Eric Henry

I read the ISO 18969 draft. First thought: “𝘶𝘴𝘦𝘭𝘦𝘴𝘴.” Second thought: “𝘞𝘦𝘭𝘭, 𝘐’𝘭𝘭 𝘯𝘦𝘷𝘦𝘳 𝘣𝘦 𝘫𝘰𝘣𝘭𝘦𝘴𝘴.” That’s a problem: A standard that secures work for consultants. And way too many ISO standards are inconclusive. There’s a legend in the field. A consultant saying to a Notified Body: “𝘐 𝘶𝘯𝘥𝘦𝘳𝘴𝘵𝘢𝘯𝘥 𝘐𝘚𝘖 13485 𝘣𝘦𝘵𝘵𝘦𝘳 𝘣𝘦𝘤𝘢𝘶𝘴𝘦 𝘐 𝘢𝘮 𝘪𝘯 𝘵𝘩𝘦 𝘐𝘚𝘖 𝘨𝘳𝘰𝘶𝘱.” True or not, this story shows the mindset. The goal is the seat at the table, not the standard content. If ISO really wanted clarity, it could start with: - open review - anonymous contribution - free access to groups - free standards Manufacturers don’t need more vague pages. They need clarity.

65

35 Comments

Ah, QMSR and ISO 13485. Sounds like a meet-cute between two regulations, doesn't it? Cast your mind back to 1996, when both the QSR and ISO 13485 burst onto the scene around the same time. The FDA, with their usual grandiose proclamations, declared the QSR would banish redundancy and save industry a whopping $439 million. (Spoiler alert: FDA math has, shall we say, not quite panned out as promised.) Fast forward to today, and the whole idea behind QMSR was to finally harmonize with ISO 13485. And for the most part, it does. QMSR embraces most of ISO 13485, even borrowing a bit from ISO 9000 (specifically clause 3). But here's where it gets amusing: while it doesn't explicitly reference the risk management standard ISO 14971, the FDA fully expects you to know they're talking about it when they say "risk." It's like a secret handshake for regulators – they don't require you to follow it, but you better know what they mean. And it gets even better! The QMSR has a delightful preamble that attempts to explain the parts that don't quite harmonize with ISO 13485. Think of it as a "it's complicated" relationship status. This includes definitions, labeling and packaging, UDI details, and reporting and removal processes. This isn't just regulatory wordplay either, because the FD&C Act often trumps ISO, and other regulations might have their own definitions too. So, it's not always a straightforward path. Good times. Remember - you've only got so much to get cozy with these changes. February 2026 is the deadline, which is not a lot of time in the regulatory world. If you need help, or if you still have questions about navigating the QMSR and ISO 13485 labyrinth, give me a call. I'll be happy to walk you through it. #medicaldevices #regulatoryaffairs #FDA #compliance #quality #qualitymanagement #medtech #biotech #submissions #QMSR #iso13485

140

10 Comments

🧠 QMS Myth #2: “Once we implement it, we’re done.” Spoiler alert: Nope!!!   A Quality Management System isn’t a checklist you complete once and forget.   It’s a living, breathing framework that needs constant care—like a plant... or a gremlin (don’t feed it garbage after midnight). 🚨 Here’s the truth: ✔️ Procedures get outdated. ✔️ People change roles. ✔️ Products evolve. ✔️ Risks shift. ✔️ Regulations update.   If your QMS hasn’t been touched since go-live, it’s not “mature”—it’s flatlined. 🫠 (And it might not survive your next audit.)   ✅ A healthy QMS has a pulse—fed by internal audits, CAPAs, metrics, and leadership engagement.   Let’s stop treating implementation as the finish line.   It’s the starting gate.   #QualityManagement #QMS #MedTech #FDACompliance #ISO13485 #ContinuousImprovement #BushmanQC #vQMS

322

34 Comments

Last week, I asked: 'Is it acceptable to close a CAPA as ‘effective’ when the root cause hasn’t been entirely eliminated?' 315 people from the medical device world answered: → 127 (40%) say yes → 188 (60%) say no Why did I ask? Nothing is worse than working on a CAPA for months (or even years) and realizing that the actions seem ineffective. Now, I am not talking about a sloppy investigation that didn't identify the root cause or poor actions. (The inadequate CAPAs need to be redone. Period.) This is about: 1. You've put due diligence into the RCA 2. You've implemented the best actions you could 3. But the problem is still recurring What do you do now - close or start from scratch? I see both sides, but as always → context matters: CAPAs are about reducing risks to an acceptable level. Recurrence doesn't always mean failure. Here's what matters to me: • Did I understand the root cause? • Was the action plan adequate for the risk level? • Is the remaining risk acceptable? (Plus → Can I justify our decisions?) The reality is: Perfect elimination of every root cause isn't always possible. Sometimes physics, technology, or (unreasonable) additional costs limit what you can achieve. What's important is transparency about: 1. What level of improvement have you reached 2. How do you monitor ongoing performance 3. Why do you consider it sufficient Here's my practical approach: • Define clear effectiveness criteria upfront • Document the rationale for acceptance • But still maintain oversight of recurring issues The key is making informed decisions: You either chase unrealistic perfection or accept reasonable improvements while maintaining control. But remember: Whatever you decide, make sure you can defend it. PS - Do you agree? _________ Follow Georg Digel to learn more about effective NC & CAPA management in the medical device industry.

156

67 Comments

In New Product Development, it’s rarely a lack of engineering skill that derails a design. It’s when engineering happens without compliance in mind. When Regulatory joins the design table early, those brilliant but non-compliant designs turn into compliant, real-world successes. Regulatory Affairs is often seen as a downstream function- brought in to review documentation, verify compliance, and sign off on design controls. But when RA joins too late or remains a “silent partner”, opportunities to shape smarter, safer, and more compliant designs are missed. When regulatory professionals are part of the early design discussions, we can help interpret how guidances and standards apply, anticipate potential compliance challenges, and strengthen risk assessments before they become roadblocks. Involving RA early isn’t just good practice, it’s good design strategy. It saves time, reduces rework, and leads to more robust, globally ready products.

54

2 Comments

Heads up! FDA just announced an update to the "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions" final guidance. Note that this is a final guidance. The primary change is the addition of Section VII to consolidate the premarket cybersecurity guidance from 2023 with the subsequent "Select Updates for the Premarket Cybersecurity Guidance: Section 524B of the FD&C Act" guidance from 2024, which defines a cyber device subject to Section 524B of the Federal Food Drug and Cosmetic Act revised in December 2022 to add additional cybersecurity requirements to medical devices.

305

13 Comments