Just released as of June 25, 2014 this NBRG Consensus Paper for the Interpretation and Application of Annexes Z in EN ISO 14971:2012 is finally available.  Be forewarned that the document is not yet adopted by the NBRG, which can only be done at the next Meeting in October 2014.  Hopefully it will be adopted at that meeting.  I will check in with my NBRG Risk Management Working Group contacts to find out if they know more about that issue.

But let’s take this chance to review a little about the document and the history of the EN ISO 14971:2012 Annex Z’s.  Future posts will get into more details. The following 3 paragraphs come straight from the introduction of the document as the Working Group summarizes the situation really well.  I happen to know a couple of these working group members personally and I know they have a very good handle on the situation and they have provided some very good background.  

In October 2010, the regular review of ISO 14971:2007 which is the basis of EN ISO 14971:2009 was closed by a broad majority of votes confirming the existing status and the wide-spread acceptance of this standard in the medical devices community, including competent authorities. In November 2010, the European Commission raised a formal objection against the use of several harmonized standards, including EN ISO 14971, followed by an in-depth assessment of the coverage of the Essential Requirements of the Medical Device Directives (90/385/EEC, 93/42/EEC and 98/79/EC) by these standards.

As a result of these objections, the Annexes Z to EN ISO 14971 were modified, resulting in EN ISO 14971:2012. This amendment of the EN ISO 14971 standard did not modify the normative parts of ISO 14971:20071. The Annexes Z describe the extent of presumption of conformity that can be based on application of the normative requirements of ISO 14971 alone. The “content deviations”, expressed in the revised Annexes Z, between ISO 14971:2007 and the Medical Device Directives have been commented by many experts in the field of risk management and resulted in diverging interpretations from different stakeholders (e.g. manufacturers, notified bodies, competent authorities).

This document has been prepared as a Notified Body Consensus Paper by a working group headed by the NBRG Vice Chair, with representatives from several European Notified Bodies and industry associations COCIR, Eucomed, EDMA and ZVEI. The paper aims to provide a practical interpretation of these “content deviations” to the Medical Device Directives and give guidance as to how to implement the risk management requirements. The work consolidates prior publications of various sources and is intended to facilitate common understanding between industry and Notified Bodies.

If you would like further info on the consensus document and some history please check out the previous posts below (Latest to Oldest):

• MD&DI Article “Collaboration Holds the Key to Clarity on EN ISO 14971:2012”

• NBRG Consensus Document on EN ISO 14971:2012 Is On Its Way MD&M West ’14 Presentation 

• NBRG Call for Industry Participation – Survey Understanding Annex Z EN ISO 14971:2012

This post is a status update on the NBRG RMWG Risk Management Consensus Document

30 April 2014 – The NBRG (Notified Body Recommendation Group) Risk Management Working Group (RMWG) membership will have a face to face meeting in mid May to refine the draft Consensus document on EN ISO 14971:2012.  This meeting has come about because the NBRG RMWG received some feedback recently from the EU Commission and they will consider it and roll it into this document.

The consensus document’s purpose is to reduce the confusion around the EU Harmonized Standard EN ISO 14971:2012 Annexes ZA, ZB, & ZC that amends the EN ISO 14971:2009 version of the standard to align with the 3 Medical Devices Directives (the Medical Device, Active Implantable Medical Device, and In Vitro Diagnostic Medical Devices Directives). The previous plan was to have this Consensus document completed and released by Mid to Late April ’14 but at this point it is hoped the NBRG RMWG will have a final released document by the end of June 2014. We look forward to sending good news about the progress of this document over the next month or so.

If you would like further info on the consensus document and some history please check out the previous posts below (Latest to Oldest):

• MD&DI Article “Collaboration Holds the Key to Clarity on EN ISO 14971:2012”
• NBRG Consensus Document on EN ISO 14971:2012 Is On Its Way MD&M West ’14 Presentation
• NBRG Call for Industry Participation – Survey Understanding Annex Z EN ISO 14971:2012

The NBRG (Notified Body Recommendation Group) Risk Management Working Group is working to put together a consensus document.  A call to industry has been sent out to ask for participation in a survey on how your risk management system aligns with EN ISO 14971:2012 that will help in the direction of this consensus document so please take part in it.  Read the article for more details and a post that links to the survey.

Past posts on this subject include:

• NBRG Consensus Document on EN ISO 14971:2012 Is On Its Way MD&M West ’14 Presentation
• NBRG Call for Industry Participation – Survey Understanding Annex Z EN ISO 14971:2012

If you need help with Risk Management with respect to the IEC 60601 series of Standards, email Leo Eisner directly at Leo@EisnerSafety.com, or call Leo at +1-(503)-244-6151. He is the Principal Consultant of Eisner Safety Consultants (bit.ly/EisnerSafetyConsultants).

The live link to the survey is on the fourth set of pages on slide deck and is slide 8 of the presentation.  The more participants in the survey the more likely your voices will be heard and we hope this will improve the potential outcome of the process.

