标准编号:	YY/T 0595-2020
中文名称:	医疗器械 质量管理体系YY/T 0287-2017 应用指南
英文名称:	Medical devices—Quality management systems—Guidance on the application of YY/T 0287-2017
中标分类:	C30    医疗器械综合
行业分类:	YY    医药行业标准
发布机构:	国家药品监督管理局
发布日期:	2020-02-21
实施日期:	2020-4-1
标准状态:	现行
替代旧标准:	YY/T 0595-2006 医疗器械 质量管理体系 YY/T 0287-2003 应用指南
翻译语言:	英文
文件格式:	PDF
中文字符数:	89000 字
翻译价格(元):	7000.00 元
交付时间:	付款后 1 个工作日

Codeofchina.com is in charge of this English translation. In case of any doubt about the English translation, the Chinese original shall be considered authoritative.



This standard is developed in accordance with the rules given in GB/T 1.1-2009.



This standard replaces YY/T 0595-2006 Medical devices - Quality management systems - Guidance on the application of YY/T 0287-2003, with respect to which, the following main technical changes have been made:



——the guidance on each clause in the text is revised based on the text of YY/T 0287-2017;



——"Example of the process of integrating applicable regulatory requirements into the quality management system” is added (see Annex A);



——“Correspondence between YY/T 0287-2017 and Medical devices - Quality management specifications for production (issued on December 29, 2014) and annexes” is added (see Annex B).



Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. The issuing body of this standard shall not be held responsible for identifying any or all such patent rights.



This standard was proposed by the National Medical Products Administration of People’s Republic of China.



This standard is under the jurisdiction of the National Technical Committee on Quality Management of and General Requirements for Medical Devices of Standardization Administration of China (SAC/TC 221).



The previous edition of the standard replaced by this standard is as follows:



——YY/T 0595-2006.





Introduction



This standard provides guidance to assist in the development, implementation and maintenance of quality management systems that aim to meet the requirements of YY/T 0287-2017 for organizations that design and develop, produce and store, distribute and install, service, finally decommission and dispose medical devices, or that design, develop and provide related services, as well as suppliers or other external parties that provide products and services for them.



This standard provides guidance on the application of Clauses 4~8 of YY/T 0287-2017.



This standard provides examples, descriptions and options that help the organizations establish, implement and maintain the quality management system that meets the requirements of YY/T 0287-2017. These examples are not prescriptive, only possible for organizations, and are not necessarily suitable for each organization.



This standard neither adds requirements to or modifies the requirements of YY/T 0287-2017, nor specifies any other requirements. It is intended to help stakeholders understand and apply YY/T 0287-2017 and clarify various available methods and ways to meet the requirements of this standard.



Guidance and other reference information provided by this standard may comply with applicable regulatory requirements, but compliance requirements with any standards and regulations cannot be determined by this standard.



The quality management system of an organization should meet the requirements of customers, the regulatory requirements applicable to the quality management system and the requirements of the organization itself. This standard provides a way for the organization to integrate the applicable regulatory requirements into its quality management system. The "regulatory requirements" cover the requirements of any laws and regulations (such as laws, regulations, ordinances or directives) applicable to users of YY/T 0287-2017, and their application is limited to the requirements of quality management system and the safety or performance requirements of medical devices.



Since the regulatory requirements for the quality management system of the organization may differ with its different roles in the medical device supply chain in different jurisdictions, Annex A provides an example of the process of integrating applicable regulatory requirements into the quality management system, and Annex B provides the correspondence between YY/T 0287-2017 and Medical devices - Quality management specifications for production (issued on December 29, 2014) and annexes.



The application of "risk" within this standard is related to the safety or performance requirements of medical devices or complies with applicable regulatory requirements. Risks may exist in all systems, processes or functions, and adopting a risk-based approach may ensure that these risks are identified and considered in the organization’s processes of establishing, implementing, maintaining and improving the quality management system.



