New EU medical device regulations pose many compliance challenges

New regulations in the European Union aimed at modernizing the regulatory framework for medical devices are imposing several new compliance obligations on all medical device makers that want to market and sell their products in the EU.

The EU in May finalized and published two new regulations that fundamentally change and strengthen EU law on medical devices and in vitro diagnostic medical devices. Medical device makers now have until 2020, and in vitro diagnostic medical device makers have until 2022, to come into compliance with the requirements.

The Medical Device Regulations (MDR) and In Vitro Diagnostics Regulations (IVDR) replace three former directives on medical devices, last updated in the 1990s. Since adoption of the old directives, new methods and technologies have turned the life sciences industry on its head, necessitating that the legal framework for medical devices be modernized. “The new rules…better reflect the most recent scientific and technological progress and set the gold standard for medical device regulation globally,” the European Commission stated.

Because these are regulations, as opposed to a directive, they apply directly in EU member states without having to be implemented in national legislation and, thus, unify the legal framework for medical devices throughout the EU. They will bring with them tighter scrutiny over the 500,000 types of medical devices currently available in the EU, and apply to both medical devices made in or imported to the EU.

“The new regulations will affect the entire supply chain,” says Fiona Maini, life sciences director at Deloitte. “Any organization putting a device on the EU market will need to conform to the requirements, including manufacturers, distributors, and importers.” Manufacturers located outside the EU can appoint an authorized representative within the EU to act on their behalf, she says.

The regulations will affect medical-device and IVD companies from a commercial, portfolio, research and development, process, and organizational standpoint: “Compliance will require an enterprise-wide approach, pulling together a multi-disciplinary team,” Maini adds. “This will require cross-functional governance, program planning, business process engineering, change management, technology evaluation, and effective deployment to meet compliance.”

These new rules are just one of a number of regulatory initiatives underway within the EU that distinguishes it as a regulatory regime of interest. They matter not just to compliance officers within the medical devices industry, but to any company that has medical devices in its supply chain, as well as any companies manufacturing similar products that either operate in the EU or do business in it.

Revised product definitions and classification rules. The new regulations modify certain product definitions. For example, some products regulated under the old directive as “accessories” now constitute a medical device under the new regulations.

The new regulations also modify the classification rules of certain products, using the following risk categories: class 1 (low risk); class IIa and IIb (moderate risk); and class III (high risk). Under the new rules, certain medical devices and IVDs have been reclassified to a higher risk class, requiring greater scrutiny by oversight bodies, particularly as it concerns class II and class III devices.

Additionally, the MDR regulation applies new rules to medical software. Software that drives a device or influences the use of a device falls within the same class as the device. If the software is independent of any other device, it will be classified separately.

From a compliance standpoint, this means manufacturers will need to fully review and reassess their portfolio of products against the new regulations. Which products in your portfolio will be affected by the changes to the definition of a medical device, and what products need to be reclassified?

Notified Body oversight. Ensuring compliance with the new regulations is particularly important since the new rules also afford greater oversight to notified bodies by National Competent Authorities (NCAs) to increase scrutiny during certification, as well as post-certification and marketing stages. The new rules also allow notified bodies to conduct unannounced audits.

“The notified body landscape is expected to change drastically under the new regulations, and it will be necessary to maintain dialogues throughout the transitionary period,” Maini says. “Companies will need to be constantly prepared for unannounced audits, which will require that all documentation and operational processes are continuously accurate and compliant at all times throughout the product lifecycle.”

Supplier management and vendor selection will be a crucial aspect, as companies will need to know who their suppliers are and have contracts in place that address the subject of unannounced audits, as well as what is expected from them to satisfy compliance with the regulations, Maini says. “The activities should be the basis of a multi-year roadmap and a dynamic implementation plan as requirements are further clarified.”

KEY CONSIDERATIONS

Fiona Maini, life sciences director at Deloitte, offers some key questions to consider when assessesing compliance with the Medical Device Regulations and In Vitro Diagnostics Regulations.
How aware is the wider organization and senior leadership of these mandatory changes?
What are the costs and resource implications of the new regulations on my business?
Will the new regulations impact current regulatory and market-access strategy?
Based on the product portfolio assessment will divestiture of products be necessary? Does the benefit of compliance outweigh the costs to comply?
What does my pipeline of new and established products look like in terms of re-certification?
What will the future Notified Body landscape look like, and how do I engage early to avoid delays and loss of market access?
Do I have sufficient safety and/or performance evidence for recertification as well as a risk-based post-market follow-up plan?
What are the changes required to my technical files across the portfolio? Are formats consistent across design centers?
What changes are required to existing systems (e.g. QMS, Complaints, Safety, Regulatory Information Management, UDI and labeling), and what new systems might be required to support compliance? Is our data landscape harmonized across the enterprise and franchises? Are there opportunities to use new technology to facilitate this?
Do I have a full and transparent view of my supply chain? How can I ensure compliance throughout it?
Are there opportunities to build value beyond compliance?
Source: Compliance Week

Clinical evaluations. Greater emphasis will now be placed on clinical evidence to support medical device registration and post-market safety. Medical-device makers must create a clinical development plan, including a plan for post-marketing surveillance.

