GUIDELINES FOR REGISTRATION OF MEDICAL DEVICES NOVEMBER, 2025 Doc. No.: DHT/GDL/024 Version 2 Rwanda FDA, P.O.Box:1948 Kigali-Rwanda, Email: info@rwandafda.gov.rw Website: www.rwandafda.gov.rw, Toll Free:9707 FOREWORD Rwanda Food and Drugs Authority (Rwanda FDA) is a regulatory body established by the Law N° 003/2018 of 09/02/2018. One of the functions of Rwanda FDA is to regulate matters related to quality, safety and performance of medical devices including In vitro Diagnostics in order to protect public health by increasing their access and availability. Considering the provisions of the technical regulations Governing Registration of Medical Devices including In Vitro Diagnostics in its article which gives the power to issue guidelines, Rwanda Food and Drugs Authority (Rwanda FDA) has issued Guidelines for registration of medical devices. These guidelines were developed in reference to the Africa Medical Devices Forum (AMDF), World Health Organization (WHO) and the International Medical Device Regulators Forum (IMDRF). The purpose of these guidelines is to provide guidance to medical devices importers, manufacturers and distributors intending to market or manufacture their devices in Rwanda, on the documentation requirements by Rwanda FDA to assess conformity of such devices to the essential principles of safety, quality and performance before market authorization can be issued. These guidelines are hereby promulgated for information, guidance and strict compliance by all concerned. Adherence to the guidelines by the manufacturers/applicants will facilitate timely assessments and approvals of medical devices dossiers by Rwanda FDA for pre-market authorization/ registration. We wish to acknowledge all the efforts of key stakeholders and express our gratitude to all individuals who actively participated in the development and validation of these guidelines. Prof. Emile BIENVENU Director General DOCUMENT DEVELOPMENT HISTORY First issue date 13 February 2020 Effective date of this revision …. Document Revision History Date of Version Changes made and/or reasons for revision revision number - 2 -Change of the guidelines title -Revision of the definitions -Amendment of the technical file sections -The STED mode of submission has been superseded by the Table of Content (ToC) -Inclusion of the notification procedure for class A medical devices -inclusion of the renewal process -Revision of timelines -Revision and inclusion of forms and cover letter and their inclusion as APPENDIXs -Editorial changes TABLE OF CONTENTS FOREWORD .......................................................................................................................................2 DOCUMENT DEVELOPMENT HISTORY ......................................................................................3 DOCUMENT REVISION HISTORY .........................................................................................3 TABLE OF CONTENTS (TO BE REVISED) ...................................................................................4 ACCRONYMES AND ABBREVIATIONS .......................................................................................6 GLOSSARY / DEFINITIONS ............................................................................................................7 INTRODUCTION .............................................................................................................................12 1.1. BACKGROUND ...............................................................................................................12 1.2. SCOPE ...............................................................................................................................12 1.3. GENERAL PRINCIPLES ................................................................................................12 1.4. SUBMISSION OF APPLICATION ....................................................................................13 1.5. APPLICATION REQUIREMENTS ...............................................................................13 1.5.1. REQUIREMENTS FOR NOTIFICATION OF NEW APPLICATIONS ........................13 1.5.2. REQUIREMENTS FOR REGISTRATION OF NEW APPLICATIONS .......................13 1.5.3. REQUIREMENTS FOR RENEWAL OF REGISTERED MEDICAL DEVICES APPLICATIONS ........................................................................................................................14 1.5.4. REQUIREMENTS FOR RENEWAL OF NOTIFIED MEDICAL DEVICES APPLICATIONS ........................................................................................................................14 1.6. RECEIVING APPLICATIONS FOR MEDICAL DEVICES REGISTRATION/NOTIFICATION .........................................................................................14 1.7. DOSSIER ASSESSMENT PROCEDURES ...................................................................14 1.7.1. DOSSIER NOTIFICATION PROCEDURE .................................................................15 1.7.2. DOSSIER REGISTRATION PROCEDURE ................................................................15 1.8. COMPLIANCE WITH THE QUALITY MANAGEMENT SYSTEM (QMS) ..........16 1.9. AUTHORITY’S INTERNAL SCIENTIFIC REVIEW COMMITTEE FOR MEDICAL DEVICE REGISTRATION ...................................................................................16 1.10. TIMELINES FOR MEDICAL DEVICES REGISTRATION/NOTIFICATION .......17 1.10.1. TIMELINES FOR REGISTRATION/NOTIFICATION OF NEW APPLICATIONS 17 1.10.2. TIMELINES FOR RENEWAL OF NOTIFIED/REGISTERED DEVICES APPLICATIONS ........................................................................................................................17 1.11. CLASSIFICATION OF MEDICAL DEVICES .............................................................18 1.12. TECHNICAL DOCUMENTATION FORMAT AND DATA PRESENTATION OF THE DOSSIER ............................................................................................................................18 1.13. CONTENT OF THE TECHNICAL DOCUMENTATION ..........................................18 1.14. OTHER MEDICAL DEVICES .......................................................................................54 1.14.1. REPAIRS .......................................................................................................................55 1.14.2. SECOND-HAND AND FULLY REFURBISHED DEVICES .....................................55 1.14.3. MEDICAL DEVICES THAT REQUIRE FINAL PROCESSING ...............................55 1.15. CLASSIFICATION RULES ............................................................................................55 REFERENCES: .................................................................................................................................65 ENDORSEMENT OF THE GUIDELINES ......................................................................................66 APPENDICES ............................................................... ERROR! BOOKMARK NOT DEFINED. APPENDIX 1: COVER LETTER ....................................................................................................67 APPENDIX 2: ..................................................................................................................................69 APPLICATION FORM FOR MEDICAL DEVICES INCLUDING IN VITRO DIAGNOSTICS DEVICES (IVDDS) NOTIFICATION .............................................................................................69 APPENDIX 3: ..................................................................................................................................72 APPLICATION FORM FOR MEDICAL DEVICES AND IN VITRO DIAGNOSTICS DEVICES (IVDDS) REGISTRATION ..............................................................................................................72 APPENDIX 4: .............................................................. ERROR! BOOKMARK NOT DEFINED. ESSENTIAL PRINCIPLE CHECKLIST OF MEDICAL DEVICES INCLUDING IVDS .............77 APPENDIX 5: ................................................................................................................................109 PRE-MARKET REQUIREMENTS FOR MEDICAL DEVICE CYBERSECURITY ..................109 ACCRONYMES AND ABBREVIATIONS CAB Conformity Assessment Body DOC Declaration of Conformity EAC East African Community EEC European Economic Community EP Essential Principles FIFO First In First Out GMP Good Manufacturing Practice IMDRF International Medical Devices Regulators Forum ISO International Organization for Standardization IRB Institutional Review Board ISRC Internal Scientific Review Committee IVD In Vitro Diagnostic STED Summary of Technical Documentation QMS Quality Management Systems LTR Local Technical Representative RWANDA FDA Rwanda Food and Drugs Authority TOC Table of Content MA Marketing Authorization GLOSSARY / Definitions For the purpose of these guidelines, the following definitions shall apply: 1. “Authority” means the Rwanda Food and Drugs Authority or its acronym “Rwanda FDA”, established under Law N0. 003/2018 of 09/02/2018; 2. “Abridged assessment” a limited independent assessment of specific parts of the dossier, or regulatory submission of data for suitability of use under local conditions and regulatory requirements, taking into account prior assessment (including dossier review and/or independent performance evaluation) and inspection outcomes from WHO prequalification or any National Regulatory Authority (NRA) deemed by the Authority as competent to inform the latter in its decision. 3. “Active medical device” means any medical device which depends on a source of electrical energy or any source of power other than that directly generated by the human body or gravity and which acts by converting this energy. Medical devices intended to transmit energy, substances or other elements between an active medical device and the patient, without any significant change, are not considered to be active medical devices. Stand-alone software is considered to be an active medical device; 4. “Active diagnostic medical device” means an active device that whether used alone or in combination with another medical device, is intended for the use of detecting, monitoring or treating a physiological condition, state of health, illness or congenital deformity; 5. “Active therapeutic medical device” means an active device that whether used alone or in combination with another medical device, is intended to support, modify, replace or restore a biological function or structure for the purpose of treating or mitigating an illness or injury or symptom of an illness or injury; 6. “Applicant” means a person who applies for registration of a product to Rwanda FDA, who must be the owner of the product. He may be a manufacturer or a person to whose order and specifications, the product is manufactured. After the product is registered, the applicant shall be the “Marketing Authorization Holder” 6. “Conformity Assessment Body (CAB)” means a body, other than a regulatory authority, engaged in determining whether the relevant requirements in technical regulations or standards are fulfilled. 7. “Law” means Law N0 003/2018 of 09/02/2018, establishing the Rwanda FDA and determining its mission, organization and function. 8. “Local Technical Representative (LTR)” means any company registered in Rwanda and licensed by Rwanda FDA to deal with regulated products that has received a mandate from the Applicant to act on his/her behalf with regard to matters pertaining to the registration of regulated products; 9. “Medical device family” means a group of medical devices that are made by the same manufacturer, that differ only in shape, colour, flavour or size, that have the same design and manufacturing process and that have the same intended use; 10. “Medical device group” means group of devices comprising a collection of medical devices, such as a procedure pack or tray, that is sold under a single name; 11. “Medical Device System” means a medical device comprising a number of components or parts intended to be used together to fulfill some or the entire device’s intended functions and that are sold under a single name; 12. “Active implantable medical device” means any active medical device, together with any accessories for its proper functioning, which is intended to be totally or partially introduced, surgically or medically, into the human body or by medical intervention into a natural orifice, and which is intended to remain after the procedure; 13. “Implantable device” means any device which is intended to be totally introduced into the human body or, to replace an epithelial surface or the surface of the eye, by surgical intervention which is intended to remain in place after the procedure. Any device intended to be partially introduced into the human body through surgical intervention and intended to remain in place after the procedure for at least 30 days is also considered an implantable device; 14. “Invasive device” means a device, which, in whole or in part, penetrates inside the body, either through a body orifice or through the surface of the body. Body orifice means any natural opening in the body, as well as the external surface of the eyeball, or any permanent artificial opening, such as a stoma or permanent tracheotomy; 15. “In Vitro Diagnostic (IVD) Medical Device” means a medical device, whether used alone or in combination, intended by the manufacturer for the in-vitro examination of specimens derived from the human body solely or principally to provide information for diagnostic, monitoring or compatibility purposes. Note: IVD medical devices include reagents, calibrators, control materials, specimen receptacles, software, and related instruments or apparatus or other articles and are used, for example, for the following test purposes: diagnosis, aid to diagnosis, screening, monitoring, predisposition, prognosis, prediction, determination of physiological status. 16. “Accessory to a Medical Device” means an article intended specifically by its manufacturer to be used together with a particular medical device to enable or assist the device to be used in accordance with its intended use; 17. “Label” means written, printed, or graphic information either appearing on the medical device itself, or on the packaging of each unit, or on the packaging of multiple devices. Note: The definition above refers to the human readable label. 18. “Labeling" means the label, instructions for use, and any other information that is related to identification, technical description, intended purpose and proper use of the medical device, but excluding shipping documents. Note 1: Labeling can also be referred to as “information supplied by the manufacturer.” Note 2: Labeling can be in printed or electronic format and may either physically accompany the medical device or direct the user to where the labeling information can be accessed (such as through a website). 19. “Manufacture” means all operations that involve preparation, processing, filling transforming, packaging, repackaging and labelling of a medical device; 20. “Manufacturer” means any natural or legal person1 with responsibility for design and/or manufacture of a medical device with the intention of making the medical device available for use, under their name; whether such a medical device is designed and/or manufactured by that person themselves or on their behalf by another person(s). Note 1: This ‘natural or legal person’ has ultimate legal responsibility for ensuring compliance with all applicable regulatory requirements for the medical device in the countries or jurisdictions where it is intended to be made available or sold, unless this responsibility is specifically imposed on another person by the Regulatory Authority within that jurisdiction. Note 2: The manufacturer’s responsibilities are described in other GHTF and IMDRF guidance documents. These responsibilities include meeting regulatory requirements at various points during the product lifecycle, such as adverse event reporting and notification of corrective actions. Note 3: ‘Design and/or manufacture’, as referred to in the above definition, may include specification development, production, fabrication, assembly, processing, packaging, repackaging, labeling, relabeling, sterilization, installation, or remanufacturing of a medical device; or putting a collection of devices, and possibly other products, together for a medical purpose. Note 4: Any person who assembles or adapts a medical device that has already been supplied by another person for an individual patient, in accordance with the instructions for use, is not the manufacturer, provided the assembly or adaptation does not change the intended use of the medical device. Note 5: Any person who changes the intended use of, or modifies, a medical device without acting on behalf of the original manufacturer and who makes it available for use under his own name, should be considered the manufacturer of the modified medical device. Note 6: An authorized representative, distributor or importer who only adds its own address and contact details to the medical device or the packaging, without covering or changing the existing labeling, is not considered a manufacturer. Note 7: To the extent that an accessory is subject to the regulatory requirements of a medical device2, the person responsible for the design and/or manufacture of that accessory is considered to be a manufacturer. 21. “Medical device” means any instrument, apparatus, implement, machine, appliance, implant, reagent for in vitro use, software, material or other similar or related article, intended by the manufacturer to be used, alone or in combination, for human beings, for one or more of the specific medical purpose(s) of: • diagnosis, prevention, monitoring, treatment or alleviation of disease, • diagnosis, monitoring, treatment, alleviation of, or compensation for, an injury, • investigation, replacement, modification, or support of the anatomy, or of a physiological process, • supporting or sustaining life, • control of conception, • cleaning, disinfection, or sterilization of medical devices, • providing information by means of in vitro examination of specimens derived from the human body; and does not achieve its primary intended action by pharmacological, immunological, or metabolic means, in or on the human body, but which may be assisted in its intended function by such means. Note 1: Products which may be considered to be medical devices in some jurisdictions but not in others include: • cleaning and disinfection substances, • aids for persons with disabilities, • devices incorporating animal and/or human tissues, • devices for in-vitro fertilization or assisted reproduction technologies. Note 2: For clarification purposes, in certain regulatory jurisdictions, devices for cosmetic/aesthetic purposes are also considered medical devices. Note 3: For clarification purposes, in certain regulatory jurisdictions, the commerce of devices incorporating human tissues is not allowed. 22. “Fee” means the fee prescribed in Regulation related to regulatory services and fines; 23. “Batch number (or lot number, lot code, batch code)” A set of numbers and/or letters that specifically identifies a device batch and permits its manufacturing, packaging, labeling and distribution history to be traced 24. “Packaging” operations involved in the preparation of goods for containment, protection, handling, delivery, storage, transport and presentation of goods, from raw materials to processed goods, from the producer to the user or consumer 25. “Packaging material” means any material, including printed material, employed in the packaging of a medical device, excluding any outer packaging used for transportation or shipment; 26. “Instructions for Use” General and technical information provided by the manufacturer to inform the user of the medical device or IVD medical device’s intended purpose and proper use and of any contraindications, warnings, or precautions to be taken. It is provided by the manufacturer to support and assist the device users in its safe and appropriate use. 27. “Intended Use / Intended Purpose” means the objective intent regarding the use of a product, process or service as reflected in the specifications, instructions and information provided by the manufacturer. Note 1: The intended use/intended purpose are also part of promotional or sales materials or statements, although these materials lie outside the scope of this document. Note 2: The intended use can include the indications for use. 28. “Dossier” means a file that contains detailed information on the device description, manufacturing, quality control and biomedical studies that demonstrates quality, safety and performance of the finished medical device; 29. “Quality Management System” means a management system to direct and control an organization with regard to quality, from establishing quality policy, quality objectives and implementing and maintaining quality system; 30. “Technical Documentation” means documented evidence, normally an output of the Quality Management System that demonstrates compliance of a device to the Essential Principles of Safety and Performance of Medical Devices; 31. “Medical Devices with Measuring Function” a device has a measuring function if; a. The device is intended by the manufacturer to measure: - quantitatively a physiological or anatomical parameter, or - a quantity or a qualifiable characteristic of energy or of substances delivered to or removed from the human body, b. The result of the measurement - is displayed in legal units or other internationally acceptable units or - is compared to at least one point of reference indicated in legal units or other acceptable units. c. The intended purpose implies accuracy, claimed explicitly or implicitly, where a non- compliance with the implied accuracy could result in a significant adverse effect on the patient’s health and safety. 32. “Notified Medical Devices” means medical devices that have been granted marketing authorization through the notification process. 33. “Marketing authorization/ Registration certificate or Notification letter” means a legal document issued by the Authority for the purposes of marketing or free distribution of a product which has been approved after evaluation for safety, quality and performance. 34. “Marketing Authorization holder” means a company which holds an authorization to place a medical device on the Rwandan market and is responsible for that device. INTRODUCTION
1.1.
Rwanda Food and Drugs Authority (Rwanda FDA) is established by the Law N° 003/2018 of 09/02/2018, especially in its article 8 and 9; Considering the provisions of the technical regulations governing the registration of medical devices including In Vitro Diagnostics, especially in its article which grants the authority the power to issue guidelines, the authority has issued Guidelines for registration of Medical Devices. Manufacturers of all classes of medical devices are expected to demonstrate conformity to the Essential Principles of Safety and Performance, through the preparation and holding of technical documentation that shows how each medical device was developed, designed and manufactured together with the descriptions and explanations necessary to understand the manufacturer’s determination with respect to such conformity. The technical documentation should be revised to reflect the current status of the medical device through normal application of the manufacturer’s QMS.
1.2.
These guidelines shall apply to all medical devices, other than In Vitro Diagnostics intended to be marketed in Rwanda through registration, notification or renewal. They provide guidance on the technical documentation to be submitted to Rwanda Food and Drugs Authority (Rwanda FDA) for assessment and registration. 1.3.General principles For the purpose of conformity assessment, the manufacturer should assemble information from existing technical documentation to provide evidence that the subject medical device is in conformity with the Essential Principles (EP). The information submitted shall reflect the status of the medical device at a particular moment in time (e.g. at the moment of pre- market submission or when requested) and is prepared in order to meet regulatory requirements. The submission should contain summary information on selected topics and may contain detailed information on certain specific sections including the Essential Principles checklist - EP checklist. All information should be submitted in any of the official language(s) and may also include, for example: abstracts, high level summaries, or existing controlled documents sufficient to communicate key relevant information and allow a reviewer to understand the subject and assess the validity of that information. The EP checklist is created as part of the manufacturer’s technical documentation and is controlled by the manufacturer’s QMS. It provides a tabular overview of the Essential Principles and identifies those that are applicable to the medical device, the chosen method of demonstrating that the device conforms to each relevant Essential Principle and the reference of the controlled document that is relevant to a specific Essential Principle. While many controlled documents are referenced in the EP checklist, only some may be contained within this submission. The cited references to the controlled documents also allow easy identification of additional relevant documents and data.
