Understanding The Impact Of New European MDR And IVDR On Quality And Regulatory System Resources

Despite of the political turmoil in Europe with “Brexit,” the new Medical Device Regulations (MDR) and In-Vitro Diagnostic Regulations (IVDR) have been officially adopted.

As a result of the changes wrought by the new regulations, many adjustments will be required in the roles and responsibilities of those involved in manufacturing and distribution of medical device products into Europe, which are covered in articles 10-15 of the new regulation. These changes are substantially different from the current Medical Device Directives, and will affect all medical device companies including manufacturers, importers, distributors, and authorized representatives.

In February, the European Council released the final MDR and IVDR texts, which were approved in March by the European Council and in April by the European Parliament. The regulations were published on May 5, 2017 in the Official Journal of the European Union, and both will enter into force on May 26, 2017. Thus, the new MDR rules will apply on May 26, 2020, and IVDR rules in 2022. The primary goal is to increase emphasis on safety and effectiveness after several incidents in the European market revealed regulatory weaknesses, and the changes will require adjustments in the roles and responsibilities of existing resources. In this article I attempt to summarize the organizational adjustments that shall be made in order to fulfill the new expectations.

New Unique Device Identification (UDI) Requirements

There are many requirements associated with verifying UDI, including a requirement to place it on the label of the device and all higher levels of packaging (not shipping containers). Additionally, UDI device identifiers (Basic UDI-DI, defined in Annex V Part C) must appear on the EU declaration of conformity.  

The European UDI System was designed to improve the traceability of medical devices and IVDs, and to improve incident reporting, as well as field safety corrective actions and monitoring by the competent authorities. Article 27 and Annex VI of the regulation define requirements for UDI; these requirements vary depending on the risk of the device. UDI will be used to report serious incidents and field safety corrective actions to comply with Article 87 of the Regulation. MEDDEV templates have been developed that will include numeric descriptions and UDI, and it is the manufacturer’s responsibility to keep the list of UDIs that it has been assigned up-to-date.

Manufacturers of implantable devices must provide UDIs on the devices’ accompanying implant cards.

European Authorized Representatives, importers, distributors and health institutions must store, preferably by electronic means, UDIs of devices they supply if those devices are class III implantables. EU member states expect health institutions and healthcare professionals to store the UDIs of the devices they have been supplied with, as well.

Annex V indicates a new UDI-DI is required whenever there is a change that could lead to misidentification of the device and/or ambiguity in its traceability — in particular, any change of one of the following UDI database data elements: brand name, device version or model, labelled as single use, packaged sterile, need for sterilization before use, quantity of devices provided in a package, critical warnings, or contraindications.

Before a device is placed on the market, the core data elements have to be submitted to the UDI database, and the devices and the device packages must have UDIs visible via an approved UDI carrier [e.g., a bar code accompanied by Human Readable Interpretation (HRI)].

Additionally, several device classification changes will affect UDI. For example, reusable surgical instruments will shift from from Class I to Class IIa, and products for cleaning/disinfection of medical devices, as well as some IVDs, will be impacted.

Implementation Of EU Product Rules – Regulatory System Roles

Four different actors involved in the regulatory process are described in the “Blue Guide” legislative framework published in 2016: 

1. The European Commission, European Council, and Parliament — In charge of administrative tasks, development of legislation, and support and cooperation between states and other critical players. Additionally, these entities ensure cooperation between Notified Bodies, and keep the list of Notified Bodies up-to-date.
2. Member States: EU, European Economic Area, European Free Trade Association (EFTA), Customs Union (EUCU), and the Mutual Recognition Agreement (MRA) countries — In charge of national law enforcement, designating notified bodies, and ensuring that only safe and compliant products are commercialized.
3. Notified Bodies — Conduct conformity assessments on manufacturers
4. Manufacturers, Importers, Distributors, Suppliers, Subcontractors, and EU Authorized Representatives — This group is known as economic operators, and they have ultimate responsibility for conformity to the regulations.

Medical Device Coordination Group

The new regulations require establishment of an expert committee composed of persons designated by the member states, based on the individuals’ roles and expertise in the field of medical devices, including IVDs. Committee members will provide advice to the Commission and assist both the Commission and member states in ensuring harmonized implementation of the new regulations. The group should be able to establish subgroups so as to have available in-depth technical expertise regarding all medical devices, including IVDs.

Each member state must appoint one committee member and one alternate to a three-year term. The committee will advise the Commission in matters concerning Notified Bodies, develop guidance to ensure smooth rollout of the regulations (i.e., conduct clinical and performance evaluations, clinical investigations, performance studies, and monitor Notified Bodies), and contribute to monitoring the technical progress of safety and performance requirements to ensure they are adequate.

