ISO Certification

EMKI-cert Ltd. certifies management system according to EN ISO 13485: 2016 standard in the following main technical areas:
1.1.    Non-active Medical Device
1.2.    Active Non-Implantable Medical Devices
1.4.    In Vitro Diagnostic Medical Devices (IVD)
1.5.    Sterilization Method for Medical Devices
1.6.    Devices incorporating/utilizing specific substances/ technologies
1.7.    Parts or services

EMKI-cert Ltd. is entitled to issue accredited certificates, and its activities are controlled by the National Accreditation Authority.

 

Requirements for the management system of medical device manufacturers

- comply with the EN ISO 13485: 2016 standard
- as a manufacturer of a medical device, comply with 93/42/EEC Directive (here) and the relevant requirements of EU Regulation 2017/745 of the European Commission and Parliament (here)
- In the case of an IVD medical device manufacturer, comply with 98/79/EC Directive (here) the relevant requirements of EU Regulation 2017/746 of the European Commission and Parliament (here)
- the processes comply with the EU recommendations for manufactured medical devices: MDCG's.

Request for certification information

Ask your questions to EMKI-cert Kft. at the telephone number and e-mail address published on the website.
EMKI-cert Kft. treats incoming inquiries confidentially and strives for the greatest professionalism in its response.
EMKI-cert Kft. handles personal data in accordance with the provisions of the Data Protection Information.

Request for Quotation

A request for certification quote can be initiated with the downloadable Request for Quotation form at EMKI-cert Kft.
We can undertake the certification of a management system that has been operating for at least 3 months.
Certification according to the EN ISO 13485: 2016 standard can be applied for the following activities related to medical devices: manufacturing, contract manufacturing, service, trade.
In order to make a quick quotation in accordance with the needs and legal requirements, we ask that all interpretable sections of the Request for Quotation form be filled in accurately and clearly.
The certification fee is calculated based on the time to be spent. When determining the audit time requirement, the following is taken into account:
- number of employees working in the scope of certification (including the number of employees and critical subcontractors supporting the activity)
- number of sites
- complexity of processes.
See: Fee items.

EMKI-cert Kft. requests written confirmation from the client regarding the acceptance of the quotation in all cases. In case of acceptance of the quotation after the deadline EMKI-cert Kft. reserves the right to extend the validity of the quotation or to reject the request.

The following flowchart illustrates how to request a quotation:

 

Contracting

After the acceptance of the quotation EMKI-cert Kft. prepares the draft contract, which will remain a draft until both Parties sign it. The draft contract will be sent to the client by e-mail (in pdf format). The client must send back the contract, printed in three copies and duly signed, which will enter into force if the Managing Director of EMKI-cert Kft. has also signed it.

If the client does not send back the draft contract signed within 2 months - despite repeated written requests - EMKI-cert Kft. considers that the client has withdrawn from the contract intention. It notifies the client by e-mail and archives the client’s documents that have been generated.

EMKI-cert Kft. registers the contract signed by both parties and issues a “Client ID” identifying the client - for the entire certification cycle-and then initiates the process related to the planning, organization and conducting of the audit. We request documents from the client regarding his/her management system and the products he/she manufactures when we have provided them with our General Statement of Confidentiality. The certification contract of EMKI-cert Kft. applies to the circumstances specified in the Request for Quotation form. If EMKI-cert Kft. experiences different circumstances during the review of client documents or on-site audit, it is entitled to review the concluded contract or- in the absence of an agreement- to terminate the contract unilaterally for further certification activities.

Flowchart showing the process of concluding a contract:

 

Deadlines

 
EMKI-cert Kft. has set the following deadlines in its internal regulations in connection with the request for quotation and contracting which it takes into account during its procedures.

 

Initial, surveillance and renewal certification process

The certification cycle consists of initial certification and surveillance audits. One certification cycle for ISO certification is 3 years. The initial certification consists of two parts: Stage 1 and Stage 2.

Stage 1 includes a review of the client's documentation during which the certification body determines whether the established management system and its documentation are suitable for auditing.

According to IAF MD 1 the assessment covers the requirement that the client's central functions be subject to a quality management system. Central functions include system documentation management and modification, management review, complaint handling, internal audit, corrective action and regulatory and standard management.
An additional requirement for multi-site manufacturers is to:
-the entire organization (all sites) is subject to an uniform quality management system,
- the organization has defined the central functions which it cannot outsource and which must be subject to a quality management system
- the organisation's uniform quality management system is subject to central management review,
- all premises of a multi-site organization must be examined by internal audit, in particular the inspection of requirements for central functions.