1.4.
An application for Medical devices registration/notification for either locally manufactured or imported should be submitted to Rwanda FDA by the applicant via Rwanda FDA Online portal. Where applicable, samples can be submitted along with the cover letter (APPENDIX 1) together with a printed email notification bearing an application reference number generated at the time of application submission, at Rwanda FDA head Quarters reception to the following address:: Director General Rwanda FDA Rwanda Food and Drugs Authority P. O. Box 1948 Kigali- Rwanda
1.5.
1.5.1. Requirements for notification of new applications Medical Devices falling under class A which are in a non-sterile state, a non-active and with non- measuring function (List to be provided for guidance) shall apply for notification to the Authority. Applicants shall submit (online) the following: 1. Signed and dated copy of the cover letter addressed to the DG of Rwanda FDA (Appendix 1) 2. Signed and dated and duly filled in application form for notification (Appendix 2) 3. Valid Certificate of compliance to ISO 13485 standard or its equivalent from the manufacturer(s) of the device 4. Declaration of Conformity (DoC) 5. Instruction for Use (IFU) (where applicable) 6. Device artworks/ mock ups 7. One device commercial pack sample (where applicable). In case samples are not provided, a letter explaining the reason of non-submission should be provided and real life 3D pictures should be included the submitted documentation. 1.5.2. Requirements for registration of new applications Other medical devices not eligible for notification shall apply (online) for registration and their applications shall include the following: 1. Signed and dated copy of the cover letter addressed to the DG of Rwanda FDA (Appendix 1) 2. Signed and dated application form for device registration (Appendix 3) 3. Technical documentation/Technical file (Table of Content (ToC)) 4. Declaration of Conformity (DoC) 5. Copies of referenced literature and other supporting documents 6. Two commercial samples of medical devices and certificate of conformity (where applicable), however additional samples might be required (in case samples are not provided, a letter explaining the reason of non-submission should be provided and real life 3D pictures should be included the submitted documentation) 7. Rwanda FDA QMS audit certificate or Proof of QMS audit application (for class C and class D medical devices). 1.5.3. Requirements for renewal of registered medical devices applications An application for renewal of medical devices registration be submitted online and shall include the following: 1. Signed and dated copy of the cover letter addressed to the DG of Rwanda FDA (Appendix 1) 2. Signed and dated application form for registered devices (Appendix 3) 3. Current artworks/ mock ups of the device 4. Technical documentation/Technical file (Table of Content (ToC) 5. two commercial pack samples (where applicable) 6. Payment of renewal fee and QMS audit fee as per relevant regulations 1.5.4. Requirements for renewal of notified medical devices applications 1. Signed and dated copy of the cover letter addressed to the DG of Rwanda FDA (Appendix 1) 2. Signed and dated application form for notified devices (Appendix 2) 3. Valid Certificate of compliance to ISO 13485 standard or its equivalent from the manufacturer(s) of the device 4. Current artworks/ mock ups of the device 5. One commercial pack samples (where applicable) 6. Payment of renewal fees as per relevant regulations 1.6.Receiving Applications for Medical Devices Registration/Notification An application for registration/ notification of a medical device is only received via the online platform and is considered complete by the Authority upon receiving all necessary information and the payment of prescribed notification/registration fees has been effected. After receiving a product notification/registration application, a reference number is assigned to the application and the latter will be used in all subsequent correspondences relating to the application.
1.7.
1.7.1. Dossier Notification Procedure After receiving an application requesting notification via the online platform, the Authority shall proceed with the screening of the dossier for completeness based on the First in First out (FIFO) rules. A medical device dossier is reviewed by one assessor to verify the completeness of requirements. During the review, additional data and/or samples may be requested. Once a query has been issued to the applicant, the notification process stops until the Authority receives via the online platform, a response to the raised queries. Further processing of the application may only be undertaken if responses to queries issued contains all outstanding information requested in one submission. Failure to comply with this condition or if the queries have been reissued for a second time and the applicant provides unsatisfactory responses, the application will be rejected. In the event that the responses to the queries are not submitted within the specified time, from the date they were issued, it will be considered that the applicant has withdrawn the application unless the applicant has requested an extension of the deadline to the Authority. Thereafter, notification of the medical device may only be considered upon submission of a new application. In case the dossier is complete, the application will be scheduled for peer review. The applicant shall receive a notification letter within twenty (20) working days. 1.7.2. Dossier Registration Procedure After receiving an application requesting registration via the online platform, the Authority shall proceed with the screening of the dossier for completeness. In the event that the dossier is incomplete, it will not be scheduled for assessment and the applicant will be notified via the platform within twenty (20) working days and requested to comply with requirements. In case of a positive outcome from the screening, the application will be scheduled for assessment according to the First in First out (FIFO) rules. Priority assessment may be granted where the device is intended for diagnosis, treatment or alleviation of rare disease conditions or in the case of an emergency situation. A Medical Device dossier is reviewed by two assessors whose role is to provide scientific and regulatory oversight regarding the quality, safety and performance of the medical device. The Authority reserves the right during the assessment procedure, to request any additional information/samples so as to establish the quality, safety and performance of the device. Samples may be analysed in the Quality Control Laboratory on a risk basis approach, in order to guide the Authority’s final decision. In case of incompleteness during assessment, additional data will be requested from the applicant. The assessment process stops until the Authority receives a response to the raised queries. Further processing of the application may only be undertaken if responses to queries issued contain all outstanding information requested. Failure to comply with this condition or if the queries have been reissued for the fourth time and the applicant provides unsatisfactory responses, the application will be rejected. In the event the responses to the queries are not submitted within the specified timeline for medical devices undergoing abridged assessment procedure from the date they were issued, it will be considered that the applicant has withdrawn the application unless the applicant has requested for extension of the deadline to the Authority. Thereafter, registration of Medical Devices may only be considered upon submission of a new application. In case the dossier is deemed complete after the assessment, the application will be scheduled for peer review. The applicant shall receive a certificate of registration within a maximum period of One hundred eighty (180) working days. Note: i. For lower risk medical devices, the aforementioned timeline may be significantly shortened. ii. The Authority may rely on assessments and audits conducted by other recognized regulatory authorities or conformity assessment bodies (CABs); An abridged assessment procedure may then be conducted.
1.8.
The QMS audit is part of a Medical Device registration process. All devices under classes C and D shall apply and pay relevant QMS audit fees. The Authority should conduct an inspection of the manufacturing facility or use other means to verify whether the manufacturing site complies with QMS before the Medical Device is registered. During the assessment, assessors may highlight QMS’s issues and communicate them to the department that has the mandate of inspection and compliance. QMS audit compliance of the manufacturing site of devices under the abridged assessment procedure shall be confirmed through desk review; however, if deemed necessary the Authority may conduct an onsite inspection. Note: The Authority reserves the right to conduct a Quality Management System (QMS) audit for other classes of medical devices should regulatory review or technical assessment indicate the necessity. More information on QMS requirements and application for QMS audit is detailed in relevant guidelines.
1.9.
After the assessment completion, a final dossier assessment report shall be presented to the Authority’s Internal Scientific Review Committee (ISRC) before making final decisions for granting or rejecting the medical device market authorization. In the event, that there are safety, quality or performance issues to be resolved as per the decision of the ISRC, the application shall remain pending until the resolution of the raised issues. If the applicant fails to provide the required data within the specified timeline, the application shall be considered as withdrawn. The Authority shall register/ notify the Medical device in the event that data on safety, quality and performance or other requirements are considered satisfactory and a certificate of registration/ certificate of notification shall be granted.
1.10.
1.10.1. Timelines for registration/notification of new applications Medical Devices dossiers shall be scheduled for assessment according to the First in First out (FIFO) basis upon compliance with the requirements. An application for registration/notification shall be processed within: Twenty (20) working days for the notification procedure Sixty (60) working days for the abridged assessment procedure One hundred eighty (180) working days for the full assessment procedure Any additional data shall be submitted within: Ten (10) working days for Medical Devices undergoing notification procedure Twenty (20) working days for Medical Devices undergoing abridged assessment procedure Sixty (60) working days undergoing the full assessment procedure Note: The registration certificate shall be valid for a period of five (5) years, whereas the notification letter shall be three (3) years. In the event that the Authority suspends or cancels the registration/notification validity, a written official communication shall be issued to the applicant. 1.10.2. Timelines for renewal of notified/registered devices applications Marketing authorisation holders must apply for renewal of notification/registration to the Authority at least Sixty (60) working days before the expiry of the Marketing Authorization. Applications for renewal of notified/ registered medical devices shall be processed within: Twenty (20) working days for notified Medical Devices Sixty (60) working days for registered Medical Devices Any additional data shall be submitted within: Ten (10) working days for notified Medical Devices Twenty (20) working days for registered Medical Devices Note: Failure to comply with the above timeline, or if the queries have been reissued for a second time and the applicant provides unsatisfactory responses, will result in the MA suspension
1.11.
Medical devices are classified into four (4) classes (A, B, C, D) based on the level of risk to the end user and their intended purpose. Class A represents the group with the lowest risk and Class D represents the group with the highest risk. Table 1: Classification examples for Medical Devices Class Risk Levels A Low (examination gloves, tongue depressors…) B Low-Moderate(electronic thermometers, tubes for blood transfusion, Hypodermic needles…) C Moderate-High (lung ventilators, condoms…) infusion pumps…) D High (cardiac pacemakers, implants, IUDs….) Where a medical device can be classified into more than one class, the class representing the higher risk applies. Where one medical device is intended to be used together with a different medical device, that may or may not be from the same manufacturer, a separate submission should be made and the conformity assessments of the medical devices shall be applied separately to each of the devices. Whilst the manufacturer has the primary responsibility to classify its devices, the Authority may challenge the classification and will have the final say in deciding the class of the medical devices. Each submitted application shall contain only one of the following: a. A single medical device b. One medical device family c. One medical device system d. One medical device group
1.12.
All medical devices in classes A B, C & D require pre-market submission of technical documentation demonstrating conformity with Essential Principles except for those requiring notification (List to be provided for guidance). The information within the Technical file shall be organized in the Table of Content (ToC) submission structure such that it incorporates the relevant sections described in these guidelines.
1.13.
The technical documentation shall be submitted as Table of content (ToC) format The ToC comprises of 6 chapters as well as subchapters which shall be compiled in a well- organized structure within the technical documentation as one file or one folder with all relevant sections. Files shall be presented in a searchable format so as to avoid unnecessary delays during the registration process. Note: For chapters/ subchapters that are not applicable to a specific device, the applicant is requested to indicate “NA” and provide a brief explanation as to why the chapters/ subchapters are not applicable. CHAPTER 1 – REGIONAL ADMINISTRATIVE
1.01
The cover letter is provided under Appendix 1, it should be filled and signed by the applicant.
1.02
The table of content should specify the page number for each item referred to in the technical file.
1.03
In case specific terms or acronyms have been used in the technical file, they should be defined under this section.
1.04
Application Form for Medical Devices and In Vitro Diagnostics Devices (IVDDs) registration is provided under Appendix 3, it should be filled and signed by the applicant.
1.05
Where applicable, a table listing each variant/model/configuration/component/accessory that is the subject of the submission and the following information for each variant/model: a) the identifier (e.g. bar code, catalogue, model or part number, UDI) b) a statement of its name/description that provides (e.g. Trade name, size, material)
1.06
Certificates Under this section, the applicant should provide a valid QMS audit (applicable for class C and D) issued by Rwanda FDA, or equivalent certificates from other competent authorities (i.e. ISO 13485, QMS certificates from other National Regulatory Authroties,…)
1.07
The applicant should provide the following: -List of the Regulatory Authorities that have provided current regulatory approval for the supply of this product in their country/region of authority -Details of the type of regulatory approval obtained from each Regulatory Authority -Current evidence of the regulatory approval, such as certificates provided by the Regulatory Authority
1.08
This section applies for applications of WHO prequalified devices, and devices registered in countries with which Rwanda FDA has signed Memorandum of understanding. Under this section, the applicant should state whether the submitted application falls under one of the two cases above
1.09
To be paid after submission of the dossier in the portal
1.10
Where applicable/relevant, the applicant will be requested to submit a List prior submission or pre-submissions where regulator feedback was provided
1.11
Where applicable
1.12
Under this section, the applicant should provide a Declaration of Conformity (DoC), dated and signed by the manufacturer. The DoC should contain at least the following information: Manufacturer’s Information, Authorized Representative (if applicable), Medical Device Information, Risk classification, Statement of Conformity which should include Applicable Regulations or Standards 1.12.01 Performance and Voluntary Standard where applicable 1.12.02 Environmental Assessment This section is only applicable for devices that present new environmental concerns. The applicant should provide an environment assessment 1.12.03 Clinical Trial Certifications Where applicable 1.12.04 Indications for Use Statement with Rx and/or OTC designation Enclosure This information should figure on the IFU 1.12.05 Truthful and Accurate Statement Not applicable 1.12.06 USFDA Class III Summary and Certification Not applicable 1.12.07 Declaration of Conformity
1.13
Where applicable, letter from the owner of any separate document referenced in the submission (e.g. Master File or previous regulatory submission), granting access to the information in the referenced document. The letter should include the information of the applicant who cited the separate document (e.g. Master File or previous regulatory submission), the product name, the document number that has been filed, and the page number/chapter information of the separate document authorized to be cited.
1.14
Under this section, a letter of authorization from the manufacturer authorizing the Local Technical Representative to submit the application to Rwanda FDA. The letter should clearly highlight the responsibility of the LTR.
1.15
Not applicable CHAPTER 2 – SUBMISSION CONTEXT
2.01
Under this chapter, the applicant should include the following: -All headings and sub-headings for chapter 2 -Specify the page number for each item referred to in the table.
2.02
The applicant should provide a summary of the following: -Trade name, proprietary name -Statement of the device type (e.g. hip implant, infusion pump, standalone software), -The device’s general purpose, -The type of submission (e.g. new, change of existing application (reason, description of change, renewal)
2.03
Where applicable
2.04
The content of this chapter should be captured in the subsections below 2.04.01 Comprehensive Device Description and Principle of Operation The applicant should provide the following under this subsection: -A general description of the device, including: • A statement of the device name • What the device does • Who uses it and for what? • Where to use it the device (places/environment) • How it works? Including a description of the features/variants/operating modes that enable the device to be used for indications/intended use (principle of operation/mechanism of action) and if not readily apparent or typical for the device type, a brief description of the underlying science/technology, design concepts, and/or theoretical principles supporting the device's function. • If applicable, labelled pictorial representation (diagrams, photos, drawings). • If system, how the components relate • If applicable, identify if the device incorporates software/firmware and its role -Product specification, including: • Physical characteristics or relevance to the end user (dimensions, weight) • Features and operating modes • Input specifications (e.g. electrical power requirements, settings and associated allowable ranges/limits) • Output and performance characteristics (e.g. range and type of energy delivered, resolution of images) • If applicable, an indication of the variants/models of the devices and a summary of the differences in specifications of the variants (comparison table and/or pictures/diagrams with supporting text). -List of accessories intended to be used in combination with the devices (where applicable) -Indication of any other medical devices or general product intended to be used in combination with the medical device (where applicable) -List all components or accessories that can be sold separately (where applicable) -If approved by the regulator, provide the approval number and identification for each component or accessory. -If the device is to be sterilized, an indication of who is to perform the sterilization and by what method or an affirmative statement that the device is non-sterile when used. -A summary of the composition of the device including, the material specification and/or chemical composition of the materials that have direct or indirect contact with the user and/or patient. -Chemical/Material Characterization. If applicable, chemicals may be identified using either the IUPAC (International Union of Pure and Applied Chemistry) or the CAS (Chemical Abstract Service) Registry number. -An indication of biological material or derivate used in the medical device, including: origin (human, animal, recombinant or fermentation products or any other biological material), source (e.g. blood, bone, heart, any other tissue or cells), and the intended reason for its presence and, if applicable, its primary mode of action. -An active pharmaceutical ingredient (API) or drug, an indication, identity, the intended reason for its presence its primary mode of action and source of the substance, should be provided, if the device contains an API. -Engineering diagrams/prints/schematics of the device (should be provided as a separate file within the submission). 2.04.02 Description of Device Packaging The following information should be provided: -Information regarding the packaging of the device (primary packaging, secondary and any other packaging associated (where applicable)) -Specific packaging of accessories marketed together with the device -Information about the correct packaging needed to package the medical device or its accessories before performing the sterilization (where applicable) 2.04.03 History of Development Where the information is available, the applicant should provide the following information: -A table describing preferably with 4 columns as below: Device Name Description of motivation for list of and/or Version changes from the change verification/validation previous row activities, including clinical studies, conducted using this version -where applicable, for any design verification or validation activities presented in this submission (including clinical studies) performed on any earlier versions of the subject device, include a justification for why the changes do not impact the validity of the data collected under those activities in supporting the safety and effectiveness of the final device design. 2.04.04 Reference and Comparison to Similar and/or Previous Generations of the Device The applicant should provide the following information: -A list of similar devices (available on local and international market) and/or previous generation of the devices (if existent) relevant to the submission. -A key specification comparison, preferably in a table, between the references (similar and/or previous generation) considered and the device. (where applicable) 2.04.05 Substantial Equivalence Discussion Not applicable
2.05
The content of this chapter should be captured in the subsections below 2.05.01 Intended Use; Intended Purpose; Intended User; Indications for Use This section should include the following information (If more than one device is included, the information should be provided for each device) as appropriate: -Intended Use: The statement of intended use should specify the therapeutic or diagnostic function provided by the device and may describe the medical procedure in which the device is to be used -Intended Purpose: What is expected with the use of this medical device? Which results are expected? -Intended user and skills/knowledge/training that the user should have to operate or use the device. -Identify if the device is intended for single or multiple use -Indications for Use: • Disease or medical condition that the device will diagnose, treat, prevent, mitigate, or cure, parameters to be monitored and other considerations related to indication for use. • If applicable, information about patient selection criteria. • If applicable, information about intended patient population (e.g. adults, pediatrics or newborn) or a statement that no subpopulations exist for the disease or condition for which the device is intended. -Identify any changes to the previously approved intended use/intended purpose/intended user/indications, for amendments/supplements or changes to existing approvals, where applicable. 2.05.02 Intended Environment/Setting for use The applicant should provide the following information under this subsection -The setting where the device is intended to be used (e.g. domestic use, hospitals, medical/clinical laboratories, ambulances, medical/dental offices). Multiple options can be indicated. -Environmental conditions that can affect the device’s safety and/or performance (e.g. temperature, humidity, power, pressure, movement), If applicable 2.05.03 Pediatric Use Where applicable the applicant should provide the following: Description of any pediatric subpopulations that suffer from the disease or condition that the device is intended to treat, diagnose or cure, 2.05.04 Contraindications For Use If applicable, provide a statement that specifies the disease or medical conditions that would make use of the device inadvisable due to unfavorable risk/benefit profile. Note: The statement of contraindications for the device must be as presented in the labelling.
