Codeofchina.com is in charge of this English translation. In case of any doubt about the English translation, the Chinese original shall be considered authoritative.
This standard is developed in accordance with the rules given in GB/T 1.1-2009.
This standard replaces YY/T 0595-2006 Medical devices - Quality management systems - Guidance on the application of YY/T 0287-2003, with respect to which, the following main technical changes have been made:
——the guidance on each clause in the text is revised based on the text of YY/T 0287-2017;
——"Example of the process of integrating applicable regulatory requirements into the quality management system” is added (see Annex A);
——“Correspondence between YY/T 0287-2017 and Medical devices - Quality management specifications for production (issued on December 29, 2014) and annexes” is added (see Annex B).
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. The issuing body of this standard shall not be held responsible for identifying any or all such patent rights.
This standard was proposed by the National Medical Products Administration of People’s Republic of China.
This standard is under the jurisdiction of the National Technical Committee on Quality Management of and General Requirements for Medical Devices of Standardization Administration of China (SAC/TC 221).
The previous edition of the standard replaced by this standard is as follows:
——YY/T 0595-2006.
Introduction
This standard provides guidance to assist in the development, implementation and maintenance of quality management systems that aim to meet the requirements of YY/T 0287-2017 for organizations that design and develop, produce and store, distribute and install, service, finally decommission and dispose medical devices, or that design, develop and provide related services, as well as suppliers or other external parties that provide products and services for them.
This standard provides guidance on the application of Clauses 4~8 of YY/T 0287-2017.
This standard provides examples, descriptions and options that help the organizations establish, implement and maintain the quality management system that meets the requirements of YY/T 0287-2017. These examples are not prescriptive, only possible for organizations, and are not necessarily suitable for each organization.
This standard neither adds requirements to or modifies the requirements of YY/T 0287-2017, nor specifies any other requirements. It is intended to help stakeholders understand and apply YY/T 0287-2017 and clarify various available methods and ways to meet the requirements of this standard.
Guidance and other reference information provided by this standard may comply with applicable regulatory requirements, but compliance requirements with any standards and regulations cannot be determined by this standard.
The quality management system of an organization should meet the requirements of customers, the regulatory requirements applicable to the quality management system and the requirements of the organization itself. This standard provides a way for the organization to integrate the applicable regulatory requirements into its quality management system. The "regulatory requirements" cover the requirements of any laws and regulations (such as laws, regulations, ordinances or directives) applicable to users of YY/T 0287-2017, and their application is limited to the requirements of quality management system and the safety or performance requirements of medical devices.
Since the regulatory requirements for the quality management system of the organization may differ with its different roles in the medical device supply chain in different jurisdictions, Annex A provides an example of the process of integrating applicable regulatory requirements into the quality management system, and Annex B provides the correspondence between YY/T 0287-2017 and Medical devices - Quality management specifications for production (issued on December 29, 2014) and annexes.
The application of "risk" within this standard is related to the safety or performance requirements of medical devices or complies with applicable regulatory requirements. Risks may exist in all systems, processes or functions, and adopting a risk-based approach may ensure that these risks are identified and considered in the organization’s processes of establishing, implementing, maintaining and improving the quality management system.
The organization should apply the risk-based approach to all processes required by the quality management system. The organization may apply the risk-based approach to:
——determine the degree of control required for each process of the quality management system;
——identify and handle risks that affect the compliance and effectiveness of the quality management system.
The organization may achieve improvements by responding to processes such as complaint handling, post-market surveillance, nonconformity disposal, corrective and preventive actions. These processes may ensure beneficial and cost-effective improvement of the organization. The quality management system itself does not necessarily bring about the improvement of workflow or products, but it is a systematic method to achieve the organization’s objectives, which may guide the organization to improve the overall performance and provide a solid foundation for the organization's sustainable development plan.
The following auxiliary verbs are used in this standard:
——"shall" is only used in the original text of YY/T 0287-2017, indicating a requirement;
——"should" indicates a suggestion;
——"may" means permission;
——"might" means probability or ability.
"Note" is guidance on understanding or explaining the relevant requirements.
Medical devices - Quality management systems - Guidance on the application of YY/T 0287-2017
1 Scope
1.1 General
This standard provides guidance for the application of the requirements for quality management systems contained in YY/T 0287-2017.