The organization should apply the risk-based approach to all processes required by the quality management system. The organization may apply the risk-based approach to:



——determine the degree of control required for each process of the quality management system;



——identify and handle risks that affect the compliance and effectiveness of the quality management system.



The organization may achieve improvements by responding to processes such as complaint handling, post-market surveillance, nonconformity disposal, corrective and preventive actions. These processes may ensure beneficial and cost-effective improvement of the organization. The quality management system itself does not necessarily bring about the improvement of workflow or products, but it is a systematic method to achieve the organization’s objectives, which may guide the organization to improve the overall performance and provide a solid foundation for the organization's sustainable development plan.



The following auxiliary verbs are used in this standard:



——"shall" is only used in the original text of YY/T 0287-2017, indicating a requirement;



——"should" indicates a suggestion;



——"may" means permission;



——"might" means probability or ability.



"Note" is guidance on understanding or explaining the relevant requirements.





Medical devices - Quality management systems - Guidance on the application of YY/T 0287-2017



1 Scope



1.1 General



This standard provides guidance for the application of the requirements for quality management systems contained in YY/T 0287-2017.



This standard is applicable to various organizations that design and develop, produce and store, distribute and install, service, finally decommission and dispose medical devices, or that design, develop and provide related services, as well as suppliers or other external parties that provide products and services for them.



This standard is not applicable to inspection by regulatory authorities or evaluation by certification authorities.



1.2 Application



1.2.1 General



The relevant requirements of Clauses 6, 7 and 8 of YY/T 0287-2017 may legitimately be omitted in one of two ways: they may be “excluded” or “not applicable”. It is important to note, however, that any exclusion or non-applicability should be detailed and justified in the organization’s quality manual.



1.2.2 Exclusions



The exclusion of design and development should comply with the regulatory requirements. If the applicable regulations allow the exclusion of design and development, this may justify such exclusion by the organization from the quality management system. The organization should provide methods to verify that the design of products and services is sufficiently safe and effective, and explain them in the quality management system. When declaring the compliance with YY/T 0287-2017, the organization should specify any exclusion of design and development from its quality management system.



Some regulatory requirements permit organizations to place some medical devices on the market without having to demonstrate conformance with design and development controls. The organization should determine whether the design and development may be excluded according to the applicable regulatory requirements of different products and the countries or regions where the products are to be launched. For example, if the applicable regulations of the country or region where the products are launched stipulate that the medical device is of certain category (such as low-risk medical device) or the medical device has undergone specific compliance assessment procedures (such as type test), its design and development may not meet the requirements of YY/T 0287-2017, 7.3. Even if the organization is permitted by regulations to exclude the requirements of 7.3, it still has obligations to meet product realization requirements of YY/T 0287-2017, 7.1, 7.2, 7.4, 7.5 and 7.6. In addition, outsourcing of design and development process cannot justify the exclusion of 7.3 from the organization's quality management system.



1.2.3 Non-applicability



The organization may review all requirements in Clauses 6, 7 and 8 of YY/T 0287-2017 according to their roles and activities in different stages of the medical device life cycle and the types of medical devices, and identify those activities that need not be completed by the organization or requirements that are not applicable to the organization's products. Inapplicable requirements may not be considered in the quality management system.



2 Normative references



The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced documents (including any amendments) applies.



GB/T 19000-2016 Quality management systems - Fundamentals and vocabulary (ISO 9000: 2015, IDT)

YY/T 0287-2017 Medical devices - Quality management systems - Requirements for regulatory purposes (ISO 13485: 2016, IDT)



3 Terms and definitions



For the purposes of this document, the terms and definitions given in GB/T 19000-2016 and YY/T 0287-2017 apply.



4 Quality management system



4.1 General requirements



4.1 General requirements



4.1.1 The organization shall document a quality management system and maintain its effectiveness in accordance with the requirements of this standard and applicable regulatory requirements.



The organization shall establish, implement and maintain all requirements, procedures, activities or arrangements that need to be documented in accordance with the requirements of this standard or applicable regulatory requirements.



The organization shall document one or more of its roles under the applicable regulatory requirements.