On 8 February we posted the NBRG letter which was a Call for Industry Participation in the Survey on Understanding Annex Z of EN ISO 14971:2012. 

[slideshare id=32021997&doc=mdmwestpresentationonnbrgconsensusdocumentoneniso14971201211feb2014-140306235842-phpapp01&type=d]

On 7 February 2014 the Vice Chair of the Notified Body Recommendation Group, Michael Bothe, sent out a letter to industry to ask for their participation in a short survey (about 10 minutes long) to help the Notified Bodies understand what are industry’s current practices when it comes to conducting Risk Management Process on their medical devices and IVD’s and how it relates to EN ISO 14971:2012.  As the letter says it is to “attempt to develop a practical interpretation on how to use and implement Risk Management in the context of the European Medical Devices Directives, more specifically the European version of ISO 14971:2007, as published in EN ISO 14971:2012.”

Please join in on this survey, as the more participation the more representative the data will be to the Notified Bodies and hopefully this will make for a better Consensus Document on EN ISO 14971:2012 Risk Management Process.  Please complete your survey responses by 21 March 2014.

To find out more about what is going on with this proposed Consensus Document please join me, Leo Eisner as the track chair for Improving Risk Management Strategies and Procedures, at the MD&M West conference on Tuesday 11 February 2014, as I discuss how we got to this point and what is hopefully going to culminate in a Consensus Document on Risk Management with regard to EN ISO 14971:2012.

If you have questions about this topic or need help with compliance with your Medical products you can e-mail Leo Eisner at Leo@EisnerSafety.com directly or call Leo at 503-244-6151.  Leo is the Principal Consultant of Eisner Safety Consultants.

I (as a medical device consultant, US TAG member of IEC SC 62A & 62D & Convener of SC62D JWG9 {IEC/ISO/AAMI/CENELEC 80601-2-58} and a past Notified Body Auditor) am really pleased to see the extremely hard work that has gone into this document and also in the value that it will pass on to all the stakeholders.  There are many stakeholders that were involved in this process including Notified Bodies, NB-MED EN 62304:2006 issues team (Thank you for your hard work.), NB-MED, COCIR (European Coordination Committee of the Radiological, Electromedical and Healthcare IT Industry), Manufacturers, OEMs, Standards Developers for EN & IEC & other national standards bodies, Test Houses, Consultants, other countries regulatory bodies (i.e. FDA, Health Canada, etc.) and more.  By use of so many different stakeholders that submitted some of these and other questions this document has a much more consistent view on the implementation issues with the complexity of the topic of medical device software.  

This document is good for learning about your specific implementation issue(s) or if you have the time I would highly recommend reading the whole document, as this will help you understand the intricacies of some of the situations of implementing EN 62304 with respect to the Medical Devices Directives (I’m sure there are more issues but a good portion have been captured by this first version).  I believe this document would be of great help to implement similar guidance documents for many other national medical device regulatory agencies around the world for IEC 62304:2006 (or their national version of the standard).

The Table of Contents gives a good glimpse into the realm of the issues covered in this document and covers the following topics.  I also provide a further glimpse into the document by summarizing some of the specific issues within those sections (these are the indents furthest to the right):

