Therapeutic Goods (Conformity Assessment Standard for Quality Management Systems) Order 2019

Conformity assessment standard: A standard that, once designated under section 41DC of the Therapeutic Goods Act, can be used to satisfy parts of the conformity assessment procedures required for medical devices. The concept here is narrower than a simple technical standard: it is a standard that the Minister (or delegate) declares to be a conformity assessment standard for a particular quality management system and for particular procedures. The instrument defines "standard" itself to mean a standard published by ISO, as in force or existing immediately before the commencement of this order (31 March 2019). That date locks the version of each referenced standard. The order does not incorporate future amendments unless a new order is made.

Quality management system: The organisational structure, responsibilities, procedures, processes and resources for implementing quality management, as required under Parts 1, 4 and 5 of Schedule 3 to the Regulations. Part 1 concerns full quality assurance including design, Part 4 concerns production quality assurance (excluding design), and Part 5 concerns product quality assurance (excluding design and process validation). The order links each part of Schedule 3 to a particular scope of compliance with ISO 13485:2016.

Deemed compliance: The mechanism in subsections 5(3) and 6(3) whereby a manufacturer that complies with a designated standard is automatically taken to have applied the listed conformity assessment procedures. This is a regulatory shortcut: it avoids the need for the manufacturer to undergo the full procedure as defined in the Regulations, provided it can demonstrate compliance with the standard. However, this deeming is not absolute immunity from further regulatory action; the Secretary can still request evidence that the standard is being applied and maintained.

Kinds of medical devices: The order applies to the "kind" of medical device, a term defined in section 3(1) of the Act. It means a category of device established by the manufacturer having the same design, manufacturing process, and intended purpose. The order does not carve out by risk classification; it applies across all classes. But the scope of deemed compliance is limited to the quality management system components listed in the schedules, not the entire conformity assessment procedure.

Sterile state: For section 6, the device must be intended by the manufacturer to be supplied in a sterile state. This is the manufacturer's own intention, not a regulatory classification. The term "supplied in a sterile state" is not further defined in this instrument, but derives from the Act and Regulations. Manufacturers must have a sterilization process validated and controlled, and the sterile barrier system must be maintained. The order lists specific sterilization-related ISO standards in Schedule 2, covering ethylene oxide, radiation, aseptic processing, liquid chemical sterilants, moist heat, dry heat, low-temperature steam and formaldehyde, packaging, and microbial risk control for cell-based products. Each standard is tied to a specific purpose, and compliance is treated as meeting the quality management system procedures for sterility assurance under Parts 1 and 4 of Schedule 3 to the Regulations.

The order directly affects manufacturers of medical devices who seek to rely on the deemed-compliance mechanism to satisfy the conformity assessment procedures under Parts 1, 4 and 5 of Schedule 3 to the Regulations. This includes manufacturers both in Australia and overseas who are required to conform to the Australian regulatory framework for supply of medical devices in Australia. Because the Therapeutic Goods Act applies to devices imported into Australia, foreign manufacturers who export devices to Australia are also affected, as they must have their quality management systems assessed against the designated standards (or undergo the full procedures directly).

Sponsors of medical devices in Australia (the entities who apply for inclusion in the Australian Register of Therapeutic Goods) are indirectly affected. A sponsor relies on a manufacturer's conformity assessment to support the application. If the manufacturer uses the deemed-compliance pathway under this order, the sponsor can reference that in the application. But the sponsor remains responsible for the accuracy of the information and for ensuring the manufacturer maintains its quality management system.

Conformity assessment bodies (CABs) that audit manufacturers against the designated ISO standards are also affected. The order gives regulatory force to audits performed against ISO 13485:2016 and the sterilization standards listed in Schedule 2. A manufacturer that holds a valid ISO 13485 certificate from an accredited CAB can argue it satisfies the quality management system requirements. However, the order does not by itself mandate that CABs must be accredited; that is a matter under the Regulations and the Act. In practice, the Therapeutic Goods Administration (TGA) maintains requirements for CAB recognition.

Small and medium-sized device manufacturers are particularly affected because adopting the ISO standards involves direct costs: purchasing the standards, implementing the quality management system, training staff, and obtaining external certification audits. The order does not reduce those costs; it merely allows manufacturers to substitute one form of evidence (the ISO certificate) for regulatory inspection. Larger manufacturers with existing ISO certification benefit from a reduced regulatory burden, as they can reuse their certification for Australian market access.

