The following article on the EU’s Medical Device Regulation (MDR) originally appeared in the July 2019 issue of In Compliance Magazine. Since then, there have been a number of important developments related to the implementation of the MDR, and some of the details as reported in this article have been updated. For the most up-to-date information on the EU’s MDR, visit the author’s website at www.EisnerSafety.com and LinkedIn feed at http://bit.ly/LeoELinkedIn.

Less than 3 Months Left to Implement the EU MDR

What were the drivers in the European Union (EU) for changing from the Medical Device, Active Implantable and In-Vitro Diagnostic Directives (MDD, AIMDD, and IVDD) to the Medical Device and In-Vitro-Diagnostic Regulations (MDR and IVDR)?

• Fraudulent production of the PIP silicone breast implants highlighting the weakness in the legal system which damaged the confidence of EU patients, consumers and healthcare professionals.
• Metal-on-metal hip implant failures showing a weakness in the clinical evaluation and post-market surveillance requirements.
• Directives are transposed into National Law in each EU member state, leading to different interpretations of the Directives’ essential requirements.
• Directives require regular updating to stay current with technological and scientific developments. The MDD, AIMDD and IVDD were published over 30 years ago and the last significant updates were about 10 years ago.

As noted by the EU Commission on the Europa website:

“The new regulations will ensure:

• A consistently high level of health and safety protection for EU citizens using these products
• The free and fair trade of the products throughout the EU
• That EU legislation is adapted to the significant technological and scientific progress occurring in this sector over the last 20 years”

This article will focus exclusively on the MDR.

In my previous article for In Compliance Magazine (see In Compliance Magazine, June 2018), I brought up some of the current and upcoming challenges for the medical device industry in regard to the regulatory and quality systems space. One of the significant issues is the EU MDR. If you haven’t done a GAP assessment of your portfolio of devices and started preparations to transition your portfolio to the new Regulation you won’t have enough time to be compliant with the MDR and could lose market access. You have less than 3 months to be ready for the MDR. The transition period started in May 2017, the MDR has a three year transition period ending 25 May 2020. If your MDD product certificate expires after 26 May 2020 you may have a partial reprieve, of up to 4 years, if you do not intend to change the product significantly. But you will still need to meet parts of the MDR even under this exemption.

The transition for your products to meet the MDR is a massive project and will require a lot of internal and external resources. This is not a project where just regulatory affairs experts can do all the work. You will need to work with engineering, your technical writers, manufacturing, operations, legal, regulatory, quality, clinical specialists, IT, your distributors, importers, authorized representative (AR), and your Notified Body (NB), etc. Many of these groups will need to work together. Upper management needs to be aware of the significant impacts on your organization and they should provide the approval for the resources (financial, personnel, etc.) needed to make this happen.

Several years ago there were about 80 Notified Bodies under the MDD. In 2018 there were about 50 MDD NBs left and the trends seem to be on the decline as NBs are having a hard time hiring the proper personnel to deal with the increased workload demands of preparing for the MDR while still maintaining the MDD workload, dealing with MDSAP, the transition that just finished for ISO 13485:2016, etc. Also, the designation process to become a NB under the MDR is a long process (taking a year or more) and not all NBs under the MDD have applied for the designation process for the MDR.

Significant Changes/Impacts from the MDR

The impact on NBs, Economic Operators (manufacturer, an AR, importer, distributor, assemblers of systems and procedure packs), among other players, is massive. Here is a partial list of the significant changes/impacts on manufacturers, the NBs and others impacted by this new Regulation:

• Requirements applicable to medical devices and active implantable medical devices are now combined into the MDR, instead of being in two separate Directives (the MDD and the AIMDD).
• All medical devices under the MDR will need a Clinical Evaluation Report (CER) or will need to conduct a Clinical Investigation. CERs and clinical evidence must be kept up to date post CE Marking of the device.
• A periodic safety update report (PSUR) must be prepared for Class IIa, IIb and III devices (every year
• for Class IIb and III, and every other year for Class IIa) summarizing the results and conclusions of the analyses of the post-market surveillance data gathered as a result of the post-market surveillance plan.
• All Class I devices, under the MDR, will need to meet the requirements of the MDR by May 26, 2020. No NB involvement for Class I devices is required unless they are measuring or provided sterile.
• Class I reusable surgical instruments will have NB involvement (new). Previously this was just Class I.
• Software is specifically called out as a medical device in the Classification Rules (new).
• Devices incorporating or consisting of nanomaterials is specifically called out in the Classification Rules (new)
• Groups of products without an intended medical purpose listed in Annex XVI (such as contact lenses, implants for cosmetic or anatomical modification, liposuction, lasers and intense pulsed light equipment used for skin resurfacing, tattoo or hair removal, etc.) will be covered by the MDR and will need to meet requirements of Common Specifications still to be issued.
• There are more specific requirements for the Declaration of Conformity (DoC) including being translated in all languages required by the Member States(s) in which the device is made available.
• Annex I, Essential Requirements of the MDD or AIMDD has expanded and is now termed General Safety and Performance Requirements in the MDR under Annex I. Some of the new requirements include:
  • cybersecurity
  • phthalates
  • additional and more detailed requirements around risk management
  • operation with other devices designed in such a way that the interoperability and compatibility are reliable and safe
  • substances which are carcinogenic, mutagenic or toxic to reproduction (CMR) and endocrine-disrupting substances
  • nonviable human origin tissues or cells.
• Technical Files of the Directives are now Technical Documentation and there are more detailed requirements.
• There are additional and more stringent supply chain (i.e., critical suppliers, manufacturers, ARs, importers, and distributors) requirements. Post-market surveillance and vigilance is not just the manufacturer’s responsibility anymore as distributors and importers have responsibilities in this area.
• AR requirements have significantly increased,
  such as:
  • AR must have a person responsible for regulatory compliance
  • Article 12 of MDR requires specific contractual agreement between the AR and the manufacturer
  • Only a single AR is allowed
  • An AR is legally responsible for defective devices.
• Manufacturers need to have at least one person responsible for regulatory compliance within their organization who possesses the requisite medical device expertise.
• Manufacturers need to determine, in a manner that is proportionate to the risk class, type of device and the size of the enterprise, the measures they need to have in place to provide sufficient financial coverage against any potential liability. ARs may end up being legally liable if manufacturers outside the EU don’t meet this requirement.
• The European Databank for Medical Devices (EUDAMED) has been in use under the Medical Device Directive since 2011 but has not been accessible to the public and manufacturers. The data in EUDAMED has only been accessible to the EU national Competent Authorities and the EU Commission. That will change with the updated EUDAMED.
• The objectives of the updated EUDAMED are to enhance overall transparency, avoid multiple reporting requirements, streamline and facilitate information flow, and enhance coordination between member states.
• Unique device identification (UDI) is a new requirement which will be implemented to track devices throughout the supply chain (through the various Economic Operators). A big part of the EUDAMED upgrade is to incorporate the UDI for each device manufactured into the database.
• NBs need to be approved through a designation process under the new medical Regulations before they can issue certificates to the MDR for manufacturers’ products and their quality systems. As of 26 May 2019, only two NBs have been designated under the MDR (BSI in the United Kingdom & TÜV SÜD in Germany). You can check any updates on the NANDO db. The BSI UK designation process took about a year, and it took about one and a half years for TÜV SÜDs designation. Where do we stand with the designation process for other NBs and what are the numbers?
• The EU’s General Data Protection Regulation (GDPR) includes protection of personal data which applies to many medical devices. Per the MDR, a device with software will need to meet the GDPR. The GDPR transitional period ended 25 May 2018.
• Regarding the impact of Brexit, some UK NBs have found alternative EU locations outside of the UK to establish Europeanbased NBs.

NB Designations and Brexit Updates

A presentation issued by the EU Commission in January 2020 indicated:

• 44 MDR applications were received since the designation process opened on 26 November 2017 (1 withdrew),
• 40 MDR preliminary assessment reports (PARs) have been received by SANTE/F (1 withdrew),
• Post-assessment activities
  • 25 CAPA plans received (1 withdrew), and
  • 12 MDCG (Medical Device Coordination Group) recommendations.

The original Brexit date of 29 March 2019 was pushed off until 31 October 2019, and now the UK has officially exited the EU on 31 January 2020. They have until the end of 2020 to finalize all the details with the EU.

It is not clear what will happen as this is a political nightmare in the UK and impacts the rest of the EU 27 and many other nations around the world, since any manufacturer that sells product to the UK is impacted and also there are shortages of products hitting the UK from the unknowns.

Steps to Implement this Huge Change

Every company will have unique challenges and some common ones for this transition. This is a generic, “high-level” list which will help you prepare and hopefully fully implement, but there still could be a lot of additional details your company will need to deal with.

