Nancy Morrison, Director of Regulatory Affairs, Regulatory and Quality Solutions LLC (R&Q)03.21.18
The upcoming EU Medical Devices Regulation (MDR) changes are significant, potentially impacting device classification and the need for clinical data. It’s imperative organizations act now to meet these requirements in 2020 and beyond. Portfolio planning, gathering clinical evidence, quality system considerations, and technical documentation are just a few major areas of concern.
Is your organization prepared? Over the past year—especially within the last few months—R&Q has received numerous questions related to the EU MDR. Hopefully, this compilation of those questions and their answers expounding on different aspects of the regulation helps your organization take the next step.
Q: The transition period doesn’t end until May 2020. Why start now?
A: 2020 is not far away. Given the extensive amount of work that must happen between now and then, if you don’t start now, you won’t finish. The resources of the notified body and lead times will not be available. The closer to the 2020 date, the longer we’d expect the lead times to be...if you can even get the support. At the minimum, you must execute your plan and understand how big of a gap you have to fill between now and then. At least then you’ll know if your products are in good shape with only minor tweaks to make. Hitting that date will be impossible if the plan isn’t started today.
Q: How do we get management on board with starting this effort now?
A: You really need to understand what the effort is. It will take considerable planning over several years to get your portfolio and these gaps in line with the regulations. Understand management must be on board and help you, and provide sufficient resources to ensure you meet the requirements. Otherwise, your products will be off the market.
Q: How should a company communicate to its Notified Body about timing for transitioning and implementing to ISO 13485:2016 and the new regulation? Is it appropriate to communicate using a change notification? Is there a standard process?
A: An upcoming surveillance or recertification audit would be a good opportunity to discuss timing. If a recertification audit is approaching and you want to transition to ISO 13485:2016 during that audit, reach out to them now to ensure they have the resources allocated for an audit to the new requirements. Our sources have suggested it will take approximately eight months to get a MDSAP/ISO 13485:2016 audit on the schedule. None of the Notified Bodies have been recertified to the MDR, so there are at least nine to 12 months before they can consider certification against the MDR. I suggest asking whether they plan to apply for recertification including your types of devices so you know whether to consider changing Notified Bodies.
Q: Will all Notified Bodies be re-designated? Is there a risk they won’t be?
A: Yes. Currently, medium and high-risk devices require a conformity assessment by a Notified Body. Notified Bodies have been designated by the Member States under the MDD. Under the MDR designation procedure, Member States and the European Commission are responsible for designation. The requirements for Notified Bodies are tougher than in the past, putting additional pressure to ensure they have the technical expertise to monitor the devices/companies they service. Notified Bodies will be required to make more informed decisions to provide a high level of safety and performance of products. Again, this is part of strengthening the protections for EU patients based on prior failures.
Q: Where do we send the portfolio plan?
A: This will be shared with your Notified Body. This is the key communication piece for them to understand your plan. Also, share it internally with those who have concerns about the product and know what the product support will be. If there are any products you’ll remove from the portfolio or any portfolio extensions—the reason I continue to emphasize planning and coming back to what will happen under the MDR—if any significant changes are made, you must upgrade that product’s technical documentation to meet the MDR’s requirements. You need to understand what to do before the end of the transition period and how this will affect you as the transition period ends and the MDR is fully applicable. This portfolio planning is key to that. Share internally and with your Notified Body—the people you need to involve.
Q: What are the differences between MEDDEV 2.7.1 Rev. 4 and MDR clinical evaluation requirements?
A: Rev 4 of the MEDDEV moves closer to the MDR, but the MDR takes it a little further such as requiring a signed quality agreement to access the equivalent device’s technical information when using an equivalent for a Class III device. Additional updates relate to requirements also in the MDR, like how to conduct a clinical evaluation as well as changing requirements for Notified Bodies. It is expected a Rev 5 of the MEDDEV will be published sometime after the entry into enforcement of the new regulations to align with the new MDR requirements.
Q: Is there a template that could be used for CER that is in compliance with the new MDR? Considering Adverse event database for a device...would not the device sales be the denominator? If a competitor’s device is similar, for example, to a hemodialysis catheter, can literature about that device be used or excluded? Is a contract required to use that data?
A: A good starting point is the templates that are provided in the MEDDEV Rev 4 document and adding the differences from the MDR. We have created MDR compliant templates on a client by client basis and tailor them specifically for the client and device categories. We can’t provide a generic template, but would be happy to quote a small project to create them or provide a gap assessment between your current process and the MDR.
Q: Do we really need to gain access to our competitor’s technical files to show equivalence for the CERs?
A: Yes, this is the requirement. Definitively for Class III and implantable devices, but in general, the bar has been raised on equivalence. Be prepared to make a more robust justification for equivalence for all devices. Further, consider leveraging your post-market surveillance data. This can include things like customer surveys, focus groups, and other proactive activities to gain understanding of the device. This will be one of the biggest challenges and has many companies nervous.
Q: Is the Clinical Evaluation Plan the best place to document our position on our CER approach and gain alignment with the Notified Body as needed?