The commission and member states also will participate in the development and implementation of delegated acts, implementing acts, and common specifications. Delegated acts are used to modify or amend the “what” of legislation. Examples include amending the list of products with no medical purpose, amending elements of technical documentation, adjusting minimum content of the Declaration of Conformity, and amending requirements for performance studies.

Implementing acts are used to clarify and implement the “how” of legislation. Examples include determining whether products fall within the definition of a medical device, defining arrangements for review of technical and clinical assessments conducted by Notified Bodies, and ensuring uniform documentation is submitted for clinical investigations and performance studies.

Common specifications, detailed under Article 9 of the regulation, are used when no harmonized standards exist, or when harmonized standards are not sufficient. They define criteria for meeting safety and performance requirements, clinical evaluation requirements, and requirements for technical documentation. They can also be used for products with no medical purpose, or for single-use devices that go through reprocessing.

EU Authorized Representatives

The new regulation specifies certain obligations that a manufacturer cannot delegate to an EU representative, including design and manufacturing, risk management, clinical evaluations, technical documentation, Declaration of Conformity, UDI, quality management system (QMS), postmarket surveillance, corrective and preventive action (CAPA), and field safety corrective action (FSCA). The manufacturer ultimately is responsible for these activities, but EU representatives will be more legally liable than in the past. In fact, they now are required to terminate their mandate if the manufacturer acts contrary to its obligations under the regulation, and must inform the member states and Notified Body of any such occurrence.

Article 11 indicates that, when a manufacturer is not established in a member state, its device may only be placed on the EU market if said manufacturer designates an authorized representative. The designation is valid only when accepted in writing by the EU authorized representative, and is effective for all devices of the same generic device group. The authorized representative is to perform all tasks specified in the agreed-upon mandate, and to provide a copy of this mandate to the competent authority upon request. The mandate requires, at least, verifying that the Declaration of Conformity and the technical documentation are drawn up, and verifying that the conformity assessment performed is appropriate.

The authorized representative also needs to ensure that copies of the technical documentation, the Declaration of Conformity, and the Notified Body certificates are available for at least 10 years after the device was last placed on the market; for implantable devices, the requirement is 15 years. In addition, the authorized representative must register with a Single Registration Number, as well as verify that the manufacturer has entered UDI information and basic UDI-Dis for all products.

Finally, EU authorized representatives must provide information to the competent authority, upon request, to demonstrate conformity in the requested language; forward any requests for samples to the manufacturer and ensure these devices are accessible; cooperate with competent authorities in any CAPAs; and communicate with the manufacturer about complaints and reports.

Notified Bodies will start looking at agreements between the manufacturer and authorized representatives during audits to assess compliance with these requirements.

Person Responsible For Regulatory Compliance

The regulation requires manufacturers and authorized representatives to have, permanently and continuously at their disposal, at least one person responsible for regulatory compliance who possesses the requisite expertise in IVDs. Microenterprises (e.g., those employing fewer than 10 people, and with revenues lower than €2 million) and small enterprises (e.g., those employing fewer than 50 people and with revenues lower than €10 million) are not required to have this person available within the organization, but must have access to such an individual.

This person is responsible for ensuring that the conformity of devices is properly checked, before product release, according to quality system requirements; the technical documentation and Declaration of Conformity are available and up-to-date; and that postmarket surveillance and reporting obligations are complied with.

General Obligations Of Manufacturers

Manufacturers bear the biggest burden in ensuring compliance to the regulations. Article 10 lists manufacturers’ general obligations, explaining what they need to do, and the Annexes explain how they need to do it. Here is a summary of the responsibilities:

• Conduct clinical evaluations, including post-market clinical follow-ups
• Ensure technical documentation is available for all devices, including custom-made devices. (10 years for most devices, 15 years for implantable devices)
• Declaration of Conformity written and affixed to CE marking of conformity
• UDI compliance
• Establish a system for risk management
• Establish a quality system that covers all parts of the organization dealing with quality processes (mainly tied to ISO 13485:2016)
• Taking corrective action to ensure a device conforms to the regulation when deficiencies are identified. Distributors, EU authorized representatives, and importers should be notified. If the device presents a serious risk, competent authorities of the member states in which the device is available and the Notified Body that issued a certificate for the device must be notified of the corrective action taken.
• Ensure incidents and field safety corrective actions are recorded and reported
• Cooperate with competent authority to provide information or product samples as needed
• Ensure EUDAMED is notified in the event a device is designed or manufactured by another legal entity.
• Ensure processes are in place to manage compensation claims for damages caused by a defective device
• Ensure each authorized representative has the necessary information permanently available
• Ensure procedures are in place to keep production conformant with the regulation
• Implement a postmarket surveillance program and ensure it is up to date
• Ensure devices are accompanied by all relevant information in the languages determined by the member states where each device is available. The label shall be indelible, easily legible, and clearly comprehensible to the intended user or patient.

