The EU’s new Medical Device Regulation will apply as of May 2021. The MDR will bring many changes and thus will have a significant impact on operators in the field.
The Regulation (EU) 2017/745 on medical devices (“Medical Device Regulation” or “MDR”) entered into force already in May 2017, but will finally apply as of May 26, 2021 after the graduated transitional periods coupled with further delay due to the COVID-19 pandemic. The MDR will replace the EU Medical Device Directive (93/42/EEC) as well as the EU Directive (90/385/EEC) on Active Implantable Medical Devices. The MDR will be accompanied by complimentary national legislation on medical devices, the government proposal for which is expected to be presented in April 2021.
The new MDR establishes a regulatory framework for medical devices that aims to safeguard public health and safety while supporting the competitiveness of the market. In addition, the new MDR is adapted to the significant technological and scientific progress that has occurred in the health tech sector over the last decades. However, additional regulatory changes within the health tech field are still to be expected next year as the Regulation (EU) 2017/745 on in vitro diagnostic medical devices (“IVDR”) replacing the old EU IVDR Directive (98/79/EC) are applied as of May 2022.
Expanded scope and changed classification of devices
The MDR extends the concept of a “medical device” by including more devices than the previous Directive. Now, devices with the specific medical purpose of prediction and prognosis of a disease as well as products that are intended for cleaning, disinfecting or sterilizing medical devices are considered medical devices. The broadened definition even includes certain products without an intended medical purpose, such as coloured contact lenses and cosmetic devices. The reason for the extended classification scope is that these products are similar to medical devices in terms of functioning and risks profile.
While the classification system has been maintained, rules have tightened and changed for some products, which will result in some devices being reclassified to higher classes subject to stricter requirements. In addition, Class III and implantable devices will have higher clinical requirements and a regular scrutiny process. The risk classification system under the MDR is based on risks associated with the device in question. If more than one classification rule apply, the one with the highest risk class outcome should be chosen. The new classification rules will have a direct impact on e.g. software, nanomaterials and nonsurgical invasive devices.
For Class I medical devices, it is sufficient running a self-assessment of the device’s conformity, provided that the device is not sold as sterile or has a measuring function. The Conformity assessment of Class II a, II b and III medical devices, however, requires the approval of a notified body. The device may only be CE marked after it has passed the conformity assessment procedure. Due to the COVID-19 situation, it is currently possible to place certain devices that are not CE marked on the market. Fimea can grant an exemption for coronavirus protection medical devices intended for use by health or social care professionals upon application. The policy is only valid for the duration of the pandemic.
Further obligations for economic operators
A number of new obligations is set out by the MDR for all economic operators (manufacturers, authorized representatives, importers and distributors). The regulation also distinguishes the operators’ roles when it comes to e.g. labelling, the provision of technical documentation, post-market surveillance and filing complaints. Although manufacturers are primarily responsible for all processes, the obligations can be transferred to other parties under certain circumstances.
As one of the new obligations that are imposed on manufacturers, they are required by the MDR to maintain technical documentation available for an extended time period as well as to maintain systems for risk and quality management for all devices. Manufacturers will also have to identify at least one person within their organisation that is ultimately responsible for all aspects of MDR compliance. The organisation must document the specific qualifications of this individual relative to the required tasks. Special relief may apply to so-called micro and small enterprises.
Devices safety assessed throughout their life cycle
Through the clinical evaluation provisions in the MDR, the focus shifts from just approving the device to evaluating the device throughout its entire life cycle. The MDR sets out more specific requirements for clinical evaluations as well as their documentation, but the evaluation and associated documentation must also be updated throughout the life cycle of the device.
The post-market surveillance provisions also reflect the focus on continuous evaluation and improvement. According to the MDR, manufacturers must have a post-market surveillance plan as part of their quality management system. The plan should be device-specific, proportionate to the risk class, and appropriate for the type of device. It should include proactive monitoring of device performance for recertification, annual safety updates for higher risk class devices, and rapid reporting of safety incidents. Manufacturers must also hold a post-market surveillance plan available as part of their technical documentation, including information concerning for example serious incidents, complaints and trend reporting. Increased reporting obligations mean that manufacturers must prepare a Periodic Safety Update Report for each Class IIa, Class IIb, and Class III device that is submitted to the Notified Body for review. For manufacturers of Class I devices, a post-market surveillance report is required. Notified Bodies will also have the ability to perform unannounced audits that include product sample checks and product testing.
Improved traceability and transparency for devices
The MDR introduces a Unique Device Identification (“UDI”) system that applies to all devices, excluding custom-made and performance study or investigational devices. This means that a unique UDI code has to be affixed to the label or packaging of each device before the device is placed on the market. Through the UDI system, devices on the market can be identified and traced. Competent authorities can thus better monitor devices, and serious incidents can be reported more efficiently.
The European database on medical devices (EUDAMED) will contain information about UDIs. EUDAMED will provide a living picture of the lifecycle of medical devices that placed on the market in the European Union in order to enhance overall transparency. The database will include information e.g. about the devices, their certificates, economic operators and clinical investigations as well as serious incidents linked to the devices.
What does the MDR mean for software?
Medical device software (“MDSW”) is software that is intended to be used, alone or in combination, for a purpose as specified in the definition of a “medical device” in the MDR, regardless of whether the software is independent or driving or influencing the use of a device. If the software drives or influences a (hardware) medical device and also has a medical purpose, then it is qualified as a MDSW. Software may be qualified as MDSW regardless of its location, e.g. operating in the cloud, on a computer, on a mobile phone, or as an additional functionality on a hardware medical device. MDSW may be intended to be used by healthcare professionals or laypersons (e.g. patients or other users).
As previously mentioned, the definition of medical device will extend into including devices with the specific medical purpose of prediction and prognosis of a disease. Additional medical software might fall under the scope of this definition. Software for general purposes, however, are no medical devices, even when used in the healthcare setting. The manufacturer specifies the intended use. A new software-specific classification rule will also push devices into higher risk classes than before. The implementation of the MDR does not introduce relevant changes in the regulation of embedded software. In contrast, standalone medical software products are affected by changes in the classification rules in the MDR compared to the current regulations.
The MDR brings consistency to the European regulatory framework in the field of medical devices. Inevitably, it also introduces several changes in comparison to the previous Directives. The MDR places significant new obligations on economic operators in the medical device industry. Economic operators, especially manufacturers, should thus fully understand the new regulation in order to prepare for the changes ahead. This concerns both old and new operators. It is therefore recommended that operators commence their journey on implementing the MDR into their business as soon as possible.