In the case of an audit of the management system of high-risk, Class III medical device („high risk” according to IAF ID 13 Recommendation point 4.) manufacturers, Stage 1 must be performed at the client's site / manufacturing site. In this case the lead auditor will agree the date and place of the Stage 1 assessment with the client in an electronic mail. Following the assessment the auditor completes the “Audit Stage 1 Assessment Report” document, a copy of which is provided by the auditor to the client. For Class III manufacturers if the Stage 1 report finds major nonconformities in the manufacturer's management system or a significant change has occurred following the Stage 1 assessment, the Stage 1 assessment must be repeated at the client's sites. For manufacturers of lower risk medical devices (II.a, II.b, custom-made devices), an extract from the "Audit Stage 1 Assessment Report" will also be sent to the client in connection with the "Audit Plan" for Stage 2.

Stage 2 of the audit includes the on-site audit. The examined premises, audited areas and the functions during the on-site audit are defined in the audit plan, which must take into account:
- the area of activity of the sites,
- the quality management system requirements for the sites,
- the sites affected by the processes and activities concerned,
- that enough time is available to achive and check the sites and that auditors involved in the audit of the site be designated.

The audit plan is developed by the lead auditor in such a way that it can be verified after the on-site audit, the suitability of the client's organizational structure, the up-to-dateness of its quality policy, the adequacy of its processes and procedures, and the reliable management of its documents and records. The audited management system must be capable of giving the parties concerned confidence in the activity. EMKI-cert Kft. sends the audit plan to the client no later than one week before the audit. The main elements of an on-site audit are: opening meeting, collecting audit evidence and information, auditor’s discussion (in case of several auditors), preparation of audit notes, and closing meeting.

Among the methods of information collection, the following can be used:
- interviews
- monitoring of processes and activities
- review of documentation and records
- filling the checklists
- sampling.

The audit methods selected for the audit depend on the defined audit objectives, area and criteria, as well as the duration and location.

During the audit the members of the audit team may jointly assess the areas and processes to be audited in accordance with the audit plan or perform the audit in a distributed or separate manner. When applying the latter solution, the audit team periodically jointly assesses the progress of the audit during the audit.

If any member of the audit team considers that the objectives of the audit cannot be achieved and this is supported by the audit evidence gathered, he/she consults the lead auditor out of turn. The lead auditor consults with the client and informs the Managing Director of EMKI-cert Kft. after reviewing the audit evidence. The same applies if there is an indication of a direct, significant risk to the client's product or service. The Managing Director of EMKI-cert Kft. or the person authorized by him, involves the lead auditor in taking the appropriate action, which may be:
- modification of the audit plan (may be decided by the lead auditor)
- change of audit objectives or scope (may be initiated by lead auditor, Managing Director approval required)
- audit interruption (can only be done with the permission of the Managing Director)

Following the audit, the lead auditor reports to the certification body on the outcome of the actions taken, all of which are recorded in the audit questionnaire.

Before the closing meeting the lead auditor is responsible for reviewing the auditors' findings, the information obtained during the audit on the subject matter of the audit, and deciding whether the audit objectives have been met and whether the audit criteria have been properly defined.

The conclusions of the audit are recorded by the audit team in the Closing meeting report, and if any nonconformities are found, their description and severity are recorded in the document entitled “Nonconformity Report”.

In the event of a major nonconformity, the members of the audit team must agree on whether their rechecking can be performed by a document review or whether a repeated on-site audit is required. In the case of the latter, the need for a repeated on-site audit shall be recorded in the line “ Objective evidence and description of nonconformity ” of the Nonconformity report regarding the method of rechecking.

A nonconformity must be made if the identified deficiency is unique, rare, does not directly affect safety, and does not have a direct impact on the achievement of the intended system objectives.

A major nonconformity must be made by the audit team if the identified deficiency is a systemic failure that affects the functionality of the management system (e.g. a standard requirement, non-compliance with a legal requirement), or an error that directly affects safety during production. A "major nonconformity" must also be established if an error at the "nonconformity" level (e.g. lack of up-to-date documentation) occurs repeatedly at the system level. In the case of a multi-site audit the auditor must determine whether the identified nonconformity relates to a single site or refers to a system problem affecting multiple sites.

In the “Nonconformity Report” the client indicates its commitment to deal with the nonconformity / major nonconformity.

