The recently adopted EU regulations – Medical Device Regulation 2017/745 and the In Vitro Medical Device Regulation 2017/746 – outline a new regulatory landscape that imposes new obligations not only on device manufacturers but also on all the other key market players (eg importers, authorised representatives, wholesalers and distributors). The new regulations are mainly aimed at increasing transparency and safety.
From a purely legal perspective, the main change is the shift from three directives to two regulations, which per se implies the introduction of a harmonised legal framework consisting of a unified set of rules that apply uniformly across all EU member states. But the real innovation is the series of measures introduced by the European legislator to reduce patient exposure to safety risks associated with the use of medical devices.
Building on the lessons learned from recent events (such as the French PIP breast implant scandal), the EU regulations require that each device bears a unique device identifier (UDI) and that quality and safety information concerning each device be recorded in an EU-wide database (accessible to the public) – to ensure all devices are traceable throughout their entire life cycle. UDIs will comprise a manufacturer- and device-specific identifier (DI) and a production identifier (PI) that will allow the device unit to be identified. UDIs will have to be included on all medical device labels. In fact, UDIs will allow individual devices to be traced throughout the supply chain (ie, through to the end user or patient) and facilitate a recall if safety risks are reported.
Additionally, all relevant stakeholders are required to report all alleged infringements of their obligations to their national competent authorities, with liability shared by all the economic operators involved in the manufacturing, importing and distribution chain.
The initial option to introduce a pre-marketing pharma-like assessment of medical devices was abandoned by the EU legislator following fierce opposition from device manufacturers. Instead, the new regulations maintain the previous approach based on certification and registration, with responsibilities assigned to the notified bodies and allocation into classes according to the risk level: I (low risk), IIa and IIb (moderate risk), and III (high risk). Furthermore, a new scrutiny procedure may apply in specific cases to class III implantable devices and class IIb active devices intended to administer and/or remove a medicinal product. The procedure involves the European Commission, which may seek advice from an ad-hoc expert panel, and entails the notified body submitting a clinical evaluation assessment report (based on its review of manufacturer-supplied clinical evidence), together with the relevant manufacturer documentation, to the Commission. The Commission then submits the documents to an expert panel that may (but is not obliged to) issue a scientific opinion within a specified time frame. If an opinion is issued, the notified body should take it into consideration in the certification procedure; if it does not, it must provide a detailed explanation of the reason. Conversely, if no expert opinion is issued, the certification procedure can go ahead.
To strengthen governance of the new system, the regulations also introduce a new Medical Device Coordination Group (which comprises member state experts and is chaired by the Commission) and a mandatory coordinated assessment of multinational clinical investigations.
The scope of application has also been extended: products outside the scope of the previous legislation are now covered, eg eye contact lens solutions and various kinds of laser equipment mainly used for aesthetic and cosmetic treatments, such as liposuction, skin resurfacing, and hair and tattoo removal.
The new rules also address the matter of re-use of medical devices. Re-use will imply reprocessing, which may only take place when authorised under national law under properly controlled conditions and in accordance with the provisions of the medical devices regulation.
Software has also been introduced: as a general principle, software that drives or influences the use of a given device will fall into the same class as the device, but in some cases the software may be classified separately.
Manufacturers will also have to fulfil new obligations concerning pre-clinical and clinical evaluation of medical devices based on a clinical development plan.
In particular, device manufacturers will have to conduct clinical investigations for class III and implantable medical devices in order to provide evidence of safety and performance.
For devices classified as class III and implantable devices – other than custom-made or investigational devices – the manufacturer must provide a summary report of the device’s safety and clinical performance in such a way that is clear to the intended user and, as necessary, to the patient. The draft of the summary report must be included in the documentation that must be submitted to and validated by the notified body involved in the conformity assessment. After validation, the notified body must upload the summary report to the EUDAMED database.
Clinical investigations must always be conducted on implantable devices and class III devices, with the exception of devices with a design based on modifications to an equivalent device already marketed by the same manufacturer. The clinical investigation must address the intended purpose, clinical benefits, and safety and performance of the device, and are subject to scientific and ethical review.
Another key aspect is the strengthened post-marketing surveillance system, with surveillance proportionate to the risk level. Manufacturers will have to collect data concerning device performance, appoint a person responsible for regulatory compliance and, under certain conditions, provide national competent authorities with a post-market surveillance plan/report, a post-market clinical follow-up report, a periodic safety update report, and/or a summary of safety and clinical performance.
To ensure compliance with the new requirements, notified bodies will be empowered to conduct unannounced audits, as well as product sample checks and product testing.
Conversely, member states will be required to improve vigilance and control over notified bodies (the selection of which will be based on stricter and more detailed criteria) by appointing an authority responsible for surveillance to ensure that all notified bodies fulfil all their obligations under the regulations, including high quality standard requirements.
Other innovations include increased transparency and information sharing, the creation of an EU portal and the upgrading of the EUDAMED database. In this regard, medical device users of implantable medical devices must be provided with an ‘implant card’ containing all the relevant information of the device used.
It should also to be noted that the new rules foresee a robust financial mechanism to ensure patients are compensated if they receive defective products. The regulations require that manufacturers have measures in place to provide sufficient financial resources – proportionate to the risk class, type of device and size of the business – to cover potential liability. This mechanism should allow patients to be rapidly and adequately compensated, and also in the event of bankruptcy of the manufacturer.
Transition periods of three (Regulation 2017/745) and five (Regulation 2017/746) years before the regulations come into full force and effect are envisaged. This will give the industry some (but not much) time to adapt: a challenge that medical device companies will have to properly address in order to contribute to the pursuit of a better, more transparent and user-safe regulatory environment that affects a vast array of products – from pacemakers and contact lenses to pregnancy tests and blood sugar monitoring systems. The transitional period will also be crucial, as medical devices already on the market fall within the scope of the new regulations and, therefore, will need to be reassessed accordingly.