relevant essential principles.

The CAB shall ensure that the technical documentation provided in the regulatory submission support the proposed classification of the medical device in the relevant regulatory jurisdiction.

The CAB shall ensure that the technical documentation provided in the regulatory submission support the proposed intended use of the medical device under review.

If the CAB conducted an audit or receives the results of an audit as part of the regulatory certification scheme, the CAB shall ensure that the audit results support the regulatory submission.

Review (Recommendation)

Specific Requirements for Medical Device CABs

If the relevant Regulatory Authority requires QMS/GMP certification prior to marketing and an audit was not part of the CAB’s evaluation, the CAB shall ensure that the manufacturer holds appropriate QMS/GMP certification relevant to the medical device under review.

The CAB shall document their recommendation for certification in a regulatory review report, based on the evaluation results. This report shall include information that addresses the requirements in section 7.7 of this document. Guidance on information to include in a medical device regulatory review report is available in IMDRF/GRRP WG/N71.

If the CAB becomes aware of information included in the regulatory submission that may require safety-related regulatory action (such as design changes that do not adequately address a postmarket issue involving marketed devices), such information shall be reported to the recognizing RA in writing within 5 working days.

Certification Decision

Exceptions to ISO/IEC 17065:2012

For regulatory jurisdictions where the Regulatory Authority makes the final decision on the regulatory submission, ISO/IEC 17065:2012 Section 7.6 does not apply to the CAB. In these situations, the CAB shall submit the regulatory review report discussed in Section 7.5.2 to the recognizing Regulatory Authority for the certification decision.

Beyond the requirements in ISO/IEC 17065:2012 Clause 7.6.3, the person(s) assigned by the CAB to make a certification decision shall be employed by the CAB.

Specific Requirements for Medical Device CABs

A CAB conducting a regulatory review shall have sufficient and reliable evidence to support a decision of compliance or non-compliance with regulatory requirements.

Certification Documentation

Exceptions to ISO/IEC 17065:2012

In regulatory jurisdictions where the final regulatory decision must be made by the Regulatory Authority, the CAB shall provide their certification recommendation and regulatory review report to the Regulatory Authority, and any certification documentation shall be issued by the Regulatory Authority in accordance with their legislation.

Specific Requirements for Medical Device CABs

The CAB shall report certifications to the recognizing Regulatory Authority when necessary, along with any other documentation required by the Regulatory Authority (which may include information regarding regulatory submissions where certification was not granted).

When a CAB issues certificates and regulatory review reports, they shall meet the requirements of the relevant Regulatory Authority.

When a CAB issues reports and certificates intended for use by a specific Regulatory Authority, the reports and certificates shall accurately document:

1. the scope of the regulatory review;
2. the scope of certification issued, including clear identification of the certified medical device and its use; and
3. the review criteria used to assess the regulatory submission, including which Regulatory Authority requirements have been assessed.

Directory of Certified Products

Specific Requirements for Medical Device CABs

The CAB shall make its directory of certified products available to the recognizing Regulatory Authority.

Surveillance

Exceptions to ISO/IEC 17065:2012

ISO/IEC 17065:2012 Section 7.9 does not apply.

Specific Requirements for Medical Device CABs

No specific requirements.

Changes Affecting Certification

Specific Requirements for Medical Device CABs

If the regulatory requirements or guidelines change in regulatory jurisdiction where certification was previously granted, the CAB shall revise their certification process to be consistent with these changes.

Termination, Reduction, Suspension or Withdrawal of Certification

Specific Requirements for Medical Device CABs

In addition to the requirements specified in ISO/IEC 17065:2012 Section 7.11, if the CAB is recommending termination, reduction, suspension, reinstatement, or withdrawal of certification without being requested by the manufacturer, they shall notify the recognizing Regulatory Authority within 5 working days. If required in the regulatory jurisdiction, final decisions regarding termination, reduction, suspension, reinstatement, or withdrawal of the certification shall be performed by the recognizing Regulatory Authority.

Records

Specific Requirements for Medical Device CABs

Records maintained by the CAB related to manufacturers shall include the following, in addition to the requirements in ISO/IEC 17065:2012:

1. regulatory submission information and regulatory review reports;
2. identification of any non-conformities identified during the certification process, and the actions taken to address these non-conformities;
3. committee deliberations and decisions, if applicable;
4. any correspondence with Regulatory Authorities regarding certification decisions or changes in certification; and
5. any certification documents, including the reports and certificates discussed in Section 7.7.2 of this document; and
6. any other relevant records necessary to establish the credibility of the certification.

Records related to certification activities shall be retained for a time frame specified by the recognizing Regulatory Authority.

Complaints and Appeals

Specific Requirements for Medical Device CABs

The CAB shall forward to the recognizing Regulatory Authority(s) information on any complaint (e.g. whistleblowers) it receives about a medical device manufacturer that could indicate an issue related to the safety and performance of medical devices or a public health risk.

