An increasing number of medical devices now incorporate complex software that processes sensitive data and supports clinical decision-making. As a result, the need for systematic cybersecurity risk management is growing. The ISO/IEC 81001-5-1 standard was developed to provide manufacturers of medical device software with clear requirements to ensure security throughout the entire lifecycle of a medical device.

The standard requires manufacturers to perform a cybersecurity risk assessment already during the design phase. This includes identifying potential threats such as unauthorized access, data manipulation, or disruption of device operation. A key part of this process is threat modelling, where the STRIDE methodology is commonly used, which enables a structured analysis of security aspects. Based on these analyses, manufacturers must incorporate appropriate security measures into the software architecture, including authentication mechanisms, data encryption, protection against malicious code, and access control.

In addition to technical measures, manufacturers must ensure traceability of all security-related decisions, establish processes for vulnerability management, and prepare incident response plans. Security does not end with the putting of the device on the market—the standard also requires ongoing software maintenance, regular updates, and continuous monitoring of emerging threats. An important element is the Software Bill of Materials (SBOM), which must include information about all components used, their origin, support status, and known vulnerabilities.

The standard also mandates the execution of various types of testing, including static and dynamic code analysis, penetration testing, input robustness testing (fuzzing), and verification of all libraries and components used. Tests must be planned and performed to check the software’s resilience against known and foreseeable attacks.

By meeting these requirements, manufacturers not only fulfil regulatory obligations but also significantly reduce the risk of security incidents, strengthen user trust, and ensure the long-term sustainability of the device. ISO/IEC 81001-5-1 therefore represents an important step toward a safer and more reliable digital healthcare ecosystem.

Find out more about SIQ services in the field of medical devices.

The post Software Requirements in Medical Devices appeared first on SIQ.

First named as European Quality Network (EQNet), eventually renamed as IQNET in 1990 to give way to interested members from Asia and the Americas.  SIQ Ljubljana, representing Slovenia, has joined the network in 1996, and since then became one of the forces in driving betterment in the conformity assessment industry.

Currently, IQNET has 36 Members representing 34 countries.  Members’ offices now extend to 84 countries or territories, boasting a total number of 365 offices worldwide. To know more about IQNET Members in different countries: Finding Us.

In 2016, IQNET welcomed affiliation from certification bodies who would like to grow with the network.  IQNET has three Affiliated Bodies to date benefiting from our cooperation efforts and provision of exclusive IQNET products and services.

Harmonizing the knowledge and expertise of Members like SIQ Ljubljana, together with the extensive reach the network could provide, IQNET through the years has established a collaborative influence in the conformity assessment industry.

Collectively, IQNET Members are consistent in capturing 20% share of certificates issued worldwide for quality, environmental, health and safety, and other management systems (average comparison with ISO survey from 2019-2024).  Our conscious commitment to seeking mutual gains in our network resulted in the expansion of IQNET recognition of products and services to keep the businesses competitive in this changing industry landscape.

IQNET through the years has successfully created an atmosphere conducive to raise relevant issues in the conformity assessment industry.  IQNET’s footprint in the Accreditation area spans from chairmanship to convenorship of permanent committees and technical working groups in International Accreditation Forum (IAF), and active membership in regional accreditation forums.

This trustworthiness paved the way for IQNET to being acknowledged by scheme owners, quality infrastructure entities, among others, as main contributor and partner. To know more about our international representations, visit: International Player.

SIQ Ljubljana, and the whole IQNET is inviting the business sector, our certified clients, partners and stakeholders to celebrate this important year with us.  To know more about IQNET visit this site:  35 Years of IQNET or follow our network’s celebration activities by searching the hashtag #IQNETday in social media.

The post SIQ Ljubljana celebrates collaborative influence with IQNET appeared first on SIQ.

Clinical investigations and post-market feedback play a key role in the assessment of safety, as defined within the European Union by Regulation (EU) 2017/745 (MDR), with the aim of ensuring higher standards of safety and performance. With technological advancements, artificial intelligence is increasingly becoming an integral part of medical devices.

In June 2024, a new Regulation (EU) 2024/1689, the so-called AI Act, was adopted. It entered into force on August 1, 2024. Certain provisions, such as definitions and prohibited practices, began to apply on February 2, 2025. EU Member States must implement the AI Act into their national legislation by August 2, 2025, with full application starting on August 2, 2026.

The AI Act classifies products based on their risk level. Medical devices incorporating artificial intelligence fall under the high-risk category. Manufacturers are required to ensure that AI systems are transparent and that their outputs are based on verifiable and reproducible methods.

On the other hand, notified bodies must assess the reliability and safety of the AI, including the evaluation of algorithms, data sets, and the impact on clinical outcomes.

This requires the involvement of experts with appropriate competencies in both medical devices and artificial intelligence. These experts must operate independently from manufacturers and other industry stakeholders and must actively prevent potential conflicts of interest. Notified bodies are under continuous supervision by competent regulatory authorities, who verify their compliance with the requirements of applicable regulations, relevant guidelines, and standards.