2.06
The content of this chapter should be captured in the subsections below 2.06.01 Global Market History The applicant should provide and up to date list of the markets (all countries or jurisdictions) where the device is approved for marketing, and include as well a list of all countries in which the device has been removed from marketing and explain the reason for removal. 2.06.02 Incident Reports and Recalls The applicant should provide the following information: -List adverse events/incidents associated with the device and a statement of the period associated with this data -A summary by event type that state the number of reported events for each event type, if the number of adverse events is voluminous -List of the medical device recalls and/or advisory notice, and a discussion of the handling and solution given by the manufacturer in each case. -A description of any analysis and/or corrective actions undertaken in response to items listed above. -If there have been no adverse events/incidents, recalls and/or advisory notice to date, provide an attestation from the manufacturer, that there have been no such events/changes. 2.06.03 Sales, Incident and Recall Rates Where available, a summary of the number of units sold in each country/region, incident rate, recall rate and a statement of the period associated with this data should be provided. 2.06.04 Evaluation/Inspection Reports Where available or where deemed necessary by the Authority, the applicant should provide copies of full audit reports and technical reports issued by other parties (e.g. Notified Body certification reports).
2.07
The applicant should provide the Post-Market Study Plans, which may include clinical or nonclinical study plans. The documentation provided here will not include final reports and analysis, and instead includes study plan information only. This may include the following Study Objectives Study Design Subjects and Sites information Endpoints (primary and secondary) Summary of Data Analysis plan Length and frequency of follow-up
2.08
The applicant should provide the following information: -A summary of the risks identified during the risk analysis process and how these risks have been controlled to an acceptable level. Plans can be considered part of the risk management documentation. -The results of the risk analysis should provide a conclusion with evidence that remaining risks are acceptable when compared to the benefits. -Where a standard is followed, identify the standard.
2.09
The applicant should duly fill in the EP checklist (Appendix 4),
2.10
No content at this level 2.10.01 List of Standards and Guidance Documents The list of standards complied to can be submitted together with the Essential Principles Checklist. 2.10.02 Declaration and/or Certification of Conformity The applicant is advised to prepare the Declaration of Conformity to recognized standards, if not submitted in chapter 1.
2.11
CHAPTER 3 – NON-CLINICAL EVIDENCE
3.01
Under this chapter, the applicant should include the following: -All headings and sub-headings for chapter 3 -Specify the page number for each item referred to in the table.
3.02
Chapter Retired
3.03
Chapter Retired
3.04
Chapter Retired
3.05
The content of this chapter should be captured in the subchapters below 3.05.01 Physical and Mechanical Characterization The applicant should provide evidence that supports the physical or mechanical properties of the device. This should include, where available: A summary of the non-clinical evidence A discussion with the rationale of the non-clinical testing considered for the device and support for their selection or omission from the verification and validation studies conducted If applicable, particulate testing from wear or device coatings. Discussion to support why the evidence presented is sufficient to support the application. Note: In case this subchapter is not applicable, the applicant should provide a statement of why this category of non-clinical study is not applicable to this case. 3.05.01.01 Study description, study identifier, date of initiation Where applicable, the applicant should provide a separate entry for each Physical and Mechanical Characterization study conducted on the device. For each study, provide: Study description Study identifier Date of initiation Summary of the study Full report of the study 3.05.01.01.01 Summary The applicant should provide a summary(ies) of the specific study(ies) provided and described in the subchapter above 3.05.01.01.02 Full Report The applicant should include test report(s) for the study/test(s) described in the subchapter above. 3.05.01.01.03 Statistical Data Where available, the applicant should provide statistical data associated with the study(ies)/tests described in the subchapter above 3.05.02 Chemical/Material Characterization The applicant should provide study(ies)/test(s) that describe the chemical or structural composition of the device and its components. This should include: A summary of the non-clinical evidence A discussion of the non-clinical testing considered for the device and support for their selection or omission from the verification and validation studies conducted in this category Discussion to support why the evidence presented is sufficient to support the application. Note: In case this subchapter is not applicable, the applicant should provide a statement of why this category of non-clinical study is not applicable to this case. 3.05.02.01 Study description, study identifier, date of initiation Where applicable, the applicant should provide a separate entry for each Physical and Mechanical Characterization study conducted on the device. For each study, provide: Study description Study identifier Date of initiation Summary of the study 3.05.02.01.01 Summary The applicant should provide a summary(ies) of the specific study(ies) provided and described in the subchapter above 3.05.02.01.02 Full Report The applicant should include test report(s) for the study/test(s) described in the subchapter above. 3.05.02.01.03 Statistical Data Where available, the applicant should provide statistical data associated with the study(ies)/tests described in the subchapter above 3.05.03 Electrical Systems: Safety, Mechanical and Environmental Protection, and Electromagnetic Compatibility The applicant should provide evidence supporting electrical safety, mechanical and environmental protection, and electromagnetic compatibility. This should include: A summary of the non-clinical evidence A discussion of the non-clinical testing considered for the device and support for their selection or omission from the verification and validation studies conducted in this category Discussion to support why the evidence presented is sufficient to support the application. Note: In case this subchapter is not applicable, the applicant should provide a statement of why this category of non-clinical study is not applicable to this case. 3.05.03.01 Study description, study identifier, date of initiation Where applicable, the applicant should provide a separate entry for each Physical and Mechanical Characterization study conducted on the device. For each study, provide: Study description Study identifier Date of initiation 3.05.03.01.01 Summary The applicant should provide a summary(ies) of the specific study(ies) provided and described in the subchapter above 3.05.03.01.02 Full Report The applicant should include test report(s) for the study/test(s) described in the subchapter above. 3.05.03.01.03 Statistical Data Where available, the applicant should provide statistical data associated with the study(ies)/tests described in the subchapter above 3.05.04 Radiation Safety The applicant should provide studies supporting radiation safety, where the device emits ionizing and/or non-ionizing radiation or where the device is exposed to radiation. This should include: A summary of the non-clinical evidence that falls within this category A discussion of the non-clinical testing considered for the device and support for their selection or omission from the verification and validation studies conducted in this category (i.e., what tests were considered and why they were or were not performed) Discussion to support why the evidence presented is sufficient to support the application. Note: In case this subchapter is not applicable, the applicant should provide a statement of why this category of non-clinical study is not applicable to this case. 3.05.04.01 Study description, study identifier, date of initiation Where applicable, the applicant should provide a separate entry for each Physical and Mechanical Characterization study conducted on the device. For each study, provide: Study description Study identifier Date of initiation 3.05.04.01.01 Summary The applicant should provide a summary(ies) of the specific study(ies) provided and described in the subchapter above 3.05.04.01.02 Full Report The applicant should include test report(s) for the study/test(s) described in the subchapter above. 3.05.04.01.03 Statistical Data Where available, the applicant should provide statistical data associated with the study(ies)/tests described in the subchapter above 3.05.05 Software/Firmware/Programmed or programmable medical devices Studies and supporting information on the software design, development process and evidence of the validation of the software, as used in the finished device, should be included in this section and the associated sub-sections. It should also address all the different hardware configurations and, where applicable, operating systems identified in the labelling. Documentation should be organized according to software or hardware systems. Note: In case this subchapter is not applicable, the applicant should provide a statement of why this category of non-clinical laboratory study is not applicable to this case. 3.05.05.01 Software/Firmware Description The applicant should provide the software description. It should include: A comprehensive overview of significant software features and functions, which may include images, flow charts, and state diagrams as needed to adequately explain the software functionality, The version of the software. The version tested must be clearly identified and should match the release version of the software, otherwise justification must be provided, Identification of the device features that are controlled by the software, the programming language, hardware platform, operating system (if applicable), use of Off-the-shelf software (if applicable), a description of the realization process. For machine learning-enabled medical device (such as adaptive models, natural language processing, neural networks, and related approaches), please provide the following, as applicable: a detailed description of each algorithm/model, including its inputs, outputs, data selection and management for training, testing, and validation (terminology may differ in different regions); model selection and evaluation; risk management activities; materials/approaches used to provide transparency; post-market performance monitoring activities. 3.05.05.02 Risk Management File (including Hazard Analysis) The risk management file should be provided and include the risk management plan, risk assessment, and risk management report. The risk assessment (e.g. hazard analysis) should take into account all device hazards associated with the device’s intended use. For software that is part of a system, a risk assessment should be performed on the system comprising the software and its whole hardware environment and noted in the software documentation with reference to the particular section of the premarket submission. 3.05.05.03 Software Requirement Specification (SRS) The Software Requirements Specifications (SRS) documentation should describe the needs or expectations for a system or software, presented in an organized format, at the software system level or subsystem level, as appropriate, and with sufficient information to understand the traceability of the information with respect to the other software documentation elements (e.g. risk management file, software design specification, system and software architecture design chart, software testing). The SRS documents the requirements for the software which typically specifies inputs and outputs, functions that the software will perform, hardware, performance, interfaces, user interaction, error definition and handling, intended operating environment, safety and security related requirements derived from a risk assessment (hazard analysis) and all ranges, limits, defaults, and specific values that the software will accept. 3.05.05.04 System and Software Architecture Design (SAD) Chart The System and Software Architecture Design (SAD) Chart should consist of detailed diagrams of the modules, layers, and interfaces that comprise the device, their relationships, the data inputs/outputs and flow of data, and how users or external products (including information technology (IT) infrastructure and peripherals) interact with the system and software. If the System and Software Architecture Design Chart is included in another document, such as the SRS, a reference to the location of the System and Software Architecture Design Chart in the submission should be included. 3.05.05.05 Software Design Specification (SDS) Software Design Specification (SDS) documentation should be provided, including sufficient information to understand the technical design details of how the software functions, how the software design completely and correctly implements all the requirements of the SRS, and how the software design traces to the SRS in terms of intended use, functionality, safety, and effectiveness. In terms of the relationship between the SRS and the SDS, the SRS describes what the software function will do and the SDS describes how the requirements in the SRS are implemented. The information presented in the SDS should be sufficient to ensure that the work performed by the software engineers who created the device software function was clear and unambiguous, with minimal ad hoc design decisions. 3.05.05.06 Traceability Analysis A Traceability Analysis links together the product design requirements, design specifications, and testing requirements. It also provides a means of tying together identified hazards with the implementation and testing of the mitigations. 3.05.05.07 Software Life Cycle Process Description / Software, Development, Configuration Management, and Maintenance Practices The Software Life Cycle Process Description / Software Development, Configuration Management, and Maintenance Practices description should describe the software development life cycle and the processes that are in place to manage the various life cycle activities. 3.05.05.08 Software Testing as Part of Verification and Validation An overall description of the verification and validation activities performed for the final software version should be provided. The applicable test protocols and reports including the expected results, observed results and pass/fail determination should also be provided Note: Discussion should address all of the different hardware configurations and, where applicable, operating systems identified in the labelling. 3.05.05.09 Software Version / Revision Level History The Software Version / Revision Level History documentation should include the history of software versions that were tested and documented as part of verification and validation activities. This typically takes the form of a line- item tabulation including the date, version number that was tested and a brief description of all changes in the version relative to the previously tested version. The last entry in a line-item tabulation should be the final version to be incorporated in the released device. This entry should also include any differences between the tested version of software and the released version. 3.05.05.10 Unresolved Software Anomalies Documentation should include a list of unresolved anomalies present in the software with the following items for each unresolved anomaly: A description of what the anomaly is and what root cause(s) of the anomaly could be; Identification of how the anomaly was discovered and, where possible, identification of the root cause(s) of the anomaly; Evaluation of the impact of the anomaly on the device’s safety and effectiveness, including operator usage and human factors considerations; Outcome of the evaluation; and Risk-based rationale for not correcting or fixing the anomaly in alignment with the risk management plan or procedure(s). 3.05.05.11 Cybersecurity Refer to APPENDIX 5 for requirements compilation for this subechapter 3.05.05.12 Interoperability If the device can communicate with other devices. Evidence to support the interoperability should be provided. 3.05.06 Biocompatibility and Toxicology Evaluation The applicant should provide studies to assess the immunological response to animal or human tissues, tissue components or derivatives are to be included in this section. This should include: A list of all materials in direct or indirect contact with the patient or user. State conducted tests, applied standards, test protocols, the analysis of data and the summary of results A discussion of the non-clinical testing considered for the device and support for their selection or omission from the verification and validation studies conducted in this category (i.e., what tests were considered and why they were or were not performed) Discussion to support why the evidence presented is sufficient to support the application. Note: In case this subchapter is not applicable, the applicant should provide a statement of why this category of non-clinical study is not applicable to this case. 3.05.06.01 Study description, study identifier, date of initiation Where applicable, the applicant should provide a separate entry for each Physical and Mechanical Characterization study conducted on the device. For each study, provide: Study description Study identifier Date of initiation 3.05.06.01.01 Summary The applicant should provide a summary(ies) of the specific study(ies) provided and described in the subchapter above 3.05.06.01.02 Full Report The applicant should include test report(s) for the study/test(s) described in the subchapter above. 3.05.06.01.03 Statistical Data Where available, the applicant should provide statistical data associated with the study(ies)/tests described in the subchapter above 3.05.07 Non-Material-Mediated Pyrogenicity The applicant should provide studies to support pyrogenicity evaluation of final release, such as endotoxin levels. This should include: A summary of the non-clinical evidence that falls within this category A discussion of the non-clinical testing considered for the device and support for their selection or omission from the verification and validation studies conducted in this category (i.e., what tests were considered and why they were or were not performed) Discussion to support why the evidence presented is sufficient to support the application. Note: In case this subchapter is not applicable, the applicant should provide a statement of why this category of non-clinical study is not applicable to this case. 3.05.07.01 Study description, study identifier, date of initiation Where applicable, the applicant should provide a separate entry for each Physical and Mechanical Characterization study conducted on the device. For each study, provide: Study description Study identifier Date of initiation 3.05.07.01.01 Summary The applicant should provide a summary(ies) of the specific study(ies) provided and described in the subchapter above 3.05.07.01.02 Full Report The applicant should include test report(s) for the study/test(s) described in the subchapter above. 3.05.07.01.03 Statistical Data Where available, the applicant should provide statistical data associated with the study(ies)/tests described in the subchapter above 3.05.08 Safety of Materials of Biological Origin (human/animal) Evaluations performed to demonstrate the safety of materials of biological origin (e.g. animal sourced, human sourced material) are to be included in this section. This should include: A description of biological material or derivate State the harvesting, processing, preservation, testing and handling of tissues, cells and substances If applicable, discussion of infectious agents/transmissible agents known to infect the source animal Clarify the origin (including details of donor screening and source country) and describe the tests on validation of removal or inactivation methods of viruses and other pathogens in the manufacturing process. A brief summary of process validation should be included to substantiate that manufacturing and screening procedures are in place to minimize biological risks, in particular, with regard to viruses and other transmissible agents. The system for recordkeeping to allow traceability from sources to the finished device should be fully described Discussion to support why the evidence presented is sufficient to support the application. Note: In case this subchapter is not applicable, the applicant should provide a statement of why this category of non-clinical study is not applicable to this case. 3.05.08.01 Certificates If available, the applicant should provide a Certificate of Suitability (CEP) for biological material that bears TSE (Transmissible Spongiform Encephalopathy) risk, or other Certificates that support the safety of materials of biological origin (e.g. certificate of abattoir inspection). 3.05.08.02 Study description, study identifier, date of initiation Where applicable, the applicant should provide a separate entry for each Physical and Mechanical Characterization study conducted on the device. For each study, provide: Study description Study identifier Date of initiation 3.05.08.02.01 Summary The applicant should provide a summary(ies) of the specific study(ies) provided and described in the subchapter above 3.05.08.02.02 Full Report The applicant should include test report(s) for the study/test(s) described in the subchapter above. 3.05.08.02.03 Statistical Data Where available, the applicant should provide statistical data associated with the study(ies)/tests described in the subchapter above 3.05.09 Sterilization and Reprocessing Validation The content of this chapter should be captured in the subchapters below 3.05.09.01 End-User Sterilization The applicant should provide information and validation of end-user sterilization where it is necessary for the end-user to sterilize the device. This should include: a) A description of the sterilization process (method, parameters) and Sterility Assurance Level (SAL) b) A summary of the non-clinical evidence c) A discussion of the non-clinical testing considered for the device and support for their selection or omission from the verification and validation studies conducted in this category (i.e., what tests were considered and why they were or were not performed) d) If applicable, state the rationale on the durability of the product against two or more sterilization. e) Discussion to support why the evidence presented is sufficient to support the application. Note: In case this subchapter is not applicable, the applicant should provide a statement of why this category of non-clinical study is not applicable to this case. 3.05.09.01.01 Study description, study identifier, date of initiation Where applicable, the applicant should provide a separate entry for each Physical and Mechanical Characterization study conducted on the device. For each study, provide: Study description Study identifier Date of initiation 3.05.09.01.01.01 Summary The applicant should provide a summary(ies) of the specific study(ies) provided and described in the subchapter above 3.05.09.01.01.02 Full Report The applicant should include test report(s) for the study/test(s) described in the subchapter above. 3.05.09.01.01.03 Statistical Data Where available, the applicant should provide statistical data associated with the study(ies)/tests described in the subchapter above 3.05.09.02 Manufacturer Sterilization Validation Information and validation of manufacturer sterilization where the device is provided sterile. This should include: A description of the sterilization process (method, parameters) and Sterility Assurance Level (SAL) State if parametric release is used A summary of the non-clinical evidence that falls within this category Information on the ongoing revalidation of the process. Typically, this would consist of arrangements for, or evidence of, revalidation of the packaging and sterilization processes. A discussion of the non-clinical testing considered for the device and support for their selection or omission from the verification and validation studies conducted in this category (i.e., what tests were considered and why they were or were not performed) Discussion to support why the evidence presented is sufficient to support the application. Note: In case this subchapter is not applicable, the applicant should provide a statement of why this category of non-clinical study is not applicable to this case. 3.05.09.02.01 Study description, study identifier, date of initiation Where applicable, the applicant should provide a separate entry for each Physical and Mechanical Characterization study conducted on the device. For each study, provide: Study description Study identifier Date of initiation 3.05.09.02.01.01 Summary The applicant should provide a summary(ies) of the specific study(ies) provided and described in the subchapter above 3.05.09.02.01.02 Full Report The applicant should include test report(s) for the study/test(s) described in the subchapter above. 