Representing one of the largest medical device markets in the world, the European Union (EU) recently underwent a significant regulatory shift. In 2016, the European Council, Parliament and Commission agreed on final regulatory texts that will govern medical devices and in vitro diagnostic medical devices (IVD), reportedly beginning in 2020. The proposed regulations, the Medical Devices Regulation (MDR)1 and the in vitro Diagnostic Medical Devices Regulation (IVDR)2 are designed to fill the regulatory gaps uncovered, as technology outpaced the current regulatory regime, which was last updated in 2007. This new regulatory order, reportedly scheduled to be published in the Official Journal of the European Union in the spring of 2017 and to become fully effective three to five years later, ushers in a new regulatory era for medical device and IVD manufacturers throughout the world.
This client alert, focusing on the common provisions found in both regulations, is the first in a series of three that examine the provisions of each new regulation and the potential impact on the medical device and IVD industry. The second client alert will focus on the provisions specifically related to medical devices in the MDR, and the third on the provisions specifically related to in vitro diagnostic medical devices in the IVDR. All three client alerts are based on the form of the proposed Regulations as of December 2016.
This alert will focus on the common provisions between the two proposed regulations, including:
Economic actors and regulatory duties
Regulatory enforcement actions
General quality management system requirements
Summary of safety and clinical performance
Unique Device Identifiers
General points on conformity assessments
Clinical investigations and performance studies
Medical devices and IVDs placed on the market in the EU are currently governed by a set of three main Directives.3 One important point differentiates these Directives from the proposed Regulations, and that is their mode of operation. Directives set out the results that should be achieved by the Member States, leaving each Member State to determine how it will achieve such results. A Member State must transpose the Directive's requirements into its own national laws. Regulations, on the other hand, are "binding in their entirety and directly applicable."4 This means that Regulations need not be transposed into national laws, and that they supersede incompatible national laws.5 Member States are not stripped of their authorities by a Regulation, however. The new regulations for medical devices and IVDs do allow Member States to continue to survey their own markets and make decisions as to whether a device is banned from the Member State's market.
The MDR and the IVDR are, at the same time, similar and quite different from their predecessor Directives. Manufacturers should examine the more prescriptive elements in the MDR to ensure that their systems and devices still comply. The MDR is more specific than the Directives in the way it mandates how manufacturers comply with its regulatory requirements. Thus, even currently compliant manufacturers should ensure that their systems and devices placed on the market in the manufacturer's name will continue to comply under the new proposed MDR. In contrast to that of medical devices, the regulatory scheme for IVDs represents a drastic change from the current requirements in the Directive. For example, the new classification scheme will purportedly bring 80% of all IVDs under the umbrella of the IVDR (a notable increase from the 20% currently under the purview of the Directive), creating significant regulatory hurdles for new and legacy IVDs, even if the IVD fell within the purview of the previous Directive. However, IVD manufacturers may find it easier to create a new system according to the regulatory requirements than medical device manufacturers find it to revise their existing system. Regardless, medical device and IVD manufacturers should closely examine the proposed regulations to establish and analyze the gap between the current and upcoming requirements to ensure market access.
1 Harmonized Proposal for a Regulation of the European Parliament and of the Council on medical devices, and amending Directive 2001/38/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 (Hereinafter MDR). Each citation only points to the MDR, even though IVDR contains the same language.
2 Harmonized Proposal for a Regulation of the European Parliament and of the Council on in vitro diagnostic medical devices.
3 Council Directive 93/42/EEC of 14 June 1993 concerning medical devices; Council Directive of 20 June 1990 on the approximation of the laws of the Member States relating to active implantable medical devices (90/385/EEC); Directive 98/79/ EC of the European Parliament and of the Council of 27 October 1998 on in vitro diagnostic medical devices.
4 European Parliament, Sources and Scope of European Union Law. 2016.
One of the first major differences between the Directives and the MDR and the IVDR is the number and type of defined terms. Many material terms in the Directives were undefined, leaving Member States to fill in the gaps, sometimes in different ways. There are more definitions in the MDR and IVDR, leaving them less open to interpretation. The number and type of defined terms can signal the focus of the MDR and IVDR. For example, new definitions related to clinical evaluations and clinical investigations point to the increased focus and specificity on these topics in the chapters and annexes devoted to them later on in the regulation. Likewise, definitions related to post-market surveillance and vigilance signal the increased prominence of the post-market surveillance system in the manufacturer's quality management system.
