European Union – Medical Device Regulations, Capgemini

Implications and way forward.

After a pause, device makers are buying again, mostly thanks to either stockpiles of Covid cash or,The new European Union Medical Device Regulation (EU-MDR) and In-Vitro Diagnostic Regulations (IVDR) revoke the existing directives on medical devices. The predecessors to EU-MDR and IVDR – the Medical Device Directive (MDD [93/42/EEC]) and Active Implantable Medical Device Directive (AIMDD [90/385/EEC]), had innate imperfections and were not able keep up with rapid modernization in technology and medical sciences. This prompted the European Commission to introduce urgent reforms to improve consistency, traceability, and transparency in regulatory processes, and monitoring of post-market performance. With fast-approaching deadlines, it is imperative that manufacturers adopt a strategic approach to addressing the complexities of the new regulatory environment and accelerate implementation of new requirements. The impact of regulation can dramatically impact medical device manufacturers, including in terms of both their existing and future portfolios. The cost of compliance will most likely be significant and will thus become a critical consideration for businesses.

This point of view will help to understand the impact of the EU MDR on the industry, and how manufacturers should judiciously address and mitigate risk by careful planning and process management to ensure a smooth transition to the new regulatory landscape. Although the new regulations may have many similarities to the Medical Devices Directive 93/42/EEC (MDD), the differences are in the details. To address these, MDR compliance will involve four key phases – regulatory and business strategy, gap assessment, remediation, and sustenance.

The European market is the world’s second largest, with over 500,000 different medical devices accounting for an annual revenue of 110 billion euros in sales. The EU legislative framework remained largely unchanged since the 1990s and played a significant role in the success of the European market over the past decades. However, over time, it became outdated and ineffective due to innovation, modernization of medical technologies, lack of consistency in implementation across member states, and recent adverse incidents involving breast implants and hip replacements. This prompted the European Commission to introduce urgent reforms to improve consistency, traceability, transparency in regulatory processes, and monitoring of post-market performance. The EU approved and released the new regulations, which will replace the Medical Device Directive [MDD] (93/42/ EEC) and Active Implantable Medical Devices Directive [AIMDD] (90/385/EEC) with Medical Device Regulation (MDR 2017/745) and the In-Vitro Diagnostic Regulation (IVDR 2017/746), in May 2017. Both regulations enable a shift from pre-approval toward a full-lifecycle approach, resulting in closer regulatory oversight. Though the new regulations build upon existing MDD and AIMDD directives, they have driven the European regulatory environment to implement more stringent clinical data requirements, extended data management, and more complex conformity assessment procedures (particularly for high-risk medical devices), and introduced product liability and penalties. Steps have been taken to retain traceability and transparency in the entire process by linking medical devices to a unique device identification number that will contain all the necessary information, and will be available to the public and to the regulators.

Key changes in the new MDR regulation

• Compared to the MDD, the MDR promotes a shift from the pre-approval stage, i.e., the path to CE marking, to a lifecycle approach. This approach is similar to the lifecycle view advocated by the US FDA and advanced by many international standards;
• Reclassification of many medical devices to a higher-risk class and a new classification for reusable surgical devices requiring notified body (NB) oversight. (This has mainly affected previously classified class I devices);
• Availability of the EUDAMED database to all the stakeholders is another significant change;
• The frequency of PMS activities is increased;
• All PMS reports, including PSURs (periodic safety update reports), need to be a part of the technical documentation and must be regularly updated in the EUDAMED;
• Planning, execution, and reporting of post-market surveillance and risk-management activities must be included as a part of standard operating practices (SOPs) in the company QMS. Hence, the QMS also needs to get updated;
• GSPRs are increased with more focus on risk management and instructions for use;
• The requirement of technical documentations is extended to include all the post-market activity reports, PMCF (post-market clinical follow-up) reports, clinical evaluation reports, and more;
  Traceability is introduced using UDI (unique device identification);
• There is more onus and legal liability on economic operators to adhere to the regulation. Notified bodies (NBs) have increased responsibilities and need to conduct announced as well as unannounced audits on a yearly basis; and
• A new role, PRRC (person responsible for regulatory compliance), is introduced and becomes legally responsible for compliance.

