Global Insight

By Steven Morgan

With the release of the Medical Device Regulation (EU 2017/745) in May of this year, the European Parliament has significantly strengthened the regulatory requirements on manufacturers of CE marked medical devices. In light of this review, I felt it would be useful to explore some of the practical challenges facing medical device manufacturers.

The differences between the current Medical Device Directive (MDD) and the Medical Device Regulation (MDR) are significant and in most cases manufacturers will need to plan carefully so as to complete the additional work necessary in the required timescales.

Timescales

May 2017 with a three-year transition period before replacing the MDD. During this transition period, any product certificates issued by the Notified Bodies (NB’s) will be valid for a maximum of four years after the end of the transition period. Any medical devices which have not been approved to the MDR after that time cannot carry the CE mark and so cannot be sold in the member states of the European Union.

Change to Notified Bodies

At the same time as the MDR was being finalised, a review of the oversight and effectiveness of NB’s has also been conducted, principally led by the national Competent Authorities. The result of this process has led to a reduction in the overall number of NB’s operating within Europe and a rationalisation in the range and type of medical devices that NB’s are approved to certify.

Consequently, there is currently a large number of medical device manufacturers who are either considering or are compelled to change NB’s and a reduced pool of NB’s able to offer assessment services to them. Couple this with a shortage of experienced medical device auditors and it is clear that the whole medical device industry is facing a serious bottleneck over the next two to three years.

It is therefore very important that manufacturers, if they haven’t already done so, discuss their requirements with their NB’s as soon as possible to either:

• Confirm their ability to continue to assess the types of devices they produce;
• Identify an alternative NB who can assess their product types and has the resources available to meet their transition timescales.

As an indication of the work to be done by the NB’s in the coming years, it is estimated that there are over 500,000 medical devices currently approved for sale in Europe. All of these will need to be assessed to the MDR – and there is no automatic acceptance of existing devices which are compliant to the current MDD!

Some Key Differences Between the MDD and MDR

While the MDD and the MDR overlap in many areas, the MDR builds in a large number of additional or enhanced requirements. All manufacturers will need to review their compliance with these new requirements as defined in Annex I through Annex XVI of the MDR.

Of particular note are:

• Some products which were classified as accessories are now classified as devices. The follow-on effect of this is that some products that were outside the scope of coverage for the MDD are now classified as accessories under the MDR
• Annex I of the MDR (General Safety and Performance Requirements) has been significantly updated over Annex I of the MDD (Essential Requirements) – each medical device type will need to be reassessed against the new requirements. In particular, the regulation specifically states the requirement for a risk management process to be applied throughout the product lifecycle.
• Clinical evidence to show equivalence with an existing predicate device – the new regulation requires a more extensive rationale for assuming equivalence to an existing device – especially with regard to technical performance and clinical evidence. Without access to the full predicate clinical data, it may be difficult to demonstrate to the satisfaction of an NB the level of equivalence needed. In this regard, class IIb implantable devices (i.e. IOL’s) are treated more like a class III device.
• Product labelling – all manufacturers will be required to review their compliance to the requirements for product labelling and Instructions for Use (IFU’s) as defined in MDR Annex I – Chapter III.
• All medical devices will be required to carry a Unique Device Identification (UDI), although the timing for the implementation of UDI’s will be longer than for the MDR transition and will depend on the classification of the medical device. The UDI will be unique to a particular device type, but will not be required to identify individual production units.
• Post Market Surveillance (PMS) – the MDR now requires manufacturers to proactively seek information on the performance of their devices in the market throughout the lifecycle of the device. The information gathered needs to be reviewed and appropriate action taken to address not only specific non-conformities through corrective action but also the proactive monitoring of trends or the evidence which could indicate the potential for adverse events to occur. Each manufacturer will need to develop a PMS plan for each device type, outlining how effective post market surveillance will be achieved. Regular safety update reports summarising the results of the PMS program will need to be prepared and added to the technical documentation under Quality Management System control.