3.05.09.02.01.03 Statistical Data Where available, the applicant should provide statistical data associated with the study(ies)/tests described in the subchapter above 3.05.09.03 Residual Toxicity This section should contain the information on the testing for sterilant residues, where the device is supplied sterile and sterilized using a method susceptible to residues. This should include: A summary of the non-clinical evidence that falls within this category A discussion of the non-clinical testing considered for the device and support for their selection or omission from the verification and validation studies conducted in this category (i.e., what tests were considered and why they were or were not performed) Discussion to support why the evidence presented is sufficient to support the application. Note: In case this subchapter is not applicable, the applicant should provide a statement of why this category of non-clinical study is not applicable to this case. 3.05.09.03.01 Study description, study identifier, date of initiation Where applicable, the applicant should provide a separate entry for each Physical and Mechanical Characterization study conducted on the device. For each study, provide: Study description Study identifier Date of initiation 3.05.09.03.01.01 Summary The applicant should provide a summary(ies) of the specific study(ies) provided and described in the subchapter above 3.05.09.03.01.02 Full Report The applicant should include test report(s) for the study/test(s) described in the subchapter above. 3.05.09.03.01.03 Statistical Data Where available, the applicant should provide statistical data associated with the study(ies)/tests described in the subchapter above 3.05.09.04 Cleaning and Disinfection Validation The applicant should provide information on the validation of cleaning and disinfection instructions for reusable devices. This should include: A summary of the non-clinical evidence that falls within this category A discussion of the non-clinical testing considered for the device and support for their selection or omission from the verification and validation studies conducted in this category (i.e., what tests were considered and why they were or were not performed) Discussion to support why the evidence presented is sufficient to support the application. Note: In case this subchapter is not applicable, the applicant should provide a statement of why this category of non-clinical study is not applicable to this case. 3.05.09.04.01 Study description, study identifier, date of initiation Where applicable, the applicant should provide a separate entry for each Physical and Mechanical Characterization study conducted on the device. For each study, provide: Study description Study identifier Date of initiation 3.05.09.04.01.01 Summary The applicant should provide a summary(ies) of the specific study(ies) provided and described in the subchapter above 3.05.09.04.01.02 Full Report The applicant should include test report(s) for the study/test(s) described in the subchapter above. 3.05.09.04.01.03 Statistical Data Where available, the applicant should provide statistical data associated with the study(ies)/tests described in the subchapter above 3.05.09.05 Reprocessing of Single Use Devices Validation Data The required validation data including cleaning and sterilization data, and functional performance data demonstrating that each single use device (SUD) will continue to meet specifications after the maximum number of times the device is reprocessed as intended. Note: In case this subchapter is not applicable, the applicant should provide a statement of why this category of non-clinical study is not applicable to this case. 3.05.09.05.01 Study description, study identifier, date of initiation Where applicable, the applicant should provide a separate entry for each Physical and Mechanical Characterization study conducted on the device. For each study, provide: Study description Study identifier Date of initiation 3.05.09.05.01.01 Summary The applicant should provide a summary(ies) of the specific study(ies) provided and described in the subchapter above 3.05.09.05.01.02 Full Report The applicant should include test report(s) for the study/test(s) described in the subchapter above. 3.05.09.05.01.03 Statistical Data Where available, the applicant should provide statistical data associated with the study(ies)/tests described in the subchapter above 3.05.10 Animal Testing The applicant should submit information about any animal studies conducted to support the submission. This should include: A summary of the non-clinical evidence that falls within this category A discussion of the non-clinical testing considered for the device and support for their selection or omission from the verification and validation studies conducted in this category (i.e., what tests were considered and why they were or were not performed) Discussion to support why the evidence presented is sufficient to support the application. Note: In case this subchapter is not applicable, the applicant should provide a statement of why this category of non-clinical study is not applicable to this case. 3.05.10.01 Study description, study identifier, date of initiation Where applicable, the applicant should provide a separate entry for each Physical and Mechanical Characterization study conducted on the device. For each study, provide: Study description Study identifier Date of initiation 3.05.10.01.01 Summary The applicant should provide a summary(ies) of the specific study(ies) provided and described in the subchapter above 3.05.10.01.02 Full Report The applicant should include test report(s) for the study/test(s) described in the subchapter above. 3.05.10.01.03 Statistical Data Where available, the applicant should provide statistical data associated with the study(ies)/tests described in the subchapter above 3.05.11 Usability/Human Factors Studies specifically assessing the instructions and/or device design in terms of impact of human behaviour, abilities, limitations, and other characteristics on the ability of the device to perform as intended should be included here. This should include: A summary of the non-clinical evidence A statement of the test environment and relation to the intended use environment A discussion of the non-clinical testing considered for the device and support for their selection or omission from the verification and validation studies conducted in this category (i.e., what tests were considered and why they were or were not performed) If a clinical study has been conducted that includes human factors/usability endpoints, reference to the studies and endpoints should be made, but full results do not need to be repeated. Discussion to support why the evidence presented is sufficient to support the application. Notes: i. If a clinical study has been conducted that includes usability/human factors endpoints, reference to the studies and endpoints should be made, but full results do not need to be repeated and should be included in Chapter 4 – Clinical Evidence. ii. In case this subchapter is not applicable, the applicant should provide a statement of why this category of non-clinical study is not applicable to this case. 3.05.11.01 Study description, study identifier, date of initiation Where applicable, the applicant should provide a separate entry for each Physical and Mechanical Characterization study conducted on the device. For each study, provide: Study description Study identifier Date of initiation 3.05.11.01.01 Summary The applicant should provide a summary(ies) of the specific study(ies) provided and described in the subchapter above 3.05.11.01.02 Full Report The applicant should include test report(s) for the study/test(s) described in the subchapter above. 3.05.11.01.03 Statistical Data Where available, the applicant should provide statistical data associated with the study(ies)/tests described in the subchapter above 3.05.12 Evidence for devices with preservatives or antimicrobial claims The applicant must provide the following for the following application: For multi-use products such as eye lubricants and contact lens care products that contain a preservative, evidence to support its preservation efficacy must be provided. For products such as sterile dressings with antimicrobial claims, evidence to support its antimicrobial efficacy must be provided.
3.06
This heading should include: A listing of published non-clinical studies involving this specific device Legible copies of key articles, including translation where applicable to meet the regulators language requirements Discussion to support why the evidence presented is sufficient to support the application. Note: A statement that no literature related to the device was found is to be provided in case non clinical bibliography has not been submitted.
3.07
The applicant should provide the following under this subchapter: a) An indication of environmental conditions for correct storage of the device (e.g. temperature, pressure, humidity, luminosity). b) A statement of the expiration period considering the materials and sterilization (when applicable), indicated as a period of time or any other means of appropriate quantification. Note: If the above is not submitted, please provide a rationale that storage conditions could not affect device safety or effectiveness 3.07.01 Product Stability The applicant should provide details relating to product stability under specified storage conditions and in final packaging or simulated conditions. This should include: A statement of the shelf-life (for each component if there are differences between components) and the proposed storage condition for the device A summary of the non-clinical evidence, covering shelf-life period when stored at the proposed storage condition, A discussion of the non-clinical testing considered for the device and support for their selection or omission from the verification and validation studies conducted in this category (i.e., what tests were considered and why they were or were not performed) Discussion to support why the evidence presented is sufficient to support the application. Evidence to support stability of the medicinal substance contained in the device at the proposed storage condition Evidence of in-use stability supporting the stability during actual routine use of the device (real or simulated); Note: In case this subchapter is not applicable, the applicant should provide a statement of why this category of non-clinical study is not applicable to this case. 3.07.01.01 Study description, study identifier, date of initiation Where applicable, the applicant should provide a separate entry for each Physical and Mechanical Characterization study conducted on the device. For each study, provide: Study description Study identifier Date of initiation 3.07.01.01.01 Summary The applicant should provide a summary(ies) of the specific study(ies) provided and described in the subchapter above 3.07.01.01.02 Full Report The applicant should include test report(s) for the study/test(s) described in the subchapter above. 3.07.01.01.03 Statistical Data Where available, the applicant should provide statistical data associated with the study(ies)/tests described in the subchapter above 3.07.02 Package Validation The applicant should submit details relating to package integrity over the claimed shelf-life and in the packaging and distribution environment (transport and packaging validation) and when applicable, following exposure to the sterilization process. This should include: A summary of the non-clinical evidence, covering shelf-life period A discussion of the non-clinical testing considered for the device and support for their selection or omission from the verification and validation studies conducted in this category (i.e., what tests were considered and why they were or were not performed) Discussion to support why the evidence presented is sufficient to support the application. Note: In case this subchapter is not applicable, the applicant should provide a statement of why this category of non-clinical study is not applicable to this case. 3.07.02.01 Study description, study identifier, date of initiation Where applicable, the applicant should provide a separate entry for each Physical and Mechanical Characterization study conducted on the device. For each study, provide: Study description Study identifier Date of initiation 3.07.02.01.01 Summary The applicant should provide a summary(ies) of the specific study(ies) provided and described in the subchapter above 3.07.02.01.02 Full Report The applicant should include test report(s) for the study/test(s) described in the subchapter above. 3.07.02.01.03 Statistical Data Where available, the applicant should provide statistical data associated with the study(ies)/tests described in the subchapter above
3.08
This section is specifically intended for tests performed to ensure the safety and/or effectiveness of the device that are not delineated in the rest of the Chapter 3. This should include A description of the purpose of the test, the risk/safety issue the test is addressing; the test methods and results of the test 3.08.01 Study description, study identifier, date of initiation Where applicable, the applicant should provide a separate entry for each Physical and Mechanical Characterization study conducted on the device. For each study, provide: Study description Study identifier Date of initiation 3.08.01.01 Summary The applicant should provide a summary(ies) of the specific study(ies) provided and described in the subchapter above 3.08.01.02 Full Report The applicant should include test report(s) for the study/test(s) described in the subchapter above. 3.08.01.03 Statistical Data Where available, the applicant should provide statistical data associated with the study(ies)/tests described in the subchapter above CHAPTER 4 – CLINICAL EVIDENCE
4.01
Under this chapter, the applicant should include the following: -All headings and sub-headings for chapter 4 -Specify the page number for each item referred to in the table.
4.02
Under this subsection, the applicant should provide the following: A brief (1-2 page) summary of the available clinical evidence being presented in support of the submission. The document should list the evidence presented, its characteristics (RCT, case study, literature review, post market data from another jurisdiction or from a marketed device) and provide a discussion of how this is considered sufficient to support request for marketing for the requested indications. A tabular listing of clinical studies may be included in this section. If any of the study devices differ from the devices to be marketed, including competitor’s devices, a description of these differences and their impact on the validity of the evidence in terms of support for the application for any device referenced in the application. This may include a detailed comparison of the clinical, technical and biological characteristics of the two devices, with a detailed critical analysis demonstrating the devices to be similar to such an extent that there would be no clinically significant difference in safety or performance. A discussion of the clinical evidence considered for the device and support for their selection (i.e., what type of evidence was considered and why they were or were not used) Discussion to support why the evidence presented is sufficient to support the application. Note: Human factors testing that include patients should be included here. 4.02.01 Clinical Evaluation Report A clinical evaluation report reviewed and signed by an expert in the relevant field that contains an objective critical evaluation of all of the clinical data submitted in relation to the device. A complete curriculum vitae, or similar documentation, to justify the manufacturer's choice of the clinical expert. 4.02.02 Device Specific Clinical Trials Clinical trial information to be provided under this subchapter should be grouped by trial. The information is clearly highlighted in the subchapters below. 4.02.02.01 Trial description, protocol number, date of initiation This subchapter should include the following information: Trial Description, Protocol Number, Date of Initiation This information should be custom, based on study details and created for each study conducted 4.02.02.01.01 Clinical Trial Summary A summary of the specific study described in the custom heading above should be provided. It should include: The key characteristics of the study (e.g. title of study, investigators, sites, study period (date of enrolment/date of last completed), objectives, methods, # patients, inclusion/exclusion criteria) and Summary of the results of the analysis Summary of conclusions related to the endpoints Note: The sponsor/applicant should explicitly state whether the data are sex, gender, age, race, and ethnicity disaggregated. If the data are not disaggregated, the sponsor/applicant should provide a rationale why. 4.02.02.01.02 Clinical Trial Report A clinical trial report of the specific study described in the custom heading above should be provided. The clinical study report should include elements such as the investigational plan/study protocol, protocol changes and deviations, description of patients, data quality assurance, analysis/results. 4.02.02.01.03 Clinical Trial Data The information under this subchapter may not be provided. However, where deemed necessary the Authority may request clinical trial (s) raw data. 4.02.03 Clinical Literature Review and Other Reasonable Known Information The applicant should present the following under this subchapter; A critical evaluation of the relevant scientific literature currently available relating to the safety and/or effectiveness of the device. This should incorporate: i. A documented search protocol to a level of detail that allows the search to be reproduced; ii. A selection strategy (inclusion/exclusion criteria); iii. Criteria for appraising the data (both favourable and unfavourable) to determine the contribution of each data set to support the conclusions; iv. Results of the literature search; and v. A documentation of the appraisal to the extent that it can be critically reviewed by others. A legible copy of key articles, including translation where applicable to meet the regulators language requirements. Note: The applicant should provide a statement if no literature related to the device was found.
4.03
If not provided in the clinical trial protocol, the Authority may request the applicant to submit the information related to informed consent in the collection of the clinical information used to support the submission, such as copies of Institutional Review Board-approved informed consent forms.
4.04
If not provided in the clinical trial protocol, the Authority may request the applicant to provide information on Investigators and study administrative structure information. It should include the following as appropriate: Investigators (who signed the Investigator agreement)-name, address, telephone # (contact info), CV Sites-Site number as reflected in the study report in reference to the investigator, address if different from the above Sponsor-address and regulatory contact information Contract Research Organization (CRO), if applicable-name, address, and contact information Laboratory facilities (central lab and/or local lab that participated in the study)-name, address, contact information
4.05
Where applicable, other clinical experience data/real world data (including device registries, post-market studies conducted in other jurisdictions)
4.06
Where available, the applicant may submit a plan detailing the methods and procedures used to proactively collect and evaluate data related to the device's safety and performance post market.
4.07
Other information that may be important to the submission but that does not fit in any of the other headings of this chapter should be provided under this subchapter. CHAPTER 5 – LABELLING AND PROMOTIONAL MATERIAL
5.01
Under this chapter, the applicant should include the following: -All headings and sub-headings for chapter 5 -Specify the page number for each item referred to in the table.
5.02
The applicant should provide legible copies of the primary and secondary packaging labels. shipping labels should not be included under this subchapter.
5.03
Package Insert/Instructions for Use included in the package, when required or provide support for why this element is not applicable. 5.04 e-labelling where applicable, the applicant should provide the e-labelling itself, additionally, the following should be provided: For eligible medical devices and Software as a Medical Device, the applicant needs to identify which form of e-labelling is being used (e.g. electronic storage system or built-in system, website). Details of risk management in relation to e-labelling. When IFUs are requested, a description of the procedure and operations on providing IFU's when requested Written information for users on the webpage identifying where the IFU and further information can be found in relevant languages. A description on how the e-labeling requirements for the website have been met. If a video/App is available to demonstrate how the device is intended to function, provide a valid link as well as details about how it is maintained and updated throughout the life cycle of the device.
5.05
Labelling directed at the healthcare professional other than the package insert, such as the surgical manual
5.06
Labelling directed at the patient other than the package insert, such as informational material written to be comprehended by the patient or lay caregiver
5.07
Labelling directed the technical users and operators of medical devices focusing on the proper use and maintenance of the device and surgical technique instructions
5.08
Where applicable, the stickers/cards intended to be placed in the patient’s chart identifying the implant (e.g. serial #, lot#, make, model, etc), implant registration cards, and other relevant labeling information should be provided
5.09
The applicant should provide product brochures, catalogues containing devices (including claims) available for the user or available at the time of application
5.10
The applicant is requested to provide other information that may be important to the submission but that does not fit in any of the other subchapters of this chapter. CHAPTER 6 – QUALITY MANAGEMENT SYSTEM
6.01
Under this subchapter, a cover Letter is only required when the submission includes quality system information.
6.02
Under this chapter, the applicant should include the following: -All headings and sub-headings for chapter 6 -Specify the page number for each item referred to in the table.
6.03
The applicant should provide an abbreviated description of the device, operating principles and overall manufacturing methods. This section includes general information such as: • A description of the device, including pictures, and where possible, the proprietary name, common name, model number(s), product code, and intended use; and • A description of how the device works Note: Product Descriptive Information is only provided under this chapter when the submission includes quality system information and Chapter 2.04 “Device Description” is not provided as part of the submission.
6.04
The following information should be provided: Name, address, scope/role, and contact information for all sites where the device or its components are manufactured. Description of any relationship between the facilities to the applicant when there is more than one involved in the manufacturing process for the applicable device. Where applicable, addresses for all critical subcontractors, such as outsourced production, critical component, or raw material production (e.g. animal tissue, drugs), and sterilisation.
6.05
Where applicable, an application form associated with Quality management Systems in the premarket review process should be filled out.