Note: The role of the organization may include manufacturer, authorized representative, importer or distributor.



4.1.2 The organization shall:



a) identify the processes needed for the quality management system and their application throughout the organization by considering the role of the organization;



b) apply a risk-based approach to control the appropriate processes required for quality management system;



c) determine the sequence and interaction of these processes.



4.1.3 For each process of quality management system, the organization shall:



a) determine necessary criteria and methods to ensure the effective operation and control of these processes;



b) ensure that necessary resources and information are available to support the operation and monitoring of these processes;



c) take necessary actions to achieve planned results and maintain the effectiveness of these processes;



d) monitor, measure (as appropriate) and analyze these processes;



e) establish and maintain necessary records to demonstrate the compliance with this standard and with the applicable regulatory requirements (see 4.2.5).



4.1.4 The organization shall manage these processes of quality management system in accordance with the requirements of this standard and applicable regulatory requirements. Changes of these processes shall include:



a) evaluating the effect of process changes on the quality management system;



b) evaluating the effect of process changes on medical devices produced in the quality management system;



c) controlling in accordance with the requirements of this standard and applicable regulatory requirements.



4.1.5 If the organization chooses to outsource any processes that affect product compliance, the organization shall monitor such processes and ensure to control them. The organization shall retain the responsibility to ensure that the outsourced process meets the requirements of this standard, customer requirements and applicable regulatory requirements. Controls shall be appropriate to the risks involved and the ability of external parties to meet the requirements in 7.4. Controls shall include a written quality agreement.



4.1.6 The organization shall establish documented procedures for the validation of the application of computer software for quality management system. The software applications shall be validated prior to initial use and, as appropriate, after changes to such software or its application.



The specific approach and activities associated with software validation and revalidation shall be proportionate to the risk associated with the use of the software.



Records of these activities shall be maintained (see 4.2.5).



4.1.1 The implementation and maintenance of an effective quality management system aims to enable the organization to provide medical devices or related services that meet customer and applicable regulatory requirements.



The organization may maintain the suitability, adequacy and effectiveness of its established quality management system through a range of activities, such as:



——defining and promoting processes which lead to achieving regulatory compliance;



——acquiring and using process data and information on a continuing basis;



——determining and providing resources, including human and information system resources;



——directing necessary changes to the quality management system;



——responding to the feedback;



——taking corrective and preventive actions;



——accepting independent external assessments and responding;



——using suitable evaluation methods such as internal audits and management reviews.



The organization should identify and document one or more of its roles in the life cycle or supply chain of medical devices according to the applicable regulatory requirements in different jurisdictions. The organization is subjected to different applicable legal requirements since it plays different roles in different jurisdictions. The organization may play the following different roles in accordance with the applicable regulatory requirements:



——manufacturer;



——supplier of raw materials, parts or components;



——contract manufacturer;



——packaging, sterilization or logistics service provider;



——metering and calibration service organizations;



——importer;



——distributor;



——authorized representative.



4.1.2 The organization's quality management system consists of interrelated processes. The organization should establish a quality management system to identify and determine the required processes and their application in the whole organization according to one or more roles it plays. The determination and application of these processes are related to the organization's activities, operation mode, management needs and applicable regulatory requirements.



The quality management system requires that the risk-based approach be applied to the appropriate processes of the organization. The organization may apply the risk-based approach to determine the degree of control required for each process of the quality management system, and identify and dispose of risks affecting the compliance and effectiveness of the quality management system. The organization should implement risk control actions or preventive actions to reduce or prevent unexpected results.



YY/T 0287-2017 does not explicitly require the use of specific risk management approach to identify and reduce risks in various processes of the quality management system, but the risk-based approach may be applied to control related processes. The organization may choose the following applicable methods or analysis tools:



——strategic tools, such as Superiority Weakness Opportunity Threats (SWOT) and Michael Porter's Five Forces Model;



——detailed technical analysis methods, such as failure mode and effect analysis (FMEA), hazard analysis and critical control points (HACCP);



——root cause and decision analysis tools, such as fault tree analysis (FTA).



