Certification Contract

Medical Device Quality Management SystemImplementRules

ID:SJC-TP-033

Version:A/2

Prepared by:Planning Team

ApproveXu Wenlu

2025Year08Month08Published on  2025Year08Month08Daily Implementation

Zhejiang Sanjing Testing and Certification Co., Ltd. Publish

Edit Book shoe calendar

Goal Record

1. Applicable Scope

2. Certification Basis

3. Basic Requirements for Certified Personnel

4. Initial Certification Program

5. Surveillance Audit Procedure

6. Reauthentication Process

7. Suspend or revoke certification

8. Certification Requirements

9. Integrated audit with other services and management systems

10. Accept Conversion Certification

11. Accept the organization's appeal

12. Manage authentication records

13. Other

1 Applicable Scope

1.1 This rule governs the medical device quality management system certification activities conducted by Zhejiang Sanjing Testing and Certification Co., Ltd. (hereinafter referred to as "the Organization") within China in accordance with relevant standards.

1.2 This rule is based on relevant laws and regulations on certification and accreditation, combined with applicable technical standards, to establish a quality management system for medical devices.Specifically define the certification implementation process, clarify this organization's management responsibilities for the certification process, and ensure medical device quality.Standardize and ensure the effectiveness of quality management system certification activities.

1.3 This rule sets forth the basic requirements for this organization's medical device quality management system certification activities. All certification personnel must comply with these rules during such activities.

1.4 This rule covers the following certificate types: Medical Device Quality Management System Certification

2 Authentication Basis

GB/T 27021.1 "Conformity assessment — Requirements for bodies auditing and certifying management systems"》

GB/T 42061-2022 Medical devices — Quality management systems — Requirements for regulatory purposes

Basic requirements for 3 certified personnel

3.1 reviewers shall have CCAA Register as an auditor.

3.2 Certified personnel must undergo GB/T 42061-2022/ISO 13485:2016《Medical Devices — Quality Management Systems — Requirements for Regulatory Purposestraining; reviewers must be assessed and deemed capable of managing the enterprise's medical device quality management system.

3.2 Certifiers must comply with applicable laws and regulations and bear legal responsibility for the authenticity of certification activities, related records, and audit reports.

4Initial Certification Program

4.1 Process Certification Application

4.1.1 The organization applying for certification can obtain the following information directly from this institution's website or through appropriate channels:

a. Scope of certification activities and status of accreditation;

b. Full terms of this policy;

c. Certificate format;

d. Procedures for appealing or filing complaints regarding the authentication process;

e. Application forms, certification contracts, and other template documents.

4.1.2 The application and the applying organization must submit at least the following documents:

Fill in the Application for Certification by the Applicant:Certification Application Form》, and submit the required application materials in accordance with the attachment requirements.Includes, but is not limited to:

a. Copy of valid business license;

b. Current and effective medical device quality management system documents and document list;

c. Valid licenses and permits required by national regulations, such as service, health, or business operation licenses;

d. Laws, regulations, standards, and technical specifications related to business operations (international, national, local, industry) list (suitable for inclusion in medical device quality management system documentation, such as the Quality Manual);

e.Organizational Chart (suitable for inclusion in medical device quality management system documents, such as the Quality Manual);

f.Description of Key Business Processes (suitable for inclusion in medical device quality management system documentation, such as the Quality Manual).

4.2 Submit for Review

4.2.1 Review Requirements

This institution reviews the application materials submitted by the applicant organization based on the scope of certified activities and premises, as well as personnel.The number of workers, the time required to complete reviews, and other factors affecting certification activities are collectively considered to determine whether we have the capacity to accept certification. Apply

Ordered to suspend business by law enforcement or regulatory authorities, or listed as "serious violator" in the National Enterprise Credit Information Publicity SystemFor applications submitted by the "List of Chinese Enterprises," this institution will not accept their certification requests.