This standard is applicable to various organizations that design and develop, produce and store, distribute and install, service, finally decommission and dispose medical devices, or that design, develop and provide related services, as well as suppliers or other external parties that provide products and services for them.
This standard is not applicable to inspection by regulatory authorities or evaluation by certification authorities.
1.2 Application
1.2.1 General
The relevant requirements of Clauses 6, 7 and 8 of YY/T 0287-2017 may legitimately be omitted in one of two ways: they may be “excluded” or “not applicable”. It is important to note, however, that any exclusion or non-applicability should be detailed and justified in the organization’s quality manual.
1.2.2 Exclusions
The exclusion of design and development should comply with the regulatory requirements. If the applicable regulations allow the exclusion of design and development, this may justify such exclusion by the organization from the quality management system. The organization should provide methods to verify that the design of products and services is sufficiently safe and effective, and explain them in the quality management system. When declaring the compliance with YY/T 0287-2017, the organization should specify any exclusion of design and development from its quality management system.
Some regulatory requirements permit organizations to place some medical devices on the market without having to demonstrate conformance with design and development controls. The organization should determine whether the design and development may be excluded according to the applicable regulatory requirements of different products and the countries or regions where the products are to be launched. For example, if the applicable regulations of the country or region where the products are launched stipulate that the medical device is of certain category (such as low-risk medical device) or the medical device has undergone specific compliance assessment procedures (such as type test), its design and development may not meet the requirements of YY/T 0287-2017, 7.3. Even if the organization is permitted by regulations to exclude the requirements of 7.3, it still has obligations to meet product realization requirements of YY/T 0287-2017, 7.1, 7.2, 7.4, 7.5 and 7.6. In addition, outsourcing of design and development process cannot justify the exclusion of 7.3 from the organization's quality management system.
1.2.3 Non-applicability
The organization may review all requirements in Clauses 6, 7 and 8 of YY/T 0287-2017 according to their roles and activities in different stages of the medical device life cycle and the types of medical devices, and identify those activities that need not be completed by the organization or requirements that are not applicable to the organization's products. Inapplicable requirements may not be considered in the quality management system.
2 Normative references
The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced documents (including any amendments) applies.
GB/T 19000-2016 Quality management systems - Fundamentals and vocabulary (ISO 9000: 2015, IDT)
YY/T 0287-2017 Medical devices - Quality management systems - Requirements for regulatory purposes (ISO 13485: 2016, IDT)
3 Terms and definitions
For the purposes of this document, the terms and definitions given in GB/T 19000-2016 and YY/T 0287-2017 apply.
4 Quality management system
4.1 General requirements
4.1 General requirements
4.1.1 The organization shall document a quality management system and maintain its effectiveness in accordance with the requirements of this standard and applicable regulatory requirements.
The organization shall establish, implement and maintain all requirements, procedures, activities or arrangements that need to be documented in accordance with the requirements of this standard or applicable regulatory requirements.
The organization shall document one or more of its roles under the applicable regulatory requirements.
Note: The role of the organization may include manufacturer, authorized representative, importer or distributor.
4.1.2 The organization shall:
a) identify the processes needed for the quality management system and their application throughout the organization by considering the role of the organization;
b) apply a risk-based approach to control the appropriate processes required for quality management system;
c) determine the sequence and interaction of these processes.
4.1.3 For each process of quality management system, the organization shall:
a) determine necessary criteria and methods to ensure the effective operation and control of these processes;
b) ensure that necessary resources and information are available to support the operation and monitoring of these processes;
c) take necessary actions to achieve planned results and maintain the effectiveness of these processes;
d) monitor, measure (as appropriate) and analyze these processes;
e) establish and maintain necessary records to demonstrate the compliance with this standard and with the applicable regulatory requirements (see 4.2.5).
4.1.4 The organization shall manage these processes of quality management system in accordance with the requirements of this standard and applicable regulatory requirements. Changes of these processes shall include:
a) evaluating the effect of process changes on the quality management system;
b) evaluating the effect of process changes on medical devices produced in the quality management system;
c) controlling in accordance with the requirements of this standard and applicable regulatory requirements.
4.1.5 If the organization chooses to outsource any processes that affect product compliance, the organization shall monitor such processes and ensure to control them. The organization shall retain the responsibility to ensure that the outsourced process meets the requirements of this standard, customer requirements and applicable regulatory requirements. Controls shall be appropriate to the risks involved and the ability of external parties to meet the requirements in 7.4. Controls shall include a written quality agreement.