Attend Marcelo’s webinar to ensure your Quality System meets new expectations.

Simplifying Your Quality System While Implementing ISO 13485:2016 Requirements

 

Importers And Distributors

Distributors and importers have a lot more responsibilities under the new regulations. These are summarized as follows:

• Act with due care when making a device available on the market, per applicable requirements
• Verify that devices are CE marked, a Declaration of Conformity is available, the importer name and address is on the label (if applicable), and that UDI numbers were assigned by the manufacturer
• Notify the manufacturer, EU authorized representative, and importer when they believe a device is not conformant with the regulation, and cooperate with all relevant parties to ensure proper actions are taken. Notify competent authority and Notified Body if they consider a device to be falsified or present a serious risk.
• Track complaints, non-conforming devices, recalls, and withdrawals. Provide information, as necessary, to manufacturer (or to other parties requesting related information) to assist with investigations
• Immediately notify relevant parties of complaints or reports from healthcare professionals, patients, or users regarding suspected incidents related to a device
• Grant access to the device by providing device samples free of charge to competent authorities, when requested
• Ensure existence of a registered trade name and a registered place of business (and address) where they can be contacted, and ensure labeling is clear and legible. Keep copies of Declaration of Conformity and Notified Body certificates (applies to importers — 10 years for most devices, 15 years for implantable devices)
• Ensure that storage or transportation conditions comply with the conditions set by the manufacturer (applies to distributors)

European Database On Medical Devices

Several articles in the regulation address requirements to register information electronically under EUDAMED, as part of the MDR and IVDR, for the economic operators (numeric codes for all actors are described under the Blue Guide). These codes, and the resulting database, will follow devices across the entire supply chain:

• Electronic System on Registration of Devices — All medical devices and IVDs, for all economic operators
• Electronic System on Notified Bodies and Certificates — Includes subsidiaries, experts, Notified Bodies, and certificates including UDIs and Summary of Safety and Performance
• Electronic System on Vigilance and Post Market Surveillance — Includes serious incidents, FSCAs, periodic summary reports, trend reports, Field Safety Notifications, and periodic safety update reports
• Electronic System on Market Surveillance — Includes surveillance activities, devices presenting an unacceptable risk, non-compliant products, and preventive health protection measures
• Electronic System on Clinical Investigations — Includes sponsors, description of investigational device, status, and adverse events.
• Electronic System on Performance Studies (IVDR only) — Includes sponsors, description performance studies, status, and adverse events
• UDI Database — UDI database for all medical devices and IVDs

Summary

The new regulations include significant changes, including verification of the Declaration of Conformity and technical documentation, the addition of a designated person responsible for regulatory compliance, verification that UDIs are properly used, new labeling requirements, demonstration of device conformity to regulations, and involvement in postmarket surveillance.

Organizations commercializing products in the EU must prepare to adopt these new rules, as “grandfathering in” will not be allowed, and each device must be certified under the new rules in the transitional time frames that have been defined — as previously stated, the new regulations are expected to be adopted in the first half of 2017, with medical device manufacturers having 36 months, and IVD manufacturers  60 months, to meet the new requirements once they are officially implemented. While manufacturers, authorized representatives, importers, and distributors will have time to transition to the new regulation, it is important to start planning as soon as possible to prepare for the many requirement changes. 

About The Author

Marcelo Trevino is the President, Global Regulatory Affairs and Quality Systems, at TregMedical, a life sciences group focused on global medical device regulatory, quality, and compliance. Marcelo can be reached at: marcelotrevino@outlook.com

Marcelo has 23+ years’ experience in quality and regulatory affairs, serving in multiple senior leadership roles with different organizations while managing a variety of medical devices: surgical heart valves, patient monitoring devices, insulin pump therapies, surgical instruments, orthopedics, medical imaging/surgical navigation amongst others. He has an extensive knowledge of medical device management systems and medical device regulations worldwide (ISO 13485:2016, ISO 14971:2019, EU MDD/MDR, MDSAP). Mr. Trevino holds a B.S. degree in Industrial and Systems Engineering and an MBA in Supply Chain Management from the W.P. Carey School of Business at Arizona State University. He is also a certified Quality Management Systems Lead Auditor by Exemplar Global.

He has experience working on Lean Six Sigma Projects and many Quality/Regulatory Affairs initiatives in the US and around the world including Third Party Auditing through Notified Bodies, Supplier Audits, Risk Management, Process Validation and remediation activities.

Additionally, he is a Certified Six Sigma Black Belt and Biomedical Auditor through the American Society for Quality (ASQ) and holds Certificates in Environmental & Sustainability Management Regulatory Affairs Management from University of California, Irvine.

He regularly publishes articles to assist corporations in their quest for exceptional quality and regulatory compliance.