Certification of the quality management system and obtaining the CE marking for their product are important milestones for future medical device manufacturers. The Notified Body plays a central role in this process as a testing authority. We spoke to Dietmar Schaffarczyk, auditor at QS Schaffhausen AG / QS Services Ltd, to find out more about the perspective of a Notified Body (NB) and its expectations of young MedTech startups.
Let’s start with a common misconception. Many believe that a Notified Body can provide direct advice. Can you clear up this misconception?
Dietmar Schaffarczyk: Of course. It is important to understand that our main task is the assessment and certification according to the defined regulatory requirements, such as ISO 13485, MDR/IVDR and ISO 27001. We cannot and must not offer direct advice in the sense of a consultancy. This means that we cannot actively intervene in the development or implementation of our clients’ quality management systems or recommend specific solutions to their challenges. Our role is to assess and confirm that their products and systems comply with regulatory requirements. This independence is important in order to maintain a self-sufficient, critical view.
A Notified Body is an organization designated by a national accreditation body to carry out conformity assessment procedures. These procedures are crucial for medical device manufacturers to prove that their products comply with the requirements set out in ISO 13485, the Medical Device Regulation (MDR) or the In Vitro Diagnostic Regulation (IVDR). Their role is to assess and certify the quality systems, risk management, clinical evaluation and even IT security practices related to ISO 27001.
It seems that the Notified Body is much more than just an inspection body. How do you approach startups to guide them through this complex process?
DS: As the NB, we see ourselves not only as a testing body, but also as a partner. Our goal is to guide startups through the entire certification process and ensure that they fully understand and meet the regulatory requirements. In doing so, we certainly respect the current status of a company. A global player is to be seen differently than a startup in which two or three people are dealing with a wide variety of issues. However, this should not be misunderstood as a possible excuse: Even the smallest companies must comply with regulations. However, the implementation will be different and will be respected by us.
Can you elaborate on the team support behind a Notified Body?
DS: Behind every Notified Body is a team of experts from different fields who work together to provide a comprehensive assessment. This team includes specialists for different product groups, technologies, development phases and, of course, specific standards such as ISO 13485 and ISO 27001, ISO 62304, ISO 14971, ISO 62366, to name a few. Our experts bring in-depth technical understanding, clinical experience, and knowledge of the regulatory and technical landscape. This multidisciplinary support enables us to evaluate products comprehensively.
How should startups in medical technology then proceed to develop the necessary knowledge and understanding of these requirements?
DS: It is recommended that startups work with external experts, such as the MII, who specialize in providing advice and support in the field of medical device development and certification. These institutions can provide valuable insight and practical guidance to develop a basic understanding of the regulatory landscape. In addition, they can help implement the necessary processes and systems to ensure compliance. As they have already accompanied certification processes several times, they know what we as auditors attach importance to.
Why is it also important for startups to build up regulatory expertise within the company?
DS: A deep understanding of the regulatory requirements and the processes necessary to meet those requirements is critical to the long-term success of a MedTech startup. Not only to obtain the initial certification, but also to ensure ongoing compliance. This ensures the long-term safety and quality of the medical device. This requires, among other things, the development and maintenance of an effective quality management system, risk management, and ongoing clinical evaluation and market surveillance. Internal expertise enables startups to react agilely and proactively to changes in the regulatory environment and bring innovations to market faster and more safely. And last but not least: Only those who themselves have an understanding of regulatory requirements and their interrelationships can enter into discussions with external consultants and auditors on an equal footing.
Talking about starting a conversation – when and how is the best way for a startup to approach a Notified Body?
DS: How and when – that is a difficult question to answer in general terms. In any case, it is important to note that an NB or CB (Certification Body) is also a “critical service provider” within the meaning of ISO 13485:2016. It is therefore essential to evaluate Notified Bodies in good time: Does the scope of the NB fit my company’s product? Where is the NB based? Are there perhaps unwanted travel and accommodation costs, e.g. because the NB is based abroad? What is the response time of the NB to a non-binding inquiry? What fees and costs are incurred by the NB? It is important to get a comprehensive picture of the NB/CB landscape well in advance. For company certification, your own QMS should be at least 65% implemented in accordance with ISO 13485:2016 before approaching a NB or CB without obligation. The documents should be 85% implemented when the order is placed. For the stage 1 audit, an internal audit must also have already been completed and evaluated and the management review carried out.
Finally, what advice would you give to startups embarking on the certification process?
DS: My main advice would be to see regulatory requirements not as an obstacle, but as an opportunity. Compliance with these requirements not only ensures the safety and efficacy of your products, but also strengthens customer and patient confidence in your brand. Hence my appeal to all MedTech founders: Start planning your regulatory roadmap early, actively seek dialog with experienced advisors and use the resources available to overcome these challenges. And don’t forget that building internal expertise in regulatory affairs is a crucial step along the way.
We would like to thank Dietmar Schaffarczyk for his insights from an auditor’s perspective and can only conclude: Plan your C2 certification roadmap early, identify the right NB for your project and prepare documents sufficiently before approaching the NB. At MII, we support MedTech startups in mastering these milestones – in a time-efficient manner and with a holistic view of the business model!
Univ.-Doz. (ETH) Dietmar Schaffarczyk works as Dipl. Lead Auditor and Lead Technical Assessor for QS Schaffhausen AG (CB) and for QS Services Ltd (CB/NB). He teaches Regulatory Thinking® at the ETH Zurich, D-HEST and Regulatory Compliance at the Carinthia University of Applied Sciences, Austria. Dietmar is a coach at the MII and 4C Accelerator and a managing partner in several medical technology companies. You can find out more about Dietmar Schaffarczyk here.