4.1.6 The organization shall establish documented procedures for the validation of the application of computer software for quality management system. The software applications shall be validated prior to initial use and, as appropriate, after changes to such software or its application.
The specific approach and activities associated with software validation and revalidation shall be proportionate to the risk associated with the use of the software.
Records of these activities shall be maintained (see 4.2.5).
4.1.1 The implementation and maintenance of an effective quality management system aims to enable the organization to provide medical devices or related services that meet customer and applicable regulatory requirements.
The organization may maintain the suitability, adequacy and effectiveness of its established quality management system through a range of activities, such as:
——defining and promoting processes which lead to achieving regulatory compliance;
——acquiring and using process data and information on a continuing basis;
——determining and providing resources, including human and information system resources;
——directing necessary changes to the quality management system;
——responding to the feedback;
——taking corrective and preventive actions;
——accepting independent external assessments and responding;
——using suitable evaluation methods such as internal audits and management reviews.
The organization should identify and document one or more of its roles in the life cycle or supply chain of medical devices according to the applicable regulatory requirements in different jurisdictions. The organization is subjected to different applicable legal requirements since it plays different roles in different jurisdictions. The organization may play the following different roles in accordance with the applicable regulatory requirements:
——manufacturer;
——supplier of raw materials, parts or components;
——contract manufacturer;
——packaging, sterilization or logistics service provider;
——metering and calibration service organizations;
——importer;
——distributor;
——authorized representative.
4.1.2 The organization's quality management system consists of interrelated processes. The organization should establish a quality management system to identify and determine the required processes and their application in the whole organization according to one or more roles it plays. The determination and application of these processes are related to the organization's activities, operation mode, management needs and applicable regulatory requirements.
The quality management system requires that the risk-based approach be applied to the appropriate processes of the organization. The organization may apply the risk-based approach to determine the degree of control required for each process of the quality management system, and identify and dispose of risks affecting the compliance and effectiveness of the quality management system. The organization should implement risk control actions or preventive actions to reduce or prevent unexpected results.
YY/T 0287-2017 does not explicitly require the use of specific risk management approach to identify and reduce risks in various processes of the quality management system, but the risk-based approach may be applied to control related processes. The organization may choose the following applicable methods or analysis tools:
——strategic tools, such as Superiority Weakness Opportunity Threats (SWOT) and Michael Porter's Five Forces Model;
——detailed technical analysis methods, such as failure mode and effect analysis (FMEA), hazard analysis and critical control points (HACCP);
——root cause and decision analysis tools, such as fault tree analysis (FTA).
The organization should determine and document the methods or analysis tools used.
The organization should apply the risk-based approach to the establishment, implementation, maintenance and improvement of quality management systems and related processes in order to:
——determine the control methods for risks in the design and development of products and processes, ensure the safety and performance of medical devices, improve process outputs and prevent unexpected results;
——improve the effectiveness of the quality management system;
——maintain and manage the system that can fundamentally handle risks and achieve objectives.
The following articles of YY/T 0287-2017 require that the risks to be addressed shall be considered in the appropriate process of the quality management system:
——method for determining the effectiveness of personnel training (see YY/T 0287-2017, 6.2);
——method for selecting and monitoring suppliers (see YY/T 0287-2017, 7.4.1);
——scope of verification of purchased products (see YY/T 0287-2017, 7.4.3);
——method for software application validation (see YY/T 0287-2017, 4.1.6, 7.5.6 and 7.6).
The following articles of YY/T 0287-2017 do not explicitly state the associated risks, but the risk-based approach has been applied:
——time interval of management review (see YY/T 0287-2017, 5.6);
——control of production and service provision (YY/T 0287-2017, 7.5.1);
——the nature of the disposal of nonconforming products and necessary corrections (see YY/T 0287-2017, 8.3);
——determination of actions to prevent the occurrence and recurrence of nonconformities (see YY/T 0287-2017, 8.5.2 and 8.5.3).
The organization may take various actions to deal with risks, which are already covered by the requirements of YY/T 0287-2017, such as:
——define responsibilities and authorities;
——identify training needs, implement training and assign competent personnel;
——implement the design and development of products and processes;
——prepare specific method documents and work instructions;
——validate implementation process;
——calibrate or verify monitoring and measuring equipment;
——carry out inspection or other monitoring and measurement of products and processes;
——take corrective actions and ensure that they are extended to other relevant departments of the organization.