In the event of a major nonconformity the client must send an action plan for the planned corrective action within 15 days of the audit or take direct action to handle the nonconformity. It has a maximum of 90 days to implement the planned actions. EMKI-cert Kft. understands the specified deadlines in a calendar day. The action plan must include clearly defined tasks and deadlines. If sub-tasks are defined, sub-deadlines can also be set. In the event of a major nonconformity the auditor performs a root analysis submitted by the client and monitor the planned or implemented corrective actions. EMKI-cert Kft. sends its comments on the results of the review and verification to the customer in writing (electronically). Nonconformity handling will be rechecked no later than 30 days after receipt of client documents. The findings related to the rechecking are documented by the auditor in the relevant section of the Nonconformity report.

If during the audit the audit team decided that it is necessary to recheck the management of the major nonconformity at the location of the client's activity (premise, manufacturing site), EMKI-cert Kft will prepare a repeated audit plan for the on-site audit. The Managing Director or his / her designee appoints a suitably qualified member of the original audit team to carry out the additional audit. The auditor designated for rechecking sends the audit plan to the client within 30 days after client's indication of the nonconformity handling. If the objectives of the additional on-site audit are met, the audit team will follow the rules of normal audits (nonconformity handling, nonconformity management, etc.).

In the case of an initial audit a certification decision can only be made after all major nonconformities have been handled. The submission of an action plan alone is not enough to make a certification decision. The certification decision must be made within 6 months after the on-site audit, which must be taken into account by the client and the certification body when handling nonconformities.

A major nonconformity found during the on-site audit can be fully closed if the actual actions have been taken by the client have been properly documented and objectively verified to the certification body and the lead auditor or the auditor who found the nonconformity has verified the acceptance of the corrective action by the certification body.

Corrective action must be taken by the customer within the specified deadline in the event of a nonconformity. The lead auditor will check the adequacy of the root analysis performed by the client and the corrective action taken at the following on-site audit. The relevant provision is recorded by the lead auditor in the appropriate section of "Nonconformity Report".

The audit results in an audit report that provides information on the adequacy and effectiveness of the client's management system, provides evidence that the client's management system meets the applicable requirements and is capable of achieving the expected results. It includes client evidence obtained from internal audits and management reviews to verify, maintain, and improve system functionality. The audit report includes conclusions on the adequacy of the scope of the certification and confirmation that the objectives of the audit have been achieved.

After the completion of the audit documents, a certification decision will be made.

The certification decision to close the certification process can be as follows:
a) granting the certification,
b) refusal of certification,
c) extending or reducing the scope of certification,
d) renewal of certification,
e) suspension of certification,
f) reinstatement of the suspension of certification,
(g) withdrawal of certification.

In the case of initial certification decision a) or b) may be taken. In the case of renewal certification decisions (b), (c) and (d) may be taken. If justified the decision maker may decide in accordance with points (e), (f) and (g) during the certification cycle. The certification decision can be made by a designated person. During the certification decision the decision maker must check the audit folder reviewed during the decision preparation and the relationship between the Request for Quotation form submitted to EMKI-cert Kft. and the data content of the concluded contract with the client's experience. The decision maker must confirm that the on-site audit conducted by the audit team has achieved the audit objectives. The decision maker must also analyze the lead auditor's recommendation for certification and the conditions or comments on certification that may be included in the recommendation. The decision maker must check that the identified nonconformities in Stage 1 or 2 of the audit have been dealt with in accordance with the relevant regulations and that the deadline has not exceeded 6 months from the first day of the on-site audit. If the deadline for correction actions has exceeded the permitted time interval the decision-maker provides for a repeat of Stage 2 of the audit.

In the case of renewal certification, in addition to the above, the decision maker must review the reports (audit reports) during the system certification cycle, and any complaints from users.

If the decision is positive after the initial/renewal audit, EMKI-cert Kft. will issue a certificate to the client. In the event that a multi-site client requires a separate certificate at one of its premises, according to IAF MD 1 document 7.8.3 point, the certification body ensures that the main certificate and the certificate relating to the site are linked together and they have the same expiry date. As a general rule each certificate is issued in duplicate, one for the client and one for the certification body. If the client requests more than one copy of the same certificate, EMKI-cert Kft. treats each additional copy as a duplicate.

If EMKI-cert Kft. is convinced that the client's management system complies with the relevant standard requirements, it maintains the certificate. EMKI-cert Kft. certifies compliance with the requirements in the framework of surveillance on-site audits at the client. At the end of the certification cycle the certification can be renewed at the request of the client.

During the surveillance audits, a partial review of the management system is sufficient, but the surveillance audit must cover at least the following areas:
- management system for the planned and efficient operation of the client in accordance with the objectives,
- control of internal audits and management reviews
- to review of the previous audit nonconformities and the correction actions taken to deal with the nonconformities,
- handling complaints,
- continuous improvement activities,
- continuous monitoring of operation,
- to review changes
- the use of certification marks and other references related to certification status.

