The official IVDR transition period is here. IVDR expert Dr. Oliver Eikenberg discusses how IVD manufacturers should take action, starting with how to implement IVDR QMS requirements for the May 2025 deadline.
Quality management systems (QMS) define a common structure and core concepts for organizations to plan, do, check, and act (PDCA). In the medical device industry, the importance of the QMS has grown to ensure quality in developing, manufacturing, and distribution processes. A medical device QMS is a structured system that documents the procedures and processes implemented throughout the complete lifecycle of a medical device, from design and development to production and distribution to post-market surveillance. If specific processes (e.g., design, manufacturing, distribution) are outsourced, the manufacturer must demonstrate adequate control over these processes.
The IVDR Article 10(8) requires all manufacturers of IVDs to comply with all applicable requirements – including an effective QMS – to obtain CE Marking under the IVDR. There is no specific obligation to use the European harmonized standard “EN ISO 13485:2016 Medical devices — Quality management systems — Requirements for regulatory purposes,” but it typically serves as a basis for an IVDR-compliant QMS. The strong link between the QMS and requirements from MDR or IVDR is reflected in detail in the Z-Annexes (ZA, ZB) of this standard.
How and when QMS requirements in the IVDR apply to your device depends on how you are currently marketing your device. Typically, the following scenarios apply for IVD manufacturers:
On 9 July 2024, a new amendment ((EU) 2024/1860) to the MDR and IVDR was published, introducing new extended transitional provisions and specific obligations for certain IVDs (legacy devices). One of these new obligations is to implement a QMS in accordance with Article 10(8) IVDR by 26 May 2025, regardless of the IVD device class. The EC also states: “The documentation on the QMS needs to be part of the application for conformity assessment for any devices the manufacturer intends to transfer to the IVDR, and must be submitted by the relevant deadlines for applications to a notified body no later than 26 May 2025 for class D devices and for devices covered by an IVDD certificate, 26 May 2026 for class C devices and 26 May 2027 for class B and class A sterile devices.”
In other words, the deadline to have a IVDR-compliant QMS is 26 May 2025 for Class D devices, which can be a significant hurdle for legacy IVDs that were “self-declared” as “general IVDs” per the IVDD but now fall under Class D per the IVDR (e.g., SARS-CoV-2, Malaria, Dengue fever, Treponema pallidum, Trypanosoma cruzi). For this class of IVDs, the IVDR-compliant QMS is also a prerequisite to lodge the application with the Notified Body by the same deadline of 26 May 2025.
Even if you are not yet audited or lodging an application to Notified Bodies, you should have already conducted a gap assessment for your current QMS and updated the relevant QMS procedures. These changes in your QMS may also affect contracted partners, such as distributors.
While there is no official interpretation for the required QMS level, the Q&A document “EXTENSION OF THE IVDR TRANSITIONAL PERIODS” from July 2024 provides some insight.
Question 9 states that the QMS should be in a condition to “ensure that manufacturers gradually move towards full compliance with the IVDR requirements” and that “manufacturers must draw up the documentation on its QMS by this date (regardless of the device risk class under the IVDR).” In other words, even if the records created out of these QMS processes are not yet completely in place, the QMS process must show how these will be met. For example, for IVDR Article 10(8) e), you need to have a risk management procedure that describes the planning, initial risk analysis, risk analysis and mitigations, and the risk management report in line with ISO 14971.
For IVDR Article 10(8) f), you must establish a performance evaluation procedure that describes how you will conduct scientific validity, analytical performance, and clinical performance to address the clinical evidence. This typically requires templates for the required IVDR elements, such as PEP, PER, SCP, APR, CPR, etc. Consequently, manufacturers need to understand what the IVDR requirements are and how they can be combined within the existing QMS. Depending on the company structure and level of transition to IVDR, updating the existing QMS might be a short task for some or significant work for others.
Class D manufacturers who want to lodge an application in May 2025 must follow these procedures and create the relevant records. This will be reviewed for lodging the application with the Notified Body.
