May 2020, the Medical Device Regulations implementation day (MDR Deadline), seems far away. But if you are already selling, or planning to sell, medical device(s) in the EU market, you should be well into figuring out what changes you need to make in your Quality Management System.

StarFish Medical attended the Vancouver RAPs Convergence, MDM-West, and Washington State Medical Device Summit in the past year hoping to get more clarity on MDR and IVDR implementation and the MDR Deadline. Alas, we were left as puzzled as the majority of the medical industry.  Unfortunately, notified bodies (NB) are not in a much better position.

In the absence of guidance documents, medical device manufacturers are trying to interpret the MDR to the best of their abilities. At the same time, NBs are understaffed and overwhelmed with the changes. This is the best reflected in the fact that only five NBs are certified thus far:  BSI UK, Dekra, TUV Rheinland, TUV SUD and Instituto Italiano del Marchio di Qualita S.P.A. (IMQ).  As a reminder, we had approximately 90 notified bodies under the MDD. Due to much stricter requirements for an NB’s scope, we can expect serious consolidation of NBs and smaller NBs disappearing from the EU market. This could impact your company directly.

In this blog I would like to share the information available so far, and point out some issues with MDR and the looming MDR Deadline that you may need to consider:

Stricter requirements on NBs and manufacturers:

• In addition to the four NBs mentioned above, there is a rumor that an additional 16 NBs will be certified by May 2020. The other NBs seem to be unprepared for the transition. If your current NB is not certified, you should investigate whether your current NB will be certified in time for the renewal of your CE Mark. You should also determine if your device(s) will still be in their scope. If not, are you already in discussion with another NB?
• No grandfathering. Many devices will have to be reclassified. The advice from MDM West speakers was that you need to figure out the classification of your device(s) and present it to the NB – this means more or less persuading the NB that your classification assessment is correct.
• Claiming clinical effectiveness used to be based on equivalency with predicate device. With the new regulations, you can’t claim equivalence if you don’t own the specifications or your competitor doesn’t provide you with their specifications. Furthermore, the NB will expect that your competitor informs you of any changes on their device. Good luck with that one! This requirement is effectively killing ‘substantial equivalence’ claims for the CE mark. Manufacturers will be forced to document their own device’s effectiveness, safety, and usability.
• Labeling requirements are more elaborate. Risks will have to be included in the labeling information.
• Risk management has to be determined as far as possible (AFAP), not as low as reasonably practical (ALARP). Please note that regulators are not concerned about your costs.
• More clinical evidence will need to be provided. Again, no grandfathering. Continual evaluation of clinical data is required. Proactive post-market monitoring needs to be set up and is not limited to dealing with complaints.
• A new requirement adds the need for qualified Regulatory Affairs (RA) personnel in addition to qualified Quality Assurance (QA) personnel; an integrated QA/RA department needs to be set up. The good news is that you can subcontract RA specialists to work with your QA department.
• The scope of the regulations is extended and now includes implants for aesthetic purposes, such as color changing contact lenses.
• EUDAMED 2 database entries are mandatory and will allow exchange of market surveillance, clinical investigations, and safety and clinical performance between NBs. Eventually it will be accessible by the public. EUDAMED 2 looks to be more complex and requires up to 30 pieces of information, depending on the type of device. The medical device industry has expressed concerns about how stable the database would be at launch time. Specifically, if the database is late arriving and everyone has to try and connect to it at the same time, would it crash? I say don’t count on it crashing, rather start applying to the National Competent Authority for a Single Registration Number (SRN) and be prepared to appoint a Local User Administrator (LUA).
• New expectations on economic operators are another concern. The MDR spells out clearer rights and responsibilities for manufacturers, importers, distributors, including diagnostic services and internet sales. The big players such as Authorized Representatives (AR) and distributors are most likely kept in the loop about incoming changes, but are others, like the pharmacies, aware that they would be considered distributors? Are they aware that they will have these obligations imposed upon them?
• Verification of the training has stricter requirements. Signed training sheets are not enough anymore.
• In-depth technical file assessments that we have not experienced so far, combined with expert panel reviews and the unannounced audits, will be required.
• There are still no guidances to help industry with implementation of the MDR and IVDR.
• We do not know what the impact of Brexit will be.
• Considering all of these unknowns, would there be any extensions for low risk devices? Rumors imply that there might be an additional grace period for these devices.

Please note that a lot of the new requirements are already captured in ISO 13485:2016. This is not coincidence; the regulators were responding to public pressure to better control medical devices after several scandals that shook the industry (e.g. breast implants that were using industrial grade silicon instead of medical grade material and the Bleeding Edge documentary).