Economic Operators and Regulatory Duties
The MDR and IVDR include definitions and duties for economic operators in a device's distribution chain, including new operators that were not mentioned in previous regulatory regimes. The Directives gave only the manufacturer the legal and regulatory duty of control over the product through manufacturing and distribution. While the MDR and IVDR still charge the manufacturer with this duty, other economic operators such as distributors and importers will have roles to play as well. Additionally, for economic operators such as manufacturers and authorized representatives, the regulatory duties are spelled out and enhanced in an attempt to leave no liability gap with respect to placing devices on the market and putting them into service.
A manufacturer is "the natural or legal person who manufactures or fully refurbishes a device or has a device designed, manufactured or fully refurbished, and markets that device under his name or trademark."6 Article 8 in both regulations outlines the regulatory duties for manufacturers. For example, manufacturers must meet all the following obligations:
Record and report incidents and field safety corrective actions, and document and maintain a risk management system
Conduct a clinical evaluation according to the regulatory requirements in Article 49 and Annex XIII
Draw up and regularly update their device's technical documentation according to the regulatory requirements in each Regulation's annex
Comply with the EU unique device identifier (UDI) requirements
Ensure procedures are in place that allow the manufacturer and their devices to maintain conformity to the regulation
6 MDR Article 2(19).
Manufacturers Own Brand Labelers
Own Brand Labelers (OBL) are also manufacturers, and so must adhere to the regulatory requirements for manufacturers. An OBL, also known as a "private label manufacturer," places another manufacturer's (the OEM) certified devices on the market under the OBL's own name. An agreement between the OEM and OBL outlines the extent to which the OEM and OBL share legal responsibility for the device and documentation. Competent authorities have tolerated this arrangement to varying degrees under the current regulatory scheme. However, the MDR and IVDR change this by placing regulatory responsibilities squarely on the manufacturers' shoulders, regardless of whether the manufacturer is an OEM or an OBL. This includes the requirement to "draw up and keep up to date the technical documentation . . ." to which the OBL may not currently have complete access. This could be a dramatic shift in regulatory duties for some OBLs, for which OBLs and OEMs may find the need to update commercial arrangements to accommodate.
An authorized representative is a "person established within the [European] Union who has received and accepted a written mandate from a manufacturer, located outside the European Union, to act on his behalf in relation to specified tasks with regard to the latter's obligation under this Regulation."7 Authorized representatives are mentioned in the Directives as the manufacturer's representative in the EU, but the MDR and IVDR go a step further and dictate activities that the authorized representative must be able to perform according to its contract with the manufacturer. For example, authorized representatives must be able to keep available a copy of the technical documentation, and verify that the manufacturer has complied with its registration obligations.8 Currently, there is no regulatory obligation for authorized representatives to verify the manufacturer's registration in any Member State. Importantly, authorized representatives are to be held jointly and severally liable with its client manufacturer when the manufacturer breaches it regulatory duties.9
Importers and Distributors
Importers and distributors are also specified in the MDR and IVDR. An importer is a "person established within the Union who places a device from a third country on the Union market."10 A distributor is a "person in the supply chain, other than the manufacturer or importer, who makes a device available on the market, up until the point of putting [it] into service."11 Importers and distributors have the duty, among others, to verify that the devices they import or distribute have the correct documentation in place, including the CE marking, UDI and any product information that accompanies the device.12 Importers and distributors also must keep complaint records and inform the manufacturer of these complaints.13