6.06
The applicant should provide a high level quality management system documents, including procedures for establishing and maintaining the quality management system such as the quality manual, quality policy, quality objectives, and control of documents and records, as well as records providing evidence of conformance requirements, and of the effective operation of the quality management system (when applicable). ISO 13485 Elements - SOPs and device specific documentation to satisfy clause 4
6.07
The applicant should provide a documents, including procedures that provide evidence of the management commitment to the establishment and maintenance of the QMS by addressing quality policy, planning, responsibilities/authority/communication and management review, as well as records providing evidence of conformance to requirements, and of the effective operation of the quality management system (when applicable). ISO 13485 Elements - SOPs and device specific documentation to satisfy clause 5
6.08
The applicant should provide a documents, including procedures that provide evidence of the adequate provision of resources to implement and maintain the QMS, as referenced in regulator’s guidance or regulation, including human resources, infrastructure, and work environment, as well as records providing evidence of conformance to requirements, and of the effective operation of the QMS (when applicable). ISO 13485 Elements - SOPs and device specific documentation to satisfy clause 6
6.09
The applicant should provide high level product realization documents, including procedures such as those addressing planning and customer related processes, as well as records providing evidence of conformance to requirements, and of the effective operation of the quality management system (when applicable). Records demonstrating conformance to requirements are only provided under this chapter when the submission includes quality system information, and these records were not provided within the submission as part of the previous subchapter. ISO 13485 Elements - SOPs and device specific documentation implementing sub clause 7.1 and 7.2
6.10
The applicant should provide documents, including procedures that provide evidence of the systematic and controlled development of the device design from initiation of the project to transfer to production, as well as records providing evidence of conformance to requirements, and of the effective operation of the quality management system (when applicable). Records demonstrating conformance to requirements are only provided under this chapter when the submission includes quality system information, and these records were not provided within the submission as part of a previous subchapter (e.g. as part of “Biocompatibility and Toxicology Evaluation” Chapter 3.05.06). ISO 13485 Elements - SOPs and device specific documentation implementing sub clause 7.3
6.11
The applicant should provide documents including procedures that provide evidence that purchased products/services conform to established relevant quality and/or product specifications, as well as records providing evidence of conformance to requirements, and of the effective operation of the quality management system (when applicable). ISO 13485 Elements - SOPs and device specific documentation implementing sub clause 7.4
6.12
The applicant should provide the manufacturing process for the medical device should be provided in the form of a list of resources and activities that transform inputs to the desired output. Information should include the appropriate manufacturing methods and procedures, manufacturing environment or condition, and the facilities and controls used for the manufacturing, processing, packaging, labeling, and storage. Information on the manufacturing process should be provided in sufficient detail to allow a general understanding of the manufacturing processes and enable judgement of the appropriateness of the controls in place. Detailed proprietary information on the manufacturing process is not required. The information may be presented in the form of a process flow chart showing an overview of production, controls, assembly, final product testing and packaging of the finished medical device. If multiple facilities are involved in the manufacture of medical device, Applicable information for each facility must be submitted Manufacturing activities carried out at each site should be clearly identified
6.13
The applicant should provide documents including procedures that provide evidence of monitoring and measuring equipment used in the QMS is controlled and continuously performing per the established requirements, as well as records providing evidence of conformance to requirements, and of the effective operation of the quality management system (when applicable). ISO 13485 Element - SOPs and device specific documentation for implementing sub clause 7.6
6.14
The applicant should provide documents, including procedures that provide evidence of how monitoring, measurement, analysis and improvement to ensure the conformity of the product and QMS, and to maintain the effectiveness of the QMS, as well as records providing evidence of conformance to requirements, and of the effective operation of the quality management system (when applicable). ISO 13485 Element - SOPs and device specific documentation for implementing clause 8
6.15
The applicant should provide a quality plan. This plan should specify “which processes, procedures and associated resources will be applied by whom and when to meet the requirements of a specific project, product, process or contract”. This information may be provided in an application in the form of a flow chart. Note: The review requirement for a quality plan is not met by the ISO 13485 certificate alone, instead refer to ISO 10005.
6.16
According to the above procedures of the quality management system, applicants shall form documents and records related to the quality management system. The following materials shall be submitted for inspection during the inspection on the quality management system. Basic information form of applicant. Organizational chart of the applicant. General layout of the enterprise and the distribution map of production areas. Where there are requirements for purification in the production process, a copy of the environmental testing report (with the layout plan attached) issued by a qualified testing institution shall be provided. The flow chart of the product production process, which shall indicate the main control points and items, main raw materials and sources of purchased parts and the quality control methods. Catalogue of main production equipment and inspection equipment (including the equipment required for incoming inspection, process inspection and final factory inspection; environmental monitoring equipment shall also be provided for the production conducted under the purification conditions). Self-inspection report of the quality management system. Where applicable, the explanation on the comparison of the product to be inspected and products previously passing the inspection in terms of production conditions and production process shall be provided.
6.17
Heading for other information that may be important to the submission but that does not fit in any of the other headings.
1.14.
1.14.1. Repairs Where a registered device is “repaired” and returned to its original owner after the repair the components used in the repair would not require registration. The device should not be „placed on the market‟ but returned to its owner. If the repaired device was not registered, then registration process will be required. 1.14.2. Second-hand and fully refurbished devices Second-hand medical devices are those which are already on the market and have been „pre-owned‟ and used and that are subsequently „sold on‟ for the same continued use. These products are considered to be already registered and do not require second registration by their new owner. A medical device that has been fully refurbished is not the same as one that has been repaired or undergone maintenance. Therefore, it requires to be registered as a new medical device. They will be considered to be the „manufacturer‟ under the regulations and are required to place the product on the market under their own name. “Fully refurbished” is considered to mean that a device has been completely rebuilt / made as new from used devices and is assigned a new „useful life‟. It would also be considered as a new device if a new intended purpose was assigned. 1.14.3. Medical devices that require final processing Some devices may not be supplied in their final state (i.e. may not be immediately available for use) once placed on the market. They may require some further processing prior to being „usable‟, for example processing, preparation, installation, assembly or fitting. These activities are not usually undertaken by the manufacturer but are carried out by the healthcare professional or the final user. Examples of such activities are: • sterilization of medical devices supplied non-sterile; • assembly of systems; • configuration of electronic equipment; • preparation of dental fillings • fitting of contact lenses; • adaptation of a prosthesis to the needs of the individual patient. Note: The type of documentation for registration and application process for borderlines medical devices shall depend on the declared intended use and risk class declared by the manufacturer. Majority of border line medical devices especially do not require registration. However, applicants must confirm the status before importation is initiated.
1.15.
The actual classification of each device depends on the claims made by the manufacturer and on its intended use. While the provision of illustrative examples in the table that follows is helpful when interpreting the purpose of each rule, it must be emphasized that the actual classification of a particular device must be considered individually, taking account of its design and intended use (GHTF/SG1/N15:2006: The Global Harmonization Task Force-Principles of Medical Devices Classification) Duration of Use: Transient: Normally intended for continuous use for less than 60 minutes. Short term: Normally intended for continuous use for between 60 minutes and 30 days. Long term: Normally intended for continuous use for more than 30 days. Note: For the purpose of this document, continuous use means: i) The entire duration of use of the device without regard to temporary interruption of use during a procedure or, temporary removal for purposes such as cleaning or disinfection of the device. ii) The accumulated use of a device that is intended by the manufacturer to be replaced immediately with another of the same type. 1. Non-invasive Devices Rule Illustrative Examples Rule 1. All non-invasive devices which come Devices covered by this rule are extremely into contact with injured skin: claim sensitive. - are in Class A if they are intended to be Examples: bandages; cotton wool. used as a mechanical barrier, for compression or for absorption of exudates only, i.e. they heal by primary intent; - are in Class B if they are intended to be Example: non-medicated impregnated used principally with wounds which have gauze dressings. breached the dermis, including devices principally intended to manage the microenvironment of a wound. - unless they are intended to be used Devices used to treat wounds where the principally with wounds which have subcutaneous tissue is at least partially exposed breached the dermis and can only heal by and the edges of the wound are not sufficiently secondary intent, in which case they are close to be pulled together. To close the wound, in Class C. new tissue must be formed within the wound prior to external closure. The device manufacturer claims that they promote healing through physical methods other than „primary intent‟. Examples: dressings for chronic ulcerated wounds; dressings for severe burns. Rule 2(i). All non-invasive devices Such devices are „indirectly invasive‟ in that intended for channelling or storing they channel or store liquids that will eventually liquids, or be delivered into the body. gases Examples: administration sets for gravity for the purpose of eventual infusion, infusion; syringes without needles. administration or introduction into the body are in Class A, unless they may be connected to an active Examples: syringes and administration sets for medical device in Class B or a higher class, in infusion pumps; anaesthesia breathing circuits. which case they are Class B; Note: “Connection” to an active device covers those circumstances where the safety and performance of the active device is influenced by the non-active device and vice versa. Rule 2(ii). All non-invasive devices intended Examples: tubes used for blood to be used for t ransfusion, organ storage containers channeling blood, or storing or channeling other body liquids, or storing organs, parts of organs or body tissues, for the purpose of eventual infusion, administration or introduction into the body are Classthey unless B. are blood bags, in which case Example: Blood bags that do not they are Class C. incorporate an anti-coagulant. NOTE: In some jurisdictions, blood bags have a special rule that places them within a different class. Rule 3. All non-invasive devices intended Such devices are “indirectly invasive‟ in that they for modifying the biological or chemical treat or modify substances that will eventually be composition of delivered into the body. They are normally used blood, in conjunction with an active device within the other body liquids, or scope of either Rule 9 or 11. other liquids, Examples: haemodializers intended for infusion into the body are in Note: For the purpose of this part of the rule, Class C, „modification‟ does not include simple, mechanical filtration or centrifuging which are covered below. unless the treatment consists of filtration, Examples: devices to remove carbon dioxide centrifuging or exchanges of gas or of heat, in particulate filters in an extracorporial circulation which case they are in Class B. system. Rule 4. All other non-invasive devices are in These devices either do not touch the patient or Class A. contact intact skin only. Examples: urine collection bottles; compression hosiery; non-invasive electrodes, hospital beds. 2. Invasive device Invasive devices Rule Illustrative Examples Rule 5. All invasive devices with respect to Such devices are invasive in body orifices body orifices? (other than those which are and are not surgically invasive (refer to surgically invasive) and which: definition in Section 4). Devices tend to be are not intended for connection to an diagnostic and therapeutic instruments used active medical device, or in ENT, ophthalmology, dentistry, are intended for connection to a Class A proctology, urology and gynaecology. medical device only. Classification depends on the duration of use and the sensitivity (or vulnerability) of the orifice to such invasion. are in Class A if they are intended for Examples: examination gloves; enema transient use; devices. are in Class B if they are intended for Examples: urinary catheters, tracheal tubes. short-term use; unless they are intended for short-term use in Examples: dressings for nose bleeds. the oral cavity as far as the pharynx, in an ear canal up to the ear drum or in a nasal cavity, in which case they are in Class A, are in Class C if they are intended for Example: urethral stent; contact lenses for long-term use; long-term continuous use (for this device, removal of the lens for cleaning is considered as part of the continuous use). unless they are intended for long-term use in the Examples: orthodontic materials, oral cavity as far as the pharynx, in an ear canal removable dental prosthesis. up to the ear-drum or in a nasal cavity and are not liable to be absorbed by the mucous membrane, in which case they are in Class B. All invasive devices with respect to body Examples: tracheal tubes connected to a orifices (other than those which are surgically ventilator; suction catheters for stomach invasive) that are intended to be connected to an drainage; dental aspirator tips. active medical device in Class B or a higher Note: Independent of the time for which class, are in Class B. they are invasive. Rule 6. All surgically invasive devices A majority of such devices fall into several intended for transient use are in Class B, major groups: those that create a conduit through the skin (e.g. syringe needles; lancets), surgical instruments (e.g. single-use scalpels; surgical staplers; single-use aortic punch); surgical gloves; and various types of catheter/sucker etc. unless they are reusable surgical instruments, Examples: Manually operated surgical in which case they are in Class A; or drill bits and saws. Note: A surgical instrument connected to an active device is in a higher class than unless intended to supply energy in the form of Example: catheter containing sealed ionizing radiation, in which case they are in radioisotopes. Class C; or unless intended to have a biological effect or be Notes: (a) The „biological effect‟ referred wholly or mainly absorbed, in which case they to is an intended one rather than are in Class C; or unintentional. The term „absorption‟ refers to the degradation of a material within the body and the metabolic elimination of the resulting degradation products from the body. (b) This part of the rule does not apply to those substances that are excreted without modification from the body. Example: Insufflation gases for the Abdominal cavity unless intended to administer medicinal products Example: insulin pen for self- by means of a delivery system, if this is done in administration. a manner that is potentially hazardous taking NOTE: The term „administration of account of the mode of application, in which medicines‟ implies storage and/or they are in Class C; or influencing the rate/volume of medicine delivered not just channelling. The term „potentially hazardous manner‟ refers to the characteristics of the device and not the competence of the user. unless they are intended specifically for use in Example: spinal needle. direct contact with the central nervous system in which case they are in Class D; or unless intended specifically to diagnose, monitor Examples: angioplasty balloon catheters or correct a defect of the heart or of the central and related guide wires; dedicated circulatory system through direct contact with disposable cardiovascular surgical these parts of the body, in which case they are in instruments. Class D. Rule 7. All surgically invasive devices Such devices are mostly used in the intended for short-term use are in Class B, context of surgery or post-operative care, or are infusion devices, or are catheters of various types. Examples: infusion cannulae; temporary filling materials; non-absorbable skin closure devices; tissue stabilisers used in cardiac surgery. Note: Includes devices that are used during cardiac surgery but do not monitor or correct a defect. unless they are intended to administer medicinal Note: The term „administration of products, in which case they are in Class C; or medicines‟ implies storage and/or influencing the rate/volume of medicine delivered not just channelling. unless they are intended to undergo chemical Example: surgical adhesive. change in the body (except if the devices are placed in the teeth), in which case they are in Class C; or unless they are intended to supply energy in the Example: brachytherapy device. form of ionizing radiation, in which case they are in Class C; or unless they are intended to have a Example: absorbable suture; biological biological effect or to be wholly or mainly adhesive. absorbed, in which case they are in Class D; Note: The „biological effect‟ referred to or is an intended one rather than unintentional. The term „absorption‟ refers to the degradation of a material within the body and the metabolic elimination of the resulting degradation products from the body. unless they are intended specifically for use Example: neurological catheter. in direct contact with the central nervous system in which case they are in Class D; unless they are intended specifically to Examples: cardiovascular catheters; diagnose, monitor or correct a defect of the heart temporary pacemaker leads; carotid or of the central circulatory system through artery shunts direct contact with these parts of the body, in which case they are in Class D. Rule 8. All implantable devices, and long- term Most of the devices covered by this rule surgically invasive devices, are in Class C, are implants used in the orthopaedic, dental, ophthalmic, and cardiovascular fields. Example: maxilla-facial implants; bone plates and screws; bone cement; non- absorbable internal sutures; posts to secure teeth to the mandibula bone (without a bioactive coating). unless they are intended to be placed into the Examples: materials for inlays, crowns, teeth or on prepared tooth structure, in which and bridges; dental filling materials. case they are in Class B; or unless they are intended to be used in direct Examples: prosthetic heart valves; contact with the heart, the central circulatory cardiovascular stents; pacemaker leads system or the central nervous system, in which and electrodes; deep brain stimulation case they are in Class D; or electrodes; cerebrospinal catheter. unless they are intended to be life supporting or life sustaining, in which case they are in Class D; or unless they are intended to be active implantable Example: pacemakers; implantable medical devices, in which case they are Class D; defibrillators. or unless they are intended to have a Example: implants claimed to be biological effect or to be wholly or mainly bioactive. absorbed, in which case they are in Class D; Note: Hydroxy-apatite is considered as or having biological effect only if so claimed and demonstrated by the manufacturer. unless they are intended to administer medicinal Example: subcutaneous infusion ports products, in which case they are in Class D; or for long-term use. unless they are intended to undergo chemical Example: surgical adhesives intended change in the body (except if the devices are for long term use. placed in the teeth), in which case they are in Note: Bone cement is not within the Class D; or scope of the term „chemical change in the body‟ since any change takes place in the short rather than long term. unless they are breast implants, in which case they are in Class D. 3. Active devices Rule Illustrative Examples Rule 9(i). All active therapeutic devices Such devices are mostly electrically intended to administer or exchange energy are powered equipment used in surgery; in Class B, devices for specialised treatment and some stimulators. Examples: muscle stimulators; powered dental hand pieces; hearing aids; neonatal phototherapy equipment; ultrasound equipment for physiotherapy. unless their characteristics are such that they Examples: lung ventilators; baby may administer or exchange energy to or from incubators; electrosurgical generators; the human body in a potentially hazardous way, external pacemakers and defibrillators; including ionizing radiation, taking account of surgical lasers; lithotriptors; therapeutic the nature, the density and site of application X-ray and other sources of ionizing of the energy, in which case they are in Class radiation. C. Note: The term „potentially hazardous‟ refers to the type of technology involved and the intended application. Rule 9(ii). All active devices intended to Examples: external feedback systems control or monitor the performance of active for active therapeutic devices. therapeutic devices in Class C, or intended directly to influence the performance of such devices, are in Class C. Rule 10(i). Active devices intended for Such devices include equipment for diagnosis are in Class B: ultrasonic diagnosis/imaging, capture of physiological signals. - if they are intended to supply energy which Examples: magnetic resonance will be absorbed by the human body (except for equipment; diagnostic ultrasound in non- devices used solely to illuminate the patient's critical applications; evoked response body, with light in the visible or near infra- stimulators. red spectrum, in which case they are Class A), or - if they are intended to image in vivo Example: gamma/nuclear cameras. distribution of radiopharmaceuticals, or -if they are intended to allow direct diagnosis Example: electronic thermometers, or monitoring of vital physiological processes, stethoscopes and blood pressure monitors; electrocardiographs. unless they are specifically intended for: Example: monitors/alarms for intensive a) monitoring of vital physiological care; biological sensors; oxygen parameters, where the nature of variations is saturation monitors; apnoea monitors. such that it could result in immediate danger to the patient, for instance variations in cardiac performance, respiration, activity of central nervous system, or b) diagnosing in clinical situations where the patient is in immediate danger, Example: ultrasound equipment for use in which case they are in Class C. in interventional cardiac procedures. Rule 10(ii). Active devices intended to emit Example: devices for the control, ionizing radiation and intended for diagnostic monitoring or influencing of the and/or interventional radiology, including devices emission of ionizing radiation. which control or monitor such devices, or those which directly influence their performance, are in Class C. Rule 11. All active devices intended to administer Such devices are mostly drug delivery and/or remove medicinal products, body liquids systems or