Review criteria include, but are not limited to:

a. Assess the sufficiency of the organization's basic information and service-related details, understand its characteristics, verify the legality of its legal status, and validate the authenticity and validity of the provided information via public websites when necessary.

b. Has the applying organization received all information regarding certification requirements and agreed to comply? Have any discrepancies in understanding been resolved? A preliminary scope of acceptability has been determined.

c. Does the organization's competence meet the requirements for audit implementation, including the competency of certification auditors and certification decision-makers?

For certification projects determined to be non-acceptible after review, this organization will5 Notify the applicant of the daily certification request. For non-acceptanceApplications that are withdrawn or rejected shall be archived and preserved in a confidential manner.

4.2.2 Sign Certification Agreement

After accepting the application, this organization will enter into a legally binding written certification agreement with the applicant. The agreement shall include the following:

a. Commitment by the applying organization to maintain an effective management system and standardized control levels following certification.

b. Commitment by the application organization to comply with relevant laws and regulations on certification and accreditation, assist regulatory authorities in supervision and inspection, and truthfully provide relevant materials and information regarding inquiries and investigations.

c. The certified organization shall promptly notify this institution if any of the following occurs after certification:

① Major complaints from customers and stakeholders.

(2) The products or services provided are deemed non-compliant by the market regulation authority.

③ A major incident related to its products or services has occurred.

4. Major changes to the management system and key processes, including: legal status; operational or organizational status; ownership changes; acquired regulatory licenses; changes to legal representative or top management; relocation of business premises; and changes to the scope of activities covered by the management system.

5. Other significant issues affecting the operation of the management system.

d. The applying organization commits to using the certification certificate, certification mark, and related information correctly after obtaining certification.

e. Scope of the medical device quality management system certification to be conducted.

f. Responsibilities, rights, and obligations of this organization and the applicant organization during the certification audit process and throughout the validity period of the certification certificate.

g. Fees for certification services (calculation method per company documents), payment terms, and breach of contract provisions.

4.2.3 Review of changes to authentication information or requirements

When a certified organization applies to change its name, address, scope of certification, or certification requirements, it must complete the following form:Certified Organization Certification Information Confirmation Form，Submit the necessary supplementary information. Our institution will review the changes. Pay special attention to the sufficiency and legality of the application materials for changes. If, upon review, the application is deemed ineligible, prompt feedback will be provided.Reason for joining the organization.

4.3 Review Planning

4.3.1 Develop audit scheme

4.3.1.1 In accordance with the relevant documents of this institution, taking into account the organization's size, industry characteristics, and operational complexity, Develop an audit plan for the entire certification cycle based on the number of business premises, the verified effectiveness level of the medical device quality management system, and previous audit results. Adjust the original audit plan dynamically by incorporating feedback from each completed audit and any changes identified prior to the next audit.

4.3.1.2 To ensure the completeness and validity of the certification audit, this organization will proceed in accordance with the company's ZGC3106 Other Management System Audits Time Determination Standard, based on the number of effective personnel covered by the applicant's management system and considering the scope of service activities.Assess the complexity of features, technical difficulty, and risk levels to calculate and determine the required number of on-site audit person-days. In special cases, the number of audit person-days may be increased or decreased, provided there is a valid justification and proper documentation.

4.3.2 Form audit team

4.3.2.1 The organization will form the audit team by selecting auditors with relevant competence based on the activities covered by the management system. Technical experts may be included as needed.

4.3.2.2 Technical experts provide technical support for certification reviews but do not act as auditors or have their time counted toward audit duration. The activities of technical experts during the review process are the responsibility of the auditors in the audit team.

4.3.3 Audit Notification

After confirming the audit time and audit team,Audit Notification，Send to the review team.

4.3.4 Audit Plan

4.3.4.1 Upon receiving the audit notification, the audit team shall develop a written audit plan (including multi-site sampling plans) to establish a basis for reaching agreement among relevant parties on the arrangement and implementation of audit activities.

4.3.4.2 The audit plan includes the following: audit objectives, audit criteria, audit scope, dates and locations of on-site audits, duration of on-site audits, and audit team members.

4.3.4.3 To enable observation of service activities during on-site audits, schedule the audit while the services within the certification scope are operating normally.

