The Final text of the long anticipated European Medical Device Regulations has been published. The new regulations include some 123 Articles split into Ten Chapters and Seventeen Annexes. It’s a weighty read, at some 566 pages compared to the 95 pages combined for the Medical Device (MDD) and Active Implantable Medical Device (AIMD) Directives.
It’s notable that in this torrent of extra detail, the fundamental arrangements for regulation which were put in place around 25 years ago are essentially unchanged. We still have general requirements for safety and performance, use of harmonized standards, risk based classification and third party conformity assessment based on risk.
But within this familiar framework the new regulations introduce a considerably more prescriptive requirements in almost every area.
- The 14 Essential Requirements are replaced with 23 General Safety and Performance Requirements with much more detail.
- Software requirements are spelt out indepth including consideration of data privacy and cyber-security.
- Classifications are revised to capture a host of new devices into Class III and introduce special requirements for Class I reusable surgical instruments.
- There are detailed requirements for Risk Management, Postmarket Monitoring and Clinical Evaluation, and these fundamental aspects of regulation are much more tightly integrated.
- There are new requirements around single use devices and their reprocessing.
- Custom devices which are mass produced will no longer be exempted from conformity assessment.
There’s too much to deal with in this first look at the final text. Look out for follow on articles and Webinars dealing with different aspects in more detail -and also with the new IVD regulation, but for now – here’s an overview of the key points.
The General Safety and Performance Requirements
Out with the old Essential Requirements. The new Annex I brings a much more detailed set of requirements which at times become very specific. There are new requirements relating to software, devices incorporating medicines or biological origin materials, and risks associated with lay use of devices. The requirements for sterile devices and for biological safety are both considerably expanded, with specific requirements related to specified carcinogens, endocrine disruptors and phthalates. The old Essential Requirement 13 on labeling is expanded to a complete Chapter III in the new text. The new Regulations retain reference to harmonized standards, but also add in relevant parts of the European pharmacopoeia. Look out for Common Specifications. Mysterious documents to be drafted by the Commission to fill the gaps where there are no standards. Click here to download a handy copy of the new GSPR,
Stronger Notified Body Oversight
One of the central pillars of the European reforms has been the strengthening of the oversight – and capacity – of Notified Bodies. The new regulations bring a much more rigorous designation process, with multiple parties involved in the designation process to ensure consistency and transparency. All Notified Bodies are required to re-apply for designation, with a lengthy review process likely to take at least 18 months. The expectation is that the end of this process will see around 20 Notified Bodies remaining from the current total of around 70.
Economic Operators – Regulation for All
The old MDD essentially provided requirements for manufacturers and their authorized representatives. The new Regulations introduce the concept of economic operator. That includes manufacturers, importers, distributors and market representatives and Notified Bodies and the Regulations place specific requirements on each of these. Most notably:
- Distributors and Importers are required to maintain detailed records and to actively participate in postmarket monitoring including supporting adverse event reporting and recall processes.
- European Representatives are to be held jointly and severally liable for safety of medical devices. Expect EC reps to insist on insurance cover and fees to be adjusted accordingly. And speaking of insurance, the preamble to the new Regulations specifically requires manufacturers to take out product liability insurance.
Risk management concepts are embedded throughout the regulations. Students of the controversy over the Z Annexes to ISO 14971 will be relieved to learn that the Essential Requirements introduce a more pragmatic approach. The Annex I, Chapter I General Requirements deal at length with risk stating risks are required to be acceptable “when weighed against the benefits to the patient” and going on to state that “Manufacturers shall manage risks so that the residual risk associated with each hazard as well as the overall residual risk is judged acceptable”. Although in places the language is at times clumsy: with General Requirement 2 stating “The requirement in this Annex to reduce risks as far as possible means the reduction of risks as far as possible without adversely affecting the benefit-risk ratio.” Make of that what you will.