The chart below is a brief overview and comparison to corresponding EN ISO 13485 and other standards to further illustrate the complete QMS requirements:
| QMS Requirements from IVDR Article 10(8) | Comparison to EN ISO 13485 or Other Standards | Required QMS Procedures |
|---|---|---|
| (a) a strategy for regulatory compliance, including compliance with conformity assessment procedures and procedures for management of modifications to the devices covered by the system; | Clause 4.2.3 Medical Device File Clause 5. Quality Management System Planning Clause 7.3.9 Control of Design and Development Files |
comply with applicable EU Regulations (IVDR and others, as applicable). manage design changes are evaluated in line with MDCG 2020-3 Rev.1. |
| (b) identification of applicable general safety and performance requirements and exploration of options to address those requirements; | Clause 7.3 Design and Development Clause 7.4 Purchasing Clause 7.5 Production and Service Provision |
include applicable GSPR requirements in design input and develop them up to the final design output |
| (c) responsibility of the management | Clause 5. Management Responsibility | manage responsibilities for PRRC and dedicated personnel |
| (d) resource management, including selection and control of suppliers | Clause 6. Resource Management Clause 7.4 Purchasing |
manage supplier controls and outsourced processes on a risk-based approach |
| (e) risk management as set out in Section 3 of Annex I | EN ISO 14971:2019 + A11:2021 | establish, implement, document and maintain a risk management system starting with a risk management plan, initial hazard identification and analysis, risk analysis and final risk management report. This risk management system must have been used continuously throughout the iterative design stages and entire lifecycle of a device and must include post-market surveillance activities and data |
| (f) performance evaluation, in accordance with Article 56 and Annex XIII, including PMPF; | 7.3.7- Design and Development Validation EN ISO 20916:2024 | plan performance evaluation (scientific validity, analytical performance, clinical performance) with the elements of a Performance Evaluation Plan (PEP) and Performance Evaluation Report (PER) control clinical performance studies in line with ethical and Good Study Practice standards |
| (g) product realisation, including planning, design, development, production and service provision; | Clause 7.1 Product Realization Clause 7.3 Design and Development Clause 7.4 Purchasing Clause 7.5 Production and Service Provision |
design and produce the devices including controls for such processes (Quality Control, Validation of Processes and Equipment) |
| (h) verification of the UDI assignments made in accordance with Article 24(3) to all relevant devices and ensuring consistency and validity of information provided in accordance with Article 26; | Clause 7.5.8 Identification Clause 7.5.9 Traceability |
apply UDI to the devices and label and register them in EUDAMED and apply the UDI to all labelling documents |
| (i) setting-up, implementation and maintenance of a post-market surveillance system, in accordance with Article 78; | Clause 5.6 Management Review Clause 8.2 Monitoring and Measurement EN ISO 14971:2019 + A11:2021 ISO/TR 20416:2020 |
set-up, implement, and maintain a post-market surveillance system and combine this information in the Technical Documentation for IVDR Annex III |
| (j) handling communication with competent authorities, notified bodies, other economic operators, customers and/or other stakeholders; | Clause 5.6 Management Review Clause 8.2.3 Reporting to Regulatory Authorities |
handle communication with competent authorities, notified bodies, other economic operators (distributors, importer), customers, and/or other stakeholders |
| (k) processes for reporting of serious incidents and field safety corrective actions in the context of vigilance; | Clause 8.2.3 Reporting to Regulatory Authorities | conduct vigilance reporting requirements in line with MDCG 2024-1 and EUDAMED or national reporting requirements |
| (l) management of corrective and preventive actions and verification of their effectiveness; | Clause 8.5 Improvement | conduct CAPA |
| (m) processes for monitoring and measurement of output, data analysis and product improvement. | Clause 8.2 Monitoring and Measurement Clause 8.4 Data Analysis |
monitor, measure and analyse device-related data and improve the devices |
EN ISO 14971:2019 + A11:2021 Medical devices - Application of risk management to medical devices
ISO/TR 20416:2020(en) Medical devices — Post-market surveillance for manufacturers
EN ISO 20916:2024 In vitro diagnostic medical devices - Clinical performance studies using specimens from human subjects - Good study practice
Pure Global can help you implement an EN ISO 13485 compliant QMS, conduct an audit, or update your QMS in preparation for the 26 May 2025 deadline, or to lodge an application or agreement with a Notified Body. Contact us to learn more about our QMS audit support services.
Explore our collection of articles, success stories, and regulatory updates, designed to help you take your product global.
Whether looking for more information or ready to partner with us, we're here to guide you through every step of the regulatory process.
Contact us