If the lead auditor has found a nonconformity during the surveillance audit that may rise the need to suspend or withdraw the issued certificate, the lead auditor provides the relevant audit evidence or the available documents to the competent decision maker. The decision maker reviews the findings of the lead auditor and decides on the maintain, suspension, or withdrawal of the certificate.

A renewal audit must be initiated by the client before the end of the certification cycle during the validity of the certificate. The objective of the renewal audit is to confirm that the client's management system continuously meets the requirements in the field of application of the certification. The renewal audit must review the compliance with the relevant requirements of the management system standard and other areas regulated by law.

The expiry date of a certificate issued during a renewal audit is based on the date on the renewed certificate, and the date of issue is adjusted accordingly. If-for reasons attributable to the client-the renewal audit has not been completed before the expiry date of the previous certificate or the re-checking of the correction actions taken to handle major nonconformities has not been completed, renewal of the certification can not be recommended.

An expired certificate can be restored if
- less than 6 months have elapsed since expiry date, and
- the recertification activity has been completed in all respects, a certification decision has been made.

If 6 months are not enough to complete the certification activity in the case of an expired certificate, a new Stage 2 is required.

In case of renewal of an expired certificate, the date of issue of the certificate must be the same as or later than the certification decision, the validity (expiration) period is based on the previous certification cycle.

Deadlines for certification

 

Special audits

EMKI-cert Kft conducts a special audit in the event that the client expands the scope of application of the management system within the certification cycle or this becomes necessary in connection with an extraordinary event.

In the event of an extension of the certification scope, the special audit may also be linked to the surveillance audit.

Due to an extraordinary event, an audit must be conducted within 30 days in accordance with the relevant provisions of the certification contract concluded between the client and EMKI-cert Kft.

An extraordinary event can be:
- investigating the client's complaint to the certification body,
- a significant change at the client,
- control related to the withdrawal of suspended certification.

The audit plan for the special audit only covers the control of problem areas. Since the client cannot object to the identity of the auditors designated for special audit, EMKI-cert Kft. takes into account the requirements for competence requirements and the client's previous comments on the impartiality of each auditor/expert when compiling the audit team.

 

Rules on suspension and withdrawal of certificates

 

If the certification body has reasonable doubt about the client's management system or the adequacy of the production, the client's certification must be reviewed and, if necessary, suspended or, in a particularly serious situation where patient safety is at risk, withdrawn, in accordance with the applicable regulations.

Suspension: temporary invalidation of the certificate for the scope of the certificate or part of it.
Withdrawal: invalidation of the certificate.

During the certification procedure, EMKI-cert Ltd. checks the client's compliance with the standard requirements and other, e.g. legal requirements, and that the certification mark specified by the certification body has been used.
If the certification body finds any nonconformity from the above requirements at any point, it will issue and deliver a nonconformity report to the client during the audit. The client is obliged to manage the nonconformity and to send the documents proving the management of the nonconformity to EMKI-cert Ltd. If the client fails to manage the nonconformity, the certification body shall act in accordance with its internal rules and the relevant clauses of the certification contract with the client. If the client does not correct the nonconformity detected, the certification body may decide to suspend or withdraw the certificate. The certification body's right to do so is specified in the certification contract.

If the lead auditor has identified a nonconformity during the surveillance audit that may require the certification body to suspend or withdraw the issued certificate, the lead auditor shall provide the audit evidence or available documentation to the decision maker or a competent person designated by the decision maker, who shall review the lead auditor's findings and decide on the sustainability, suspension or withdrawal of the certificate. In the case of a multi-site audit, a decision shall also be made as to whether the action (suspension, withdrawal) affects the site (scope limitation) affected by the nonconformity or the entire quality management system.    

If the surveillance audit is not carried out by the due date of the year and the client has not requested a change of the deadline, the issued certificate will be suspended by EMKI-cert Ltd. and the client will be informed in writing. The certification body is obliged to initiate the withdrawal of the certificate if it does not carry out a successful special audit at the client's premises within 6 months of the suspension (by special agreement, at the client's request).

If the certificate is withdrawn and EMKI-cert Ltd. does not issue a new certificate, EMKI-cert Ltd. will notify the client of the termination of the contract.
In case of suspension of a certificate, the certification contract is valid either until the expiry date of the original certificate or until the certificate is withdrawn.

Withdrawn or suspended certificates may not be used by the client as if they were valid certificates!