A: Yes, the plan lays out your overall approach. Per MEDDEV 2.7.1 Rev. 4, there are five stages to clinical evaluation planning. The first four define the scope, identify the pertinent data, have someone ensure the data’s scientific validity and clinical relevance, then analyze the data. Finalizing the clinical evaluation report (CER) is the last step in clinical evaluation. CERs themselves have a section on approach and criteria. So, we think CER approach is covered as part of the process and in the actual CER.
Q: What is the purpose of the State of the Art section? Is it simply background, current setting, alternative therapies? Or are we intended to demonstrate our device is state of the art? What happens if it isn’t? I have heard repeatedly there will be “no more grandfathering” for established devices with a long market history. What does that mean under the new MDR? Will we need to sponsor clinical studies or proactively develop new clinical data? Do the Notified Bodies have a clear understanding of requirements under the MDR or are they waiting on regulatory agencies’ interpretation? Are we all grasping at straws as we figure out what the expectations will be?
A: The state of the art ensures that the device complies with current medical practice. It has more of a focus on indications for use and current medical treatment guidelines. If your device was used for a long time, but newer treatments are now the standard of care as a result of better outcomes or patient preference, it could point to a different risk/benefit analysis on the device. We have had CERs submitted for Notified Body review that incorporate a State of the Art report, so this portion has been practiced by some organizations.
Q: Intended use vs. indications for use. Some older products do not have indications for use. Do you need to redefine intended use to include all indications, or can you use a risk-based approach and use evidence for one high risk indication?
A: Under the MDR regulations, labeling must include “(b) the details strictly necessary for a user to identify the device, the contents of the packaging and, where it is not obvious for the user, the intended purpose of the device;” Given this new requirement, you will need to identify and include indications in the label. Furthermore, your risk management file for the medical device or medical device family must include your assessment of the product risk in the context of the intended use or purpose, as well as any reasonably likely misuse (uses not intended).
Q: MDSAP vs MDR—will Notified Bodies have two separate audits that may be performed at the same time?
A: The EU is not participating in MDSAP at the present time. If the MDSAP auditing organization is also an EU Notified Body, they can do both together, but might want extra time for the EU regulatory requirements—similar to how it is currently done for the additional requirements of the directives by most auditing organizations.
Nancy Morrison has over 25 years of quality and regulatory experience in the medical industry with U.S. and global regulatory submission experience. With R&Q, Nancy works with startup, mid-size, and multi-national medical device and combination product companies. Nancy has a Bachelor of Science degree in Mathematics and an Advanced Certificate in Regulatory Affairs along with RAC certifications for the U.S. and EU. Nancy builds collaborative relationships with stakeholders to utilize regulations and identify opportunities that provide compliant and effective business solutions.
Is your organization prepared? Over the past year—especially within the last few months—R&Q has received numerous questions related to the EU MDR. Hopefully, this compilation of those questions and their answers expounding on different aspects of the regulation helps your organization take the next step.
Q: The transition period doesn’t end until May 2020. Why start now?
A: 2020 is not far away. Given the extensive amount of work that must happen between now and then, if you don’t start now, you won’t finish. The resources of the notified body and lead times will not be available. The closer to the 2020 date, the longer we’d expect the lead times to be...if you can even get the support. At the minimum, you must execute your plan and understand how big of a gap you have to fill between now and then. At least then you’ll know if your products are in good shape with only minor tweaks to make. Hitting that date will be impossible if the plan isn’t started today.
Q: How do we get management on board with starting this effort now?
A: You really need to understand what the effort is. It will take considerable planning over several years to get your portfolio and these gaps in line with the regulations. Understand management must be on board and help you, and provide sufficient resources to ensure you meet the requirements. Otherwise, your products will be off the market.
Q: How should a company communicate to its Notified Body about timing for transitioning and implementing to ISO 13485:2016 and the new regulation? Is it appropriate to communicate using a change notification? Is there a standard process?
A: An upcoming surveillance or recertification audit would be a good opportunity to discuss timing. If a recertification audit is approaching and you want to transition to ISO 13485:2016 during that audit, reach out to them now to ensure they have the resources allocated for an audit to the new requirements. Our sources have suggested it will take approximately eight months to get a MDSAP/ISO 13485:2016 audit on the schedule. None of the Notified Bodies have been recertified to the MDR, so there are at least nine to 12 months before they can consider certification against the MDR. I suggest asking whether they plan to apply for recertification including your types of devices so you know whether to consider changing Notified Bodies.
Q: Will all Notified Bodies be re-designated? Is there a risk they won’t be?
A: Yes. Currently, medium and high-risk devices require a conformity assessment by a Notified Body. Notified Bodies have been designated by the Member States under the MDD. Under the MDR designation procedure, Member States and the European Commission are responsible for designation. The requirements for Notified Bodies are tougher than in the past, putting additional pressure to ensure they have the technical expertise to monitor the devices/companies they service. Notified Bodies will be required to make more informed decisions to provide a high level of safety and performance of products. Again, this is part of strengthening the protections for EU patients based on prior failures.
