Edition 3.1 of IEC 60601-1 ensures “basic safety and essential performance” of medical electrical equipment. It is used by medical device regulators but also recognized by some other regulatory authorities as a regulatory instrument for gauging electrical safety approval.

From the perspective of compliance, IEC 60601-1 is considered one of the costliest standards that has ever been published. Older versions of the standard were expensive, costing $10,000 to $20,000 for relatively low-risk products to get certified. The newer versions doubled and even quadrupled some of those costs. The costs of compliance with edition 3.2 of the standard is likely to create significant challenges for manufacturers of medical devices powered by electricity, but not all countries require it. Some countries have more than one authority that applies it differently and have different allowances for adopting or keeping superseded versions of IEC 60601-1.

Though no transition is yet announced for the withdrawal of IEC 60601-1, edition 3.1, preparations need to get underway to address the impact of edition 3.2 to determine which countries will recognize it and how to stage compliance, especially as it will likely be used to support the new European Medical Device Regulation in Europe, which in May 2024 should fully replace the older Medical Device Directive.

Recognition in Europe

The European Commission has not yet adopted edition 3.2. CENELEC, the EU’s Competent Body, will be expected to harmonize it with the new EU Medical Device Regulation’s General Safety and Performance Requirements (GSPR). Harmonization would be expected before May 27, 2024, but the European Commission has the power to support ongoing recognition of the older and newer standard if it chooses. Manufacturers should prepare for a 2024 transition for CE marking for both their older and newer devices, and make sure that edition 3.1 is still listed as recognized for giving a “presumption of conformity” with the legal requirements for continued CE marking of their medical devices.

Addressing newer risk management, software, and other standards

Edition 3.2 includes references to the newer ISO 14971:2019: “Medical devices—Application of risk management to medical devices,” as well as the newer version of IEC 62304: “Medical device software—Software life cycle processes.” The risk management component was responsible for a dramatic shift in the way medical devices were to be evaluated at the testing labs, as well as a $20,000 higher price tag on testing. This is one reason the Occupational Health and Safety Administration (OSHA) sustained recognition for an older UL 60601-1 first edition, which does not require a risk management file to be submitted.

Certification by nationally recognized testing labs (NRTL)

OSHA does not recognize the edition 3.2 standard yet. OSHA usually relies on a U.S. version to be published beforehand; for example, a version of edition 3.1 was created by the American Advancement for Medical Instrumentation (AAMI). It is expected that AAMI will create a U.S. version of edition 3.2 and then approach OSHA to have the agency recognize it. OSHA, however, has demonstrated a willingness to recognize older versions, even while standards development organizations, such as IEC, AAMI, CSA, and ISO, follow through on their own “dates of withdrawal.”

OSHA does not have to withdraw the older standard

The Dental Trade Alliance was involved in providing reasons for OSHA to keep recognition of the older standard—UL 60601-1, edition 1—back in 2010. OSHA has a basic need for electrical equipment, and the older standard had proven itself. This sustained recognition allowed many companies to keep their existing OSHA-approval marks without having to retest their products.

Canadian electrical approval

Canadian standards developer CSA Group is expected to prepare a Canadian “CAN/CSA” version of edition 3.2. The Canadian Electrical Code requires a certification mark to the CSA versions of the IEC versions of standards like IEC 60601-1. Canadian electrical approval is represented by a small “C” near the certification mark of the testing lab. CSA usually publishes its version within two years of the IEC publication.

Unlike OSHA, the Standards Council of Canada (SCC, which is Canada’s accreditation body) and provincial electrical inspectors have not supported any superseded 60601-1 standard that CSA has withdrawn from recognition. It is therefore expected that by 2022, the CAN/CSA version will be published, and the NRTLs will require upgrades to edition 3.2 within three to five years. In many ways, Canada’s electrical code has been the strongest legal driver to force companies to retest to the newer IEC 60601-1 standard. Health Canada does not require existing licensed products to meet the latest product standards and does not require certification of medical devices. Although this standard is used only for basic electrical safety within the provincial electrical codes, the electrical inspectors did not consider the cost and complexity in the same way OSHA had before signing edition 3.0 and 3.1 into law.

Medical device regulators view on role of new standards

Already “licensed,” “cleared,” or “approved” medical devices do not normally require retesting to continue being placed on the market.

Regulatory authorities such as Health Canada and the U.S. Food and Drug Administration (FDA) gauge medical device safety and performance on much broader terms than meeting a single standard. They expect manufacturers to monitor complaints and determine what kinds of changes are needed. This view is supported by the regulatory authorities of the International Medical Device Regulators Forum (IMDRF), which have documented their current thinking as follows:

5.5  Status of Devices Designed using the Superseded Version of the Recognized Standard and Supplied before the end of the Transition Period

Where a medical device was designed according to the superseded version of the recognised standard to demonstrate conformity with one or more relevant Essential Principles and is either in the distribution chain or has been supplied to the end user before the end of the transition period, the manufacturer is not required to take any action unless there are safety implications, in which case the manufacturer should implement a risk mitigation strategy and take appropriate action to address these safety concerns.

Reference: GHTF/SG1 N044:2008—“Role of Standards in the Assessment of Medical Devices”

‘Significant changes’ and ‘critical components’

Testing labs have allowed legacy products that they have certified to continue using the older standards for a generous amount of time (five years), so long as the manufacturer does not change a part that is listed by them as a “critical component.” Many test reports list dozens of parts considered as critical components. If one of those items were to change on a product, after that standard has been withdrawn, there is a high likelihood of it being driven back for upgrade testing to meet the requirements of edition 3.2 before being allowed to add an alternate part to the list of critical components.