4.3.4.4 Before the audit begins, the audit team shall submit the audit plan for confirmation by the applicant organization. In case of special circumstances requiring a temporary change to the plan, the applicant organization must be promptly notified, and mutual agreement reached on the changes.

4.4 Implement Audit

4.4.1 General Requirements

Medical device quality management system certification audits are divided into initial audits (document review + on-site audit), surveillance audits (first Once, second time), or recertification audit type, the audit team will complete the audit work according to the audit plan schedule. On-site The "site" under review refers to the primary location where activities within the scope of certification are carried out. In most cases, it is where the organization's personnel centralized location.

4.4.2 File Review

Document review will be completed prior to the on-site audit (does not count toward auditor days), in accordance with applicable standards and relevant laws and regulations.Require review of the applicant organization's management system documentation for conformity, suitability, and adequacy. During the audit, when... When nonconformities are identified that affect the operation of the management system, notify the applicant organization to take timely corrective action. to ensure the management system's control level meets standard requirements. If necessary, a document review may be conducted prior to the on-site audit to determine whether and when to schedule the on-site audit based on its results.

4.4.3 Opening and Closing Meetings

The audit team shall convene opening and closing meetings with the auditee in accordance with the established procedure, involving the auditee's top management.Representatives and personnel from functional departments related to the management system shall attend the meeting. Attendees must sign in, and the audit team shall maintain... Keep the sign-in sheets for the opening and closing meetings. Upon request by the auditee, audit team members shall present their identification documents to the applying organization.

4.4.4 Audit Method

4.4.4.1 On-site audit methods include:

a) Chat;

b) Consult reference materials;

c) On-site observation;

d) When feasible, conduct on-site testing or measurements.

4.4.4.2 The audit team conducts the review based on applicable standards.

4.4.5 Generate audit report.

4.4.5.1 After each audit, the audit team leader shall prepare the "Audit Report" based on relevant information identified during the on-site audit.Report," and is responsible for its content. Upon approval by the Technical Committee, it shall be issued to the certification applicant.

4.4.5.2 The report shall provide an accurate, concise, and clear record of the audit to support certification decisions. It shall include the following:

a) Customer name, address, and management representative;

b) Audit Type (e.g., initial certification, surveillance, or recertification audit)

c) Purpose, scope, and criteria of the audit;

d) Audit team members and audit schedule;

e) Statement of compliance with applicable certification requirements;

f) Time period covered by the report;

g) Non-conformance situations;

h) Audit conclusion.

4.5Corrective actions for nonconformities and verification of their results

4.5.1For non-conformities identified during the audit, the organization shall require the applicant to analyze the root cause and take corrective actions within Take corrective action within the specified timeframe.

4.5.2 The organization shall verify the effectiveness of corrective actions and measures taken by the auditee.

4.6Authentication Decision

4.6.1This organization should comprehensively evaluate the audit report, nonconformities, corrective actions and their results. Based on this, make the certification decision.

The audit team members for 4.6.2 shall not participate in the certification decision for the audit project.

4.6.3 Before making a certification decision, the organization shall confirm the following:

a. The audit report complies with Rule 4.4. The requirements necessary to provide the information needed to make a certification decision.

b. The institution has reviewed, accepted, and verified the effectiveness of corrective actions and their results for nonconformities reflecting the following issues.

Failed to meet requirements of the medical device quality management system standard.

2. Management objectives are not measurable, or the measurement methods are unclear.

③ Monitoring and measurement of key points that have a significant impact on achieving management objectives are not functioning effectively, or these key pointsIncomplete or invalid report or review records.

④ Deficiencies exist in the effectiveness of continuous improvement of the medical device quality management system, raising significant concerns about achieving management objectives.

c. The organization has reviewed other nonconformities and accepted the applicant's plan for corrective actions.

4.6.4 meets 4.6.3 If the organization provides sufficient objective evidence that it meets the following requirements, the certification body shall determine that the organization complies with the certification requirements and issue a certificate.

a. The applicant's medical device quality management system complies with the required standards and operates effectively.

b. Products or services covered by the certification comply with applicable laws and regulations.

c. The applying organization has fulfilled its obligations as specified in the certification contract.