anaesthesia equipment. or other substances to or from the body are in Examples: suction equipment; feeding Class B, pumps; jet injectors for vaccination; nebuliser to be used on conscious and spontaneously breathing patients where failure to deliver the appropriate dosage characteristics is not potentially hazardous. unless this is done in a manner that is potentially Examples: infusion pumps; anaesthesia hazardous, taking account of the nature of the equipment; dialysis equipment; substances involved, of the part of the body hyperbaric chambers; nebuliser where concerned and of the mode and route of the failure to deliver the appropriate administration, in which case they are in Class C. dosage characteristics could be hazardous. Rule 12. All other active devices are in Class A. Examples: examination lamps; surgical microscopes; powered hospital beds & wheelchairs; powered equipment for the recording, processing, viewing of diagnostic images; dental curing lights 4. Additional Rule Rule Illustrative Examples Rule 13. All devices incorporating, as an integral These medical devices incorporate part, a substance which, if used separately, can medicinal substances in an ancillary role. be considered to be a medicinal product, and Examples: antibiotic bone cements; which is liable to act on the human body with heparin-coated catheters; wound action ancillary to that of the devices, are in Class dressings incorporating antimicrobial D. agents to provide ancillary action on the wound; blood bags incorporating an anti- coagulant. Rule 14. All devices manufactured from or Example: porcine heart valves. incorporating animal or human cells/tissues/derivatives thereof, whether viable or non-viable, are in Class D, unless such devices are manufactured from or Examples: leather components of incorporate non-viable animal tissues or theirorthopaedic appliances. derivatives that come in contact with intact skin only in which case they are in Class A. Rule 15. All devices intended specifically to be Example: desk-top sterilisers for use with used for sterilising or disinfecting medical dental instruments. devices are in Class B. unless they are disinfectant solutions or washer- Examples: solutions intended to be used disinfectors intended specifically for invasive for the disinfection of medical devices medical devices, as the end point of processing, without further processing (for example in in which case they are in Class C; or a steriliser) including those where the infective agent is a prion; washer-disinfector equipment specifically for disinfecting an endoscope or another invasive device. unless they are intended to clean medical devices by means of physical action only, in which case they are in Class A. Rule 16. All devices that are intended Note: In some jurisdictions such specifically to be used for disinfecting, cleaning, products: rinsing or, when appropriate, hydrating contact are considered to be outside the scope lenses are in Class C. of the medical device definition; may be subject to different controls. Rule 17. All devices used for contraception or the Examples: condoms; contraceptive prevention of the transmission of sexually diaphragms. transmitted diseases are in Class C, unless they are implantable or long-term Example: intrauterine contraceptive invasive devices, in which case they are in device. Class D. REFERENCES: 1. WHO Global Model Regulatory Framework for Medical Devices including in vitro diagnostic medical devices 2. GHTF/SG1/N12:2000 Role of Standards in the Assessment of Medical Devices 3. GHTF/SG1/N15:2006 Principles of Medical Devices Classification 4. GHTF/SG1/N40:2006 Principles of Conformity Assessment for Medical Devices 5. GHTF/SG1/N41:2005 Essential Principles of Safety and Performance of Medical Devices 6. GHTF/SG1/N43:2005 Labelling for Medical Devices 7. IMDRF/RPS WG/N9(Edition 3) FINAL:2019 Non-In Vitro Diagnostic Device Market Authorization Table of Contents (nlVDMAToC) 8. African Medical Devices Forum Guidelines on regulatory requirements for issuance of market authorization of medical devices including in-vitro diagnostic medical devices 9. IMDRF/GRRP WG/N52 FINAL:2024 (Edition 2) Principles of Labeling for Medical Devices and IVD Medical Devices 10. AMDF Guidelines on requirements on Labelling of medical devices Including in vitro diagnostic Medical devices ENDORSEMENT OF THE GUIDELINES Prepared by Checked by Approved by Title Division Head of Division Manager Director General manager Department for QMS Names Steven Dr. Vedaste Marie Ange Prof. Emile NKUSI HABYALIMANA UWASE BIENVENU Date & Signature Doc No: DD/HMDR/DOC.TYPE/…. Revision No:1 Effective Date: dd/mm/yyyy
Appendix 1 — Appendix 1
cover letter <Applicant> <Address> <Postal Code><Town> <Date> Rwanda FDA, 1948 Kigali-Rwanda Dear Sir/Madam, Subject: Submission of Application Dossier(s) for Marketing Authorization of < Medical device(s) or Change on registered/notified Medical device (s)>> We are pleased to submit our Application Dossier(s) for the registration of medical devices/In Vitro Diagnostics Devices (IVDDs) that details are as follows: Name of the Medical device(s) /IVDD(s): ………………………………….…………………….. Classification of the Medical Device(s)/IVDD(s): …………………………………………….….. Intended use of the Medical Device(s)/IVDD(s): ……………………............................................ You will find enclosed the submission dossier as specified hereafter: 󠇯 We confirm that the application dossier has been well checked for completion prior submission. Type of Submission: 󠇯Full registration Application 󠇯Abridged Application 󠇯Notification Renewal Application for registration 󠇯Renewal Application for notification 󠇯Application for Change on registered/notified medical device 󠇯 sample(s) submitted (where applicable) 󠇯 Application for QMS audit to Rwanda FDA, where applicable (as per relevant guidelines) 󠇯 I confirm that the Product Dossier information submitted is the same in all aspects as the product registered with the relevant SRA, WHO PQ and EAC (Only for Abridged Applications) I, the undersigned certify that all the information in this form and accompanying documentation is correct, complete and true to the best of my knowledge Yours sincerely, <Signature> <Name> <Title> <Phone number(s)> <Email address> Doc No: DD/HMDR/DOC.TYPE/…. Revision No:1 Effective Date: dd/mm/yyyy
Appendix 2 — Appendix 2
Application Form for Medical Devices including In Vitro Diagnostics Devices (IVDDs) Notification Application Number Rwanda FDA use only Date of submission of dossier Rwanda FDA use only 1.0 PARTICULARS OF THE MEDICAL DEVICE or IVD (Bold or Tick the right type of application) 1.1 Name of the Medical Device or IVD 1.2 Type of application • New • Renewal • Change* • Notifiable change • minor change • major change * In case change (s) has(ve) been made to registered/notified medical device (s), fill in the following 2 rows Reason for change Detailed description of the change (s) 1.3 Classification of the Medical Device or IVD and Classification rule(s) applied 1.4 Intended use of the Medical Device or IVD Intended user: •Professional user •self user 1.5 Name and address (physical and postal) of Applicant Address: Country: Telephone: Telefax: E-Mail: 1.6 Name and address (physical and postal) of legal manufacturer Address: Country: Telephone: Telefax: E-Mail 1.7 Visual description of the Medical Device or IVD 1.8 Proposed shelf life (in months) (where applicable): 1.9 Proposed storage conditions (where applicable): 1.10 Other regulatory authority(ies) approval(s) (i.e. European conformity (CE) mark, United States Food and Drug Administration (USFDA) approval, etc) Regulatory Authority’s (ies’) Approval(s) Approval/Authorization number 1.11 Country of origin (where the device was manufactured) 1.12 Name(s) and physical address(es) of the manufacturing site(s) of the Medical Device or IVD. Alternative sites should be also declared here. All manufacturing sites involved in the manufacturing process of the device, stating the role of each including quality control / in-process testing sites should be listed. Address: Country: Telephone: Telefax: E-Mail: 1.13 Name and address (physical and postal) of the Agent/Local Technical Representative (LTR) (Attach a valid appointment letter notarized from the country of origin): Address: Country: Telephone: Telefax: E-Mail: 1.14 Version of the product insert (attach a copy of relevant labeling including the Instruction For Use (IFU)) 2.0 DECLARATION BY THE APPLICANT I, ,the undersigned ce rtify that all the information in this form and accompanying documentation is correct, complete and true to the best of my knowledge. I further confirm that the information referred to in my application dossier is available for verification during Quality audit inspection. I also agree that I shall carry out Post marketing Surveillance to monitor the safety, quality and performance of the device on the market and provide safety, quality and performance update reports to Rwanda FDA. I further agree that I am obliged to follow the requirements of Rwanda Legislations and Regulations, which are applicable to Medical Devices including IVDs. I also consent to the processing of information provided to Rwanda FDA Signature: Date: Doc No: DD/HMDR/DOC.TYPE/…. Revision No:1 Effective Date: dd/mm/yyyy
Appendix 3 — Appendix 3
Application Form for Medical Devices and In Vitro Diagnostics Devices (IVDDs) registration Application Number Rwanda FDA use only Date of submission of dossier Rwanda FDA use only 1.0 PARTICULARS OF THE MEDICAL DEVICE or IVD (Bold or Tick the right type of application) 1.1 Name of the Medical Device or IVD 1.2 Type of application • New • Renewal • Change* • Notifiable change • minor change • major change * In case change (s) has(ve) been made to registered/notified medical device (s), fill in the following 2 rows Reason for change Detailed description of the change (s) 1.3 Classification of the Medical Device or IVD and Classification rule(s) applied 1.4 Intended use of the Medical Device or IVD 1.5 Name and address (physical and postal) of Applicant Address: Country: Telephone: Telefax: E-Mail: 1.6 Name and address (physical and postal) of the legal manufacturer Address: Country: Telephone: Telefax: E-Mail 1.7 Name(s) and physical address(es) of the manufacturing site(s) of the Medical Device or IVD. Alternative or contract manufacturing sites should be also declared here. All manufacturing sites involved in the manufacturing process of the device, stating the role of each including quality control / in-process testing sites should be listed. Address: Country: Telephone: Telefax: E-Mail: 1.8 Visual description of the Medical Device or IVD 1.9 Proposed shelf life (in months) (where applicable): 1.10 Proposed storage conditions (where applicable): 1.11 Other sister/variants of the medical device (s) or IVD (s) registered or applied for registration with Rwanda FDA 1.12 list all accessories that are manufactured/ sold with the devices 1.13 Have you applied for Marketing Authorization(s) of medical device(s) or In Vitro Diagnostics Devices (IVDs) in any of the country of East African Community (EAC)? • Yes • No If yes state Medical Device name or IVD: Regulatory Authority(ies) where you have applied for registration: 1.14 Device Marketing Authorization in the country of origin (Attach Marketing Authorization of the Medical Device or IVD from the National Regulatory Authority). If not registered, state reasons • Authorized Country: • Withdrawn (by the applicant after Date of authorization: authorization) Country: Authorization number: Date of withdrawal: Reason of withdrawal: • Refused Country: Date of refusal: • Suspended/revoked (by competent Reason of refusal: authority) Country: Date of suspension/revocation: Reason for suspension/revocation: 1.16 Name and address (physical and postal) of the Agent/Local Technical Representative (LTR) (Attach a valid appointment letter notarized from the country of origin): Address: Country: Telephone: Telefax: E-Mail: 1.17 Name and address (physical and postal) of the person or company responsible for Pharmacovigilance and Post Marketing Surveillance: Address: Country: Telephone: Telefax: E-Mail: 1.18 Qualitative and Quantitative composition of the Medical Device or IVD (If applicable) 1.19 Name and address (physical and postal) of the Contract Research Organisation(s) where the clinical studies of the Medical Device or IVD were conducted. (If applicable) Address: Country: Telephone: Telefax: E-Mail: 2.0 DECLARATION BY THE APPLICANT I, ,the undersigned ce rtify that all the information in this form and accompanying documentation is correct, complete and true to the best of my knowledge. I further confirm that the information referred to in my application dossier is available for verification during Quality audit inspection. I also agree that I shall carry out Post Marketing Surveillance to monitor the safety, quality and performance of the device on the market and provide safety, quality and performance update reports to Rwanda FDA. I further agree that I am obliged to follow the requirements of Rwanda Legislations and Regulations, which are applicable to Medical Devices. I also consent to the processing of information provided to Rwanda FDA. Signature: Date: Doc No: DD/HMDR/DOC.TYPE/…. Revision No:1 Effective Date: dd/mm/yyyy
Appendix 4 — Appendix 4
Essential Principle checklist of Medical Devices including IVDs The EP checklist can be used by Regulatory Authorities, CABs and even manufacturers themselves to readily understand how the manufacturer demonstrates compliance to the essential principles for a particular device. The EP checklist also allows easy identification of relevant documents and data for conformity assessment purposes. The contents of the checklist will vary from device to device. Very simple devices will have EP checklists of a few pages as many of the essential principles may not be applicable. In these cases, the supporting references to be included in the checklist will be minimal. More complex devices are more likely to reference a larger number of standards, test reports and documents. The EP checklist in those cases might be many pages long. The following is a recommended template for the EP checklist. Preparation of the EP checklist as outlined below will provide a useful overview of the manufacturer’s conformity to the essential principles The manufacturer should identify the device, and when applicable the various configuration/variants covered by the checklist. Applicable to device? Here the answer is either “Yes” or “No”. If the answer is “No”, this should be briefly explained. Example: For a device that does not incorporate biological substances, the answer to Essential principle 5.8.2 would be “No – The device does not incorporate biological substances” Method of Conformity The manufacturer should name the title and reference of the standard(s), industry or in- house test method(s), comparison study(ies) or other method used to demonstrate compliance. For standards, this should include the date of the standard and where appropriate, the clause(s) that demonstrates conformity with the relevant EP. Where a standard is referred to more than once in the checklist, simply the reference number and date can be repeated. Identity of specific documents This column should contain the reference to the actual technical documentation that demonstrates compliance to the essential principles, i.e. the certificates, test reports, study reports or other documents that resulted from the method used to demonstrate compliance. Brand name : Generic name: Risk class: Clause Essential Principal Applicable Method of Identity of to the Conformity specific device? Documents 1. GENERAL REQUIREMENTS Medical devices should be designed and manufactured in such a way that, when used under the conditions and for the purposes intended and, where applicable, by virtue of the technical knowledge, experience, education or training, and the medical and physical conditions of intended users, they will perform as intended by the manufacturer and not compromise the clinical condition or the safety of patients, or the safety and health of users or, where applicable, other persons, provided that any risks which may be associated with their use constitute acceptable risks when weighed against the benefits to the patient and are compatible with a high level of protection of health and safety. 2. The solutions adopted by the manufacturer for the design and manufacture of the devices should conform to safety principles, taking account of the generally acknowledged state of the art. When risk reduction is required, the manufacturer should control the risk(s) so that the residual risk(s) associated with each hazard is judged acceptable. The manufacturer should apply the following principles in the priority order listed: identify known or foreseeable hazards and estimate the associated risks arising from the intended use and foreseeable misuse; eliminate risks as far as reasonably practicable through inherently safe design and manufacture; reduce as far as is reasonably practicable the remaining risks by taking adequate protection measures, including alarms; and inform users of any residual risks. 3. Medical devices should achieve the performance intended by the manufacturer and be designed and manufactured in such a way that they are suitable for their intended purpose. 4. The characteristics and performances referred to in Clauses 1, 2 and 3 should not be adversely affected to such a degree that the health or safety of the patient or the user and, where applicable, of other persons are compromised during the lifetime of the device, as indicated by the manufacturer, when the device is subjected to the stresses which can occur during normal conditions of use and has been properly maintained in accordance with the manufacturer’s instructions. 5. Medical devices should be designed, manufactured and packaged in such a way that their characteristics and performances during their intended use will not be adversely affected by transport and storage conditions (for example, fluctuations of temperature and humidity) taking account of the instructions and information provided by the manufacturer. 6. Medical devices should achieve their intended performance during normal conditions of use. All known, and foreseeable risks, and any undesirable effects, should be minimized and be acceptable when weighed against the benefits of the intended performance. ESSENTIAL PRINCIPLES APPLICABLE TO MEDICAL DEVICES OTHER THAN IVD 7. DEVICES 7.1 DESIGN AND MANUFACTURING REQUIREMENTS Chemical, physical & biological properties The devices should be designed and manufactured in such a way as to ensure the characteristics and performance referred to in clause 6. Particular attention should be paid to: the choice of materials used, particularly as regards toxicity and, where appropriate, flammability, the compatibility between the materials used and biological tissues, cells, and body fluids taking account of the intended purpose of the device. the choice of materials used should reflect, where appropriate, matters such as hardness, wear and fatigue strength.; 7.2 The devices should be designed, manufactured and packaged in such a way as to minimize the risk posed by contaminants and residues to the persons involved in the transport, storage and use of the devices and to patients, taking account of the intended purpose of the product. Particular attention should be paid to tissues exposed and to the duration and frequency of exposure. 7.3 The devices should be designed and manufactured in such a way that they can be used safely with the materials, substances and gases with which they enter into contact during their normal use or during routine procedures; if the devices are intended to administer medicinal products they should be designed and manufactured in such a way as to be compatible with the medicinal products concerned according to the provisions and restrictions governing these products and that their performance is maintained in accordance with the intended use. 7.4 The devices should be designed and manufactured in such a way as to reduce as far as reasonably practicable and appropriate the risks posed by substances that may leach or leak from the device. Special attention shall be given to substances which are carcinogenic, mutagenic or toxic to reproduction. 7.5 Devices should be designed and manufactured in such a way as to reduce as far as reasonably practicable and appropriate risks posed by the unintentional ingress or egress of substances into or from the device taking into account the device and the nature of the environment in which it is intended to be used. 8. Infection & microbial contamination 8.1 The devices and manufacturing processes should be designed in such a way as to eliminate or to reduce as far as reasonably practicable and appropriate the risk of infection to patients, users and, where applicable, other persons. The design should: allow easy handling, and, where necessary: reduce as far as reasonably practicable and appropriate any microbial leakage from the device and/or microbial exposure during use, prevent microbial contamination of the device or specimen, where applicable, by the patient, user or other person. 8.2 Devices labelled as having a special microbiological state should be designed, manufactured and packaged to ensure they remain so when placed on the market and remain so under the transport and storage conditions specified by the manufacturer. 8.3 Devices delivered in a sterile state should be designed, manufactured and packaged in a non-reusable pack, and/or according to appropriate procedures, to ensure that they are sterile when placed on the market and remain sterile, under the transport and storage conditions indicated by the manufacturer, until the protective packaging is damaged or opened. 8.4 Devices labelled either as sterile or as having a special microbiological state should have been processed, manufactured and, if applicable, sterilized by appropriate, validated methods. 8.5 Devices intended to be sterilized should be manufactured in appropriately controlled (e.g. environmental) conditions. 8.6 Packaging systems for non-sterile devices should maintain the integrity and cleanliness of the product and, if the devices are to be sterilized prior to use, minimize the risk of microbial contamination; the packaging system should be suitable taking account of the method of sterilization indicated by the manufacturer. 8.7 The labelling of the device should distinguish between identical or similar products placed on the market in both sterile and non-sterile condition. 9. Medical devices incorporating a substance considered to be a 9.1 medicinal product/drug Where a device incorporates, as an integral part, a substance which, if used separately, may be considered to be a medicinal product/drug as defined in the relevant legislation that applies within that jurisdiction and which is liable to act upon the body with action ancillary to that of the device, the safety, quality and performance of the device as a whole should be verified, as well as the safety, quality and efficacy of the substance in the specific application, 10. Medical devices incorporating materials of biological origin 10.1 In some jurisdictions products incorporating tissues, cells and substances of animal origin may be considered medical devices. In this case, such tissues, cells and substances should originate from animals that have been subjected to veterinary controls and surveillance adapted to the intended use of the tissues. National regulations may require that the manufacturer and/or the Regulatory Authority retain information on the geographical origin of the animals. Processing, preservation, testing and handling of tissues, cells and substances of animal origin should be carried out so as to provide optimal safety for patients, users and, where applicable, other persons. In particular, safety with regard to viruses and other transmissible agents should be addressed by implementation of validated methods of elimination or inactivation in the course of the manufacturing process. 10.2 In some jurisdictions products incorporating human tissues, cells and substances may be considered medical devices. In this case, the selection of sources, donors and/or substances of human origin, the processing, preservation, testing and handling of tissues, cells and substances of such origin should be carried out so as to provide optimal safety for patients, users and, where applicable, other persons. In particular, safety with regard to viruses and other transmissible agents should be addressed by implementation of validated methods of elimination or inactivation in the course of the manufacturing process. 10.3 In some jurisdictions products incorporating cells and substances of microbial origin may be considered medical devices. In this case, processing, preservation, testing and handling of cells and substances should be carried out so as to provide optimal safety for patients, users and, where applicable, other persons. In particular, safety with regard to viruses and other transmissible agents should be addressed by implementation of validated methods of elimination or inactivation in the course of the manufacturing process. 11. Manufacturing and environmental properties 11.1 If the device is intended for use in combination with other devices or equipment, the whole combination, including the connection system should be safe and should not impair the specified performance of the devices. Any restrictions on use applying to such combinations should be indicated on the labelling and/or in the instructions for use. Connections which the user has to handle, such as fluid, gas transfer or mechanical coupling, should be designed and constructed in such a way as to minimize all possible risks from incorrect connection. 