Brazil, the hardest nut to crack

Brazil requires recertification of electromedical devices to IEC 60601-1 every five years. This has presented the greatest challenge for sustaining access to the market of electromedical devices. When the 3.1 standard is withdrawn, retesting must be carried out using the newer version, even if there is no change to a critical component. The date of withdrawal of the 3.1 standard places a high risk of withdrawal of an electromedical device from Brazil’s legal status unless edition 3.2 requirements are met. If a five-year cycle of retesting is completed to 3.1, and that standard is withdrawn within a year, an evaluation by a testing lab in Brazil would force it right back for another review before the normal five-year cycle.

Transitioning to ‘state of the art’ standards?

Medical devices must meet “state of the art,” as required by the medical device regulations in Europe, and even by standards among other nations, such as the ASEAN MDD. However, to date, there is no standardized definition of “state of the art” that indicates a manufacturer must use the “latest standards.” Even so, much debate has occurred about this subjective contradiction. The European Commission states that IEC standards such as IEC 60601-1 are voluntary, so how can they be enforced as mandatory? Can a company really lose its certification to a public law for not meeting a standard created by private standards-development organizations?

The new ISO 14971:2019, which is now referenced in IEC 60601-1, edition 3.2, defines “state of the art” but does not mention “latest standards.” In fact, the definition has a Note 1 that state of the art “does not necessarily imply the most technologically advanced solution….” So do companies have to meet the latest standard to meet the regulatory requirement for state of the art?

It is a commonly held belief that when a standard is withdrawn from recognition, it can no longer be used. That view can be taken too far to mean the latest standards alone must always be used. Such statements do not reflect the view of most medical device regulators, which have documented their position.

The statement below has been sustained by two of the largest organizations of medical device regulators in the world, the Global Harmonization Working Party and International Medical Device Regulators Forum, which include regulators from every continent:

5.4 Use of Recognised Standards when Designing and Supplying Medical Devices both during and after the Transition Period

During the transition period both the prior and the revised version of the recognised standard give presumption of conformity with the Essential Principles, consequently either may be used when designing or supplying medical devices to the end user.

After the transition period, only the revised version of the recognised standard gives presumption of conformity with relevant Essential Principles. However, manufacturers may choose to use the superseded version of the recognized standard despite the loss of the presumption of conformity to the Essential Principles and may continue to design and/or supply medical devices to the end user according to the superseded standard. In such cases, in order to demonstrate that the medical device conforms to all relevant Essential Principles, the manufacturer is required to justify its decision to use the superseded standard through documented risk assessment, and take any risk mitigation action as appropriate.

The manufacturer’s decision may be subject to review by a RA/CAB.

Reference: GHTF/SG1/N044:2008

Planning to absorb the cost: Watch those product certifications!

Electromedical device manufacturers must look at regulatory systems that require product certification. Canada has two separate authorities that use IEC 60601-1 for regulatory purposes: the Canadian Electrical Code, which requires product certification; and Health Canada, which does not. Health Canada, like the FDA and the other regulator mentioned above, retains these standards for use as “nonmandatory text” (i.e., voluntary).

Regulations that require product certification (e.g., OSHA) are among the most important regulatory systems to watch.

CE certification using gap analysis to 3.2

CE certification in Europe is subject to Notified Body review. Some of these Notified Bodies are inclined to push manufacturers to perform a gap analysis to what they will often call a “state of the art standard,” sometimes within 12 months of publication. This is arguably unnecessary because the EU Commission makes it clear these standards are voluntary; manufacturers must resolve these concerns with their individual Notified Bodies. Some manufacturers may use a risk-based approach to prove their older standards are doing a great job at mitigating risks, which IEC 60601-1 was meant to help with.

Though testing labs are not required for doing a gap analysis, manufacturers may have a hard time locating consultants with sufficient expertise to do this kind of work. Edition 3.2 has a lot of little differences, and each will have to be itemized and considered while doing a gap analysis.

In the past, the IEC has published documents identifying all the differences between versions of standards. It is possible one may be published highlighting the differences between edition 3.1 and 3.2, and help manufacturers ease their way toward completing their own gap analysis.

The XXX thousand-dollar question

Many who make powered medical devices, even if they are only powered by a small alkaline battery, could be forced to spend $20,000 to $50,000 to meet the new standard, for each electromedical device they need to certify. A company with many products could easily spend hundreds of thousands of dollars on lab fees and months of engineering hours attempting to upgrade just one product to IEC 60601-1, edition 3.2. Though regulatory agencies such as OSHA, FDA, and Health Canada have all taken an approach that does not require upgrading to the latest standard, this is not the case where we have seen third-party product certifications required by Brazil, the Canadian Electrical Code, or gap analysis demanded by certain Notified Bodies issuing CE certificates.

Manufacturers must “plan for the worst and hope for the best.” IEC 60601-1, edition 3.2, will cause manufacturers to abandon selling medical devices to countries that cannot compensate them well enough for the cost of retesting to edition 3.2. This is especially true of smaller medical device companies. Overcrowding at testing labs is expected near dates of withdrawal.

Pay closest attention to dates of withdrawal of a recognized standard. OSHA lists the standards it recognizes, as does the European Commission’s Official Journal. It is important to know what the regulatory authority is planning to withdraw and when. Product certification and testing costs are often the hardest line and most expensive technical barriers to trade.

Regulators have made the case that it’s OK to keep “oldies but goodies,” and I don’t mean old recordings of Bachman-Turner Overdrive. Standards that have proven themselves on existing products over decades deserve to be recognized. Older and proven medical device are not just good for the public health; they also can help small companies stay regulatory compliant while still “Taking Care of Business.”