The highest court in France has found the ISO registrar TUV Rheinland culpable in the Poly Implant Prothèse (PIP) breast implant scandal that has shaken Europe. PIP was found to have used subpar industrial-grade silicone in the implants, rather than more expensive medical grade materials. Dozens of patients developed cancer after receiving the inferior implants, and at least one patient died.

PIP utilized TUV Rheinland as its “Notified Body” for CE Mark audits. Subsequent lawsuits charged that PIP auditors should have found the discrepancies during annual audits, a charge which TUV has rejected, claiming that its audits are incapable of identifying such fraud. The resulting certifications issued by TUV do not make such a disclaimer, however, instead indicating the products and processes used to manufacture them were deemed safe, without exceptions.

The scandal is alleged to have forced ISO to add stronger language in the medical device standard ISO 13485, but it is not clear if this is true; some have argued that ISO is unfairly using the PIP scandal to market the boost sales of its updated ISO 13485 standard. Under the prior release of ISO 13485, medical device auditors would have been required to uncover the use of faulty or fraudulent materials, since such audits are conducted under the regulations of ISO 17021, not ISO 13485.

It was originally thought that only TUV’s role as a CE Mark Notified Body was a concern, but an online resume of the conviced Quality Director, Hannelore Font, shows that PIP held both ISO 9001 and ISO 13485 certifications at the time of the scandal. Oxebridge is still working to confirm that TUV issued those certificates, in addition to the CE Mark.

The ISO and CE Mark certification schemes are under heightened scrutiny as more and more defective products are found having been produced under quality systems bearing certificates issued by accredited certification bodies (CBs) and notified bodies (NBs.) ISO has publicly denied any responsibility for the certification schemes, even though its CASCO committee develops the rules for such audits, including ISO 17021, and ISO develops certification deadlines alongside the International Accreditation Forum (IAF).

The IAF has also refused to take action to examine how its accredited bodies, such as TUV Rheinland, are failing in their duties. Certificates featuring the IAF logo have been found at the heart of scandals such as the Takata airbag deaths, the Deepwater Horizon explosion, the Miami bridge collapse and the Kobe Steel metals falsification conspiracy.

The French ruling against TUV Rheinland marks the first time an IAF registrar has been held liable in such a case. PIP’s founder was sentenced to jail, and the company faces a fine of up to 6 billion euros.