Any appeals regarding a regulatory review performed by the CAB shall be handled by the CAB. The CAB shall notify the recognizing Regulatory Authority of any decision made regarding these appeals that changes the final review decision. The recognizing Regulatory Authorities may also establish their own process for further appeals, subsequent to appeals made to the CAB.

Management System Requirements for Medical Device CABs

Options

Specific Requirements for Medical Device CABs

The CAB shall establish, document, implement, maintain, and operate a quality management system that is appropriate to the nature, area, and scale of its reviews and capable of supporting and demonstrating the consistent achievement of the requirements of applicable medical device legislation or regulatory policies/programs.

The CAB shall retain records of conformity to this document for a period of time not less than 15 years from the creation of the record.

The CAB shall perform measuring, monitoring and the analysis of their review program to provide information relating to the characteristics and trends of their processes such as: consistency in regulatory review reports, feedback from medical device manufacturers, etc.

The CAB, when adhering to Option A or Option B under Clause 8 of ISO/IEC 17065:2012, shall conduct internal audits that cover its organization’s structure and activities at all locations involved in medical device regulatory reviews.

General Management System Requirements (Option A)

Specific Requirements for Medical Device CABs

No specific requirements.

Control of Documents (Option A)

Specific Requirements for Medical Device CABs

No specific requirements.

Control of Records (Option A)

Specific Requirements for Medical Device CABs

No specific requirements.

Management Review (Option A)

Specific Requirements for Medical Device CABs

No specific requirements.

Internal Audits (Option A)

Specific Requirements for Medical Device CABs

No specific requirements.

Corrective Actions (Option A)

Specific Requirements for Medical Device CABs

No specific requirements.

Preventive Actions (Option A)

Specific Requirements for Medical Device CABs

No specific requirements.

Information Requirements

Information Exchange Between the CAB and Recognizing Regulatory Authority(s)

The CAB shall designate a function within its organization for timely exchange of information with recognizing Regulatory Authority(s) or to respond to enquiries from recognizing Regulatory Authority(s). The CAB shall fulfill this function at all times.

The CAB shall report to the recognizing Regulatory Authority(s) that performed its initial recognition when it becomes aware of any fraudulent activities or counterfeit products. The CAB is not responsible for establishing objective evidence but must report such activities or products in writing within 5 working days from the date of discovery.

The CAB shall provide information to the recognizing Regulatory Authority(s) about any regulatory reviews and decisions to grant or refuse certification. Recognizing Regulatory Authorities may have their own requirements regarding the timing and mechanism for providing this information.

The CAB shall notify the recognizing Regulatory Authority(s) in writing within 5 working days from the date of a decision to terminate, reduce, suspend, reinstate, or withdraw certification. The notification shall include a rationale for such action.

The CAB shall notify the recognizing Regulatory Authority(s) in writing within 5 working days of changes in matters that may affect the abilities of the CAB to fulfill the requirements for recognition, such as:

1. its legal, commercial, organizational or ownership status;
2. the points of contact for regulatory coordination group activities discussed in Section 5.1.4 of this document;
3. address(es) of the CAB; or
4. scope of recognition as a CAB.

Revoking Recognition of a Medical Device CAB

The recognition of a CAB shall be revoked if a CAB does not meet the requirements of this document with due process.

Disclaimer

© Copyright 2024 by the International Medical Device Regulators Forum.

This work is copyright. Subject to these Terms and Conditions, you may download, display, print, translate, modify and reproduce the whole or part of this work for your own personal use, for research, for educational purposes or, if you are part of an organisation, for internal use within your organisation, but only if you or your organisation do not use the reproduction for any commercial purpose and retain all disclaimer notices as part of that reproduction. If you use any part of this work, you must include the following acknowledgement (delete inapplicable):

“[Translated or adapted] from [insert name of publication], [year of publication], International Medical Device Regulators Forum, used with the permission of the International Medical Device Regulators Forum. The International Medical Device Regulators Forum is not responsible for the content or accuracy of this [adaption/translation].”

All other rights are reserved, and you are not allowed to reproduce the whole or any part of this work in any way (electronic or otherwise) without first being given specific written permission from IMDRF to do so. Requests and inquiries concerning reproduction and rights are to be sent to the IMDRF Secretariat.

Incorporation of this document, in part or in whole, into another document, or its translation into languages other than English, does not convey or represent an endorsement of any kind by the IMDRF.

Please visit our website for more details.

www.imdrf.org

1. Per ISO/IEC 17065:2012, the recommendation and certification decision shall be carried out by person(s) who have not been involved in the evaluation process. ↑

2. Per ISO/IEC 17065:2012, the recommendation and certification decision can be completed concurrently by the same person or group of persons (final reviewer). ↑