Regulatory Surveillance Summary/EU MDR - October 2019 - SQA Services

By Boudewijn Jong, SQA Associate, Netherlands

Synopsis

On 20 May 2020, the new European Union Medical Device Regulation (EU MDR) will go into effect. All Medical Devices manufactured and/or sold in the European Union will be affected by this new regulation. Whether it’s a “simple” syringe or a “complex” insulin pump system with Bluetooth connection and phone apps, no medical device will be exempt from this regulation.

The new regulation is law in the European Union. While the previous Directive was guidance for each member state to interpret and add to local laws, this EU MDR is European Law and is applicable in its current form in all member states.

Starting in May 2020, companies must be ready to follow the EU MDR. At that time, companies must have systems in place for Clinical Evaluation, Post Market Surveillance, and other requirements of the new EU MDR.

SQA Services, Inc. has certified EU MDR lead auditors who can assess systems and documentation to help a company achieve compliance with the EU MDR. This does not mean that it will be easy to achieve, but with the right help, all systems and documentation can be ready in time.

Auditing the EU MDR

On 20 May 2020, the new European Union Medical Device Regulation (EU MDR) will go into effect. All Medical Devices manufactured and/or sold in the European Union will be affected by this new regulation. Whether it’s a “simple” syringe or a “complex” insulin pump system with Bluetooth connection and phone apps, no medical device will be exempt from this regulation.

For currently registered Medical Devices under the European Medical Device Directive (MDD), the impact of the new EU MDR may be significant. Devices will be allowed to continue to be marketed under the previous certification, but no changes can be made to the product, as all re-certifications must follow the MDR. The time needed for the new certification could mean a complete standstill of the development of the product for several years. Therefore, preparation for the EU MDR is an activity that should not be postponed.

When preparing for this new regulation, there are a few things that need to be taken into account, as they are significantly different from the existing MDD:

• The new regulation is law in the European Union. While the previous Directive was guidance for each member state to interpret and add to local laws, this EU MDR is European Law and is applicable in its current form in all member states. This should prevent different interpretations and requirements in the different countries. For example, one Unique Device Identification number will be implemented for the entire union.

• There are now four types of Economic Operators: Manufacturer, Authorized Representative, Importer, and Distributor.

Manufacturer: The name on the label (carton) is the manufacturer. It is the manufacturer’s responsibility to ensure that the other Economic Operators comply with the Regulation.

Authorized Representative: The manufacturer’s legal representative in the EU has full access to technical documentation, is liable legally, communicates with the competent authorities, and is the manufacturer’s link to Post Market Surveillance.

Importer: The entity that puts the Medical Device on the market has the responsibility to verify the legitimacy of the product, verify the presence of an Authorized Representative, verify certification, and make their existence known on the packaging of the device.

Distributor: The responsibilities of the distributors are similar to those of the importers but are more focused on the supply chain. Their role is often to verify what should be ensured by the importer (e.g., correct labeling).

• Each of the Economic Operators will be audited by the notified body for compliance with the EU MDR. The regulation indicates that some of these audits will be unannounced. Therefore, all Economic Operators need to be ready.

• The manufacturer is responsible for creating, maintaining, and having full access to the Technical Documentation Package. For this reason, “private labeling” will most likely cease to exist. If another company markets the device under their own name, they de facto become the manufacturer and need access to complete technical documentation, including the original manufacturer’s patents and trade secrets.

• Technical Documentation is similar to the previously mandatory Technical File, but the amount of requirements and required data have increased significantly, including Clinical Evaluation Reports and Post Market Surveillance.

• The EU MDR requires a certified quality system (e.g., ISO 13485:2016) to be present at several of the Economic Operators. The EU MDR can be interpreted as a long list of additional requirements to fulfill on top of the certification. While the ISO standard has 25 pages of requirements, the EU MDR counts 175. In general, the MDR provides much more detail on the requirements compared to ISO. It describes not only what to do, but to a certain extent, how to do it. Additional guidance documents that will be published in the coming years will provide more detail on these expectations.

• Starting in May 2020, manufacturers can continue to market devices under the previously applicable MDD. However, at that time, they must have systems in place for Clinical Evaluation, Post Market Surveillance, and other requirements of the new EU MDR.

• The EU MDR is the framework for the regulation. In the coming years, more detailed guidance, providing more detailed requirements and expectations, is planned to be implemented. It is therefore important to ensure that the company quality system is able to absorb and implement the new guidance when it is published.

• The first step in preparation for the EU MDR is to perform a gap analysis of the current systems and documentation against the EU MDR. This gap analysis is best conducted by independent auditors with in-depth knowledge of the EU MDR. Depending on the company size and the complexity of the product, a structured, full gap assessment may take up to 10 audit days. Although this is a significant investment, the notified body will spend a similar amount of time auditing the systems and documents when the certification is renewed. If a full gap assessment has not been performed, the notified body may find gaps that will prevent the product from being (re-)certified and therefore also from being sold.

• After the thorough gap analysis, the gaps identified need to be closed. The company must have a team of experts that are able to close these gaps as efficiently as possible and in compliance with the EU MDR. Some of these activities need to be performed by the company staff, as they are the experts on the products and systems. Most of the work can be outsourced to consultants, as once the gaps are closed, they would stay that way.

• After the company is fully compliant, the manufacturer is responsible for the compliance of all Economic Operators. Although less intensive, a similar approach (e.g., audit to establish gaps and project to close gaps) should be considered.

To address uncertainty regarding combination products (medical devices that are combined with a drug product and have positioned themselves halfway between each application), the EU will be adapting Directive 2001/83/EC, which better distinguishes the medical device from the drug product, as indicated in article 10 of the “consideration section” of the MDR. The article also indicates that the “device” part of the combination product should adhere to the EU MDR.

Companies are also facing uncertainty due to the upcoming Brexit. The current expectation is that although the MDR is a European Regulation, it will also be applicable in post-Brexit UK. However, it is important to understand that the Authorized Representative should be in the EU. The company may therefore end up with two Authorized Representatives: one in the EU and one in the UK.

Do companies need to start panicking now? Not so much. As an EU-MDR certified Lead Auditor, my work with SQA Services, Inc. enables me to assess a company’s systems and documentation and perform the necessary gap assessment. SQA Services, Inc. also has knowledgeable consultants to help close the gaps. My colleagues within SQA Services, Inc. and I cannot make achieving compliance with the EU MDR easy, but it will be achieved in an efficient and effective manner, ensuring that the disturbance to the organization and products is minimized.