“A device may be placed on the market or put into service only if it complies with this regulation when duly supplied and properly installed, maintained, and used in accordance with its intended purpose,” the MDR states. Manufacturers must also demonstrate the conformity of the medical device with the general safety and performance requirements by conducting a clinical evaluation.

Clinical evidence requirements for certification are higher under MDR and will potentially require additional non-clinical studies for devices seeking recertification under MDR. Certain devices—class III and implantable medical devices—will be subject to a more thorough assessment in the form of a clinical investigation that must be authorized by the member state before they can be placed on the market.

Additionally, more clinical data is required for conformity assessment of IVDs. The new definition of “intended purpose” in the regulation requires having performance evaluation data to support any claims made by the manufacturer.

Performance of a device is its ability to achieve its intended purpose as claimed. Under the new regulation, performance evaluation means an assessment and analysis of data to establish or verify the scientific validity, the analytical and, where applicable, the clinical performance of a device. In comparison, only analytical performance was requested under the old directive.

In a white paper, Deloitte recommends that manufacturers consider the following key questions for clinical evaluations:

For how many products in our portfolio will we need to general new data?

Does our portfolio include any class III or class II devices, ones that are most impacted?

Is the process for managing and preparing clinical evaluation report (CER) robust enough to update annually?

To ensure compliance with the regulations, manufacturers must be prepared to provide more detailed clinical data on their medical devices. “Both MDR and IVDR transform safety into a permanent activity rather than purely a pathway to achieve certification,” Maini says. “The regulations require constantly updated plans respectively for post-market clinical follow-ups and post-market performance follow-ups.”

A white paper published by the British Standards Institution, the national standards body of the United Kingdom, provides further recommendations on preparing for the upcoming MDR: “Manufacturers will need to revise not only their clinical strategy for new devices but also perform a gap analysis to identify gaps in clinical evidence under the new rules for devices currently on the market, because the clinical evidence for existing devices needs to be updated,” the white paper states. “For high-risk devices and permanent implants, a summary of clinical evaluation will be publicly available, so convincing clear evidence will need to be provided in layperson’s terms “

Quality management system. The MDR further recommends that manufacturers have in place a quality management system (QMS) and a post-market surveillance system, “which should be proportionate to the risk class and the type of the device in question,” the regulation states. It states further that, to minimize risks or prevent incidents related to devices, manufacturers should establish “a system for risk management and a system for reporting of incidents and field safety corrective actions.”

Upgrading the QMS to satisfy the regulatory requirements may require a significant investment. Thus, it will be important for medical-device manufacturers to assess how many QMS they currently have in operation, and whether any upgrades are necessary.

“Any organization putting a device on the EU market will need to conform to the requirements, including manufacturers, distributors, and importers.”
Fiona Maini, Life Sciences Director, Deloitte

Greater transparency and traceability. The new rules also introduce a comprehensive EU database on medical devices (EUDAMED), which the European Commission is expected to have in place by 2020. Much of this information will be made publicly available. 

The regulations further require that devices be fitted with a unique device identifier (UDI). For high-risk medical devices, medical-device makers must make a summary of safety and performance data publicly available.

The regulations also introduce new surveillance measures, including the establishment of a new Medical Device Coordination Group (MDCG), composed of member states experts and chaired by the Commission; increased cooperation between member states in the field of vigilance and market surveillance; and a mandatory coordinated assessment of multinational clinical investigations.

MedTech Europe, the European trade association representing the medical technology industries, said it welcomes the regulations, but that much more work needs to be done as it applies to the needed secondary legislation and European best practice guidance to meet the tight transition deadline.

MedTech Europe CEO Serge Bernasconi said some of the key priority areas highlighted by the industry for agreed harmonized approaches and clarity concern the transition provisions, the updated clinical evaluation requirements, the new scrutiny process, and the early availability of notified bodies.

“A lot of work has gone into these regulations, and there is still a lot to do to make them a reality,” Bernasconi said. “The amount of effort needed from all parties to implement these revised rules cannot be underestimated.”