Bryan Brosseau, Founder and Principal Consultant, Brosseau Consulting LLC11.17.21
The application date for Regulation (EU) 2017/745 (EU MDR) has passed and medtech organizations are realizing that May 24, 2024 (or an even earlier MDD certificate expiration date) is drawing near. While the date to conform to all transitional requirements has passed, a new wave of scrutiny will arrive as organizations seek certification under the new MDR. In recent conversations with industry colleagues and Notified Body personnel, it seems that one of the most challenging conformance aspects is interpreting the new regulations and understanding their practical application.
Incorporating regulatory requirements into a quality management system (QMS) depends on interpreting and fully understanding MDR mandates. In some cases, the new requirements are clearly and objectively defined, leaving little room for interpretation. For example, Article 15 states that manufacturers must have at least one employee responsible for regulatory compliance with defined criteria for that person’s qualification (e.g., “four years of professional experience in regulatory affairs or in quality management systems relating to medical devices” or a combination of one year of comparable experience and a relevant university degree). Such details leave little to guesswork.
In other cases, the regulation as written is not as clearly defined. For example, Paragraph 5 of Article 61 contains a new requirement that is making medtech manufacturers of various device classifications very anxious. Article 61 states that when equivalence is used to leverage clinical data from another manufacturer’s device instead of a study, “the two manufacturers have a contract in place that explicitly allows the manufacturer of the second device full access to the technical documentation on an ongoing basis.” Some creators of Class IIa devices that previously claimed equivalence to similar products have misunderstood this requirement. They panicked upon hearing a grossly simplified interpretation of the regulation: “you claim equivalence to a similar product, you now must have a contract with that manufacturer.” However, this is not the case, as clinical investigation is now required only for Class IIb and III devices. Additionally, this principal does not apply to all equivalence claims for clinical evaluation. Part A of Annex XIV requires, “manufacturers have sufficient levels of access to data relating to devices with which they are claiming equivalence in order to justify their claims of equivalence.” But it should be noted that no agreement is explicitly required—the new regulation only mandates such an agreement when leveraging clinical data for the equivalent device instead of a study. It is feasible to perform an evaluation using clinical literature for the equivalent device and comparative analysis or testing of the device, provided the manufacturer has the necessary data for which equivalence is claimed through testing or from some other source.
Further to the available requirements, new common specification documents or other, applicable regulations (e.g., 1272/2008/EEC) are subject to interpretation and understanding by staff handling the transition. Looking forward, delegating and implementing acts may also present such opportunities. There is a lot to digest and only so much time to do so. There are several practices that may expedite compliance and influence an efficient and thorough adoption of MDR requirements into the QMS and technical documentation.
Incorporating MDR requirements into QMS and technical documentation entails several steps for an efficient transition, including a) accurately interpreting the MDR text and ensuring an understanding, b) assessing existing information for the device, and c) formulating the appropriate path forward to leverage existing information or obtain new supporting data.
To begin, companies must step back and consider all relevant aspects of the regulation to interpret this requirement. In particular, they should search the regulation for any related content that may give clues to the EU Commission’s intent. For example, whereas most content regarding the Summary of Safety and Clinical Performance is in Article 32, there is also information that may drive interpretation in Paragraph 49 and Article 61.
Other sources to help companies interpret and apply MDR requirements follow.
MDCG guidance documents: New documents are released frequently, and many have already been released for device classification, UDI (Unique Device Identification), Clinical Investigation and Evaluation, PRRC (Person Responsible for Regulatory Compliance), and implant cards. MDCG guidance documents for Notified Bodies also should be reviewed, as they clarify MDR content as well as the Notified Bodies’ role in auditing the QMS and assessing technical documentation. Consult the Europa website for a complete list of published guidance and list of guidance documents in progress.1
Education: Healthcare executives should attend MDR-related conferences, virtual events, training, or seminars. These not only can bolster knowledge of the MDR but address the increased regulatory focus on competence. Documentation of such events can supplement companies’ audit preparedness and consultants’ qualifications as a supplier by clients. Before committing to a conference, however, participants should review the agenda and the speaker biographies. Attending an event with speakers from regulatory agencies and notified bodies allows participants to obtain information directly from the authorities and provides networking opportunities with these professionals. Speakers with experience in multiple organizations, with therapies, or obtaining certification of various technologies also brings ideal perspective for understanding and applying MDR requirements.