Manufacturers of devices intended to be supplied in a sterile state face an additional layer of obligations under section 6. They must not only have a quality management system compliant with ISO 13485:2016; they must also implement the specific sterilization standards listed in Schedule 2 appropriate to their sterilization method. For sterile device manufacturers, the order effectively creates two tiers of compliance: one for the general quality system (Schedule 1) and one for the sterilization-specific processes (Schedule 2). The deemed-compliance procedures under section 6 apply to both Part 1 and Part 4 procedures, meaning even if the manufacturer excludes design (Part 4), they still must meet the sterilization-related standards.

The order itself does not impose new duties on manufacturers. The duties to comply with conformity assessment procedures are sourced in the Therapeutic Goods Act and the Regulations. What the order provides is a right: a manufacturer has the right to have its quality management system, if it complies with a designated standard, be treated as having applied the corresponding conformity assessment procedures. This is a procedural right that reduces the manufacturer's evidentiary burden.

However, the order also imposes a de facto condition: the compliance must be with the specific version of the standard frozen at 31 March 2019. A manufacturer that implements a later edition of ISO 13485 or any of the sterilization standards cannot automatically rely on the deemed-compliance mechanism for that latter edition. The order would need to be amended to incorporate a newer version. This creates a compliance risk if a manufacturer updates to a newer standard without ensuring the TGA accepts it as equivalent.

The order also implicitly puts the onus on the manufacturer to correctly select which standard and which exclusion applies. For example, Schedule 1 item 2 excludes clause 7.3 (Design and Development). A manufacturer that is responsible for the design of the device cannot use that item; it must use item 1 (full standard) or item 3 (if it also excludes process validation depending on the part). The manufacturer must therefore determine which Part of Schedule 3 to the Regulations applies to its device and then choose the corresponding standard scope. Making the wrong selection may result in the deemed-compliance not being available, potentially leading to a finding that the conformity assessment procedures have not been applied, which could jeopardise the application for inclusion on the Register.

There is no right to elect not to apply the standard; the order is permissive. A manufacturer can always choose to have the full conformity assessment procedures applied directly by a conformity assessment body or the TGA, without using the deemed-compliance shortcut. But doing so may be more resource intensive and time consuming.

For sterile device manufacturers, the duty to validate sterilization processes remains substantive. The order merely provides that compliance with the relevant ISO standards is treated as meeting subparagraphs 1.4(5)(d)(i) and 4.4(5)(c)(i) of Schedule 3 to the Regulations. Those subparagraphs deal with requirements for sterile devices. The manufacturer must still actually perform the validation, routine control, and packaging activities described in the standards. The order does not exempt the manufacturer from having a valid sterilization process; it only recognises the standard as the method for demonstrating compliance.

The order itself contains no penalty provisions. It is a legislative instrument that defines the scope of deemed compliance; enforcement occurs under the broader framework of the Therapeutic Goods Act 1989. If a manufacturer claims compliance with a designated standard but does not in fact maintain a quality management system meeting that standard, that false claim could attract penalties under the Act, such as for making a false or misleading statement in relation to a conformity assessment procedure (section 41M of the Act). Additionally, if a device is supplied without proper conformity assessment, civil or criminal penalties could apply under Part 4A of the Act.

The order does not give the regulator any new powers of inspection, audit, or seizure. Those powers are found in the Act (such as the Secretary's power to request information or to conduct audits). However, the order does affect enforcement indirectly. If the TGA audits a manufacturer and finds that its quality management system does not comply with the designated standard, the TGA can conclude that the conformity assessment procedures have not been properly applied. This could lead to suspension or cancellation of the device's inclusion in the Register, or direction to recall the device.

The order also has implications for enforcement against conformity assessment bodies. If a CAB certifies a manufacturer against ISO 13485:2016 but the certification is not valid (e.g., the CAB failed to audit properly), the manufacturer's reliance on deemed-compliance may be undermined. But the order does not address CAB obligations; those are in the Regulations and the Act. The TGA can recognise or withdraw recognition of CABs.