Reuse of Single Use Devices and In-hospital Manufacturing
There’s been considerable debate in the development of the regulations about reprocessing of single use devices, with some European countries strongly in favour of reprocessing and others less so. The Regulations actively contemplate reprocessing activities but make it clear that commercial reprocessors are to be considered manufacturers and subject to the full force of the regulations. However there’s a get-out clause for hospitals – where national authorities are empowered to allow reprocessing within hospitals to be conducted to a lower standard – providing the devices are not transferred outside to that facility.
The original manufacturers must now justify single use claims based on specific risk assessment. General Safety and Performance Requirement 23.4 (p) states
if the device bears an indication that it is for single use, information on known characteristics and technical factors known to the manufacturer that could pose a risk if the device were to be re-used. This information shall be based on a specific section of the manufacturer’s risk management documentation, where such characteristics and technical factors shall be addressed in detail. If in accordance with point (d) of Section 23.1.no instructions for use are required, this information shall be made available to the user upon request
Hospitals also get a break on making their own devices. Hospitals and clinics are specifically exempted from the Regulations provided they don’t supply anything they manufacturer outside of the hospital.
New Definitions – Placing on the market is now expressly commercial
There are a host of new definitions including of course for medical device, custom-made device and for making available on the market. Placing a device on the market is now defined to be something that takes place as part of a commercial activity (whether for charge or for free). it remains to be seen whether this will provide a loophole for organisations such as charities.
The definition of serious adverse event is expanded to specifically include hospitalization, medical or surgical interventions to prevent life threatening injury or illness, chronic disease, foetal distress, foetal death or a congenital physical or mental impairment or birth defect,
Nanomaterials are also explicitly defined in terms or particle sizes and proportions of agglomerates, as well as Fullerenes, graphene flakes and single-wall carbon nanotubes with one or more external dimensions below 1 nm deemed to be nanomaterials.
Custom Device Exemptions Curtailed
The exemptions from conformity assessment for custom devices are very substantially removed. Custom devices which are mass produced (even if to individual prescriptions) will now be subject to full conformity assessment requirements. All Class III implantable custom devies will be required to undergo conformity assessment irrespective of quantity produced.
Specific Requirements for Software
A new Safety and performance Requirement 17 “Electronic programmable systems – devices that incorporate electronic programmable systems and software that are devices in themselves” sets out detailed requirements for software. Stand alone software is also explicitly classified as an active medical device in the updated classification rules. The new requirements essentially codify existing IEC 62304 requirements – although there’s also a specific requirement to consider hardware functionality (e.g. screen resolution) of mobile device platforms such as smart phones and tablets. On top of the software development rules, the Regulations also introduce requirements to consider both privacy and cybersecurity including “minimum requirements on hardware, IT networks characteristics and IT security measures, including protection against unauthorised access“.
The new software classification Rule 11 elegantly integrates software device classification with the Software level of Concern classification from IEC 62304 (as well as the US FDA software guidance).
Physical labeling continues to be mandated as in the MDD, but now there’s a requirement that for manufacturers who operate a website, labeling information must also be published there. E-labeling is allowed as a supplement but not instead of physical labeling. Instructions for Use (IFU) may be in electronic form but must conform to Regulation (EU) No 207/2012 on electronic instructions for use of medical devices.
As expected, there’s a lot of tweaking of the classification rules in the light of experience. Active Implants are pragmatically merged with an expanded Class III, which includes a range of other devices including:
- Surgical meshes
- Spinal implants (except screws and plates)
- IVF Media and media for transplant organs or tissues
- All active implants and their controllers or monitors
- All devices in direct contact with the heart or central circulatory system regardless of duration
- Nanomaterials with high potential for internal exposure (others are IIb/IIa)
- Active devices with significant patient management function (e.g. Automatic External Defibrillator).