Networking: While an informal network may be susceptible to erroneous information compared to the resources previously mentioned, sometimes posing a question to a professional network is an effective way to quickly vet an idea. Understanding how colleagues’ companies are addressing the requirements is a valid means of assessing the landscape—the same landscape Notified Bodies are auditing and certifying daily. Specifically, companies should consider “tried and true” methods that have withstood the rigor of MDR certification. As more organizations achieve certification, the availability of such examples will increase.
Existing QMS and technical documentation: Medtech firms should not completely write off existing documentation simply because it wasn’t compiled under the MDR. Consider what sources were leveraged in creating the documentation. In several instances, new requirements under the MDR are not new concepts. For example, many organizations are implementing procedures for trend reporting for the first time, while other are simply adapting existing procedures. Although the MDD did not include the same requirement for trend reporting as the MDR, this topic has been addressed in MEDDEV 2 12-1 rev. 82 and GHTF SG2 document N36 “Manufacturer’s Trend Reporting of Adverse Events”3 since 2013 and 2003, respectively. As such, some QMS are already primed for some MDR requirements.
Gap analysis: A gap analysis of current QMS and technical documentation is critical in interpreting the regulation considering an organization’s historical system and information under the MDD. Even in cases where a gap analysis has been performed, more detailed and focused gap analyses on specific elements of the QMS is helpful in elucidating mandates where a broad gap analysis was completed by staff who were diving into the MDR for the first time. The participation of subject matter experts in this detailed assessment is critical in understanding and applying the new requirements.
Publications and white papers: There are numerous sources of digital information that help with interpreting, understanding, and applying MDR requirements. Many trusted consulting organizations, industry publications, and even Notified Bodies provide helpful information through articles, whitepapers, social media content, and infographics that simplify MDR content.
Notified Bodies: Besides publicly available documents, many Notified Bodies have sought to flatten the learning curve for clients by providing information that does not cross the line into prohibited consulting. Such information takes the form of Notified Body policy, forms or templates, and informal feedback during audits and reviews. Companies should consider asking the Notified Body what policy, forms, or other information they have that should be considered in complying with the MDR.
EUDAMED: The increased requirement for publicly available safety and performance information also results in a potential reference point for organizations that have not yet uploaded such information to EUDAMED. As EUDAMED modules are released, such examples will be available for all to see.4 For example, Summaries of Safety and Clinical Performance (SSCP) will be published for implantable and Class III devices. As of early October, the device module is live with device listings for two manufacturers (albeit no devices yet which require the SSCP).
References
Bryan Brosseau’s experience has been forged in 20 years in the medical device and biologics industries. With a varied and in-depth knowledge of quality and regulatory requirements, he drives quality and compliance without impeding progress. Bryan implements, manages, and improves quality management systems for numerous companies and has obtained regulatory approvals for products across a wide range of therapy areas. Bryan received his bachelor’s degree in biology from the University of Georgia, maintains a Regulatory Affairs Certification (U.S.) from the Regulatory Affairs Professionals Society, and is a certified ISO 13485:2016 and MDSAP Lead Auditor.
Incorporating regulatory requirements into a quality management system (QMS) depends on interpreting and fully understanding MDR mandates. In some cases, the new requirements are clearly and objectively defined, leaving little room for interpretation. For example, Article 15 states that manufacturers must have at least one employee responsible for regulatory compliance with defined criteria for that person’s qualification (e.g., “four years of professional experience in regulatory affairs or in quality management systems relating to medical devices” or a combination of one year of comparable experience and a relevant university degree). Such details leave little to guesswork.