The organization should determine and document the methods or analysis tools used.



The organization should apply the risk-based approach to the establishment, implementation, maintenance and improvement of quality management systems and related processes in order to:



——determine the control methods for risks in the design and development of products and processes, ensure the safety and performance of medical devices, improve process outputs and prevent unexpected results;



——improve the effectiveness of the quality management system;



——maintain and manage the system that can fundamentally handle risks and achieve objectives.



The following articles of YY/T 0287-2017 require that the risks to be addressed shall be considered in the appropriate process of the quality management system:



——method for determining the effectiveness of personnel training (see YY/T 0287-2017, 6.2);



——method for selecting and monitoring suppliers (see YY/T 0287-2017, 7.4.1);



——scope of verification of purchased products (see YY/T 0287-2017, 7.4.3);



——method for software application validation (see YY/T 0287-2017, 4.1.6, 7.5.6 and 7.6).



The following articles of YY/T 0287-2017 do not explicitly state the associated risks, but the risk-based approach has been applied:



——time interval of management review (see YY/T 0287-2017, 5.6);



——control of production and service provision (YY/T 0287-2017, 7.5.1);



——the nature of the disposal of nonconforming products and necessary corrections (see YY/T 0287-2017, 8.3);



——determination of actions to prevent the occurrence and recurrence of nonconformities (see YY/T 0287-2017, 8.5.2 and 8.5.3).



The organization may take various actions to deal with risks, which are already covered by the requirements of YY/T 0287-2017, such as:



——define responsibilities and authorities;



——identify training needs, implement training and assign competent personnel;



——implement the design and development of products and processes;



——prepare specific method documents and work instructions;



——validate implementation process;



——calibrate or verify monitoring and measuring equipment;



——carry out inspection or other monitoring and measurement of products and processes;



——take corrective actions and ensure that they are extended to other relevant departments of the organization.



4.1.3 After determining the processes required for the quality management system and the risks associated with each process, the organization may focus on each process. Each process has some basic elements to deal with, which may be dealt with by considering the following issues:



——how does the organization know if a process is effective?



——what needs to be done to ensure that the process runs effectively?



——what controls are necessary for process monitoring?



——how does the organization know whether process control is effective?



——what human and material resources are needed to run and control the process?



——who is responsible for the process and what are the competence requirements for the position?



——what information is needed to effectively implement and control the process?



——does process control cover all requirements identified in planned activities?



——how to analyze the output of process monitoring?



4.1.4 The organization should manage each process of quality management system to demonstrate its continuing effectiveness in meeting customer requirements and applicable regulatory requirements as well as the organization's objectives. The disposal of changes is one of the elements in the process of managing the quality management system. If changes to the quality management system are identified as necessary, they shall be evaluated before implementation to ensure that the changes do not affect the effective operation of the quality management system or no unexpected results are generated. In particular, the organization should consider whether the changes affect the safety and performance of medical devices produced under the control of the quality management system, or affect the compliance with regulatory requirements.