A key enforcement vulnerability is the version lock. If the TGA later decides that a newer version of an ISO standard is necessary for safety, it cannot enforce that newer version under this order because the order incorporates only the version at commencement. The TGA would need to make a new order. In the interim, a manufacturer could continue to use the older standard (the designated version) and still be deemed compliant, even if the TGA considers the older version outdated. Conversely, a manufacturer that updates to a newer standard may lose deemed-compliance unless the TGA accepts it by other means. This creates a potential enforcement gap or a source of dispute.

This order is a legislative instrument made under subsection 41DC(1) of the Therapeutic Goods Act 1989. It operates within the regulatory framework comprising the Act and the Therapeutic Goods (Medical Devices) Regulations 2002. Specifically, it links to Parts 1, 4 and 5 of Schedule 3 to the Regulations, which describe the conformity assessment procedures for quality management systems. The order does not override or replace those procedures; it merely provides an alternative method to satisfy them by compliance with designated standards.

The order also interacts with the Therapeutic Goods (Medical Devices) Standard for Sterile Medical Devices and Certain Other Medical Devices if such a standard exists, though the source does not mention one. More directly, the order interacts with the TGA's recognition of conformity assessment bodies. The order does not specify that the manufacturer's compliance must be certified by an accredited body; it only says a quality management system that "complies with a standard" is treated as having applied the procedures. However, in practice, demonstrating compliance often requires third-party certification, and the TGA's administrative guidance typically requires certification by a body recognised under the Regulations. The order is silent on this point, leaving it to the general law.

The order replaces the Conformity Assessment Standards Order (Standard for Quality Management Systems and Quality Assurance Techniques) 2008, which it repeals in full in Schedule 3. That earlier instrument likely referenced earlier versions of ISO standards. Thus, for manufacturers that had been relying on the 2008 order, their quality management system must now comply with the version of the standards designated in the 2019 order. If a manufacturer had a system certified to the earlier version of ISO 13485 (e.g., ISO 13485:2003), that certification is no longer automatically accepted as a conformity assessment standard under this order. The manufacturer must either upgrade to ISO 13485:2016 or undergo the full conformity assessment procedures directly.

The order does not interact directly with state or territory laws, because the therapeutic goods regime is largely Commonwealth under the constitutional corporations power and the external affairs power. State laws on health, product liability, and occupational health and safety may apply concurrently but are not addressed by this order. The order also does not interact with international mutual recognition agreements; those are handled by separate provisions of the Act.

The order uses definitions from the Act (section 3(1) definitions of "conformity assessment procedures", "kind", "manufacturer", "medical device"). It also uses terms from the Regulations such as "quality management system" as referenced in Schedule 3. The interpretation of these terms in the order is therefore tied to the Act and Regulations as amended from time to time. If the Act or Regulations are amended to change the definition of those terms, the application of this order may shift without amendment to the order itself.

This order was made on 26 March 2019 and commenced on 31 March 2019. As shown by the commencement table in section 2, the whole instrument commenced on that date. The order repealed the earlier 2008 conformity assessment order (Conformity Assessment Standards Order (Standard for Quality Management Systems and Quality Assurance Techniques) 2008) in its entirety. The source text provided does not record any subsequent amendments to this 2019 order. However, it is possible that later amending instruments have been made but are not reflected in the version provided. The note to the commencement table says it "will not be amended to deal with any later amendments of this instrument", meaning the table is frozen at original commencement. The user's source may be the version as originally made. Therefore, the amendment history based solely on this source is limited to its creation and the repeal it effects. No amending orders are listed.

The order was made by Miranda Lauman, as delegate of the Minister for Health, under section 41DC of the Act. That section authorises the Minister to, by legislative instrument, determine that a specified standard is a conformity assessment standard for a particular kind of conformity assessment procedure. The 2019 order replaces the 2008 order, updating the referenced ISO standards from earlier versions to ISO 13485:2016 (the 2008 order likely referenced ISO 13485:2003 or ISO 13488, and possibly the earlier sterilization standards). The repeal in Schedule 3 is explicit: the whole of the Conformity Assessment Standards Order (Standard for Quality Management Systems and Quality Assurance Techniques) 2008 is repealed. There is no apparent transitional or saving provision in the order to allow continued reliance on the old standards for existing certifications. Manufacturers that had already been assessed under the 2008 order would need to transition to the new order to continue to get deemed-compliance benefits, unless the TGA provided administrative arrangements.

