Sterilisation Supplier and Raw Material Change: QMS and Risk Management Gaps
During a pre-registration assessment for a Class IIa sterile single-use syringe, the notified body's auditor reviews the manufacturer's supplier controls. The syringe is sterilised by a contract facility in another member state. The manufacturer has a quality agreement with the steriliser, but no audit has been performed for three years. The sterilisation validation was performed on a different product family with a higher bioburden, and the manufacturer relies on the steriliser's ISO 13485 certificate. In addition, the manufacturer changed the supplier of the polypropylene resin for the barrel six months ago. The new resin has the same ISO 10993-1 material category, so the manufacturer did not perform biocompatibility testing. The risk management file was not updated. The change was not notified to the notified body. Tasks: (a) Identify the QMS nonconformities and their significance under MDR Annex IX. (b) How should the manufacturer apply ISO 14971 to the resin change? (c) What supplier controls should be in place for the contract steriliser and the resin supplier?
1. Identify the QMS nonconformities and their significance under MDR Annex IX.
Read the worked answer
There are several nonconformities. First, the contract steriliser is a critical supplier, and the lack of audit for three years breaches ISO 13485 Clause 7.4 (purchasing) and the supplier monitoring requirements. Relying on the steriliser's ISO 13485 certificate is not a substitute for an audit or other evidence of control. Second, sterilisation is a special process; ISO 13485 Clause 7.5.5 and 7.5.6 require validation and revalidation. The validation on a different product family must be justified as worst-case; if the syringe has a different geometry, bioburden, or packaging, the validation may not cover it. Third, the resin supplier change without biocompatibility evaluation breaches the manufacturer's own change control and ISO 13485 Clause 7.3 (design and development) and 7.1 (risk management). Under MDR Annex IX, the QMS assessment covers these processes. These are major nonconformities because they affect sterility assurance and biocompatibility. The notified body should not issue the certificate until corrective actions are completed and verified. The manufacturer should also assess whether the resin change is a significant change requiring notification.
2. How should the manufacturer apply ISO 14971 to the resin change?
Read the worked answer
The manufacturer should treat the resin change as a change to a patient-contacting material and perform a formal risk assessment. Under ISO 14971:2019, it should update the risk management plan, identify the new hazards (e.g., extractables/leachables, additives, processing aids, colourants), estimate and evaluate the risks, and decide whether risk controls are needed. The fact that the resin has the same ISO 10993-1 material category is not sufficient; the final device's biocompatibility depends on the formulation, processing, and sterilization. The manufacturer should perform a toxicological risk assessment and, where needed, biocompatibility testing (e.g., cytotoxicity, sensitization, irritation) on the final device. It should also update the risk management file, the technical documentation, and the change control record. If the change affects the device's conformity, the notified body must be informed. The risk management review should be documented before the change is released.
3. What supplier controls should be in place for the contract steriliser and the resin supplier?
Read the worked answer
For the contract steriliser, the manufacturer should have a written quality agreement that defines responsibilities, specifications, change notification, deviation handling, and audit rights. The steriliser should be qualified and periodically audited, with audit frequency based on risk. The manufacturer should review sterilization records, validation reports, and revalidation triggers. For the resin supplier, the manufacturer should qualify the supplier, obtain material specifications and certificates of analysis, and require change notification. Incoming inspection should verify critical characteristics. The manufacturer should also monitor supplier performance and maintain a supplier risk classification. Both suppliers are critical because they affect sterility and biocompatibility. The notified body should verify that the supplier controls are effective, not just documented. If the manufacturer cannot demonstrate control, the QMS is not adequate for MDR Annex IX.