Q: Where do we send the portfolio plan?
A: This will be shared with your Notified Body. This is the key communication piece for them to understand your plan. Also, share it internally with those who have concerns about the product and know what the product support will be. If there are any products you’ll remove from the portfolio or any portfolio extensions—the reason I continue to emphasize planning and coming back to what will happen under the MDR—if any significant changes are made, you must upgrade that product’s technical documentation to meet the MDR’s requirements. You need to understand what to do before the end of the transition period and how this will affect you as the transition period ends and the MDR is fully applicable. This portfolio planning is key to that. Share internally and with your Notified Body—the people you need to involve.
Q: What are the differences between MEDDEV 2.7.1 Rev. 4 and MDR clinical evaluation requirements?
A: Rev 4 of the MEDDEV moves closer to the MDR, but the MDR takes it a little further such as requiring a signed quality agreement to access the equivalent device’s technical information when using an equivalent for a Class III device. Additional updates relate to requirements also in the MDR, like how to conduct a clinical evaluation as well as changing requirements for Notified Bodies. It is expected a Rev 5 of the MEDDEV will be published sometime after the entry into enforcement of the new regulations to align with the new MDR requirements.
Q: Is there a template that could be used for CER that is in compliance with the new MDR? Considering Adverse event database for a device...would not the device sales be the denominator? If a competitor’s device is similar, for example, to a hemodialysis catheter, can literature about that device be used or excluded? Is a contract required to use that data?
A: A good starting point is the templates that are provided in the MEDDEV Rev 4 document and adding the differences from the MDR. We have created MDR compliant templates on a client by client basis and tailor them specifically for the client and device categories. We can’t provide a generic template, but would be happy to quote a small project to create them or provide a gap assessment between your current process and the MDR.
Q: Do we really need to gain access to our competitor’s technical files to show equivalence for the CERs?
A: Yes, this is the requirement. Definitively for Class III and implantable devices, but in general, the bar has been raised on equivalence. Be prepared to make a more robust justification for equivalence for all devices. Further, consider leveraging your post-market surveillance data. This can include things like customer surveys, focus groups, and other proactive activities to gain understanding of the device. This will be one of the biggest challenges and has many companies nervous.
Q: Is the Clinical Evaluation Plan the best place to document our position on our CER approach and gain alignment with the Notified Body as needed?
A: Yes, the plan lays out your overall approach. Per MEDDEV 2.7.1 Rev. 4, there are five stages to clinical evaluation planning. The first four define the scope, identify the pertinent data, have someone ensure the data’s scientific validity and clinical relevance, then analyze the data. Finalizing the clinical evaluation report (CER) is the last step in clinical evaluation. CERs themselves have a section on approach and criteria. So, we think CER approach is covered as part of the process and in the actual CER.
Q: What is the purpose of the State of the Art section? Is it simply background, current setting, alternative therapies? Or are we intended to demonstrate our device is state of the art? What happens if it isn’t? I have heard repeatedly there will be “no more grandfathering” for established devices with a long market history. What does that mean under the new MDR? Will we need to sponsor clinical studies or proactively develop new clinical data? Do the Notified Bodies have a clear understanding of requirements under the MDR or are they waiting on regulatory agencies’ interpretation? Are we all grasping at straws as we figure out what the expectations will be?
A: The state of the art ensures that the device complies with current medical practice. It has more of a focus on indications for use and current medical treatment guidelines. If your device was used for a long time, but newer treatments are now the standard of care as a result of better outcomes or patient preference, it could point to a different risk/benefit analysis on the device. We have had CERs submitted for Notified Body review that incorporate a State of the Art report, so this portion has been practiced by some organizations.
Q: Intended use vs. indications for use. Some older products do not have indications for use. Do you need to redefine intended use to include all indications, or can you use a risk-based approach and use evidence for one high risk indication?
A: Under the MDR regulations, labeling must include “(b) the details strictly necessary for a user to identify the device, the contents of the packaging and, where it is not obvious for the user, the intended purpose of the device;” Given this new requirement, you will need to identify and include indications in the label. Furthermore, your risk management file for the medical device or medical device family must include your assessment of the product risk in the context of the intended use or purpose, as well as any reasonably likely misuse (uses not intended).
Q: MDSAP vs MDR—will Notified Bodies have two separate audits that may be performed at the same time?
A: The EU is not participating in MDSAP at the present time. If the MDSAP auditing organization is also an EU Notified Body, they can do both together, but might want extra time for the EU regulatory requirements—similar to how it is currently done for the additional requirements of the directives by most auditing organizations.
Nancy Morrison has over 25 years of quality and regulatory experience in the medical industry with U.S. and global regulatory submission experience. With R&Q, Nancy works with startup, mid-size, and multi-national medical device and combination product companies. Nancy has a Bachelor of Science degree in Mathematics and an Advanced Certificate in Regulatory Affairs along with RAC certifications for the U.S. and EU. Nancy builds collaborative relationships with stakeholders to utilize regulations and identify opportunities that provide compliant and effective business solutions.