7 MDR Article 2(20).
8 MDR Article 9(3).
9 Id. at Article 9(4a).
10 Id. at Article 2(21).
11 Id. at Article 2(22).
12 Id. at Article 12(2).
13 Id. at Article 12(5).
Person Responsible for Regulatory Compliance
The MDR and IVDR also require the manufacturer to designate a person who is responsible for regulatory compliance. Such individuals must have the requisite experience in the field of medical devices, shown through a combination of education and experience in medical device regulatory affairs.14 In general, this new position should be an internal position for the manufacturer, except that micro and small enterprises may employ a contractor who is permanently and continuously at their disposal.15 The person responsible for regulatory compliance is responsible for ensuring:
The conformity of the devices is checked against the quality management system before the device is released
The technical documentation and the declaration of conformity are drawn up and kept up to date
The manufacturer complies with the post-market surveillance operations, including its vigilance reporting obligations
If the device is investigational, a statement that the device conforms to the general safety and performance requirements according to Annex XIV section 4.116
Regulatory Enforcement Actions
The MDR and IVDR include specific market enforcement duties for the new and existing regulatory operators. While notified bodies and competent authorities have always had regulatory duties regarding market access and surveillance, the MDR and IVDR include provisions to close gaps between competent authorities' actions, reporting duties when taking actions against a manufacturer, and information sharing and cooperation. First, the two regulations require that competent authorities make annual plans to "check on the conformity characteristics and performance of devices including...review of documentation and physical or laboratory checks...."17 Under the Directives, competent authorities have the option to inspect manufacturers that commercialize product on the market the competent authority surveys, but competent authorities had no mandate to do so on a regular basis. Competent authorities may also sample products, free of charge, and can carry out unannounced inspections of economic operators, suppliers and/or subcontractors, and professional users.18 In addition to these surveillance duties, competent authorities are required to report their surveillance activities to other competent authorities.19 In addition to inspections, competent authorities may restrict or prohibit products placed on the market when the economic operator does not comply with the competent authorities' required actions.20
14 Id. at Article 13(1). 15 Id. at Article 13(1a). 16 Id. at Article 13(2). 17 MDR Article 67(1). 18 Id. at Article 67(1b). 19 Id. at Article 67(1c). 20 Id. at Article 73.
The most direct way manufacturers, including OBLs, can directly feel regulatory changes is through notified body audits. There have been reports that, in preparing for the regulatory changes, notified bodies are already requesting more, and more robust, clinical data and clinical evaluations, and performing longer audits to incorporate the additional requirements. Even though the regulations are not yet formally published or enforced, many competent authorities have reportedly instructed notified bodies to gather more evidence for some devices and have questioned notified bodies' rationales for allowing certain devices on the market. Additionally, the unannounced audits that some in the industry find contentious will be a permanent and explicit requirement of the manufacturer's conformity assessment.21
Quality Management System Requirements
As in the Directives, manufacturers will be required to operate a comprehensive quality management system. However, the MDR and IVDR specify what that system must include and how the manufacturer must operate it. These additional requirements emphasize the system's continuous loop of feedback, analysis and action. Annex VIII, the conformity assessment that includes a review of the quality management system and technical documentation, instructs notified bodies to pay particular attention to the procedures and techniques the manufacturer uses to address the following:
The strategy for regulatory compliance, including how the manufacturer identifies the legal requirements, qualification, classification and choice of conformity assessment procedures
Identifying applicable general safety and performance and how the manufacturer meets these requirements
The risk management system22
One sub-system of the quality management system that explicitly requires the feedback loop is the post-market surveillance system. According to Article 60a, the post-market surveillance system "shall be suitable to actively and systematically gather, record and [analyze] relevant data on the quality, performance and safety of a device throughout its entire lifetime, to draw the necessary conclusions and to determine, implement and monitor any preventive and corrective actions."23 Data that the post-market surveillance system gathers is used to:
Update the risk-benefit ratio for risk management, design, manufacturing information and labeling
Update the clinical evaluation
Update the summary of safety and clinical performance
Identify needs for preventive, corrective or field safety corrective actions
Identify possibilities to improve the usability, performance and safety of the devices
21 Id. at Annex VIII.4(4). 22 MDR Annex VIII(3.2). 23 Id. at Article 60a(3).
Contribute to post-market surveillance for relevant other devices
Detect and report trends24
In this way, manufacturers should be able to use the data gathered through the post-market surveillance system as inputs in the various sub-systems as a way to continuously improve their products.
Summary of Safety and Clinical Performance
The MDR and IVDR have a larger emphasis on transparency than the previous Directives, which is illustrated by including the Summary of Safety and Clinical Performance. Manufacturers of high-risk medical devices and IVDs must generate a Summary of Safety and Clinical Performance for the devices put on the market under the manufacturer's name, to be included in the device's technical documentation. This Summary of Safety and Clinical Performance includes:
Identification information about the device and the manufacturer
The intended purpose of the device and its indications and contraindications
A description of the device with a reference to any earlier versions and a description of the differences, and descriptions of any accessories or other devices intended to be used with the device
Possible diagnostic or therapeutic equivalents
References to harmonized standards and common specifications
The summary of clinical evaluation and any relevant information on post-market clinical follow-ups
Suggested users and user trainings
Information on any residual risks and undesirable effects, warnings and precautions25
This publicly available document is submitted in draft form as part of the manufacturer's conformity assessment, and must be written such that the user can understand the contents.