1. Prepare, scope and plan your MDR transition program (Gap assessment)

• Prepare management so they understand the importance and business implication of the MDR.
• What are the organizational challenges you will face?
• What internal and external resources will you need for this project?
• Do you have the budget to make this happen, and if not, can you obtain management’s support for this project?
• NBs will be stretched thin and not all will be designated under the MDR in time:
• Has your NB applied for the new regulation, where are they in the designation process, and does the scope they applied for or been designated to cover your product line(s)?
• Does your NB have the capacity to audit your QMS and your Technical Documentation before either May 26, 2020 and issue the certificates by then or before your MDD product certificate expires (if no changes or no significant changes are planned) at the latest by May 26, 2024?
• Learn the definitions and provide MDR training at a minimum for any resources that will be working on this transition.
• Confirm the classification rules of your product portfolios to the MDR.
• Review of the broader definition of medical device and look at products without an intended medical purpose.
• Review product and package labelling (including IFUs, service and installation manuals).
• Review traceability obligations, including UDI.
• Review your existing technical files against the changes needed to meet the technical documentation requirements.
• Review your Quality Management System (QMS) to meet standards and processes for medical devices.
• Determine all the economic operator roles your company undertakes.
• If your company is the legal manufacturer (name and address on device). If your company is the legal manufacturer and is outside the EU, then your AR name and address need to be marked on the device.
• Is your post-market surveillance (PMS) process adequate for the MDR?
• Determine how to address post-market clinical follow-up plan requirements.
• Review the new vigilance requirements.
• Determine regulatory requirements required of
  the QMS.
• Determine person responsible requirements and determine if will be an internal or external resource. Only micro and small companies per 2003/361/EC are allowed to rely on an external resource.
• What are the legal impacts with economic operators, legal entities (i.e. legal manufacturer vs critical suppliers)?
• Review product liability insurance against the requirements.

2. Do a cost-benefit analysis to determine if your legacy and new products will all go through this transition or decide to stop EU sales of some/all products. Consider the costs, time and resources needed for:

• Risk Classification upgrade impact
• Impact of changes to conformity assessment requirements to your company and your suppliers, especially critical suppliers
• Gaps in technical documentation
• Labelling (product, packaging, IFUs, other manuals, etc.) impact, including UDI and traceability requirements.
• Clarifying roles and responsibilities internally and externally including economic operators, AR, etc.
• Legal and liability costs
• Supply chain impacts and costs
• Vigilance and Surveillance activities
• Increased scrutiny of clinical evidence
• Expiration dates on current MDD certificates for your existing products. If your NB is still allowing renewal of your current MDD and AIMDD certificates to ensure having sufficient time towards the transition to the new rules.
• NB availability and designations status/scope
• Training on the MDR implementation and transition

3. Come up with your master plan to implement the MDR

a. Roadmap for implementation including:

• Detailed subprojects
• Resources needed
• Completion dates for each task

b. Set up a cross-functional project management team.

4. Implement your master plan

a. Execute all the sub-projects in the master plan. Some major subprojects may include:

• Technical documentation
• Upgrade your QMS
• Clinical evaluation
• Economic operators
• Critical suppliers
• UDI
• Labelling
• Traceability
• Post-market surveillance
• Vigilance
• IT reporting systems

b. Cross-functional project management team should:

• Track progress of all tasks
• Track gaps that show up as master plan progress
• Identify risks that rear their head during the implementation
• Have regular meeting to track progress
• Determine any next steps to keep on schedule

c. Project management team needs management support and executive level decision maker on team (recommended).

d. Update master plan as needed for any changes, gaps, risks that need to be addressed.

e. Give regular status updates from various teams working on subprojects to project management team.

f. Report progress of MDR implementation to the master plan as a major input into your management reviews. Consider increasing how often the management review team meets to review the MDR implementation process.

5. Update MDR ‘living documents’ that require updating on varying basis depending on the document/process/requirement of the MDR. Such as:

• Risk management
• Clinical evidence
• Post-market clinical follow-up plan
• Technical documentation
• MDR implementation master plan
• Etc.

6. Keep up-to-date on the ever-changing European regulatory environment as changes and notifications are released including, but not limited to:

• Implementing acts not released yet
• EUDAMED status and timing
• Guidance documents from MDCG, Team NB (unofficial but helpful), COCIR (industry group), etc.
• Brexit and its timing and impact

Additional Resources

There are a lot of web resources that may be helpful for keeping up to date on this massive endeavor. Here are some of the web resources I rely on a lot for keeping up to date on the MDR and its implementation:

1. EU Commission Europa website for the MDR and IVDR – New Regulations https://ec.europa.eu/growth/sectors/medical-devices/new-regulations_en
2. MED DEVICE ONLINE – great EU MDR articles. I really like the articles by Marcelo Trevino
3. https://www.meddeviceonline.com/search?keyword=eu+mdr
4. BSI America – MDR transition resources including white papers and webinars https://www.bsigroup.com/en-US/medical-devices/Our-services/MDR-Revision/MDR-transition-resources
5. TÜV SÜD – FAQs – MDR web page https://www.tuvsud.com/en/industries/healthcare-and-medical-devices/medical-devices-and-ivd/medical-device-market-approval-and-certification/medical-device-regulation/faqs-on-mdr
6. EMERGO by UL – Resource page https://www.emergobyul.com/resources. Select Europe for region and find many documents, webinars, and graphics available.
7. MedBoard – A lot of MDR information in one place and interconnected so you don’t have to go searching. Includes MDR text and Corrigendum, Implementing Acts, Correlation between Regulation & Direcitve, GAP Analyses, EU Commission Guidance, MDCG Guidance, schedules of when items are being released, connection to applicable part of the MDR. https://www.medboardco.com

This article is updated with the most current information available as of 2/1/20.