A group member asks, “Does a device manufacturing site need to be GMP-certified by local authorities or is ISO certification enough for a CE mark application?”

Dr. Peter Drechsler
Senior TQM Manager at Allmed Medical Industries GmbH
Dear all, first of all we have to talk about EN ISO 13485, if we talk about the medical device directive (MDD 93/42/EC). The EN ISO 13485 is one of the harmonized standards with regard to the MDD. Fulfilling this harmonized standard leads to the presumption of conformity of some parts of the MDD. This can be clearly seen in Annexes ZB.x of the EN ISO 13485. For 93/42/EC it’s annex ZB.3. Off course EN ISO 13485 is volontary, but without following EN ISO 13485 a manufacturer of medical devices needs to prove that his approved QMS is state of the art.

And Sarah basically nailed it.

The “manufacturing site” can but must not be the same site as the site of the legal manufacturer. A manufacturing site is considered the site(s), where the device is manufactured. That could be more than one site.
The site of the legal manufacturer must be audited by the Notified Body as well, since MDD requires processes like vigilance, complaint handling etc, which are mostly located at this sites.

Marketing a device only with a EC-certificate and without a EN ISO 13485 certificate might be difficult. When it comes to tender business, they often require a EN ISO 13485 certificate.

Philippe Deprez
Dr. Med and Surg., Medical and research Dir. Skin Tech Pharma Group; Dir.Clinica Hera, Empuriabrava,Spain
Yes, Francisco, exactly what I said: what is necessary is the respect of the ISO 13485 rules. Certification is a volontary step only but you can demonstrate that you follow 13485 rules without certificate. Getting a certification for 13485 allows you to demonstrate it once (+ following controls); it’s easier simply.
13485 belongs to the management of company.
CE comes after approbation of the specific med dev file
A company has one 13485 only but should have as many CEs as it has different medical devices

Francisco Revuelta Basagoiti
Europe Quality & Regulatory Affairs Director en Nippon Gases Euro-Holding S.L.U.
I am fully agree that it is possible to apply for CE without GMPs as it is not related scope in spite it is a quality management system and probably if following one it is covered the other but not necessarilly.
The ISO 13485 is the reference to follow if the manufacturing sites are meeting the requirements of the Directive of medical devices to get the CE.This reference to ISO has to be implemented in the manufacturing sites, but in my opinion it is not necessary them to be certified in ISO 13485 to get CE. A certification is a good way to demonstrate the system is following the standard, but it is also possible to demonstrate the same without the certification, to be confirmed by the Notified Bodies with their sampling audits. I opened yesterday a debate in other group about the obligation to be certified or not in ISO 13485 to get CE. The main reason of the debate was the change of audit programs required by Notified Bodies for ISO 13485, not allowing now sampling in muktisite certification with the lot of related incovenience in costs and resources.
As a summary, ISO 13485 is necessary to be implemented to get CE manufacturing authorisation, this doesn’t imply to be certified. Other certification such as GMPs are useful but not enough to the meet the requirements. On the other hand, the fact of meets the ISO 13485 is not enough to get the CE due to an important part is the product Technical File to be approved and maintained with the Notified Body.

Philippe Deprez
Dr. Med and Surg., Medical and research Dir. Skin Tech Pharma Group; Dir.Clinica Hera, Empuriabrava,Spain
In short, you can apply for a CE without having GMP, but not without ISO 13485.
On the other hand, I totally agree with Sarah. Differently explained; ISO13485 is a volontary quality management system for the whole company, not for the nedical device. ISO 13485 has directly nothing to see with the medical device per se because it only interests the way the whole company works in general. That’s globally the same as ISO 9001, but with a much higher level, closer to farmaceutical, for med dev manufactures.
The lab manufacturing the medical device needs other ISO’s (for clean/very clean rooms- ISO 5-6-7-… for example), giving evidence of the respect of harmonized rules of building the lab.
Lab’s machines need their own CE, and other ISO rules determine what to do with nachine for them to be conform.
AFter getting ISO for lab and for company’s management, the company has to undergo controls from european state that will give authi¡orization – or not – to manufacture a specific medical device (authorization is not global for any med.dev.)
The CE is another story, independent of ISO and of authorizations: it only gives the possibility to freely sell the product in europe, without any restriction. You can’t get a medical CE, if you have no evidences about your respect of ISO 13485.
Finally GMP is also something different: Good Manufacture Practice (GMP) is needed for pharmaceutical production. It only can be emitted by the state in the case of pharmaceutical companies. Medical devices producers are used to emit a GMP certificate on their own, based on the respect of 13485, lab protocols respect, Iso and CE, but it is not a “reel” GMP, impossible to get from state if not pharmaceutical.

Sarah H. Stec
Senior Counsel, Medical Device Regulatory Law at Johnson & Johnson
What are we calling the “manufacturing site?” Is it the site of the legal manufacturer, or the site of the factory if using a contract manufacturer (in terms of the EU regulations, they could be different)?

For the legal manufacturer, usually the party that would apply for CE marking in the first place, the medical devices directives have their own quality management system requirements (EN ISO 13485:2012 is the voluntary harmonized standard that allows a presumption of conformity to the QMS requirements in the directives). A quality management system that complies with the requirements in the medical devices directives (using EN ISO 13485:2012 as a tool to get there) would be needed for a medical device CE marking application. A Notified Body would assess the QMS and the product to ensure their conformity with the appropriate medical devices directives and harmonized standards (if you claim conformity to them) that you would use for CE marking purposes.

Bruce Youngman
Dedicated to improving value
Seems there are a couple of different things happening with this question so it can be viewed in different ways by responders. There are numerous ISO standards so I will assume that by meaning ISO certification it is to one or more of the Quality Management Systems standards. These would be more “in-line” with Good Manufacturing Practices (GMP) rules. CE deals with the technical aspects of the product(s) themselves. ISO certification alone I would say is not sufficient to satisfy the rules for CE marking.