Software classifications are integrated into a single Rule 11. and there are some clarifications:
- wound dressing rules now make explicit reference to devices which come into contact with skin or mucous membrane
- There’s some clarification around medical device data systems with implementing rule 3.7 stating: “A device is considered to allow direct diagnosis when it provides the diagnosis of the disease or condition by itself or when it provides decisive information for the diagnosis”
There’s also a new special subclass of Class I. The familiar measuring function and sterile Class I(m) and I(s) remain. But now reusable surgical instruments are required to be assessed by a Notified Body specifically in relation to their cleaning and sterilization.
Clinical Evidence, Postmarket Follow Up and Risk Reviews
The strengthening of clinical requirements has long been anticipated. The Final text retains the explicit requirements for clinical evaluation of all devices irrespective of class and is specific that clinical evaluation shall include consideration of all information sources including pre-clinical data, risk management, literature and direct clinical experience. Class III devices are required to have direct clinical trial data except in the specific circumstance of design iterations from a previous device – where a justification can be provided based on review of testing, or by comparison with another manufacturer’s devices as a predicate – but only if the other manufacturer will provide complete and perpetual access to the technical file information of the predicate. Good luck with that!
Clinical Evaluation reports are expected to be prepared by a team of experts including bio-statisticians, medical writers, product specialists and a clinician – who must sign off the report. Experts are required to be appropriately trained or experienced with degree level qualifications or lengthy direct experience.
Clinical Evaluations must be reviewed periodically (Annually for Class III devices) and the reviews used to recalibrate risk management files. All class III devices and any device which relied on predicate comparisons must be subject to active postmarket clinical follow up and again the information gained must feed into risk management review.
Lots and Lots of New Reports to be Reviewed
Get used to some new acronyms. Manufacturers will need to prepare a Periodic Safety Update Report (PSUR), Post Market Clinical Follow Up (PMCF) reports and Summary of Safety and Clinical Performance. For higher risk devices these will need to be reviewed by the Notified Body (at a fee of course), along with updates to the Clinical Evidence Report.
Eudamed – the home of Big Data?
All of this expanded regulation and oversight is to be managed by a pan-European Database which will hold all of the various reports, records of assessments of manufacturers, and of Notified Bodies, as well as details of all economic operators and of all devices supplied in Europe. The Regulation calls for the Commission to complete a plan to build the database within a year and to have it operational before the end of the three year transition. It’s an ambitious target given the glacial progress to date of implementing just the registration part. There are perhaps pious hopes of the Commission being able to data mine the Eudamed database to discern trends of device failure and provide postmarket early warning. And on the subject of postmarket databases, the regulations call for establishment of registries for high risk implants (as we have seen recommended here in Australia). However there are no details of how this will be done or paid before. It’s essentially an unfunded mandate.
Finally – the timetable for the transitional arrangements is looking ambitious at best. Given the very lengthy process for Notified Body Designation, it’s inlikeikely that conversions of device approvals to the new regulations will start before 2019, leaving just 18 months to re-qualify the entire European device Inventory. Good Luck with That! Given that the MDR transition overlaps with the transition to ISO 13485:2016 and the implementation of the Medical Device Single Audit Program – there’s plenty of opportunity for confusion and delay. This graphic shows why…
So there it is. By any standard there’s a lot going on. watch this space for more detailed reviews of some for the upcoming changes and for Webinars where we explore aspects in detail, with live Q&A.
- European Medical Device Regulation (PDF / HTML Web page)
- European IVD Regulation (PDF / HTML Web page)
- Official journal for links to multiple language versions
- Medical Device General Safety and Performance Requirements (MDR Annex I)
- Medical Device Classification Rules (MDR Annex VIII)
Click here to download
Blog – Summary of changes
Need help with CE marking or exporting to Europe? We offer comprehensive regulatory servies including development of ISO 134865 quality systems, preparation of European Technical Files and of Expert reports for biocompatibility and Clinical Evaluation. Contact us now to hear how we can support your CE marking. Call us on +61 2 9906 2984 or email firstname.lastname@example.org.