The new EU Medical Device Regulation and the EU In vitro Diagnostics Regulation were adopted by the European Parliament in April 2017 and entered into force on 25 May 2017 – with businesses expected to comply in full with the former by 26 May 2020 and with the latter by 26 May 2022. Both fundamentally change the way medical devices will be regulated going forward.
So why and how are the Regulations changing and what do businesses need to consider?
In short, the impetus for change is based on technological changes and recent scandals that have shown some of the shortcomings of current medical device regulation.
Widely publicised scandals in relation to ‘PIP’ breast implants and DePuy metal hip replacements, in the opinion of the European Commission, highlighted “the weaknesses of today’s legislation”. In any event the old legislation is from the 1990s and therefore was due some amendments. On this basis there are now two new regulations: Regulation (EU) 2017/745 on medical devices; and Regulation (EU) 2017/746 on in vitro diagnostic medical devices.
The Commission expects the Regulations to improve the quality, safety and reliability of medical devices, while also strengthening the transparency of information for consumers, and enhancing vigilance and market surveillance.
There are a huge number of changes that will impact both current suppliers of medical devices and suppliers who previously escaped regulation. When considering these, it might be helpful to group them with respect to the Commission’s aims as set out above.
Improving the quality, safety and reliability of medical devices
A wider set of products will now be caught by the legislation because of a broader definition of medical devices or in vitro diagnostic medical devices. For example, software is expressly included as a ‘medical device’, and the new definition includes not only traditional devices but also products previously considered accessories to those devices (eg cleaning and disinfecting products). The Regulations also extend to products without an intended medical purpose. Examples given of these include:
- Contact lenses and other products introduced in or onto the eye
- Products introduced into the body via surgically invasive means in order to modify anatomy
- Substances used for dermal or other fillers
- Equipment for liposuction, lipolysis or lipoplasty
- Lasers for skin treatments such as skin resurfacing, tattoos or hair removal
- Equipment for brain stimulation.
This means that there will be businesses, previously unregulated, who will face a significant challenge in getting up to speed with regulatory requirements. Additionally, many existing medical device businesses will need to review their product portfolios to establish whether new products have been brought into the regulated environment.
Furthermore, there is a new Medical Device Coordination Group charged, amongst other things, with introducing common specifications for medical devices, and supporting the European Commission in respect of implementation.
Certain devices will be upclassified to higher risk categories, and the risk classification for in vitro medical devices will be changed, bringing it more into line with the risk classification for medical devices. Examples of upclassified devices include devices that contact the spinal column, which will now be upclassified to the highest risk category (Class 3), and a major move to upclassify a significant number of in vitro devices from the lowest risk category to higher risk categories. This means they will no longer be subject to self-assessment, but instead will require approval from notified bodies. These approval procedures are likely to be more stringent, with enhanced requirements for conformity assessment and CE marking.
Strengthening transparency of information for consumers
There are changes designed to enhance the traceability and transparency in respect of devices, which will be phased in over a number of years, starting with those considered to have the highest risk. Each device will need to have a unique device identifier (UDI). This UDI will then be logged on the European database for medical devices (EUDAMED), and the records will be updated to give a living picture of devices as they move through the supply chain. This is likely to assist both with the detection of counterfeit devices and in the event of product recalls being required.
Enhanced vigilance and market surveillance
There will be enhanced market and post-market surveillance. Regulatory authorities will have more rights to conduct audits, including unannounced visits, and the expectation will be that each manufacturer will be audited at least once every five years. Manufacturers will need to actively consider the post-market performance of products. Businesses will therefore be under increased pressure to put in place, and maintain, extensive records and best practice procedures.
However, it’s not just businesses that will be affected, with heightened requirements on notified bodies. Specifically, a redesignation process will be required, alongside consistent reassessment to check that they are effectively monitoring and enforcing requirements.
Under the new Regulations all of the actors in the supply chain will, for the first time, have potential responsibility for defects in devices – previously the regulations focused solely on manufacturers. In addition, manufacturers outside the EU will need EU-based authorised representatives.
Manufacturers (or their authorised representatives) are also now required to have at least one person responsible for regulatory compliance, either within the organisation or as an available consultant.
What do businesses need to do and by when?
The good news, given the sheer scale of the changes required, is that there are relatively lengthy transition periods. Businesses need to comply in full with the medical devices regulations by 26 May 2020 and with the in vitro devices regulations by 26 May 2022. The challenge is nonetheless considerable, and a number of stakeholders have complained that there is insufficient time for an orderly transition. This is particularly the case because of the redesignation of the bodies responsible for conformity assessments and approvals.
The impact of the Regulations depends on the role of the business. Immediate steps which medical devices businesses should consider include:
- A product portfolio assessment. This is likely to be required, including pipeline products, for example to consider whether any products are caught by the broader definitions or have been upclassified
- Considering changes to contracts in light of the new obligations and liabilities
- Securing budget for increased compliance costs, including bringing on board responsible persons.
The impact of Brexit could of course also be relevant to UK businesses active in this area – but it would be very unwise at this time to conclude that the Regulations will not apply in the UK or to use Brexit as a reason not to comply. Regulatory alignment between the UK and the EU in respect of medical regulatory matters (whether as a result of a post-Brexit trade deal, or because Brexit does not happen) still appears the most likely outcome of the current Brexit process.
The challenge to affected businesses in meeting these requirements will be considerable, and much of the detail is yet to be finalised. But businesses should adopt a proactive approach to ensure they are not caught out when we reach the deadlines for implementation.
Gustaf Duhs is a partner at Stevens & Bolton LLP