Foreword i
Introduction ii
1 Scope
2 Normative references
3 Terms and definitions
4 Quality management system
4.1 General requirements
4.2 Documentation requirements
4.2.1 General
4.2.2 Quality manual
4.2.3 Medical device documents
4.2.4 Control of documents
4.2.5 Control of records
5 Management responsibility
5.1 Management commitment
5.2 Customer focus
5.3 Quality policy
5.4 Planning
5.4.1 Quality objectives
5.4.2 Quality management system planning
5.5 Responsibility, authority and communication
5.5.1 Responsibility and authority
5.5.2 Management representative
5.5.3 Internal communication
5.6 Management review
5.6.1 General
5.6.2 Review input
5.6.3 Review output
6 Resource management
6.1 Provision of resources
6.2 Human resources
6.3 Infrastructure
6.4 Work environment and contamination control
6.4.1 Work environment
6.4.2 Contamination control
7 Product realization
7.1 Planning of product realization
7.2 Customer-related processes
7.2.1 Determination of requirements related to products
7.2.2 Review of requirements related to products
7.2.3 Communication
7.3 Design and development
7.3.1 General
7.3.2 Design and development planning
7.3.3 Design and development inputs
7.3.4 Design and development outputs
7.3.5 Design and development review
7.3.6 Design and development verification
7.3.7 Design and development validation
7.3.8 Design and development transfer
7.3.9 Control of design and development changes
7.3.10 Design and development files
7.4 Purchasing
7.4.1 Purchasing process
7.4.2 Purchasing information
7.4.3 Verification of purchased product
7.5 Production and service provision
7.5.1 Control of production and service provision
7.5.2 Cleanliness of product
7.5.3 Installation activities
7.5.4 Service activities
7.5.5 Particular requirements for sterile medical devices
7.5.6 Validation of processes for production and service provision
7.5.7 Particular requirements for validation of processes for sterilization and sterile barrier system
7.5.8 Identification
7.5.9 Traceability
7.5.10 Customer property
7.5.11 Preservation of product
7.6 Control of monitoring and measuring equipment
8 Measurement, analysis and improvement
8.1 General
8.2 Monitoring and measurement
8.2.1 Feedback
8.2.2 Complaint handling
8.2.3 Reporting to regulatory authorities
8.2.4 Internal audit
8.2.5 Monitoring and measurement of processes
8.2.6 Monitoring and measurement of product
8.3 Control of nonconforming product
8.3.1 General
8.3.2 Actions in response to nonconforming product detected before delivery
8.3.3 Actions in response to nonconforming product detected after delivery
8.3.4 Rework
8.4 Analysis of data
8.5 Improvement
8.5.1 General
8.5.2 Corrective action
8.5.3 Preventive action
Annex A (Informative) Example of the process of integrating applicable regulatory requirements into the quality management system
Annex B (Informative) Correspondence between YY/T 0287-2017 and Medical devices - Quality management specifications for production (issued on December 29, 2014) and annexes
Bibliography

