Operator vs. Manufacturer Relationship and ISO 13485 / CE Requirements

[shimonv]

Hi all
Here is my question:

Company A is medical device manufacture outside the US and EU with ISO certificate 13485.​

Company B is the owner/applicant/operator of the products produced by company A and is situated in the US.​

Company B does sells and after service support for the products produced by company A to both US and EU market.​

​

Does company B have to comply with ISO 9001 or 13485 assuming it does not modify the product or labeling?​

Does company B needs to be audited by notified body since the CE is registered to its name?


Thanks!
Shimon
​

 

[MIREGMGR]

Yes, as the responsible manufacturer, Company B must have both an ISO 13485 quality system certificate and an appropriate CE certificate. Company B's QMS also must be US FDA QSR compliant.

Company A is a contract manufacturer.

Note that for the US, both Company A and Company B must be Registered and must List the devices...Company A as a contract manufacturer outside the US, Company B as the specification provider and as the initial importer.

Also note that for USA, both companies must have MDR reporting systems, and must coordinate so that both report in a timely manner in regard to any reportable incidents communicated to either.

 

[shimonv]

Thanks MIREGMGR!​

And what if A and B are parent company and subsidiary, where B is the parent company situated in the US and does only sells and after-sell support.

A is the R&D and manufacturing subsidiary outside the US.

I gather both will need to register with FDA, and the CE certificate & FDA clearance letter will be issued to the owner, which is B.

What about ISO 13485? should it be issued to A or B or is there a need for two separate certification which is costly and does not make sense to me since for all purposes and intent - B is like a distributor.


Shimon

 

[MIREGMGR]

If the two companies are legally related, you get into complicated territory on the FDA side in which different definitions are used in the various laws and rule sets. If you don't want to get complicated, the conservative approach is to operate as if the companies are independent.

If the two companies operate with full integration, i.e. they only have one Quality Manager and one management structure, then you can justify one quality system and one ISO 13485 certificate. Note that this would require a complicated NB relationship in which two widely separated locations would be supervised.

My assumption though is that because of physical separation, they each have a quality system and management. Given that, the conservative approach is for each to have an ISO 13485 certificate and its own oversight.

B is like a distributor

My view is, never let the fact that a location does distribution, sales and/or support drive your decision as to their regulatory responsibility. These three activities should be the last activities you consider, not the first. As you've described the situation, B is the specification developer and "owns the design" in the sense of being the topmost regulatorily responsible party. If only one location were going to have a regulatory system-stance, in my view it would be B, with A additionally included.

 

[Rocke]

Hi all
Here is my question:

Company A is medical device manufacture outside the US and EU with ISO certificate 13485.​

Company B is the owner/applicant/operator of the products produced by company A and is situated in the US.​

Company B does sells and after service support for the products produced by company A to both US and EU market.​

​

Does company B have to comply with ISO 9001 or 13485 assuming it does not modify the product or labeling?​

Does company B needs to be audited by notified body since the CE is registered to its name?


Thanks!
Shimon
​

Hi Shimon,
If company B is the company mentioned on the labeling, then by definition, they are the manufacturer in the EU. You do not mention what type of MDs are in question, but it is my understanding that a notified body needs to be involved in the CE-marking of all medical devices except for non-sterile class I devices, custom-made devices, and IVD devices not covered by Annex II.

A quality management system is always mandatory and as ISO 13485 is harmonized to the EU MD directives, compliance to the directives is presumed, if this standard is implemented. Certification is not always a requirement - it depends on the product classification.
Activities that are outsourced to e.g. company A can be covered by company A's quality system, if proporly controlled. That all depends on the contractual distribution of responsibilities. Ultimately, the product and all related processes must be under the control of the legal manufacturer.

You should note that if company B (legal manufacturer) is located outside the EU, they require a European Representative, which must be identified on the labeling.

 

[somashekar]

And what if A and B are parent company and subsidiary, where B is the parent company situated in the US and does only sells and after-sell support.

Regulatory do not care about how your business is run and where your subsidiary are located.
Your B can be the lead site and A the site 1.
Look up GHTF guideline on multisite auditing in the post attachment list and formulate your QMS for ISO 13485 per the details in it.
You can even see THIS thread and find the GHTF guideline in it.
Your NB will audit the site B within the MDD assessment periodically and they may also trigger an audit at site A through site B. Your good quality agreement between Lead site (B) and site 1 (A) can be so established to clearly state responsibilities and cover all such regulatory audits.