11.2 Devices should be designed and manufactured in such a way as to remove or reduce as far as reasonably practicable and appropriate: the risk of injury to the patient, user or other persons in connection with their physical and ergonomic features, the risk of use error due to the ergonomic features, human factors and the environment in which the device is intended to be used; risks connected with reasonably foreseeable external influences or environmental conditions, such as magnetic fields, external electrical and electromagnetic effects, electrostatic discharge, radiation associated with diagnostic or therapeutic procedures, pressure, humidity, temperature or variations in pressure and acceleration; the risks associated with the use of the device when it comes into contact with materials, liquids, and gases to which it is exposed during normal conditions of use; the risk associated with the possible negative interaction between software and the environment within which it operates and interacts; the risks of accidental penetration of substances into the device; the risk of incorrect identification of specimens; the risks of reciprocal interference with other devices normally used in the investigations or for the treatment given; risks arising where maintenance or calibration are not possible (as with implants), from ageing of materials used or loss of accuracy of any measuring or control mechanism. 11.3 Devices should be designed and manufactured in such a way as to minimize the risks of fire or explosion during normal use and in single fault condition. Particular attention should be paid to devices whose intended use includes exposure to or use in association with flammable substances or substances which could cause combustion. 11.4 Devices must be designed and manufactured in such a way as to facilitate the safe disposal of any waste substances. 12. Devices with a diagnostic or measuring function. 12.1 Devices with a measuring function, should be designed and manufactured in such a way as to provide sufficient accuracy, precision and stability for their intended purpose of the device, based on appropriate scientific and technical methods. The limits of accuracy should be indicated by the manufacturer. 12.2 Diagnostic devices should be designed and manufactured in such a way as to provide sufficient accuracy, precision and stability for their intended use, based on appropriate scientific and technical methods. 12.3 Any measurement, monitoring or display scale should be designed in line with ergonomic principles, taking account of the intended purpose of the device. 12.4 Wherever possible values expressed numerically should be in commonly accepted, standardized units, and understood by the users of the device. 13. Protection against radiation 13.1 General 13.1.1 Devices should be designed and manufactured and packaged in such a way that exposure of patients, users and other persons to any emitted radiation should be reduced as far as practicable and appropriate, compatible with the intended purpose, whilst not restricting the application of appropriate specified levels for therapeutic and diagnostic purposes. 13.2 Intended radiation 13.2.1 Where devices are designed to emit hazardous, or potentially hazardous, levels of visible and/or invisible radiation necessary for a specific medical purpose the benefit of which is considered to outweigh the risks inherent in the emission, it should be possible for the user to control the emissions. Such devices should be designed and manufactured to ensure reproducibility of relevant variable parameters within an acceptable tolerance. 13.2.2 Where devices are intended to emit potentially hazardous, visible and/or invisible radiation, they should be fitted, where practicable, with visual displays and/or audible warnings of such emissions. 13.3 Unintended radiation Devices should be designed and 13.3.1 manufactured in such a way that exposure of patients, users and other persons to the emission of unintended, stray or scattered radiation is reduced as far as practicable and appropriate. 13.4 Instructions 13.4.1 The operating instructions for devices emitting radiation must give detailed information as to the nature of the emitted radiation, means of protecting the patient and the user and on ways of avoiding misuse & of eliminating the risks inherent in installation. 13.5 Ionising radiation Devices intended to emit ionizing 13.5.1 radiation should be designed and manufactured in such a way as to ensure that, where practicable, the quantity, geometry and energy distribution (or quality) of radiation emitted can be varied and controlled taking into account the intended use. 13.5.2 Devices emitting ionizing radiation intended for diagnostic radiology should be designed and manufactured in such a way as to achieve appropriate image and/or output quality for the intended medical purpose whilst minimizing radiation exposure of the patient and user. 13.5.3 Devices emitting ionizing radiation, intended for therapeutic radiology should be designed and manufactured in such a way as to enable reliable monitoring and control of the delivered dose, the beam type and energy and where appropriate the energy distribution of the radiation beam. 14. Medical devices that incorporate software and standalone medical device software 14.1 Devices incorporating electronic programmable systems, including software, or standalone software that are devices in themselves, should be designed to ensure repeatability, reliability and performance according to the intended use. In the event of a single fault condition, appropriate means should be adopted to eliminate or reduce as far as practicable and appropriate consequent risks. 14.2 For devices which incorporate software or for standalone software that are devices in themselves, the software must be validated according to the state of the art taking into account the principles of development lifecycle, risk management, validation and verification. 15. Active medical devices and devices connected to them 15.1 For active medical devices, in the event of a single fault condition, appropriate means should be adopted to eliminate or reduce as far as practicable and appropriate consequent risks. 15.2 Devices where the safety of the patients depends on an internal power supply should be equipped with a means of determining the state of the power supply. 15.3 Devices where the safety of the patients depends on an external power supply should include an alarm system to signal any power failure. 15.4 Devices intended to monitor one or more clinical parameters of a patient should be equipped with appropriate alarm systems to alert the user of situations which could lead to death or severe deterioration of the patient's state of health 15.5 Devices should be designed and manufactured in such a way as to reduce as far as practicable and appropriate the risks of creating electromagnetic interference which could impair the operation of this or other devices or equipment in the usual environment. 15.6 Devices should be designed and manufactured in such a way as to provide an adequate level of intrinsic immunity to electromagnetic disturbance to enable them to operate as intended. 15.7 Devices should be designed and manufactured in such a way as to avoid, as far as reasonably practicable, the risk of accidental electric shocks to the patient, user or any other person, both during normal use of the device and in the event of a single fault condition in the device, provided the device is installed and maintained as indicated by the manufacturer 16.0 Protection against mechanical risks 16.1 Devices should be designed and manufactured in such a way as to protect the patient and user against mechanical risks connected with, for example, resistance to movement, instability and moving parts. 16.2 Devices should be designed and manufactured in such a way as to reduce to the lowest practicable level the risks arising from vibration generated by the devices, taking account of technical progress and of the means available for limiting vibrations, particularly at source, unless the vibrations are part of the specified performance. 16.3 Devices should be designed and manufactured in such a way as to reduce to the lowest practicable level the risks arising from the noise emitted, taking account of technical progress and of the means available to reduce noise, particularly at source, unless the noise emitted is part of the specified performance 16.4 Terminals and connectors to the electricity, gas or hydraulic and pneumatic energy supplies which the user has to handle should be designed and constructed in such a way as to minimize all possible risks. 16.5 Accessible parts of the devices (excluding the parts or areas intended to supply heat or reach given temperatures) and their surroundings should not attain potentially dangerous temperatures under normal use. 17.0 Protection against the risks posed to the patient or user by supplied energy or substances 17.1 Devices for supplying the patient with energy or substances should be designed and constructed in such a way that the delivered amount can be set and maintained accurately enough to guarantee the safety of the patient and of the user 17.2 Devices should be fitted with the means of preventing and/or indicating any inadequacies in the delivered amount which could pose a danger. Devices should incorporate suitable means to prevent, as far as possible, the accidental release of dangerous levels of energy or substances from an energy and/or substance source. 17.3 The function of the controls and indicators should be clearly specified on the devices. Where a device bears instructions required for its operation or indicates operating or adjustment parameters by means of a visual system, such information should be understandable to the user and, as appropriate, the patient. 18.0 Protection against the risks posed by medical devices intended by the manufacturer for use by lay 18.1 persons Devices for use by lay persons should be designed and manufactured in such a way that they perform appropriately for their intended purpose taking into account the skills and the means available to lay persons and the influence resulting from variation that can reasonably be anticipated in the lay person’s technique and environment. The information and instructions provided by the manufacturer should be easy for the lay person to understand and apply. 18.2 Devices for use by lay persons should be designed and manufactured in such a way as to reduce as far as practicable the risk of error during use by the lay person in the handling of the device and also in the interpretation of results. 18.3 Devices for use by lay persons should, where reasonably possible, include a procedure by which the lay person can verify that, at the time of use, the product will perform as intended by the manufacturer. 19.0 Label and Instructions for Use 19.1 Users should be provided with the information needed to identify the manufacturer, to use the device safely and to ensure the intended performance, taking account of their training and knowledge. This information should be easily understood 20.0 Clinical evaluation 20.1 For all medical devices, the demonstration of conformity with essential principles includes a clinical evaluation in accordance with GHTF guidance. The clinical evaluation should review clinical data in the form of any: clinical investigation reports, literature reports/reviews, and clinical experience to establish that a favourable benefit-risk ratio exists for the device. Note: Further information is provided in GHTF/SG5/N2R8:2007 Clinical Evaluation. 20.2 Clinical investigations1 on human subjects should be carried out in accordance with the spirit of the Helsinki Declaration. This includes every step in the clinical investigation from first consideration of the need and justification of the study to publication of the results. In addition, some countries may have specific regulatory requirements for pre-study protocol review or informed consent. Essential Principles applicable to IVD Devices 21.0 Chemical, physical and biological 21.1 properties The IVD devices should be designed and manufactured in such a way as to ensure the characteristics and performance referred to in Section 6. Particular attention should be paid to the possibility of impairment of analytical performance due to incompatibility between the materials used and the specimens and/or analyte (measurand) to be detected (such as biological tissues, cells, body fluids and micro-organisms) intended to be See GHTF/SG5/N3:2010 Clinical Investigations used with the device, taking account of its intended purpose. 21.2 The IVD devices should be designed, manufactured and packaged in such a way as to minimize the risk posed by contaminants and residues to the persons involved in the transport, storage and use of the devices and to patients, taking account of the intended purpose of the product. 21.3 The IVD devices should be designed and manufactured in such a way as to reduce as far as reasonably practicable and appropriate the risks posed by substances that may leach or leak from the IVD device. Special attention should be given to substances which are carcinogenic, mutagenic or toxic to reproduction. 21.4 IVD devices should be designed and manufactured in such a way as to reduce as far as reasonably practicable and appropriate risks posed by the unintentional ingress or egress of substances into or from the IVD device taking into account the device and the nature of the environment in which it is intended to be used. 22.0 Infection and microbial contamination 22.1 The IVD devices and manufacturing processes should be designed in such a way as to eliminate or to reduce as far as reasonably practicable and appropriate the risk of infection to user, professional or lay, or, where applicable, other person . The design should: allow easy and safe handling; and, where necessary: reduce as far as reasonably practicable and appropriate any microbial leakage from the IVD device and/or microbial exposure during use; and prevent microbial contamination of the IVD device or specimen where applicable, by the user, professional or lay, or other person. 22.2 IVD devices labeled either as sterile or as having a special microbiological state should be designed, manufactured and packaged to ensure they remain so when placed on the market and remain so under the transport and storage conditions specified by the manufacturer, until the protective packaging is damaged or opened. 22.3 IVD devices labeled either as sterile or as having a special microbiological state should have been processed, manufactured and, if applicable, sterilized by appropriate, validated methods. 22.4 IVD devices intended to be sterilized should be manufactured in appropriately controlled (e.g. environmental) conditions. 22.5 Packaging systems for non-sterile IVD devices should maintain the integrity and cleanliness of the product. 23.0 IVD devices incorporating materials of biological origin 23.1 Where IVD devices include tissues, cells and substances originating from animals, processing, preservation, testing and handling of tissues, cells and substances of animal origin should be carried out so as to provide optimal safety for user, professional or lay, or other person. In particular safety with regard to viruses and other transmissible agents should be addressed by implementation of validated methods of elimination or inactivation in the course of the manufacturing process. This may not apply to certain IVD devices if the activity of the virus and other transmissible agent are integral to the intended purpose of the IVD device or when such elimination or inactivation process would compromise the performance of the IVD device. National regulations may require that the manufacturer and/or the Regulatory Authority retain information on the geographical origin of the animals. 23.2 Where IVD devices include human tissues, cells and substances, the selection of sources, donors and/or substances of human origin, the processing, preservation, testing and handling of tissues, cells and substances of such origin should be carried out so as to provide optimal safety for user, professional or lay, or other person. In particular safety with regard to viruses and other transmissible agents should be addressed by implementation of validated methods of elimination or inactivation in the course of the manufacturing process. This may not apply to certain IVD devices if the activity of the virus and other transmissible agent are integral to the intended purpose of the IVD device or when such elimination or inactivation process would compromise the performance of the IVD device. 23.3 Where IVD devices include cells and substances of microbial origin, processing, preservation, testing and handling of cells and substances should be carried out so as to provide optimal safety for user, professional or lay, or other person. In particular, safety with regard to viruses and other transmissible agents should be addressed by implementation of validated methods of elimination or inactivation in the course of the manufacturing process. This may not apply to certain IVD devices if the activity of the virus and other transmissible agent are integral to the intended purpose of the IVD medical device or when such elimination or inactivation process would compromise the performance of the IVD device. 24.0 Manufacturing and environmental properties 24.1 If the IVD device is intended for use in combination with other devices or equipment, the whole combination, including the connection system should not impair the specified performance of the devices. Any restrictions on use applying to such combinations should be indicated on the label and/or in the instructions for use. 24.2 IVD devices should be designed and manufactured in such a way as to remove or reduce as far as reasonably practicable and appropriate: the risk of injury to user, professional or lay, or other person in connection with their physical and ergonomic features, the risk of use error due to the ergonomic features, human factors and the environment in which the IVD device is intended to be used; risks connected with reasonably foreseeable external influences or environmental conditions, such as magnetic fields, external electrical and electromagnetic effects, electrostatic discharge, pressure, humidity, temperature or variations thereof; the risks associated with the use of the IVD device when it comes into contact with materials, liquids, and gases to which it is exposed during normal conditions of use; the risk associated with the possible negative interaction between software and the environment within which it operates and interacts; the risks of accidental penetration of substances into the IVD device; the risk of incorrect identification of specimens; and the risks of reasonably foreseeable interference with other devices such as carry over between IVD devices 24.3 IVD devices should be designed and manufactured in such a way as to minimize the risks of fire or explosion during normal use and in single fault condition. Particular attention should be paid to IVD devices whose intended use includes exposure to or use in association with flammable substances or substances which could cause combustion. 24.4 IVD devices must be designed and manufactured in such a way as to facilitate the safe disposal of any waste substances. 25.0 Performance characteristics IVD devices should be designed 25.1 and manufactured in such a way that the performance characteristics support the intended use, based on appropriate scientific and technical methods. In particular, where appropriate, the design should address sensitivity, specificity, accuracy which is trueness and precision (repeatability and reproducibility), control of known relevant interference and limits of detection. These performance characteristics need to be maintained during the lifetime of the IVD device as indicated by the manufacturer. 25.2 Where the performance of devices depends on the use of calibrators and/or control materials, the traceability of values assigned to such calibrators and/or control materials should be assured through available reference measurement procedures and/or available reference materials of a higher order. 25.3 Wherever possible values expressed numerically should be in commonly accepted, standardized units, and understood by the users of the device. Note: While SG1 generally supports convergence on the global use of internationally standardized measurement units, considerations of safety, user familiarity, and established clinical practice may justify the use of other recognized measurement units. 26.0 Protection against radiation 26.1 IVD devices should be designed, manufactured and packaged in such a way that exposure of user, professional or lay, or other person to the emitted radiation (intended, unintended, stray or scattered) is reduced as far as practicable and appropriate 26.2 When IVD devices are intended to emit potentially hazardous, visible and/or invisible radiation, they should as far as practicable and appropriate be: designed and manufactured in such a way as to ensure that the characteristics and the quantity of radiation emitted can be controlled and/or adjusted; and fitted with visual displays and/or audible warnings of such emissions 27.0 IVD devices that incorporate software and standalone IVD device software 27.1 For IVD devices which incorporate software or for standalone software that are IVD devices in themselves, the software must be validated according to the state of the art taking into account the principles of development lifecycle, risk management, verification and validation. 28.0 IVD devices connected to, or equipped with, an energy source 28.1 IVD devices where the safety of the patient depends on an internal power supply in the IVD device, should be equipped with a means of determining the state of the power supply. 28.2 IVD devices should be designed and manufactured in such a way as to reduce as far as practicable and appropriate the risks of creating electromagnetic interference which could impair the operation of this or other devices or equipment in the usual environment. 28.3 IVD devices should be designed and manufactured in such a way as to provide an adequate level of intrinsic immunity to electromagnetic disturbance to enable them to operate as intended. 28.4 IVD devices should be designed and manufactured in such a way as to avoid, as far as reasonably practicable, the risk of accidental electric shocks to the user, professional or lay, or other person both during normal use of the device and in the event of a single fault condition in the device, provided the IVD device is installed and maintained as indicated by the manufacturer. 29.0 Protection against mechanical and thermal risks 29.1 IVD devices should be designed and manufactured in such a way as to protect the user, professional or lay, or other person against mechanical risks connected with, for example, resistance to movement, instability and moving parts. Where there are risks due to the presence of moving parts, risks due to break-up or detachment, or leakage of substances, then appropriate protection means must be incorporated. 29.2 IVD devices should be designed and manufactured in such a way as to reduce to the lowest practicable level the risks arising from vibration generated by the devices, taking account of technical progress and of the means available for limiting vibrations, particularly at source, unless the vibrations are part of the specified performance. 29.3 IVD devices should be designed and manufactured in such a way as to reduce to the lowest practicable level the risks arising from the noise emitted, taking account of technical progress and of the means available to reduce noise, particularly at source. 29.4 Terminals and connectors to the electricity, gas or hydraulic and pneumatic energy supplies which the user, professional or lay, or other person has to handle should be designed and constructed in such a way as to minimize all possible risks. 29.5 Accessible parts of the IVD devices (excluding the parts or areas intended to supply heat or reach given temperatures) and their surroundings should not attain potentially dangerous temperatures under normal use. 30.0 Protection against the risks posed by IVD devices intended by the manufacturer for self-testing 30.1 IVD devices intended for self- testing should be designed and manufactured in such a way that they perform appropriately for their intended purpose taking into account the skills and the means available to lay persons and the influence resulting from variation that can reasonably be anticipated in the lay person’s technique and environment. The information and instructions provided by the manufacturer should be easy for the lay person to understand and apply. 30.2 IVD devices intended for self- testing should be designed and manufactured in such a way as to reduce as far as practicable the risk of error by the lay person in the handling of the device and, if applicable, the specimen, and also in the interpretation of results. 30.3 IVD devices intended for self- testing should, where reasonably possible, include a procedure by which the lay person can verify that, at the time of use, the product will perform as intended by the manufacturer. 31.0 Label and Instructions for Use 31.1 Users should be provided with the information needed to identify the manufacturer, to use the device safely and to ensure the intended performance, taking account of their training and knowledge. This information should be easily understood. Note: Further information is provided in GHTF/SG1/N43:2005 Labelling for Medical Devices 32.0 Performance evaluation including analytical performance and, where appropriate, clinical performance 32.1 For an IVD device a performance evaluation should be conducted in accordance with GHTF guidance. The performance evaluation should review analytical performance data and, where appropriate, clinical performance data in the form of any: literature; performance study reports; and experience gained by routine diagnostic testing. to establish that the IVD device achieves its intended performance during normal conditions of use and that the known, and foreseeable risks, and any undesirable effects, are minimised and acceptable when weighed against the benefits of the intended performance. The depth and extent of a performance evaluation should be appropriate to the nature, intended use and risks of the IVD device, and in accordance with GHTF guidance. Note: Further information is provided in GHTF/SG1/N46:2008 Principles of Conformity Assessment for IVD Medical Devices. 32.2 Clinical performance studies using specimens from human subjects should be carried out in accordance with the spirit of the Declaration of Helsinki. This includes every step in the clinical performance study from first consideration of the need and justification of the study to publication of the results. I declare that the information provided in this form is accurate and correct and the device conforms to all applicable requirements stipulated above. Name: ___________________________________________________ Signature: ____________________________________________________ Position: ____________________________________________________ Date: ________________________________________