The order does not contain any amendment to the Act or Regulations; it is a standalone instrument. It does not amend any other legislative instrument. Its status as a legislative instrument means it is subject to disallowance by either House of the Parliament under the Legislation Act 2003. The source does not indicate whether disallowance motions occurred. There is no mention of sunsetting; the order would likely be subject to the usual 10-year sunsetting under the Legislation Act unless specifically exempted. That sunset would occur around 2029.

The source text does not reference any court or tribunal decisions concerning this order. The order is a legislative instrument that is rarely the subject of direct litigation; challenges are more likely to involve the underlying Act or the decisions of the TGA in applying or denying the deemed-compliance effect. It is possible that a manufacturer or sponsor has sought judicial review of a TGA decision relating to refusal to accept a quality management system as compliant with a designated standard, but no such cases are recorded in the source. The order itself is only four sections and three schedules; its operative provisions are straightforward mappings of standards to procedures, leaving little room for interpretive disputes that would reach court.

Nevertheless, potential grounds for litigation include: (1) whether a manufacturer's quality management system actually complies with the designated standard (a question of fact and expert evidence); (2) whether the manufacturer's intended use of a sterilization standard falls within the "purpose" specified in column 3 of Schedule 2; (3) whether an exclusion of clause 7.3 or 7.5.6 is properly applied; (4) whether the version of the standard that the manufacturer used is the version "as in force or existing immediately before the commencement of this instrument", given that ISO standards may be issued in consolidated or amended versions; (5) whether the TGA correctly determined that a standard no longer met the regulatory requirements, given the version lock.

Challenges could also arise under administrative law, such as in the Federal Court or the Administrative Appeals Tribunal, against a decision by the TGA to reject an application for inclusion on the Register on the basis that the manufacturer's quality management system was not in compliance with a designated standard. However, because the order does not confer a right to automatic inclusion, the outcome of such a challenge would depend on the TGA's assessment of the evidence and the proper construction of the order. Without a specific case in the source, the litigation history is a blank slate. The order does not appear to have been amended in response to litigation, further supporting the absence of noted challenges.

The most significant trap is the version lock for standards. The definition in section 4 states that "standard means a standard published by the ISO, as in force or existing immediately before the commencement of this instrument." That means the instruments incorporated are frozen at 31 March 2019. If ISO releases a new edition of ISO 13485 or any of the sterilization standards after that date, the new edition is not automatically a conformity assessment standard under this order. A manufacturer that updates its quality management system to the new edition cannot rely on the deemed-compliance mechanism unless the TGA accepts it by other means (e.g., by issuing a new order). Conversely, a manufacturer that retains the 2016 edition of ISO 13485 can still claim deemed-compliance even if the TGA considers the 2019 edition superior. This creates a perverse incentive against upgrading to newer standards.

The definitions also contain a note that standards are published by ISO at a specific URL. However, the note is not part of the instrument (see paragraph 13(2)(a) of the Legislation Act 2003). The official versions of the standards are not reproduced in the order. A manufacturer must purchase the standards from ISO. That imposes a direct cost and creates a risk that the manufacturer does not have access to the precise version required. The order does not provide a mechanism for the TGA to make extracts available.

The exclusions in Schedule 1 items 2 and 3 allow a manufacturer to use a reduced scope of ISO 13485 (excluding design, or excluding design and process validation). But these exclusions correspond to particular conformity assessment procedures. If a manufacturer uses item 2 (excluding design) but in fact the manufacturer is responsible for the design of the device, the deemed-compliance may not apply. The manufacturer must know which Part of Schedule 3 to the Regulations applies to its device. This is not always straightforward, especially for innovative devices where the classification may be borderline. The order provides no guidance on how to determine which part applies.

For sterile devices, section 6 only applies to Parts 1 and 4 of Schedule 3, not Part 5. A manufacturer that seeks to rely on Part 5 (product quality assurance, excluding design and process validation) cannot use section 6 for sterilization requirements. That seems to mean that a manufacturer using Part 5 must have its sterilization procedures assessed directly, not via deemed compliance with the ISO standards. That limitation may be a trap for those who assume the order covers all parts.