4.6.5If an organization's application does not meet the above requirements, it shall be deemed non-compliant with certification requirements and notified in writing. Submit an application and explain the reasons for failing certification.

4.6.6After issuing a certification certificate, this organization shall 30 within working days, report the relevant information in accordance with prescribed requirementsSend to CNCA. CNCA on its website(www.cnca.gov.cn）and the company website (http://www.zjsjjc.com）Publish the column publicly to societyCertification certificate information submitted by the organization.

4.6.7This organization shall not link the certification status of the applicant organization to the compensation of auditors and other personnel involved in the certification audit.linked to compensation.

5Surveillance Audit Procedure

5.1 The organization shall effectively monitor and supervise certified organizations (hereinafter referred to as "certificate holders") that hold its medical device quality management system certification certificates, ensuring that their certified quality management systems remain compliant.

5.2 To ensure 5.1 is achieved The requirements are that the organization shall, based on the medical device quality risk level of the certified organization or other...Features: Determine the frequency of surveillance audits for certified organizations.

5.2.1 Surveillance audits shall be conducted at least once per calendar year, except for years in which recertification is required. The first surveillance audit following initial certification shall take place within [X] months from the date of the certification decision. 12 within the month.

Note: The frequency of surveillance audits may need to be adjusted to account for factors such as seasonality or time-limited management system certifications (e.g., temporary construction sites).

5.2.2 When the deadline for the second surveillance audit is reached, but there is evidence that the certified organization is temporarily unable to undergo the surveillance audit.When applicable, the interval for surveillance audits may be extended, but shall not exceed 15 months.

If surveillance audits under 5.2.3 are not conducted within the specified period, they shall be handled in accordance with clauses 7.2 or 7.3.

The 5.3 surveillance audit timeline is calculated per company documentation.

The audit team for the 5.4 surveillance audit shall meet the requirements of clause 4.3.2.

5.5 Surveillance audits may be conducted on-site or remotely at the certified organization. Due to seasonal production cycles, it may not be feasible to cover all products during each surveillance audit; however, throughout the certificate's validity period, surveillance audits must cover the full scope of certification.all products within.

At least the following items must be reviewed during 5.6 supervision and audit:

a. Have there been any changes to the activities covered by the medical device quality management system and the resources of the operating system since the last audit?

b. Whether key critical points are operating normally and effectively in accordance with the requirements of the medical device quality management system.

c. Are the corrective and preventive actions taken for non-conformities identified in the previous audit still effective?

d.The activities covered by the medical device quality management system that are subject to legal and regulatory requirements must remain in continuous compliance with such regulations.

e. Achievement of objectives. Where applicable, if objectives were not met, the certified organization must investigate and analyze the causes and implement corrective actions during internal management reviews in a timely manner.

f. Whether the certified organization's use of the certification mark or reference to its certification status complies with relevant regulations.

g. Whether internal audits and management reviews are conducted in a standardized and effective manner, as applicable.

h. Timely acceptance and handling of complaints.

i.When applicable, timely effective continuous improvements were implemented in response to issues identified during internal audits or reported through complaints.

5.7The audit report for surveillance audits shall be5.6 Describe audit evidence and audit findings for each specified audit requirement.and audit conclusion. The audit team shall provide recommendations on whether to maintain the certification certificate.

5.8 The institution will decide to maintain, suspend, or revoke the certification certificate based on the surveillance audit report and other relevant information.

6Reauthentication Process

Before the 6.1 certification expires, if the certified organization applies to retain its certificate, the certification body shall conduct a recertification audit and decide whether to renew the certificate.

6.2 Certification Authority shall4.3.2A review team is formed by {0} requirements. Following4.3Develop a recertification audit plan based on the requirements and past surveillance audit results, and submit it to the audit team for implementation. The audit team shall carry out the recertification audit in accordance with the plan.