Appendix 5 — Appendix 5
Pre-Market requirements for Medical Device Cybersecurity 5.1 Security Requirements and Architecture Design Proactively addressing cybersecurity threats at the design stage (e.g. through efforts such as threat modeling) can better mitigate the potential for patient harm than engaging in reactive, post-market activities alone. These design inputs can come from various phases across the product’s life cycle, such as from requirements capture, design verification testing, or risk management activities in the pre- and post-market. Security requirements should also be identified during the requirements capture stage of the life cycle design process. Some security requirements and security risk control measures can be found in AAMI TIR57:2016, IEC TR 80001-2-2, IEC TR 80001-2-8, the ISO 27000 family, and resources published by NIST (e.g. NIST’s Secure Software Development Framework (SSDF), OWASP (e.g. Security by Design principles), and the US Healthcare and Public Health Sector Coordinating Council (HPH SCC) Joint Cyber Security Working Group (JCWG) (e.g. the Joint Security Plan). While the following Table 1 is not meant to be an exhaustive list, it outlines some design principles that medical device manufacturers should consider in designing their product. Table 1: Select design principles for consideration in medical device design Design Principle Description The manufacturer should consider how the device would interface with other devices or networks. Interfaces may include hardwired connections and/or wireless communications. Examples of interface methods include Wi-Fi, Ethernet, Bluetooth, USB, etc. Secure Communications The manufacturer should consider design features that validate all inputs (not just external) and take into account communication with devices and environments that only support less secure communication (e.g., a device connected to a home network or a legacy device). The manufacturer should consider how data transfer to and from the device is secured to prevent unauthorized access, modification, or replay. For example, manufacturers should determine: how the communications between devices/systems will authenticate each other; if encryption is required; how unauthorized replay of previously transmitted commands or data will be prevented; and if terminating communication sessions after a pre-defined time is appropriate. The manufacturer should consider if safety-related data that is stored on or transferred to/from the device requires some level of protection such as encryption. For example, passwords should be stored as cryptographically secure hashes. Data Protection The manufacturer should consider if confidentiality risk control measures are required to protect message control/sequencing fields in communication protocols or to prevent the compromise of cryptographic keying materials. The manufacturer should evaluate the system-level architecture to determine if design features are necessary to ensure data non- Device Integrity repudiation (e.g., supporting an audit logging function). The manufacturer should consider risks to the integrity of the device such as unauthorized modifications to the device software. The manufacturer should consider controls such as anti-malware to prevent viruses, spyware, ransomware, and other forms of malicious code of being executed on the device. The manufacturer should consider user access controls that validate who can use the device or allows granting of privileges to different user roles or allow users access in an emergency. Additionally, the same credentials should not be shared across devices and customers. Examples of authentication or access authorization include passwords, hardware keys, or biometrics, or a signal of intent that cannot be produced by another device. The manufacturer should establish and communicate a process for implementation and deployment of regular updates. The manufacturer should consider how operating system software, third-party software, or open source software will be updated or controlled. The manufacturer should also plan how to respond to software updates or outdated operating environments outside of their control (e.g. medical device software running on an unsecure operating system version). The manufacturer should consider how the device will be updated to secure it against newly discovered cybersecurity vulnerabilities. For example, consideration could be given to whether updates will require user intervention or be initiated by the device and how the update can be validated to ensure it has no adverse effect on the safety and performance of the device. The manufacturer should consider what connections will be required to conduct updates and the authenticity of the connection or update through the use of code signing or other similar methods. The manufacturer should consider controls to prevent an unauthorized person from accessing the device. For example, controls could include physical locks or physically restricting access to ports, or not allowing access with a physical cable without requiring authentication. The manufacturer should consider design features that will allow the device to detect, resist, respond and recover from cybersecurity attacks in order to maintain its essential performance. The manufacturer should consider controls such as anti-malware to prevent viruses, spyware, ransomware, and other forms of malicious code of being executed on the device. The manufacturer should consider user access controls that validate who can use the device or allows granting of privileges to different user roles or allow users access in an emergency. Additionally, the User Authentication same credentials should not be shared across devices and customers. Examples of authentication or access authorization include passwords, hardware keys, or biometrics, or a signal of intent that cannot be produced by another device. The manufacturer should establish and communicate a process for implementation and deployment of regular updates. The manufacturer should consider how operating system software, third-party software, or open source software will be updated or controlled. The manufacturer should also plan how to respond to software updates or outdated operating environments outside of their control (e.g. medical device software running on an unsecure operating system version). Software Maintenance The manufacturer should consider how the device will be updated to secure it against newly discovered cybersecurity vulnerabilities. For example, consideration could be given to whether updates will require user intervention or be initiated by the device and how the update can be validated to ensure it has no adverse effect on the safety and performance of the device. The manufacturer should consider what connections will be required to conduct updates and the authenticity of the connection or update through the use of code signing or other similar methods. The manufacturer should consider controls to prevent an unauthorized person from accessing the device. For example, Physical Access controls could include physical locks or physically restricting access to ports, or not allowing access with a physical cable without requiring authentication. The manufacturer should consider design features that will allow the Reliability device to detect, resist, respond and recover from cybersecurity and attacks in order to maintain its essential performance. Availability Secure development principles are integral to secure device design. Many current software development life cycle models or standards do not incorporate these principles by default. It is important for device manufacturers that develop medical device software to incorporate these security principles into the development of their software. Doing so necessitates that manufacturers take a holistic approach to device cybersecurity by assessing risks and mitigations throughout the product’s life cycle. Note: The life cycle activities for medical device software are specified in IEC 62304:2006/AMD 1:2015. 5.2. Risk Management Principles for the TPLC Sound risk management principles addressing the security and safety domains should be incorporated throughout the life cycle of a medical device. A cybersecurity risk that impacts device safety and essential performance, negatively affects clinical operations, or results in diagnostic or therapeutic errors should also be considered in the medical device’s risk management process. Risk management as described in ISO 14971:2019, and cybersecurity risk management (for example, as described in AAMI TIR57:2016; AAMI TIR97:2019) should be used by the manufacturer to take the following steps as part of their risk management process: Identify any cybersecurity vulnerability; Estimate and evaluate the associated risks; Control those risks to an acceptable level; Assess and monitor the effectiveness of the risk controls; and Communicate risks via coordinated disclosure to key stakeholders. Figure 1 below shows the security risk management process from AAMI TIR57:2016. This can be a specialized risk management process performed as part of overall risk management, or can be an integral part of the ISO 14971:2019 risk management process with appropriate mapping of vulnerability, threat and other security related terms. See ISO/TR 24971:2020 APPENDIX F for possible mapping. Figure 1: Schematic representation of the security risk management process (adopted from the IMDRF/CYBER WG/N60FINAL:2020) With respect to cybersecurity in medical device regulation, risk analyses should focus on assessing the risk of patient harm by considering: 1) the exploitability of the cybersecurity vulnerability, and 2) the severity of patient harm if the vulnerability were to be exploited. These analyses should also incorporate consideration of compensating controls and risk mitigations. Risk assessments link design to threat modeling, patient harm, mitigations, and testing. It is therefore important to establish a secure design architecture such that risk can be adequately managed. There are numerous tools and approaches that may be leveraged in this assessment including but not limited to security risk assessment, threat modeling, and vulnerability scoring. Security Risk Assessment: Manufacturers should consider cybersecurity risks, threats and controls throughout the product life cycle. Where applicable, cybersecurity requirements should be cross-referenced to specific device cybersecurity threats and vulnerabilities if the requirements are mitigations to identified hazards. Threat Modeling: Threat modeling is a process for identifying, enumerating and mitigating risks from potential threats in the device and system. Specifically, threat modeling includes consideration of risks, including but not limited to risks related to the supply chain (e.g., system components), design, production, deployment (e.g., into a hospital environment) and maintenance. Furthermore, creating sufficiently detailed system diagrams aid in the understanding of how cybersecurity design elements are incorporated into a device which further aids in threat modeling. In generating a threat model and per guidance from OWASP, device manufacturers should consider answering four basic questions as it pertains to cybersecurity: 1. What are we building? 2. What can go wrong? (e.g. how could it be attacked) 3. What are we going to do about that? 4. Did we do a good enough job? These questions can be asked in the context of application architecture, operational data flow, or broader system-level threat modeling as appropriate. When determining what can go wrong during threat modeling, manufacturers should consider unintended or malicious misconfiguration of software and hardware (e.g. connecting a device to the Internet that was not designed to do so). Vulnerability scoring: Vulnerability scoring provides a way to characterize and assess the exploitability and severity of a cybersecurity vulnerability. Known common vulnerabilities and exposures (CVEs) identified in design and development should be analyzed and evaluated using a consistent vulnerability scoring methodology such as the Common Vulnerability Scoring System (CVSS) or any future widely adopted vulnerability scoring system. Cybersecurity risk, vulnerability scoring, and control measures may be used to inform threat modeling and security risk assessments for new products and other risk assessment tools not specific to cybersecurity (e.g. failure mode and effects analysis (FMEA)). In integrating a security risk management process into an existing ISO 14971:2019 risk management process, activities that address security such as threat modeling and vulnerability scoring should be taken into account. 5.3. Security Testing At the verification and validation stage in the design and development process, the manufacturer should employ various types of security testing to provide assurance that the code is free of significant known vulnerabilities and that security controls have been effectively implemented. Testing should take into consideration the context of use of the device and its deployment environment. Application of software verification techniques are recommended to ensure that the software complies with the specifications and anomalies are minimized. It is also important to ensure that the medical device is tested for known vulnerabilities that could be exploited. To do this, the medical device should undergo a security assessment process or acceptance check (e.g. software testing, attack simulation, etc.). Security testing is a component of secure development framework and additional granularity regarding testing considerations may be found in the standards and resources provided in Section 5.1. Below are some high-level considerations for medical device manufacturers: Perform target searches on software components/modules for known vulnerabilities or software weakness also during development. For example, periodic security testing can include: static code analysis, dynamic analysis, robustness testing, vulnerability scanning, or software composition analysis. Conduct technical security analyses (e.g. penetration testing). These include efforts to identify unknown vulnerabilities through fuzz testing, for example; or checks for alternative entry points, e.g. by reading hidden files, configuration, data streams or hardware registers. Complete a vulnerability assessment. This includes an impact analysis of the vulnerability on other in-house products (i.e. variant analysis), the identification of countermeasures, and the remediation or mitigation of vulnerability. 5.4. TPLC Cybersecurity Management Plan As cybersecurity threats will continuously evolve, manufacturers should proactively monitor, identify, and address vulnerabilities and exploits as part of their cybersecurity management plan across the total product life cycle. A plan should be in place in the pre-market stage of product development and ideally maintained throughout the manufacturer’s organization. This plan should address: TPLC Vigilance: The proactive monitoring and identification of newly discovered cybersecurity vulnerabilities, assessment of their threat, and appropriate responses. Vulnerability Disclosure: A formalized process for gathering information from vulnerability finders, developing mitigation and remediation strategies, and disclosing the existence of vulnerabilities and mitigation or remediation approaches to stakeholders. Updates and Remediation: A plan outlining how software will be updated or how other remediation actions would be applied to maintain ongoing safety and performance of the device either regularly or in response to an identified vulnerability. Recovery: A recovery plan for either the manufacturer, user, or both to restore the device to its normal operating condition following a cybersecurity incident. Information sharing: Participation in Information Sharing Analysis Organizations (ISAOs) or Information Sharing and Analysis Centers (ISACs) that promote the communication and sharing of updated information about security threats and vulnerabilities. 5.5. Labeling and Customer Security Documentation 5.5.01. Labeling Labeling communicates to end-users relevant security information, taking into account the relative cybersecurity risk. It should include the following elements: Device instructions and product specifications related to recommended cybersecurity controls appropriate for the intended use environment (e.g., anti-malware software, network connectivity configuration, use of a firewall). A description of backup and restore features and procedures to regain configurations. A list of network ports and other interfaces that are expected to receive and/or send data, and a description of port functionality and whether the ports are incoming or outgoing (note that unused ports should be disabled). Sufficiently detailed system diagrams for end-users. 5.5.02. Customer Security Documentation In addition to the instructions for use, the technical documentation written by the manufacturer for installation, configuration of the device, as well as the technical requirements for their operating environments are particularly important for safe and secure use by the user. It should include the following elements: Specific guidance to users regarding the supporting infrastructure requirements so that the device can operate as intended. A description of how the device is - or can be hardened - using a secure configuration. Secure configurations may include end point protections such as anti-malware, firewall/firewall rules, whitelisting, security event parameters, logging parameters, physical security detection, etc. Where appropriate, technical instructions to permit secure network (connected) deployment and servicing, and instructions for users on how to respond upon detection of a cybersecurity vulnerability or incident. A description of how the device or supporting systems will notify the user when anomalous conditions are detected (i.e., security events) where feasible. Security event types could be configuration changes, network anomalies, login attempts, anomalous traffic (e.g., send requests to unknown entities). A description of the methods for retention and recovery of device configuration by an authenticated privileged user. Where appropriate, security risks and consequences of changes to the security configuration, or to the use environment A description of systematic procedures for authorized users to download and install updates from the manufacturer. Information, if known, concerning device cybersecurity end of support (see Section 6.6, Legacy Medical Devices). A Software Bill of Materials (SBOM) to inform and support operators regarding the cybersecurity of commercial, open source, or off-the-shelf software components which are included in the medical device. An SBOM creates the necessary transparency via a list identifying each software component by its name, origin, version and build. SBOMs enable device operators (including patients and healthcare providers) to effectively manage their assets and related risks, to understand the potential impact of identified vulnerabilities to the device (and the connected system) and to deploy countermeasures to maintain the device’s safety and essential performance. Device operators can use the SBOM to facilitate work with the device manufacturer in identifying software that may have vulnerabilities, update requirements, and performing appropriate security risk management. The SBOM also helps inform purchasing decisions by providing prospective buyers with visibility into the components used in applications and determining potential security risk. Manufacturers should leverage industry best practices for the format, syntax and markup used for deployment of the SBOM. Since the SBOM reveals sensitive information about the medical device, its distribution is encouraged through trusted communication channels. It is recognized that manufacturers will determine trusted ways for communicating SBOMs to the operator. 5.6. Documentation for Regulatory Submission In addition to the activities outlined in the preceding sections, medical device manufacturers should clearly document and summarize their activities related to cybersecurity. Depending on the risk class of the device, the regulator may require this type of documentation to assess the medical device prior to market entry or may request it during the post-market phase of the product’s life cycle. If required for premarket authorization, clear documentation describing the device’s design features, risk management activities, testing, labeling and evidence of a plan to monitor and respond to emerging threats throughout the product’s life cycle in relation to cybersecurity, should be submitted by the manufacturer. The following paragraphs provide further details on each of the above items. 5.6.1. Design Documentation Documentation that describes the device including any interfaces or communication pathways or components (hardware and software), and all design features that were included to mitigate cybersecurity risks relating to patient harm such as those previously outlined in Section 5.1 above (in particular the rationale and assumptions leading to the selection of the measures for access control, encryption, secure updates, logging, physical security, etc.). 5.6.2 Risk Management Documentation Documentation that clearly describes cybersecurity threats and vulnerabilities, an estimation of the associated risks, descriptions of the controls in place to mitigate those risks and evidence to demonstrate that those controls have been adequately tested. Manufacturers should consider risk controls that maximize device cybersecurity while not unduly affecting other safety controls. Specifically, the risk management documents related to cybersecurity that are submitted to the regulator should be clear and use a cybersecurity risk management standard (e.g. AAMI TIR57:2016, AAMI TIR97:2019) for guidance. The outcomes should be aligned with the overall requirements of ISO 14971:2019, to ensure that output can be used as input for the overall risk management. Risk management documents related to cybersecurity can include: • Comprehensive risk management documentation, such as a risk management report or security risk management report which should include any threat modeling, and identified cybersecurity threats. • Discussion on any impact of security risk mitigations on the management of other risks. 5.6.3 Security Testing Documentation Test reports that summarize all tests performed to verify the security of the device and the effectiveness of any security controls. Details of specific testing, such as cross-referencing software components or subsystems with known vulnerability databases, for example, can be found in Section 5.3 above, however all testing documents should contain: • Descriptions of test methods, results, and conclusions; • A traceability matrix between security risks, security controls, and testing to verify those controls; and • References to any standards and internal SOPs/documentation used. 5.6.4 TPLC Cybersecurity Management Planning Documentation A summary of the device’s maintenance plan describing the post-market processes by which the manufacturer intends to ensure the continued safety and performance of the device throughout its life cycle. As described in Section 5.4 above, these planned processes may include: TPLC vigilance, planned or corrective updates, coordinated vulnerability disclosure policies, and information sharing. 5.6.5 Labelling and Customer Security Documentation All user documentation that includes relevant information, as outlined in Section 5.5 above, to allow the user to effectively manage risk in the device’s intended environment.