Adding a New Site to Our ISO 13485 Certification

We are a US-based small medical device designer and manufacturer of custom software that is installed on a PC we assemble using commercial off-the-shelf components. We currently have a single location (corporate headquarters) on our ISO 13485 certificate, but we want to add a second location for finished device manufacturing (i.e. assemble PC and load with our software). Both sites will operate under the same management and QMS.

We have been told by our notified body that we must have an interim audit performed at the new location prior to including that location on our certificate and will need to quarantine all products manufactured at this location until approved by NB. I agree with the first part of this statement; however, I question the second part.

I believe that once the site has been registered with the FDA, finished devices can be shipped for the domestic market (i.e. US only) prior to adding the location to the ISO 13485 certificate. Currently, none of our domestic products include the CE-label only those that are exported, so these finished devices would not be CE-marked. I agree that any CE-marked product would have to be quarantined until approval by NB.

Does this make sense?

Generally I agree with you. The NB probably referred only to CE marked products that are intended for the EU market.

ISO 13485 certification, CE marking and EU distribution should be viewed separately from FDA registration and US distribution (non CE marked products). ISO 13485 certification (and scope) is not directly related to FDA registration / compliance (I assume you don't participate in the MDSAP pilot program).

Thanks for the reply. Hopefully I'll have a confirmation from our NB tomorrow.

Good. Please address your CE mark body as the NB (Notified body) and your ISO 13485 certificate body as the CB (Certifying body) for clear understanding, even though they may be the same entity.
Your CB cannot dictate to you about product quarantine.

Our CB and NB are the same entity.

Anyone want to comment on the first two paragraphs?

The following is the response from our NB/CB:

We would still advise that the client wait until the extension to scope audit of the new manufacturing location has been completed satisfactorily, before the associated product from the new location is distributed into the U.S.

The product should not be released until the extension to scope audit has been completed satisfactorily and a certificate issued, thus verifying and validating that the new location meets the necessary requirements of the extension to scope Audit, for the product manufactured at the new location.

From an E.U. perspective, non-CE marked product cannot be distributed and sold into the E.U., especially if it has been manufactured from an un-approved location.

kmbird33 said:

Anyone want to comment on the first two paragraphs?

The following is the response from our NB/CB:

We would still advise that the client wait until the extension to scope audit of the new manufacturing location has been completed satisfactorily, before the associated product from the new location is distributed into the U.S.

The product should not be released until the extension to scope audit has been completed satisfactorily and a certificate issued, thus verifying and validating that the new location meets the necessary requirements of the extension to scope Audit, for the product manufactured at the new location.

From an E.U. perspective, non-CE marked product cannot be distributed and sold into the E.U., especially if it has been manufactured from an un-approved location.

Click to expand...

What an incoherent response.

What jurisdiction do they have over distribution to / in the US???

I would suggest that the NB/CB response is simply a result of their in-built caution.

If you go ahead with US distribution, before extension audit, there is some possible elevated (commercial) risk but that is for you to decide.

Ronen E said:

What jurisdiction do they have over distribution to / in the US???

Click to expand...

No jurisdiction whatsoever. The ISO 13485 certification of the PC assembly plant is not a requirement for the product to be traded in the USA. Unless there are special circumstances not yet disclosed in this thread, that response makes no sense and would make me question the technical knowledge and wisdom of whom ever provided that.

In response to Pads38 comment, our concern is the potential for negative impact on our certifications.

In response Sidney's comment, the following is the verbiage on our certifications:

Directive 93/42/EEC on medical devices
For the following products:
"..... image management software."

ISO 13485:2003
EN ISO 13485:2012
For the following articles:
"Design, manufacture and installation of advanced image management software."

I would consider the PC an accessory since it has no custom components - our software is the only custom component. There is no reason that if we purchased an assembled high-end PC that met our specifications that it couldn't be used.