The manufacturer shall document a quality management system and maintain its effectiveness in accordance with the provisions of these Regulations
The manufacturer shall establish, implement and maintain the requirements, procedures, activities or arrangements set out in the quality management system:
1. To determine and implement the processes required for the quality management system;
2. To monitor the quality management system process based on risk assessment;
3. To determine the sequence and interaction of the implementation process of quality management system.

The manufacturer shall take the following measures on the quality management system process;
1. To determine criteria and methods adopted to establish and maintain the quality management system;
2. The acquisition of resources and information needed to establish and maintain the quality management system;
3. The necessary actions to achieve the expected results of the quality management system and to maintain the effectiveness of its processes;
4. The monitoring, analysis and necessary measurement of the quality management system process;
5. The establishment and maintenance of necessary records in order to prove compliance with the Act and these Regulations.

The formulation and changes of the foregoing process shall be carried out with the impact assessment of the quality management system and the medical device to ensure compliance with the requirements of the Act and these Regulations.

The manufacturer shall implement monitoring on the part of outsourced services in the quality management system process, which may affect the product’s compliance with the requirements.
The manufacturer shall ensure that the outsourcing process complies with the requirements of these Regulations, the customers and other relevant regulations, and shall adopt control measures commensurate with the risk of outsourcing and the ability of the trustees to comply with the law, including the signing of a written contract.

The manufacturer shall establish and document the validation procedures for the effectiveness of computer software in the quality management system. The software shall be validated prior to initial use; the same applies to the changes of software or its applications, if necessary.
The specific methods and activities used for software validation and re-validation shall be commensurate with the risk of use of the software.The manufacturer shall keep record of the foregoing measures of validation and re-validation.

The content of the quality management system document shall include the following matters:
1. Statement of quality policy and quality objectives;
2. The quality manual;
3. Procedures and records required by these Regulations;
4. Documents and records developed by the manufacturer to ensure the effectiveness of planning, operation and control of the quality management system process;
5. Other documents required by central competent authorities.

(The content of foregoing quality manual shall include the following items:)
The manufacturer shall establish a quality manual, and the content of which shall include the following items:
1. The file structure used by the quality management system.
2. The scope of the quality management system and reasons of exclusions from application or non-enforcement, if any;
3. The procedures established by the quality management system;
4. The interaction between quality management system processes.

The manufacturer shall establish medical device file for each type or series of medical devices as evidence that their manufacture complies with the provisions of the Act and these Regulations.
The foregoing medical device file shall include the following content:
1. An overview of the medical device, its intended use or purpose, and labeling;
2. Product specifications;
3. Specifications or procedures for manufacturing, packaging, storage, handling and distribution;
4. Measurement and monitoring procedures;
5. Installation requirements;
6. Service requirements.
The presentation of the foregoing content may be in the form of a document or an index.

The manufacturer shall control the documents used for the quality management system.
The manufacturer shall establish control procedures in writing for the following matters:
1. The review and approval of the documents before release and circulation; the same applies to the revise;
2. The identification and verification of the serial number of versions and the history of revisions and status;
3. The availability of the documents in respective places;
4. The confirmation of document version and readability;
5. Ascertaining the validity of the necessary external original documents, and the control of the distribution of the documents;
6. Prevention of damage or loss of documents;
7. Identification of void documents and preventive measures against misuse.
The revise mentioned as first subparagraph of foregoing paragraph shall ensure that the changes to the documents are based on the review and approval by the offices issuing the original approval or their designated offices with reference to relevant background information.
The manufacturer shall specify the period of keeping the void documents to ensure the availability of the data of manufacturing and testing, which shall not be less than the period specified in the relevant laws and regulations.

The manufacturer shall establish and maintain a record sufficient enough to prove compliance with these Regulations. Records shall remain legible, readily identifiable and retrievable.
The manufacturer shall establish a documented procedure to define the controls needed for the identification, storage, protection, retrieval, retention time and disposition of records.
The retention period of the record in the first paragraph shall be no less than the validity period of the medical device and shall be no less than three years from the date of release of the product by the manufacturer. Other laws and regulations, in which a longer period is required, shall prevail.
The manufacturer shall formulate and implement protection measures for sensitive health information in records in accordance with the provisions of the Personal Data Protection Act.