医疗器械 质量管理体系
YY/T 0287—2017 应用指南
1 范围
1.1 总则
本标准提供了YY/T 0287—2017中医疗器械质量管理体系要求的应用指南。
本标准适用于涉及医疗器械生命周期的一个或多个阶段(包括医疗器械的设计和开发、生产、贮存和流通、安装、服务和最终停用及处置，以及相关活动的设计和开发或提供)的各种规模和类型的组织，以及为其提供产品和服务的供方或其他外部方。
本标准不适用于监管机构检查或认证机构评定。
1.2 应用
1.2.1 总则
YY/T 0287—2017第6、第7、第8章中的相关要求可通过删减或不适用这两种方式之一进行合理地省略。对任何删减或不适用，组织宜在其质量手册中描述并说明理由。
1.2.2 删减
对设计和开发的删减要符合法规要求，若适用的法规允许删减设计和开发，这可作为组织从质量管理体系中将其删减的理由。组织宜提供证实产品和服务的设计足够安全有效的方法，并在质量管理体系中进行说明。组织在声明符合YY/T 0287—2017时，宜明确其质量管理体系中的设计和开发的任何删减。
一些法规要求允许组织将某些医疗器械在不必证明其符合设计和开发控制要求的情况下投放市场。组织宜根据不同产品及其拟上市国家或地区适用的法规要求确定设计和开发能否删减，例如，若拟上市国家或地区适用的法规规定了基于医疗器械类别(如低风险医疗器械)或医疗器械经过了特定的符合性评定程序(如型式试验)，则其设计和开发可不符合YY/T 0287—2017的7.3的要求。即使法规允许组织删减该标准7.3的要求，组织仍有责任符合该标准7.1、7.2、7.4、7.5和7.6中的产品实现要求。此外，将设计和开发过程外包不能作为从组织的质量管理体系中删减7.3的理由。
1.2.3 不适用
组织可依据自身在医疗器械生命周期不同阶段的角色和开展的活动以及医疗器械产品的类型，评审YY/T 0287—2017第6、第7、第8章中的所有要求，识别那些不必由组织完成的活动或不适用于组织产品的要求，在质量管理体系中对不适用的要求可不予考虑。
2 规范性引用文件
下列文件对于本文件的应用是必不可少的。凡是注日期的引用文件，仅注日期的版本适用于本文件。凡是不注日期的引用文件，其最新版本(包括所有的修改单)适用于本文件。
GB/T19000—2016 质量管理体系 基础和术语(ISO 9000：2015，IDT)
YY/T 0287—2017 医疗器械 质量管理体系 用于法规的要求(ISO 13485：2016，IDT)
3 术语和定义
GB/T 19000—2016和YY/T 0287—2017界定的术语和定义适用于本文件。
4 质量管理体系
4.1 总要求
4.1 总要求
4.1.1组织应按照本标准的要求和适用的法规要求将质量管理体系形成文件并保持其有效性。
组织应按照本标准或适用的法规要求建立、实施和保持需要形成文件的所有要求、程序、活动或安排。
组织应将其在适用的法规要求下所承担的一个或多个角色形成文件。
注：组织所承担的角色可能包括制造商、授权代表、进口商或经销商。
4.1.2 组织应：
a) 考虑组织承担的角色来确定质量管理体系所需的过程及这些过程在整个组织中的应用；
b) 应用基于风险的方法控制质量管理体系所需的适当过程；
c) 确定这些过程的顺序和相互作用。
4.1.3 对于每个质量管理体系过程，组织应：
a) 确定所需的准则和方法，以确保这些过程的有效运行和控制；
b) 确保可获得必要的资源和信息，以支持这些过程的运行和对这些过程的监视；
c) 实施必要的措施，以实现这些过程策划的结果并保持这些过程的有效性；
d) 监视、测量(适当时)和分析这些过程；
e) 建立和保持所需的记录以证实符合本标准并满足适用的法规要求(见4.2.5)。
4.1.4 组织应按照本标准要求和适用的法规要求管理这些质量管理体系过程。更改这些过程应：
a) 评价过程更改对质量管理体系的影响；
b) 评价过程更改对该质量管理体系中所生产的医疗器械的影响；
c) 按照本标准的要求和适用的法规要求进行控制。
4.1.5 若组织选择将影响产品符合要求的任何过程外包，组织应监视这类过程并确保对其进行控制。组织应保留外包过程符合本标准要求、顾客要求和适用的法规要求的责任。控制应与所涉及的风险和外部方满足7.4中要求的能力相适应。控制应包括书面质量协议。
4.1.6 组织应将用于质量管理体系的计算机软件应用的确认程序形成文件。在软件首次使用前应对软件应用进行确认，适当时，软件或其应用更改后也应对软件应用进行确认。
与软件确认和再确认有关的特定方法和活动应与软件使用有关的风险相适应。
应保留这些活动的记录(见4.2.5)。
4.1.1 实施和保持有效的质量管理体系旨在使组织能够提供满足顾客要求和适用的法规要求的医疗器械或相关服务。
组织可通过一系列活动保持其所建立的质量管理体系的适宜性、充分性和有效性。如：
——确定并提升能实现符合法规要求的过程；
——持续获取并使用过程数据和信息；
——确定并配置资源，包括人力资源和信息系统资源等；
——指导对质量管理体系进行必要的变更；
——对反馈做出响应；
——启动纠正措施和预防措施；
——接受独立的外部评定并做出响应；
——使用适宜的评价方法，如内部审核和管理评审。
组织宜按照不同管辖区所适用的法规要求，识别自身在医疗器械生命周期或供应链中的一个或多个角色，并将其形成文件。组织在不同管辖区承担的角色不同，适用的法规要求也不同。组织在适用的法规要求下可承担以下不同角色：
——制造商；
——原材料、零件或部件供应商；
——合约制造商；
——包装、灭菌或物流服务提供商；
——计量、校准服务机构；
——进口商；
——经销商；
——授权代表。