Certification to ISO 13485:2016

At the same time as the MDD was being revised and amended into the MDR, the related quality management system standard for medical device development and production, was also being updated. The result was the release of ISO 13485:2016 in 2016. Like most ISO standard updates, there is a three-year transition period to the new version, so that all medical device manufacturers need to be certified to the 2016 version during 2019. Some of the key points to note include:

• Risk based approach – the revised standard requires manufacturers to expand the use of risk based assessment right across the organisation, rather than just within product realization. In particular, risk assessment of design inputs needs to be clearly considered and documented.
• Purchasing – medical device manufacturers are now required to define their supplier selection process using a risk based approach, with a particular emphasis on the impact of the suppliers’ material or service on the final performance and safety of the medical device.
• Complaint handling – the new standard has specifically drawn out the need to address complaints with documented procedures that are compliant with all applicable regulatory requirements.
• Medical Device Files – while the previous version of ISO 13485 required manufacturers to develop technical files for each type of medical device, the new version is more prescriptive in defining what the file should contain.

While formally separate to the CE mark assessment process, in reality, there is a significant overlap in the pool of Notified Body assessors who undertake this work, resulting in additional resource constraints on NB’s and the potential for further delays in manufacturers gaining approval.

Unannounced Audits

Even before the formal release of the MDR, NB’s had increased the rigour and focus of audits. In particular, NB’s were now required by the Competent Authorities to undertake unannounced audits on medical device manufacturers.

The key points of unannounced audits are:

• There is no formal notification period – industry feedback indicates that the company may have a call on the morning of the visit, with the auditors arriving soon after.
• Medical device manufacturers are required to pay for the audit – current costs in the UK are in the region of £5000 per visit. Most medical device manufacturers can expect at least one unannounced audit during a three-year period. Two auditors are typically involved in the audit.
• A risk based approach is used by NB’s to determine when an unannounced audit is required, taking into account a range of factors, including the classification of the device and vigilance feedback.
• Unannounced audits are scheduled at random, which means it is possible for a company to be audited by a NB under the normal schedule of audits, only to have an unannounced audit soon afterwards.
• The aim of an unannounced audit is to verify if a manufacturers production processes and supporting quality management systems comply with the requirements of the regulations.
• This is achieved by looking at a sample of product and following the production records for that batch back through the process to raw material, testing for compliance with procedures and regulations as they go.
• Unannounced audits pay particular attention to how a medical device manufacturer identifies and then controls key suppliers.
• It is entirely possible that an audit of a medical device manufacturer may identify potential concerns with the management of critical suppliers, which may then trigger a second unannounced audit to that supplier, either with the manufacturer or in some cases, by the notified body alone. Note that the cost of this second audit will be charged to the medical device manufacturer.

Given that there is minimal warning of a visit, I strongly recommend that manufacturers establish plans to effectively support an unannounced audit, particularly with regard to plant shutdowns or when key members of staff are not available.

I would also recommend manufacturers to establish signed off quality agreements with critical suppliers which set realistic requirements and also clearly identify the need for suppliers to be willing to support an unannounced audit from the manufacturer’s notified bodies.

Next Steps

As I mentioned previously, early dialogue with your NB is critical in being able to meet the transition deadlines. It is also important to start planning for the implementation as early as possible – the following two-phase approach should be considered:

Gap Analysis

Undertake a gap analysis between your current QMS and technical files and the requirements of the new regulations. Consider the following questions in particular:

• What is the expiry date of our existing device certificates?
• When does your ISO 13485 certificate expire?
• How do these dates impact your transition timeline?
• Is your route to conformity assessment going to change?
• Is the clinical evidence you have, sufficient to meet the new requirements?
• What is the effect of the changes to Annex I on your organisation?
• Do you have enough resources with the right skills to close the gap?

Transition Plan

Having obtained answers to the above, the next step is to develop the implementation plan. Consider the following points when developing this.

• What are the key milestones you need to achieve?
• Who is going to lead the work?
• How are you going to monitor progress?
• How do you involve your suppliers?
• What outside resources will you need to call on?
• What additional testing do you need to complete?
• How do you manage the update of the technical files?
• Is your NB able to support your plan as required?

In Summary 

The introduction of the MDR represents the biggest change in medical device regulations for many years. It is very important for organisations to clearly understand the implications of these changes and plan to be compliant by the required time. Talk to your NB as soon as possible to ensure they can support the needs of your organisation and can help you transition smoothly to the regulation.

Disclaimer – This article is intended for information only. It does not constitute an official or agreed position of Contamac Ltd. The views expressed are entirely those of the author.