Approach for achieving successful MDR compliance
Understand the regulatory vision. A manufacturer’s portfolio of products is reviewed and assessed against the new regulations and future requirements (including any changes to classification). Depending on the updated requirements and need of remediation, the business strategy and the vision for the portfolio is planned. Based on the vision, the need for resources, trainings, risk to the usual business, and financial impact will be planned.

Review and MDR gap assessment of the portfolio. Once the new risk classification and high-level remediation plan in place, the gap assessment and its details are laid down. Every annexure and article is thoroughly assessed to achieve complete coverage.

Define MDR remediation strategy and execute strategy for end-to-end compliance. Having done the strategic planning and the gap assessment, the next phase is to implement the plan. If the gap identification is thorough, implementing the changes for remediation becomes a fairly smooth exercise. Typically, regulatory consultants, quality team, clinical experts, designers, artwork and documentation teams, along with the project manager constitute the team.

Execute strategy for post-market MDR compliance. Once the MDR-remediated product is CE marked and placed on the market, the next crucial stage of the lifecycle starts, namely, post-market surveillance.

Getting regular and early feedback from the market helps reduce recalls. There must be a plan for proactive and reactive ways of gathering feedback once the device is placed on the market.

It is necessary to implement a complaint-handling system, that captures all the feedback and categorizes it – a few cases may be of improper use, off-label use, a few may actually need a design or process change, some may need documentation updates, risk updates, etc.

A team for complaint handling is set up, which handles complaints, coordinates with other teams (clinical, design, quality, regulatory, documentation, etc.), and gets these complaints resolved.

This is a continuous cycle and ongoing activity to support the products in the market. The team also supports the data update into EUDAMED, for customers to collate the data in the required format. Regular reminders for NB audits, EUDAMED updates, and other economic operator agreements are also supported.

Key considerations for successful MDR compliance
Process redesign. Due to updated MDR requirements, the existing processes probably need to be redesigned. There are updated technical documentation requirements, which include post-market reports, clinical evidence reports, and risk management files. If preparation of any of these documents was not part of the technical dossier preparation, the whole process needs to be revisited. There is a need for extensively detailed checklists and tools to figure out the gaps within the existing technical documentation against the MDR requirements, e.g., reclassification, QMS gaps, technical dossier gaps (covering all annexures), etc. If gap analysis is thorough and fool-proof, remediation should be straightforward. Since all common specifications and harmonized standards have not been released yet, any changes will have to be incorporated later.

Quality management system (QMS) compliance. QMS is a critical path for CE mark approval. Manufacturers are required to establish, document, implement, and maintain a QMS. ISO 13485:2016 is an internationally recognized standard for medical devices, and it provides the framework for addressing the required points in the MDR: document control, management responsibility, resource management, product realization/design control, and complaint handling/CAPA. As per the new MDR requirements, post-market surveillance and risk management processes now have to be an integral part of the QMS processes, e.g., new processes for PMS planning, compliant handling, feedback collection, and PMS reporting. Training sessions for the teams to understand the SOPs, procedures, and frequency to update them, the review process, and more. Companies should plan for regular ISO 13485 audits to ensure compliance.

Post-market surveillance process changes. Once the device is CE marked and placed on the market, a planned lifecycle approach becomes crucial. As per the new requirements, PMS processes have changed significantly in terms of the reports to be generated or the frequency with which they need to be updated in the EUDAMED database. The company database needs to interface with EUDAMED so that all the data, such as incidents, trends, field safety notices and corrective actions, PSURs, etc., can be easily updated to EUDAMED. Advancements in PLM applications can be extended/customized to publish data in different file formats and messaging protocols. PLM can enable highly flexible data models, workflows, and data transfer/synchronization with regulatory databases (EUDAMED database). With an integrated system, enabled by the enterprise-wide architecture, a closed-loop quality-management system can be set up to help define, monitor, achieve, and continuously improve quality and reliability throughout the product lifecycle.

Risk-management process changes. In addition to PMS, risk-management processes must be part of the QMS. Implementing and maintaining a risk-management system throughout the lifecycle of a device is necessary. It is needed to identify and analyze the risks and then implement solutions to eliminate or reduce them, along with the evidence. The ISO 14971:2019 standard for risk management of medical devices can be used as a reference.