When there are no significant changes to the internal and external environment of a certified organization's medical device quality management system, the Stage 1 audit for recertification may be omitted, provided that the total audit time is not less than4.3.1Calculating person-days: 2/3.

For serious nonconformities identified during the recertification audit, the certification body shall set a deadline for the certified organization to implement corrective actions and corrections, and complete verification of these actions before the original certificate expires.

The certification body 6.4 makes the recertification decision based on 4.6 requirements. If the certified organization continues to meet certification requirements and fulfill its contractual obligations, a new certificate shall be issued.

6.5If recertification activities are completed before the current certification certificate's expiration date and you choose to issue a new certificate, the new certificate's expiration date may be based on the current certificate's expiration date. The issuance date on the new certificate must not be earlier than the recertification decision date.

If the certification body fails to complete the recertification audit or address serious nonconformities before the current certificate's expiration date,If corrective actions and corrections are not verified, re-certification shall not be granted, and the validity of the original certification certificate shall not be extended. If, after the current certification certificate expires, the certification body is able to6Complete any outstanding recertification activities within {0} months to restore certification; otherwise, a second-stage audit must be conducted at minimum. The certification certificate's effective date shall not be earlier than the recertification decision date, and its expiration date shall be based on the previous certification cycle.

7Suspend or revoke certification

7.1 The organization shall establish and document procedures for suspending, revoking certification, or reducing the scope of certification.

7.2 Suspend Certificate

The certification body shall suspend the certificate of 7.2.1 within 5 working days after investigation and verification if any of the following circumstances occur.

a. The medical device quality management system fails to meet certification requirements on an ongoing or serious basis, including requirements for the effective operation of the system.

b. Fails to assume or fulfill the responsibilities and obligations stipulated in the certification agreement.

c. Ordered to suspend operations for rectification by relevant law enforcement or regulatory authorities.

d. Certificate suspension required due to identified issues in system operation by local certification regulatory authorities.

e. The administrative licensing proofs, qualification certificates, mandatory certification certificates, etc., held have expired or become invalid; the resubmitted application has been accepted but the certificate renewal has not yet been completed.

f. Voluntarily requested suspension.

g. Other circumstances requiring suspension of the certification certificate.

The suspension period for 7.2.2 certification shall not exceed 6.months. But belonging to7.2.1th e The suspension period for such cases may extend until the relevant authority issues a decision on the permit.If the certification authority is able to6complete remaining tasks within the monthMonitor and AuditThe activity, then the certification can be restored.

7.2.3Information regarding the suspension of certification certificates by this organization shall clearly state the suspension start date and duration, and declare that during the suspension... Certified organizations shall not use the certification certificate, certification mark, or reference certification information during this period.

7.3 Revoke Certificate

If a certified organization under 7.3.1 falls under any of the following circumstances, this body shall take action within 5 working days after obtaining and verifying the relevant information. Revoke its certification certificate today.

a. Documents proving the cancellation or revocation of legal status.

b. Refuses to cooperate with supervisory and inspection activities conducted by the certification regulatory authority, or provides false materials or information in response to inquiries or investigations regarding relevant matters.

c.A major medical device quality liability incident occurred, confirmed by the law enforcement regulatory authority to be caused by violations committed by the certified organization.

d. Has committed other serious violations of laws or regulations.

e. The suspension period for the certification certificate has expired, but the issue causing the suspension has not been resolved or corrected (including held administrative licenses)Proofs, qualification certificates, mandatory certification certificates, etc., have expired or become invalid, but the application was not approved.

f. The medical device quality management system is not in operation or no longer meets operational requirements.

g. Failure to properly cite or promote obtained certification information in accordance with relevant regulations, resulting in serious adverse effects or consequences, or failure to correct the issue within 6 months after being required to do so by this institution.

h. Other circumstances warranting the revocation of the certification certificate.

7.3.2After revoking a certification certificate, the organization shall promptly retrieve the revoked certificate. If retrieval is not possible, the organization shallThe decision to revoke shall be published or announced on relevant media and websites.

7.4The institution shall publish relevant information on its website when suspending or revoking certification certificates, and follow the prescribed procedures and requirements. Submit to the National Certification and Accreditation Administration.

