Sites to List on Multi-Site Certifications

My company is a medical device manufacturer certified to ISO 13485 and MDSAP with a multi-site certification (we also have a MDD EC certificate and are applying for a MDR EC certificate). We are in the process of submitting a change request to our notified body to remove one of the sites we are closing and are taking this opportunity to assess all of our facilities including a new one that we opened a couple years ago to make sure we have the correct facilities listed as sites on our certificate. The guidance we received from our notified body was that any facility that performs work under our quality system should be listed on the certificate unless they are separately certified or treated as a supplier.

The site in question started out as a couple of people doing preliminary technology development work (pre-design controls), but has grown to about 15 people who recently started performing early design control work following our corporate QMS (including writing design input requirements and performing design tests using a small test lab). We currently have a couple other small facilities (~5 people each) that we have historically not included as sites because we have considered them virtual per the IAF MD1 definition (they are software engineers mostly writing code and there is no significant physical presence to their office other than their computers.

One of our VPs that manages the new facility is challenging our regulatory compliance department's recommendation that this new site should be added to our certificate and claims that unless the facility is performing final design verification, they shouldn't be listed. One of his arguments is that site listing is mainly intended for manufacturing facilities and he claims the last company he worked for (a very large and well known medical device manufacturer that coincidentally has been in deep trouble with regulators over the past 5-10 years) had many satellite design facilities that were not listed on their certificates. Our regulatory compliance research did not locate any guidance supporting the claim that only manufacturing facilities should be listed.

I'm looking for feedback on what criteria others are using to decide which facilities are listed on their medical device certificates and which ones are not. Also, feedback on which suppliers need to be disclosed as critical or crucial would be appreciated. We are struggling to come up with a usable internal definition for this.

Thanks

For ISO13485 certification, you can basically choose which sites you'd like to have covered in your certificate.

The issue obviously arises when during your MDR audit, the auditor finds that development work is done in a site that is not listed on your ISO certificate meaning this site should be treated as a supplier including requirements for selection, evaluation and monitoring. Compareble with a situation where you outsource part of your development to an engineering agency and you give them some of your QMS templates. An ISO13485 certification might not be required for such a supplier depending on the activities but you will need to define required controls (e.d. detailed reviews of their output, re-testing, etc.).

I don't know whether such a site when regarded as a supplier may still use your QMS but in your organization chart they should be clearly marked as not being part of the certified organization and they should not participate in your overall management review.

I hope this helps?