QMS for IVDs: UDI and Vigilance

UDI

One new element in the IVDR is the implementation of Unique Device Identification (UDI) for the EU. The UDI rule implemented by the IVDR is substantially similar to the US rule, but there are several differences which will require manufacturers who already have a system in place to make some modifications to their rules. As the requirement to add a UDI to each product is becoming more widespread, manufacturers need to set up a process to deal with the variations across both regions and risk classification.

From the quality management system (QMS) standpoint, it is important to put into place procedures and policies that cover controlling the issuance of the UDI code, verifying the quality of the printed automatic identification and data capture symbols (e.g. barcodes) on labels, data management and record retention. While an issuing agency will provide the initial number range and standards for assigning the UDI number, it is up to the manufacturer to ensure that the numbers are assigned appropriately, not reused or reissued, and the appropriate records are maintained throughout the manufacturing and distribution of the device. As a large data set of information on the product will need to be synchronized with various databases such as EUDAMED (European Database on Medical Devices) and the GUDID (Global Unique Device Identifier Database in the US), there also needs to be governance around the creation, submission and maintenance of this data. The manufacturer should clearly identify the data owners and the source of the data (creating a single source of truth for data that will be used by multiple parts of the organization), and document those responsibilities. Both the data and the UDI number will need to be incorporated into the change management process to ensure that modifications which impact the identification include the modification of the UDI and that changes of data are appropriately synchronized to the required database(s). Finally, the UDI will need to be included in post-market activities such as complaint records, medical device reporting and field actions.

Vigilance activities

Clear communication will be of major importance in the reporting of serious incidents and field safety corrective actions in the context of vigilance. The IVDR is clear that this process is one which must be adequately addressed in a manufacturer’s QMS. Here it is important to note, in particular, the key deadlines, responsibilities and how reconciliation will be managed. While it is often challenging to obtain a full reconciliation of responses, manufacturers must show their due diligence in the process with adequate attempts, using different means, to obtain a response from the customer when necessary. Although many large manufacturers may manage the process of local contacts in the different countries through subsidiaries or distributors, it is critical to remember that the manufacturer remains responsible for the overall process. In cases where these activities are not performed by a corporate entity, ensure that these activities are included in relevant contracts or agreements and that adequate monitoring of these steps is in place. Verify not only the timeliness of the information, but also completeness. Ensure that in cases where reconciliation of responses cannot be fully attained there are adequate records demonstrating how and when contact was attempted. Finally, ensure that adequate training and records of the training are in place.

This is an excerpt from the white paper Developing and maintaining a quality management system for IVDs. To download our other medical device white papers, please visit the Insight page on the Compliance Navigator website.