7.5 This institution is obligated and responsible for taking effective measures to prevent the continued use of invalid certification certificates and marks. Use.

8Certification Requirements

The 8.1 certification must include at least the following information:

a. Certified organization name, address, and organizational code. This information must match the details in the legal status documentation.

b. Scope of business activities for production, operation, or services covered by the medical device quality management system. If the certified medical device quality management system covers multiple locations, provide the names and addresses of the relevant locations; this information must match the details in the corresponding legal status documents.

c. Medical Device Quality Management SystemGB/T 42061-2022/ISO 13485:2016 Compliant.

d. Certificate Number.

e. Institution name.

f. Certificate issue date and validity period (start and end dates). For recertification certificates issued without interruption since initial certification, the date of initial certification may be stated.

g. Certificate Verification Methods. In addition to publishing the certificate verification method on our website, we must also include it on the certificate itself. Note Clear ：“ This Certificate Book Message Info Yes In Country Home Recognize Certificate Recognize Yes Monitor Supervise manage Process Commit Employee Yes Official Fang Net site

(www.cnca.gov.cnquery on", for public oversight.

8.2 The certification is valid for 3 years.

8.3 The organization shall establish a certificate information disclosure system. In addition to providing certification certificate information to applicant organizations and regulatory authorities, the organization shall also provide such information upon request from relevant social stakeholders to ensure public oversight.

9Integrated audit with other services and management systems

When conducting combined audits of medical device quality management systems and other management systems, 9.1, general or common requirements must comply with these rules. The audit report shall clearly reflect the requirements of clause 4.4 and ensure they are easily identifiable.

When combining audits with 9.2, the number of audit days for the combined audit should be determined based on the company's audit schedule.

10Process Conversion Certification

10.1 This institution must fulfill its social responsibilities and strictly prohibit accepting non-compliant cases for profit.GB/T 42061-2022/ISO 13485:2016 Organizations that do not effectively implement the medical device quality management system in accordance with standards are ineligible to convert their certification.

10.2 This organization shall accept applications to convert its certification certificates, thoroughly understand the reasons for conversion, and conduct necessary on-site audits.

10.3 Conversion applies only to currently valid certification certificates. Applications for conversion will not be accepted for certificates that are suspended, under suspension or revocation proceedings, or have expired.

10.4 Ordered to suspend operations or listed on the "blacklist" by regulatory authorities (e.g. 7.2 Article c item), issuedThe institution has revoked the certificate (e.g.,7.3 unless the organization undergoes comprehensive rectification, resulting in suspension or revocation of certification.The certificate issue has been resolved; otherwise, the certification application should not be accepted.

11 Accept organization appeals

When a certified organization disagrees with the certification decision, our institution shall accept its appeal and process it promptly.The written notification of the handling results shall be delivered to the certified organization within 60 days.

The written notice shall inform the certified organization that, if it believes the certification body has failed to comply with applicable certification laws, regulations, or rules.and cause self-combinationIf your legal rights are seriously infringed, you may directly file a complaint with the local certification regulatory authority or the Certification and Accreditation Administration of China.

Manage 12 authentication records

12.1 The institution shall establish a certification record retention system to document and securely preserve all phases of the certification process.

12.2 Records must be accurate and authentic to demonstrate that certification activities are effectively implemented. Records shall be in Chinese and retained for at least the duration of the certificate's validity period.

When records are saved electronically as 12.3, an non-editable electronic document format shall be used.

13Other

13.1 Mentioned in the rulesGB/T 42061-2022/ISO 13485:2016Standard time refers to the time when the certification activity occurs.This is the effective version of the standard. When describing the standard number in certification activities and certificates, use the complete standard number of the version that was effective at that time.

13.2 Copies of all documents referenced in this rule must be reproduced from the original and signed/stamped by the provider to confirm they match the original.

13.3 This organization can take necessary measures to conduct training and dissemination on the medical device quality management system and relevant technical standards, ensuring all employees correctly understand and implement these standards.