The medical device industry is facing increasingly strict regulatory requirements, aimed at promoting higher levels of safety and quality. The integration of artificial intelligence in medical devices increases the need for transparency and safety of algorithms. Companies must actively monitor regulatory changes, work closely with notified bodies, and implement appropriate procedures to ensure compliance.

Key recommendations include proactive certification, documentation digitalization, and the establishment of robust post-market surveillance systems. Timely adaptation will allow companies to maintain competitiveness and ensure smooth access to the European market.

The post AI Act and Medical Devices appeared first on SIQ.

The event was organized by SIQ, which has been a member of the IQNET association since 1996. The General Assembly coincided with the celebration of the 35th anniversary of the association’s founding. It was attended by the members of the association from more than 30 countries.

As part of the event, SIQ received two awards for conducting training courses within the IQNet Academy. Among all members, we performed best in terms of growth and the range of training programmes. In 2024, we issued as many as 463 IQNet Academy certificates, while this year we have already issued 177.

The event was an important opportunity to exchange good practices, strengthen cooperation and develop joint strategies for the future development of conformity assessment and certification of management systems.

The post SIQ organizes the 37th IQNET General Assembly appeared first on SIQ.

The post 25. otroški likovni natečaj JQA in IQNET appeared first on SIQ.

Leveraging on our local expertise, SIQ harness vast amounts of data and information, and develop them into vital knowledge for the benefit of professionals, businesses, or support the trade, regulatory, governmental organizations in our country. Through IQNET, this knowledge additionally fuels international initiatives and projects, aiming to bring benefits to global markets.

SIQ has celebrated 60th Anniversary this year. We have created an infrastructure to ensure reliability and recognition of people, products and services, such as training, inspection, and testing.

These long years of experience and continuous improvement are sending ripples of benefits to our global community — in forms of trustworthy cooperation, global recognition, and knowledge-sharing within IQNET:

SIQ Training is a licensed partner of IQNet Academy, a global brand of training for conformity assessment related topics, recognized by IQNET Partners around the world. By training with us, each professional receives a global recognition of compliance to what is required under IQNet Academy, manifesting his/her competences and commitment to continuous education in the field of conformity assessment.

IQNET is involved in a total of more than 60 executive, advisory, technical committees, working groups in stakeholder areas: 29 in international standardization activities (ISO); 25 in accreditation such as International Accreditation Forum (IAF), European Accreditation (EA), and Inter American Accreditation Cooperation (IAAC); five in scheme owners areas such as European Aerospace Quality Group, Food Safety Scheme Council, Smart Freight Centre; and three in relation with the quality infrastructure, such as with INetQI and UNIDO.

Through this representation, our stakeholders benefit from the information that only our country or our network can provide, as well as allow us to make a contribution to the changes in the conformity assessment industry that may impact our clients.

All this expertise is harnessed towards developing vital knowledge for you, and for others who rely on us. See more in our official IQNET Day 2024 website.

On this occasion, we are pleased to announce that SIQ, as a proud partner of the IQNET, will be hosting next, 37th IQNET General Assembly in 2025. The event will take place from May 26 to May 30, 2025, in Ljubljana. We look forward to welcoming members of the International Certification Network from around the world.

The post IQNET day appeared first on SIQ.

SIQ has been a full member of the CB scheme, as a certification body (NCB), since the end of 1993, when we also issued the first CB certificate. To date, we have issued over 12500 CB certificates. Some certificates were issued as amendment to the original certificate, so the total number of issued certificates is much higher than 10000.

Well done, team SIQ!

The post SIQ issues the 10000 CB certificate appeared first on SIQ.

Figure 1.1.

The MDR introduces stricter and more comprehensive requirements for demonstrating the conformity of medical devices. The entire testing and certification procedure is lengthy and can take up to two years, which many manufacturers do not expect. The first steps towards starting the certification procedure, ranging from our first contact with the customer to the confirmation of the offer and the planning of the assessment and audit, are shown in Figure 1.1.

How is the certification procedure conducted?

The organisation submits the technical documentation to the notified body. The latter carries out a brief review, i.e., a preliminary review of the documentation, which involves verifying the adequacy of the documentation structure and determining whether all of the required documents have been included. After confirming the adequacy and completeness of the documentation, the certification procedure can finally be initiated. The first part of the procedure is the assessment of the technical documentation and the clinical evaluation of the device. SIQ involves a range of qualified professionals, including clinical specialists and specialists with specific skills (in software, biocompatibility, sterilisation, etc.), where necessary. Once the assessment of the technical documentation and the clinical evaluation has been completed and the documentation is in compliance with the MDR, the certification procedure continues according to the chosen conformity assessment procedure (See Figure 1.2). 