• Introduction (background of the purpose, rationale, the main team members, and how to provide more feedback on the document)
• Abbreviations (Section 1)
• Questions and Answers (Section 2 – Heading of sections 2.1 – 2.7)
• Scope of EN 62304 (Section 2.1)
• Goes into various different scenarios and discusses the implication and implementation issues around these scenarios: such as SAAS, Embedded software including FPGA’s (a hotly contested issue) with single chip computers, Hardware Description Languages specifying FPGAs, Stand alone software, Medical apps, Excel macros, Open & closed systems, Internet or cloud based, Server based systems, Network devices.  In addition to this list of scenarios this section also goes into questions about certification; is Validation included in this standard & if not where does it get covered; what are the expectation of the Notified Bodies with regard to the standard; can you use only part of the standard; why do class A software to EN 62304; what is IEC 82304 about (software only products); among other questions.
• Placing Software as Medical Device on the Market (Section 2.2)
• Explain ‘placing medical device (in this case software or software {s/w} as part of a system) on the market’ in EU if EN 62304 is sufficient, by itself to do this; can I change my intended use and avoid these EU guidelines and regulations; Conformity Assessment routes of the MDD; other countries acceptance / requirement of the standard; can you sign-off on documents electronically; classification of software as a MEDICAL DEVICE; how do Notified Bodies (NB’s) confirm compliance to the standard; among other questions.
• Life-cycle Processes (Section 2.3)
• If s/w development is an outsourced activity what does NB expect; does this std have an equivalent expectation to requirements such as those addressed in FDA Part 11 (Electronic Records & Signatures) in the US; details on the review process at the end of each iteration when updated versions are available during the design and development of the software; does the std require a specific development process; how split up the requirements/responsibilities of the std between the manufacturer and s/w sub-contractor; how do the maintenance activities in the std relate to ISO 20000/ITIL; what are the artifacts (documents) required by EN 62304; at what level does the Problem Resolution Process apply; does software refactoring require a formal change request; what to include in the Technical File to show compliance with EN 62304; how can agile processes be EN 62304 compliant; among other questions.
• Risk Assessment and Risk Management (Section 2.4)
• How deal with risk control measures; when & why can the safety class of a s/w SYSTEM be reduced; how use ISO 14971 with EN 62304; explain Hazard, Cause, Sequence of Events in the context of software; when should we expect additional Software Hazard Analysis guidance within EN 62304; among other questions.
• Classification and Segregation (Section 2.5)
• What is segregation and how do I prove effective; use of a specific class(es) of s/w using COTS (commercial off-the-shelf) what criteria used; how does severity under intended use relate to s/w safety class; is s/w class optional; can you downgrade the classification of the system without a fully hardware protective system; does the compiler need to be classified under EN 62304; how are development platforms & tools related to s/w safety class; relation between Risk Analysis at System level & S/W Safety Classes; explain how the 3 safety classification in the std differ from the FDA’s 3 levels; correlate IEC 61508 SIL levels to EN 62304 safety classifications; s/w classification is a real issue with big implications; among other questions.
• Specifications, testing and tools (Section 2.6)
• I’m a manufacturer of medical devices – how do I document my requirements and tests; web-based medical s/w – does the std have specific requirements related to digital cert’s, (http or https) server requirements; in regard to the std how deal with risk analysis and functional specs; appropriate level of granularity of requirements as design input, design description; which (if any) of the tracing requirements are meant to be bi-directional; questions around deployment of the s/w; what is required of open source code from the std; among other questions.
• SOUP (Software of Unknown Provenance) and Legacy Software (Section 2.7)
• How assess & qualify suppliers of SOUP s/w, when the s/w hasn’t been developed for incorporating into a medical device; what testing & documentation does EN 62304 require for SOUP to meet the std; s/w that is either stand-alone or embedded which was designed prior to publication of EN 62304 but still being placed on the market (legacy product) – what needs to be done; if legacy s/w needs significant change, what processes & documents are required to achieve &/or maintain compliance with EN 62304 and when are changes considered significant;
• References (No Section Number – just after Section 2.7)
• Software Problem Resolution Process (Annex 1)
• Helpful diagram – There are several entry points to the problem resolution process, both during development and maintenance of the software (refer to question 2.3.12).
• SOUP selection, assessment & qualification (Annex 2)
• Flowchart & text to explain an example
• Traceability (Annex 3)
• The 3 flowcharts show an overview of the dependencies which need to be traced according to EN 62304 for all 3 classes – refer to note in bottom left corner of page to know which class the flowcharts apply to (refer to question 2.6.7).
• Position paper on direct diagnosis (COCIR, 2011) (Annex 4)
• As the different stakeholders may interpret this term differently, COCIR and EUROM VI wanted to share their understanding of the term “direct diagnosis”. (Refer to question 2.5.13)

Click on the weblink to see the initial request for questions that we posted on our website 26 May 2012.  To see the posting please go to http://www.eisnersafety.com/do-you-know-how-to-use-en62304-med-dvc-sw-life-cycle-as-implemented-under-themdd-aimdd-doc/

Team-NB is a voluntary organization of Medical Device Notified Bodies (doesn’t represent all EU NB’s under the 3 Medical Device Directives) and as of 12 Nov 2012 there are now 35 members.  During the 9 Oct 2012 Assembly in addition to the adoption of the CoC three (3) new members were unanimously added (LGA InterCert GmbH – Nurnberg Deutschland, UDEM – Ankara Turkey, and ALBERK QA TECKNIC – Istanbul Turkey).

The Version 3.0 Code of Conduct for Notified Bodies under Directives 90/385/EEC, 93/42/EEC, & 98/79/EC is a very thorough document which is 31 pages long and includes the Unannounced Inspections (or Unannounced Audits of Medical Device Manufacturers that are Certified under the applicable Medical Directive) which comes from the recently proposed Medical Device Regulations.  As of the 30 October 2012 News Release 14 Notified Bodies had signed the V3.0 CoC and 2 additional NBs (LNE/G-MED & DQS) signed prior to 12 Nov 2012.  It is anticipated that more NBs will sign in the near future as they adopt the policies covered within the V3.0 CoC which shows their commitment to improve the implementation of the EU CE marking certification of medical devices through clarified organizational criteria, management of competence and assessment practices.  The major topics in the document are:

• Implementation, enforcement and monitoring of the Code of Conduct
• Qualification and Assignment of Notified Body Assessment Personnel
• Minimum time for Notified Body assessments
• Unannounced visits
• Sampling of class IIa and IIb technical files
• Design Dossier Reviews
• Rules for subcontracting
• Rules for Certification Decisions 

Further revisions will be made to be in line with the new developments of the European legislation.