Product testing/clinical evidence. As per the new MDR requirements, a significant amount of clinical evaluation documentation has to be generated – pre and post market. As a part of PMS, PMCF (post-market clinical follow up) needs to be conducted and updated regularly, as a part of technical documentation. This is to be performed throughout the lifecycle of the device. Manufacturers will be required to carry out extensive product testing – pre-clinical and clinical testing, as those records will be required as evidence. Trained resources for this will be in increased demand. Businesses need to plan for resources and budgets accordingly, as this will to be an ongoing demand. There may be challenges in updating PMCF data for legacy devices. There are some extremely valuable legacy products with strong market acceptance that offer clinicians and healthcare systems greater choice. However, for some legacy products, the cost of compliance may not be justifiable, being time-consuming and costly, and may need to be strategically looked at.

Project management and governance. The new MDR compliance projects will need to have cross-functional teams and governance. As this affects the complete product lifecycle requirements, program and project management becomes crucial. Leadership needs to be proactive in strategizing the program, planning for the budget and resources, and starting implementation. Change management, effective communication, and training will become critical, as organizations will have to adapt to a great many changes. Process redesigning, possible product-design changes, and changes in post-market requirements will necessitate quick and bold decisions from the management as well as a very strong program management team.

Supply chain compliance. It is important to understand how a supply chain is going to affect the product manufacturer, authorized representative, importer, and distributor. MDR ensures transparency across the entire supply chain. Each economic operator is now responsible for their own and others’ compliance. This means the product information has to be shared across operators. Importers and distributors should cooperate in collecting the feedback once the device is placed on the market. This calls for renewed agreements within the supply chain to maintain data confidentiality. There is significant impact on labelling and eIFU requirements as well, as information about all economic operators must be placed on the labels and made available in eIFUs.

Notified body (NB) interactions. MDR has assigned more authority as well as responsibilities to the NBs.

• NBs must plan and conduct the regular announced and unannounced audits;
• They must get involved in technical dossier reviews of high-risk devices;
• They must be more vigilant; and
• They will have access to EUDAMED and they are supposed to actively review it.

Thus, there are increased expectations of the NBs. They need to have sufficiently trained resources and the infrastructure to conduct reviews and testing, as required. Organizations need to ensure that they are registered with the NB and get their audits and reviews planned well in advance, so that their product reviews do not get delayed due to unavailability of the NB.

The lack of skills and resources within the NBs could have a huge impact on the overall transition. If the NBs do not possess the required expertise and resources to manage the workloads in time, manufacturers will risk delay in certification.

To date, industry professionals have already reported waiting times of several months to receive feedback or a response from a designated NB. The (re) designation process will take 18 months on average per NB.

As of February 6, 2020, there are only 10 NBs designated under the MDR – three NBs for the IVDR, and 11 awaiting confirmation on designation under the MDR/IVDR.

Under the MDD, 75 NBs have been designated (2013). A big drop in the number of NBs will lead to NBs getting overloaded and result in huge delays in reviews and certifications. Manufacturers must factor this into their planning process.

Process automation. Considering the MDR’s lifecycle approach, continuous data updating and monitoring will be required. Robust tools are needed to ensure QMS compliance and maintain the SOPs, complaint-handling systems, audit data, CAPAs, supplier data, etc. Various regulatory and QMS software tools that help in automating the processes and maintain the data centrally and in an audit-ready state are available in both on-premises and cloud-based platforms, so that they can be accessed and data can be added from anywhere. Smart tools that use AI and ML technologies for predictive maintenance are also available. These ultimately help in ensuring patient safety as early as possible.

Integrated framework to enable traceability. An integrated product lifecycle management (PLM) system involving various systems, including ERP, MES, LMS, will help meet the EU MDR requirements for greater transparency, identification, and traceability while ensuring rigorous clinical vigilance and continuous market surveillance. An integrated solution will enable effective data management and governance and adaptable data models, and will support seamless data validation and submissions.

Outlook
MDR timelines are approaching fast and medical devices manufacturers need to act quickly. Updated MDR requirements need thorough review, planning, and enough time to set a plan in place for remediation. With a structured approach, the right planning and management, tailored training, sufficient skilled resources and budget, and the use of process automation, organizations can sail through this journey smoothly.
Capgemini