4.1.3 After determining the processes required for the quality management system and the risks associated with each process, the organization may focus on each process. Each process has some basic elements to deal with, which may be dealt with by considering the following issues:
——how does the organization know if a process is effective?
——what needs to be done to ensure that the process runs effectively?
——what controls are necessary for process monitoring?
——how does the organization know whether process control is effective?
——what human and material resources are needed to run and control the process?
——who is responsible for the process and what are the competence requirements for the position?
——what information is needed to effectively implement and control the process?
——does process control cover all requirements identified in planned activities?
——how to analyze the output of process monitoring?
4.1.4 The organization should manage each process of quality management system to demonstrate its continuing effectiveness in meeting customer requirements and applicable regulatory requirements as well as the organization's objectives. The disposal of changes is one of the elements in the process of managing the quality management system. If changes to the quality management system are identified as necessary, they shall be evaluated before implementation to ensure that the changes do not affect the effective operation of the quality management system or no unexpected results are generated. In particular, the organization should consider whether the changes affect the safety and performance of medical devices produced under the control of the quality management system, or affect the compliance with regulatory requirements.
Foreword i
Introduction ii
1 Scope
2 Normative references
3 Terms and definitions
4 Quality management system
4.1 General requirements
4.2 Documentation requirements
4.2.1 General
4.2.2 Quality manual
4.2.3 Medical device documents
4.2.4 Control of documents
4.2.5 Control of records
5 Management responsibility
5.1 Management commitment
5.2 Customer focus
5.3 Quality policy
5.4 Planning
5.4.1 Quality objectives
5.4.2 Quality management system planning
5.5 Responsibility, authority and communication
5.5.1 Responsibility and authority
5.5.2 Management representative
5.5.3 Internal communication
5.6 Management review
5.6.1 General
5.6.2 Review input
5.6.3 Review output
6 Resource management
6.1 Provision of resources
6.2 Human resources
6.3 Infrastructure
6.4 Work environment and contamination control
6.4.1 Work environment
6.4.2 Contamination control
7 Product realization
7.1 Planning of product realization
7.2 Customer-related processes
7.2.1 Determination of requirements related to products
7.2.2 Review of requirements related to products
7.2.3 Communication
7.3 Design and development
7.3.1 General
7.3.2 Design and development planning
7.3.3 Design and development inputs
7.3.4 Design and development outputs
7.3.5 Design and development review
7.3.6 Design and development verification
7.3.7 Design and development validation
7.3.8 Design and development transfer
7.3.9 Control of design and development changes
7.3.10 Design and development files
7.4 Purchasing
7.4.1 Purchasing process
7.4.2 Purchasing information
7.4.3 Verification of purchased product
7.5 Production and service provision
7.5.1 Control of production and service provision
7.5.2 Cleanliness of product
7.5.3 Installation activities
7.5.4 Service activities
7.5.5 Particular requirements for sterile medical devices
7.5.6 Validation of processes for production and service provision
7.5.7 Particular requirements for validation of processes for sterilization and sterile barrier system
7.5.8 Identification
7.5.9 Traceability
7.5.10 Customer property
7.5.11 Preservation of product
7.6 Control of monitoring and measuring equipment
8 Measurement, analysis and improvement
8.1 General
8.2 Monitoring and measurement
8.2.1 Feedback
8.2.2 Complaint handling
8.2.3 Reporting to regulatory authorities
8.2.4 Internal audit
8.2.5 Monitoring and measurement of processes
8.2.6 Monitoring and measurement of product
8.3 Control of nonconforming product
8.3.1 General
8.3.2 Actions in response to nonconforming product detected before delivery
8.3.3 Actions in response to nonconforming product detected after delivery
8.3.4 Rework
8.4 Analysis of data
8.5 Improvement
8.5.1 General
8.5.2 Corrective action
8.5.3 Preventive action
Annex A (Informative) Example of the process of integrating applicable regulatory requirements into the quality management system
Annex B (Informative) Correspondence between YY/T 0287-2017 and Medical devices - Quality management specifications for production (issued on December 29, 2014) and annexes
Bibliography
