I’ve managed CAPA and change-control for Class II-ish devices through MDR audits, and the IVDR transition for our lab-side partners pushed me to rethink how CAPA ties into risk, post‑market data, and supplier controls. The two regulations look similar on paper, but the downstream effect on CAPA processes is real — and I want to share exactly what we changed, why, and what still keeps me up at night.
High-level differences that matter for CAPA
Short checklist of regulatory differences that drove our CAPA changes:
- IVDR forces much stronger linkage between performance evaluation / clinical/performance evidence and post‑market surveillance. That means CAPAs that touch performance data often require evidence changes, not just corrective actions.
- Both MDR and IVDR raise expectations for documented risk management (ISO 14971) to be continuously updated and demonstrably linked to field data.
- Notified bodies and regulators expect traceability from an adverse event to the CAPA, the risk file, and any Technical File / IFU change — end to end.
- Supplier issues can be higher impact under IVDR because many IVDs depend on external reagents/methods; a supplier nonconformance can be a device performance risk immediately.
These translate into concrete CAPA implications: earlier RA involvement, richer evidence requirements, and tighter traceability between PMS, vigilance, risk management, and the CAPA itself.
What we changed in our CAPA workflows
Below are the practical edits we made in our eQMS (YMMV depending on your tool):
- CAPA intake form additions
- Explicit fields: "Impacts performance evaluation?" and "Impacts clinical/performance evidence?"
- Auto-tagging for product classification (MDR vs IVDR) so high‑risk IVDR products route to RA automatically.
- Root‑cause & risk assessment
- Mandatory link from CAPA to the risk file (ISO 14971 record) — you can’t close CAPA until the updated risk assessment is approved.
- Require documented acceptance criteria and measurable effectiveness checks (not “we’ll verify later”).
- Post‑market linkage
- Every CAPA that arises from or affects PMS data must reference the PMS plan and any performance evaluation reports (PER/PMSRs).
- If the CAPA suggests an update to the PER, the workflow spawns a "PER update" task to the clinical/performance lead.
- Supplier control
- We created a supplier‑CAPA subtype that auto-creates a SCAR and attaches supplier documentation requests.
- Escalation criteria: any supplier CAPA that changes reagent spec or lot acceptance triggers a batch‑recall consideration checklist.
- Traceability and evidence
- CAPAs require document links to updated IFU/labeling/technical file docs, and auditors can follow the chain in one view.
- Effectiveness evidence must be attached within the eQMS (measurement results, trend charts, returned product testing).
Process automation that helped
We leaned into automation where it saved reviewer time and improved reviewability and traceability:
- Auto-routing: CAPAs on IVDR‑tagged products route to RA + clinical lead, with an SLA reminder.
- Templates: Pre-filled CAPA templates for IVDR vs MDR cases (different evidence requirements).
- Connected workflow: CAPA → Change Control → Document Revision seeded automatically if closure requires a doc change.
- Effectiveness reminders and gated closure: CAPA cannot be closed until a scheduled effectiveness check date passes and evidence is uploaded.
I won’t claim magic — these automations reduced administrative back-and-forth and made audits less painful because reviewers could see timelines and evidence in one traceable chain.
What we learned the hard way
A few things that caught us:
- Underestimating the performance‑evidence ripple: A small lab-process drift required not only a CAPA but a PER update and new analytical validation. That added weeks of cross-functional work we hadn’t budgeted.
- Ineffective checks that looked good on paper: Early effectiveness criteria were too qualitative. We converted them to measurable, statistically defensible checks aligned to risk severity.
- Supplier pushback on SCAR timelines: Suppliers operate on their own change controls — be explicit about expected response windows and have contractual clauses to enforce it.
Standards and audit posture
Tie CAPA to the standards auditors care about:
- ISO 13485: CAPA records, effectiveness checks, and documented procedures.
- ISO 14971: Updated risk management file and input/output traceability.
- MDR/IVDR: Post‑market and vigilance linkages, and device classification impacts.
We started including a short "standards map" in each CAPA closure package showing which clauses/articles were addressed. Auditors loved that.
Small checklist to implement tomorrow
- Add "Impacts performance evaluation?" to CAPA intake.
- Require a link to the risk file before closure.
- Create IVDR-specific CAPA templates and auto-route to RA.
- Define measurable effectiveness criteria at CAPA creation.
- Automate spawning of Change Control or PER update tasks when needed.
Controlled assistance and the role of AI
We’ve experimented with AI-assisted triage: basic NLP to suggest whether incoming issues mention "performance," "safety," or "supplier" and recommend a CAPA subtype. Use it as controlled assistance — human review is mandatory. If you deploy AI-driven CAPA assistance, keep the model outputs reviewable and auditable.
Final thought
Moving from MDR to IVDR (or supporting both) is less about a single checkbox and more about embedding performance‑evidence thinking into every CAPA. The extra steps add work, but they also force better traceability and stronger risk control — which is exactly what notified bodies want to see.
How have you changed CAPA templates, automation, or evidence requirements specifically for IVDR cases? What automation actually saved time in your shop?
