EU medical device regulation:
“The early bird catches the worm” or “Familiarise yourself with the tighter regulations now”
We consider in detail below some important changes resulting from the new EU regulations MDR (2017/745/EU) and IVDR (2017/746/EU) and show you the differences between the directives and national medical devices acts on one side and the new regulations on the other.
Conformity assessment
After the introduction of the new regulations, one of the most important questions for manufacturers of high-risk devices is whether they have sufficient clinical evidence to keep their devices on the market. Currently about 95% of high-risk devices that have marketing authorisation in the EU are based on the data of competitors. Furthermore, one of the leading notified bodies has determined that two-thirds of the medical devices that are currently marketed in the EU have selected the option of equivalence with a device already on the market without maintaining their own data. In future the manufacturers must provide their own results about safety for these devices. Alternatively, if a medical technology company has claimed comparability of its device with that of another manufacturer, then the company should at least have a contract with the other manufacturer in order to be able to continue using this data in future. The company must otherwise provide its own clinical results. The company should also continuously monitor the body of data of the device class in the market. The new EU regulations have significantly increased the requirements for the burden of proof of the safety and efficacy using clinical evaluations and internal clinical trials. We therefore advise companies to closely observe which other regulations and directives will be published by the EU in the next few years. For example, some of the MEDDEV directives still have to be adapted to the requirements of the new MDR and IVDR. About ten months ago the completely revised fourth revision of the directive for clinical evaluations – MEDDEV 2.7/1 – was published in response to the PIP scandal (leaking breast implants) from 2011. The revisions of these directives are important because they will help companies to implement and apply the requirements of the MDR/IVDR (see Chapter - The clinical evaluation in the transition period between EU Directives (MDD, AIMDD) and EU Regulation (MDR).
Ask yourself whether your notified body is already at the point where they can satisfy the new regulations. It certainly makes sense to regularly discuss the processes and time lines.
MDR/IVDR versus MDD/AIMDD/IVDD
The first thing to mention is that the regulations are fundamentally more expansive compared to the directives (177 pages for the MDR compared to 65 for the MDD and 20 pages for the AIMDD; 159 pages for the IVDR compared to 37 for the IVDD). The MDR includes 123 Articles (23 previously for the MDD) and 17 Annexes (previously 10 for the MDD) in addition to 67 pages of recitals (previously 5 pages for the MDD).
Secondly, the contents of the MDR and IVDR are now much more closely harmonised. For example, in-vitro diagnostics are now also subject to a risk-based classification. This will create fundamental challenges for IVD manufacturers with devices that were previously general IVDs.
Thirdly, the objective of the new regulations is to ensure product safety. The regulations contain numerous challenges for the manufacturer: These include the increased classification of medical devices (such as Rule 11 on the classification of material medical devices or software) and the tighter market access process (scrutiny procedure) for class IIb products, for example, that supply medicinal products or new implantable class III devices.
Fourthly, not only the manufacturer but also suppliers, importers, distributors and sales organisations (the economic operators) will come under much closer scrutiny. In many cases they must comply with tighter rules. Previous contractual agreements with suppliers have to be put to the test. This is because the MDR demands that the quality management system of the manufacturer also has to incorporate comprehensive resource management, the selection and control of suppliers and even their subcontractors. At the same time, authorities such as the notified bodies are also required to deal with the suppliers for medical device manufacturers much more critically than has been the case to date. In this regard, manufacturers must place more stringent requirements on their own suppliers and comprehensively renegotiate contractual partnerships with suppliers.
Fifthly, market access for medical devices through the CE certification is temporally limited:
• After certification there are annual repeat audits conducted by the notified body.
• Every five years at the latest medical devices are recertified by the notified body and receive a new declaration of conformity after a successful audit.
• Every three years at the most – and even more frequently for high-risk devices – unannounced audits will also be conducted by the notified body at the manufacturer and their most important suppliers where random samples will be drawn from production and checked.
Other fundamental new features of the MDR include:
• Additional reports and plans such as the post-market surveillance plan/report (PMS), post-market clinical follow-up report (PMCF), periodic safety update report (PSUR), summary of safety and clinical performance (SSCP).
• Fundamentally more stringent requirements for compiling clinical data, for example, in the clinical evaluation.
• The staggered introduction of UDI labelling.
After the regulation comes into effect, the following schedule results from the MDR:
• When the MDR comes into effect, the transition period of three years specified in the regulation starts, during which the manufacturers can elect to still be certified by the old law or change to certification in accordance with the new law.
• Because the notified body can be reappointed at the earliest six months after the regulation comes into effect in order to carry out certifications in accordance with the new law, the transition period for manufacturers is reduced by this period.
• Subsequently, the 50 to 60 notified bodies in Europe must be reappointed in accordance with the new law. This is done with the joint assessment by several national authorities includes a representative of the EU Commission. This procedure is expected to take at least another 12 months but possible as long as 18 months.
• Only then, from 2019 onwards, will manufacturers be able to submit their applications for recertification with their newly appointed body, should no alternative requirements be created by the Commission in the meantime.
• The process of recertification is expected to take at least another 12 months. • The three-year transition period will be long past by the time all manufacturers in the EU and non-member countries are recertified.
This situation leads to manufacturers being well advised in expert opinion to extend their old certificates shortly before the three-year transition period ends. These will then apply for a maximum of another four years after the MDR comes into effect (until 26 May 2024). This option is a special scenario, however. Most products are expected to be recertified no later than five years from 26 May 2017.