Most often, manufacturers decide on a conformity assessment procedure set out in Annex IX or Part A of Annex XI, which involves an audit of the established quality management system. In such cases, the certification procedure continues with a certification audit, which may be combined with an audit according to the ISO 13485:2016 standard.

Figure 1.2.

It should be noted that in the entire certification procedure, it is the assessment of the technical documentation and the clinical evaluation (part one of the assessment) that takes the longest, in some cases lasting up to one or two years.

Once all non-compliances have been eliminated by the organisation and all requirements have been met, the notified body issues a certificate (EU) that enables medical device manufacturers to enter the EU market. In the case of conformity assessment according to Annex IX or Part A of Annex XI, the notified body carries out surveillance audits of the certified quality management system once a year, followed by a re-certification audit every fifth year. During the surveillance and re-certification audits, the auditors also review the manufacturer’s reports on post-market follow-up on devices and possible complications, which are called vigilance cases. The notified body carries out an unannounced audit at least once every five years (except in the case of a Class III medical device, where the audit is carried out at least once every two years) to verify how the certificate holder is maintaining and updating its quality management system. Although the overall certification procedure in accordance with the MDR is a completely new procedure, it may be partially adapted if the organisation is already a holder of a valid EC certificate in accordance with the MDD – in the case of an
audit according to Annex IX or Part A of Annex XI, a combined MDD and MDR audit is carried out.

Find out more about the procedure.

The post Procedure for Certification of Medical Devices in Accordance with the Regulation (EU) 2017/745 on Medical Devices (MDR) appeared first on SIQ.

The comprehensive range of services we offer includes testing of the safety and electromagnetic compatibility (EMC) of products, cybersecurity testing, testing according to different harmonised standards, personnel training, interpretation of standards, legislation and certification procedures, as well as management system certification according to different standards (ISO 13485, ISO 9001, ISO 14001, etc.)and certification according to relevant legislation. With these services, we support manufacturers in entering the Slovenian market as well as European and global markets.

The experience we have with the certification of medical devices under the current legislation concerning medical devices (Medical Device Directive 93/42/EEC) shows that manufacturers of medical devices who have a good knowledge of legislative requirements, harmonised standards and guidance documents usually complete the medical device certification procedure faster.

It is therefore recommended that manufacturers first undergo training to familiarise themselves with the requirements of the Regulation (EU) 2017/745 on medical devices (MDR), harmonised standards and the European guidance documents of the Medical Device Coordination Group (MDCG). Information on such training courses, which are available in Slovenian, English, Serbian and Croatian, can be found on the SIQ website under Training – Program – Medical Devices.

In the development phase of a medical device, the manufacturer must involve various experts with specific skills, such as clinical specialists – doctors who, by examining existing scientific literature, establish a scientific medical basis for the development of the device. During the development planning phase, the manufacturer must carry out the first risk assessment involving personnel with technical and medical knowledge. At this stage, the manufacturer must also review the general safety and performance requirements (MDR, Annex I) to identify the requirements relevant to the device and production. This enables the manufacturer to determine which tests and verifications will have to be carried out and which experts will need to be involved – for example, experts in sterilisation, biocompatibility, or electrical safety and electromagnetic compatibility testing. Testing according to the EN 60601 series of standards and other relevant standards can be carried out in our safety and electromagnetic compatibility laboratories. The range of accredited services and other services provided by SIQ laboratories is published on the SIQ website (www.siq.si/en/) under Our Services – Product Testing and Certification – About Us.

If the manufacturer performs the first testing at the device development stage, any defects will come to light early and can be corrected during the development phase. This saves time and ensures that the device can enter the market sooner.

Experience has shown that medical device manufacturers who are more aware of regulatory requirements, harmonised standards and guidance documents complete the certification procedure for their medical device faster.

Find out more about medical device certification and testing.

The post Complete Solutions for Medical Devices appeared first on SIQ.

As a professional, independent and impartial institution, SIQ enables manufacturers of medical devices to place safe medical devices on the market, in conformity with the relevant European legislation.
In addition to providing services for the automotive industry, the certification of medical devices is one of our strategic activities.

In March this year, we became a designated notified body in accordance with the new Medical Device Regulation.

Read more in the latest issue of SIQ Report:

• SIQ Ljubljana Becomes a Notified Body in accordance with the Medical Device Regulation
• Among Twenty-Eight in the World
• Complete Solutions for Medical Devices
• Procedure for Certification of Medical Devices in Accordance with the Regulation (EU) 2017/745 on Medical Devices (MDR)
• Quality Management System according to the MDR
• Technical Documentation according to MDR Requirements
• Post-Market Surveillance
• Certification of Distributors and Importers in Accordance with Article 16 of the MDR
• Medical Device Training
• We hosted a Delegation from Azerbaijan

SIQ Report 82 (pdf)

The post Complete solutions for Medical Devices in Accordance with the Medical Device Regulation appeared first on SIQ.