Another subtlety: section 6 uses the phrase "when used for a purpose mentioned in column 3 of that item". The column 3 purposes are often broad descriptions like "for use in the validation and routine control of ethylene oxide sterilization processes". The manufacturer must ensure that its use of the standard matches that purpose. For example, item 5 (ISO 14937:2009) is for sterilization processes "not mentioned in any of the standards specified in items 1 to 4". If a manufacturer uses ISO 14937 for a process that is in fact covered by one of the other standards, the deemed-compliance may not apply. The order does not explain how to determine which standard is "mentioned" with priority.

Finally, the order repeals the 2008 order without any transitional provision. Manufacturers that had certification under the 2008 order lose the ability to rely on it after 31 March 2019 unless they transition to the new order. The TGA may have issued guidance on transition periods, but the order itself does not grant any grace period. A manufacturer caught unaware could find its deemed-compliance no longer available.

Compliance with this order is voluntary in the sense that a manufacturer can always choose the full conformity assessment route. But for those wishing to use the deemed-compliance shortcut, the steps are as follows.

First, determine which Part of Schedule 3 to the Regulations applies to the kind of medical device. If the manufacturer is responsible for design, Part 1 (clause 1.4) applies. If the manufacturer is not responsible for design but performs production, Part 4 (clause 4.4) applies. If the manufacturer is not responsible for design and the device is produced using standardised processes that do not require validation of production and service provision, Part 5 (clause 5.4) may apply. This determination is critical because it dictates which schedule item the manufacturer can use for deemed compliance.

Second, implement a quality management system that complies with ISO 13485:2016 (Medical devices , Quality management systems , Requirements for regulatory purposes). For Part 1 devices (full design and development), use the full standard as per Schedule 1 item 1. For Part 4 devices (production only), the quality management system must comply with ISO 13485:2016 other than clause 7.3 (Design and Development) as per Schedule 1 item 2. For Part 5 devices, the system must comply with the standard other than clause 7.3 and clause 7.5.6 (Validation of processes for production and service provision) as per Schedule 1 item 3. The manufacturer should ensure its quality manual documents the exclusions and justifies them based on its responsibilities.

Third, if the device is intended to be supplied in a sterile state, additional steps under section 6 apply. The manufacturer must identify the sterilization method(s) used and select the corresponding standard(s) from Schedule 2. For each applicable item, the manufacturer must implement the listed standards for the stated purpose. For example, a manufacturer using ethylene oxide sterilization must comply with both ISO 11135:2014 and Amendment 1:2018. The quality management system must address the sterilization process as specified, and the manufacturer should maintain records of validation, routine control, and release. Compliance with these standards is treated as meeting subparagraphs 1.4(5)(d)(i) and 4.4(5)(c)(i) of Schedule 3 to the Regulations (sterile device procedures for Parts 1 and 4). Note that Part 5 is not covered by section 6, so sterile device manufacturers using Part 5 must have those procedures assessed directly.

Fourth, demonstrate compliance. The order does not require third-party certification, but in practice the TGA expects manufacturers to hold certification from a recognised conformity assessment body. The manufacturer should engage a CAB accredited for medical devices quality management systems and the relevant sterilization standards. The CAB will audit the manufacturer against the designated standards. Upon successful certification, the manufacturer holds evidence of compliance. However, the certification alone is not a guarantee; the manufacturer must continue to maintain the system and address any non-conformities.

Fifth, in applications for inclusion in the Australian Register of Therapeutic Goods, the sponsor should reference the order and the associated standards to indicate that the conformity assessment procedures have been applied via deemed compliance. The TGA may request copies of the certification, audit reports, or documentation showing the scope of the quality management system. The manufacturer should keep all records for the retention periods required by the Act.

Sixth, be aware of the version lock. The manufacturer must ensure it is using the exact version of the standard that was in force at 31 March 2019. If the manufacturer has been certified against a later edition, it should check with the TGA whether that certification is accepted as equivalent. This may require obtaining supplementary evidence or an additional audit against the 2016 edition. A manufacturer that upgrades to a later edition should not assume the deemed-compliance pathway remains open.

Finally, monitor the Federal Register of Legislation for any new conformity assessment orders that might supersede or amend this order. If a new order is made that designates a later version of the standards, the manufacturer should transition to the new designated version within any transition period specified. Failure to do so could result in loss of deemed-compliance status.