Tighter provisions for medical device manufacturers
The new EU regulations toughen the provisions regarding when medical devices or in-vitro diagnostics are placed on the market. They augment the subsequent market surveillance. The regulations have also toughened the provisions for the notified bodies and their monitoring. Notified bodies will be required to carry out unannounced audits in the company, for example.
The new regulations contain explicit provisions about the responsibility of the manufacturer regarding the traceability of quality, performance and safety of the medical devices that are already on the market. This increases the vigilance requirements. As a result of the improved traceability, manufacturers and authorities will be able to act immediately and quickly if there are any concerns. It is also intended to help products to be continuously improved on the basis of these data. Clear responsibilities will be imposed on manufacturers regarding liability, for example, but also for the recording of complaints. The obligation to maintain liability insurance or formation of adequate reserves for compensation claims in line with the model of the German business liability insurance is introduced. The EU regulations also improve the availability of clinical data. And finally, the protection of patients who take part in clinical trials is strengthened.
Certain high-risk products such as implants may be subject to an additional review by experts before they may be placed on the market (the scrutiny procedure). Expert panels and laboratories will play a critical role in providing notified bodies, relevant authorities and manufacturers with expertise and advice on clinical issues. The new EU provisions explicitly affect certain devices without a medical purpose but with similar properties. This affects, for example, fillers and coloured contact lenses for cosmetic purposes.
In the area of clinical data, the following rules now apply:
• Only clinical data from published peer-reviewed articles
• There is a new requirement for the clinical evaluation of medical devices that the manufacturer must prepare a clinical development plan including a plan for the post-marketing clinical follow-up. Existing gaps must be closed by clinical trials or non-interventional studies because overall greater attention is being placed on clinical data. As part of the technical documentation the manufacturer must also prepare a report on the clinical evaluation.
• Class III medical devices must generally undergo clinical testing.
• Clinical evaluation: Class III and implantable devices may still only access
comparison data if the manufacturer owns the devices that are used for the comparison. Or the manufacturer has a contract with the manufacturer that markets a comparable device in order to obtain access to all data and test results.
• Post-market clinical follow-up requirements: The safety/clinical evaluation/performance summary reports must be updated at least every year for class III and implantable devices.
A central database (EUDAMED) ensures traceability
A central database will be established to create an improved system for all relevant information. This database will include all relevant information of the companies involved, the notified bodies, market surveillance, clinical trials and certificates. The database will also provide patients, healthcare professionals and the public with comprehensive information about products in the EU. This will enable better decisions based on substantiated information. Medical devices should also be issued with a unique device identifier number (UDI number) and single registration numbers (SRN) to ensure seamless traceability. In accordance with a decision by the European Commission on 19 April 2010 all EU member states must use this database from May 2011. The new version will go online in the near future but when is still not clear. The Emergo group writes: “It is planned that the new EUDAMED version will be ready for beta testing by March 2018, ready for operation in March 2019 and formally ready for use in September 2019 with the entry of existing data taking up to March 2021.”
Explicit QMS and RMS requirements
The high requirements for safety and performance of medical devices includes a risk analysis and risk evaluation to provide evidence of the safety. Compliance with all the relevant laws and standards must be demonstrated. A comprehensive QM system that includes controls in the technical laboratory or batch or sample testing during production must also be verified. The new regulations MDR and IVDR now have compared to MDD, AIMDD and IVDD many more requirements for quality and risk management but the manufacturers and other economic operators will still need ISO 13485 to demonstrate complete implementation of a QM system for medical devices. ISO 13485 for quality management was renewed in 2016 and manufacturers are currently adapting their processes to the changes that are associated with the rules in the new regulations.
While the transition from MDD/AIMDD/IVDD directives to satisfy the MDR/IVDR regulation must be managed, the transition to ISO 13485 must also be coordinated time-wise in order to be prepared in advance for a QM audit. This transition should ideally be completed before the second half of 2018. In all this those changes should not be forgotten that have to be made for other regulatory authorities such as the US FDA if a manufacturer wants to sell its medical devices in these markets as well. The other challenge is the risk/benefit analysis and assessment for medical devices. A benefit/risk analysis and assessment involves the collection and testing of data and literature in order to identify the medical benefits of the use of the device compared to the residual risk.
In 2012 the European Commission published the harmonised version of the standard EN ISO 14971 Medical devices – Application of risk management to medical devices. The publication described the expectations for risk management of CE certification so that manufacturers can continue to declare the conformity of their medical devices. The type and quantity of data and literature for the analysis depends largely on whether the medical device or in-vitro diagnostic device is novel or comparable with an existing technology. Which data can be used also depends on the status in the product life cycle, that is, is the medical device still in the developmental stage or is it already on the market and are post-market surveillance data already available. For novel devices it is expected that the manufacturer has carried out clinical trials that also include quantification of the benefits and risks.
For CE certification such studies must be planned and carried out in accordance with EN ISO 14155 “Clinical trials of medical devices in humans – Good clinical practice”. ISO 14155 does not apply for in-vitro diagnostics. After market launch of the medical device or in-vitro diagnostic device, a post-market clinical follow-up is now required to continually test the consideration of the benefits and risks. Risks may be identified in this way that are not necessarily detected under controlled conditions.
Your contact:
Frau Dipl. Biol. Jana Wolkow
Project Manager Regulatory Affairs
Tel. +49 (0) 731 954 95 - 511
jana.wolkow@orangeglobal.(.)de