Unique Device Identifiers (UDI)
Unique Device Identifiers are "a series of numeric or alphanumeric characters...created through internationally accepted device identification and coding standards and that allows unambiguous identification of specific devices on the market."26 UDIs consist of a device identifier and a production identifier that are placed on the label of a device or on its package and are used by economic operators, users and customers for traceability purposes.27 Both proposed regulations provide for a UDI Database to be established to "validate, collate, process and make the core data elements for UDIs accessible to the public."28
24 Id. at Article 60a(4). 25 MDR Article 26(1a). 26 Id. at Article 2(13). 27 Id. at Article 24(1). 28 Id. at Article 24a(1).
Additionally, both regulations require compliance with the respective UDI provisions earlier than the application date for some classes of medical devices, so manufacturers should take this into account when constructing their plan for compliance.
Manufacturers will still assess the conformity of a device before placing it on the market by performing conformity assessments. In both the MDR and IVDR, the conformity assessment procedures are found at Annexes VIII-X and comprise a review of the manufacturer's quality management system and the device's technical documentation. Similar to the Directives, the manufacturer has a choice of conformity assessment, depending on the class of the device and how the manufacturer structures its quality management system and company. The product-specific client alerts that follow will go into detail as to each regulation's conformity assessment requirements.
Clinical Investigations and Performance
While the Directives required some clinical data in the conformity assessments, manufacturers and notified bodies focused on the MEDDEV Guidance Documents to help determine what data and how much to include. Incorporating provisions from the most recent MEDDEV Guidance Document on clinical evaluations, the MDR and IVDR include more requirements on the amount and type of clinical data a manufacturer uses to prove its device's conformity. Clinical investigations and performance studies are generally under the jurisdiction of the Member States, and sponsors must apply to the Member States or other organizations for study approval. The MDR and IVDR do not supersede Member States' authority in approving and denying clinical investigations and performance studies to be conducted on their market, but the two Regulations do provide a framework within which the Member State would operate. To this end, the two Regulations include initial requirements for beginning, operating and ending clinical investigations for medical devices and performance studies for IVDs. Additionally, the two Regulations include informed consent requirements that are in addition to those of the Member State in which the investigation or study takes place, and contain requirements for the Member States' ethical reviews of the investigations and studies.
Continued market access will be an issue for manufacturers throughout the regulatory transition, with many questions regarding the ongoing validity of manufacturers' current certificates. Before manufacturers may be assessed according to these new requirements, however, notified bodies must be notified, or accredited, to render certificates according to the new requirements. Both regulations provide for certificates issued according to the Directives during the transition period to be valid up to four years after the regulations' application dates. It is expected that notified bodies will begin to be notified to the new regulations about 18 months after the regulations' entry into force, and start to certify manufacturers to the MDR and IVDR as the certificates issued according to the Directives expire.
Already, the additional controls placed on notified bodies, the additional time necessary to assess the notified bodies and the decreasing number of notified bodies has created a bottleneck of audits and assessments.
Manufacturers without certificates to the MDR or IVDR at the conclusion of the transition period, and whose certificates issued according to the Directives are about to expire, may be unable to distribute products in the EU market. Manufacturers and other economic operators should examine the proposed regulations to see how they impact operations and relationships with their subcontractors and suppliers, and how to adapt current systems to the new requirements. Making a plan, communicating with the notified body and adhering to the plan are key actions in this transition period.
Our lawyers have significant expertise advising clients on EU medical device regulatory issues. For more information about these regulations, or for help, contact your principal lawyer or any of the lawyers listed in this alert.
Aline Doussin T +44 207 655 1146 E firstname.lastname@example.org
Maren Ebner T +49 69 1739 2448 E email@example.com Joachim Heine T +49 69 1739 2430 E firstname.lastname@example.org
Colleen Hermann T +1 214 758 3402 E email@example.com
Adrian Spooner T +44 207 655 1067 E firstname.lastname@example.org
Sarah Stec T +1 202 457 6304 E email@example.com
John Wyand T +1 202 626 6676 E firstname.lastname@example.org
The contents of this update are not intended to serve as legal advice related to individual situations or as legal opinions concerning such situations, nor should they be considered a substitute for taking legal advice. Squire Patton Boggs. All Rights Reserved 2017