When to apply updates to standards

[kreid]

Hello,

We are going through a tech file review at the moment.
Our notified body have implied that to demonstrate that we are complying with applying the 'State of the art' as mention in 2017/745, we need to show compliance to the latest editions of all of the standards to which we claim compliance.
In a previous life, we would maintain compliance to the original baseline of standards from the first version of the marketed device until there was a major update to the device and then we would apply the latest version of the standards.

Does anyone know of some official text that supports either the NB view or my previous approach both described above?

Thanks
Kreid

 

[Ed Panek]

We have a process where when any relevant standard is updated we review the changes and document our decision on what to do.

Notified Bodies often accepted frozen standard baselines if there were no significant design or intended use changes.

There is no direct MDR-era guidance (I'm aware of) that explicitly endorses this practice. However, MDCG 2021-5, allows continued use of a non-latest standard version if it can be justified based on:

Valid risk management considerations, Existing clinical data, Device design constraints.

If you're sticking with older standard versions, justify clearly:

• Provide a risk-based rationale (ISO 14971 framework helps).
• Explain why updating could introduce risk or require new validation.
• Show post-market data proving the current version’s safety and performance.

Document ‘State of the Art’:

• Show awareness of the latest versions (and gaps).
• Include a formal statement that the current standard version still reflects clinical/scientific consensus.
  

During an audit it's important to document "Yes we know about the changes and here is how we interpreted them and that drove to these QMS and testing updates" Remember you know your product better than any auditor will.

 

[EmiliaBedelia]

So this is an aspect that has changed for MDR. MDR introduced the phrase "state of the art". Your approach is no longer acceptable - you can't simply say, we designed this device in 2000 and so compliance with the 2000 version of the standard is acceptable. You need to do more.

Note that this doesn't mean that you have to redo testing and redo everything every few years. You just need to be aware of the "state of the art" and demonstrate that your approach provides an equivalent level of safety and performance. I will say my company found it extremely difficult to justify not fully complying with a standard (for good reasons).... in my experience, good post market surveillance wasn't enough. we needed to compare against other similar devices and show an acceptable safety level in comparison to the state of the art.

In my company we review standards twice a year, do a gap assessment, and (if possible) justify that we can claim compliance to the newest version based on the existing testing/documentation. IMO this is easier than defending using an older standard.... leads to fewer questions up front.
For 10993 specifically, this approach is actually encouraged/explicitly mentioned in the standard to reduce the need for additional animal testing (one of the refreshingly few standards which has a GOAL of not making you do more tests )

This guidance document will hopefully clear up a lot.

https://health.ec.europa.eu/document/download/59ac4cb0-f187-4ca2-814d-82c42cde5408_en

Another note: Even if a standard is harmonized, you need to check the informative annex that tells you which GSPRs it fulfills. It may still be appropriate but if it's not harmonized you may need to provide rationale why use of that standard is appropriate to demonstrate safety and performance for that particular requirement.

 

[kreid]

Two excellent answers, thanks