In other cases, the regulation as written is not as clearly defined. For example, Paragraph 5 of Article 61 contains a new requirement that is making medtech manufacturers of various device classifications very anxious. Article 61 states that when equivalence is used to leverage clinical data from another manufacturer’s device instead of a study, “the two manufacturers have a contract in place that explicitly allows the manufacturer of the second device full access to the technical documentation on an ongoing basis.” Some creators of Class IIa devices that previously claimed equivalence to similar products have misunderstood this requirement. They panicked upon hearing a grossly simplified interpretation of the regulation: “you claim equivalence to a similar product, you now must have a contract with that manufacturer.” However, this is not the case, as clinical investigation is now required only for Class IIb and III devices. Additionally, this principal does not apply to all equivalence claims for clinical evaluation. Part A of Annex XIV requires, “manufacturers have sufficient levels of access to data relating to devices with which they are claiming equivalence in order to justify their claims of equivalence.” But it should be noted that no agreement is explicitly required—the new regulation only mandates such an agreement when leveraging clinical data for the equivalent device instead of a study. It is feasible to perform an evaluation using clinical literature for the equivalent device and comparative analysis or testing of the device, provided the manufacturer has the necessary data for which equivalence is claimed through testing or from some other source.
Further to the available requirements, new common specification documents or other, applicable regulations (e.g., 1272/2008/EEC) are subject to interpretation and understanding by staff handling the transition. Looking forward, delegating and implementing acts may also present such opportunities. There is a lot to digest and only so much time to do so. There are several practices that may expedite compliance and influence an efficient and thorough adoption of MDR requirements into the QMS and technical documentation.
Incorporating MDR requirements into QMS and technical documentation entails several steps for an efficient transition, including a) accurately interpreting the MDR text and ensuring an understanding, b) assessing existing information for the device, and c) formulating the appropriate path forward to leverage existing information or obtain new supporting data.
To begin, companies must step back and consider all relevant aspects of the regulation to interpret this requirement. In particular, they should search the regulation for any related content that may give clues to the EU Commission’s intent. For example, whereas most content regarding the Summary of Safety and Clinical Performance is in Article 32, there is also information that may drive interpretation in Paragraph 49 and Article 61.
Other sources to help companies interpret and apply MDR requirements follow.
MDCG guidance documents: New documents are released frequently, and many have already been released for device classification, UDI (Unique Device Identification), Clinical Investigation and Evaluation, PRRC (Person Responsible for Regulatory Compliance), and implant cards. MDCG guidance documents for Notified Bodies also should be reviewed, as they clarify MDR content as well as the Notified Bodies’ role in auditing the QMS and assessing technical documentation. Consult the Europa website for a complete list of published guidance and list of guidance documents in progress.1
Education: Healthcare executives should attend MDR-related conferences, virtual events, training, or seminars. These not only can bolster knowledge of the MDR but address the increased regulatory focus on competence. Documentation of such events can supplement companies’ audit preparedness and consultants’ qualifications as a supplier by clients. Before committing to a conference, however, participants should review the agenda and the speaker biographies. Attending an event with speakers from regulatory agencies and notified bodies allows participants to obtain information directly from the authorities and provides networking opportunities with these professionals. Speakers with experience in multiple organizations, with therapies, or obtaining certification of various technologies also brings ideal perspective for understanding and applying MDR requirements.
Networking: While an informal network may be susceptible to erroneous information compared to the resources previously mentioned, sometimes posing a question to a professional network is an effective way to quickly vet an idea. Understanding how colleagues’ companies are addressing the requirements is a valid means of assessing the landscape—the same landscape Notified Bodies are auditing and certifying daily. Specifically, companies should consider “tried and true” methods that have withstood the rigor of MDR certification. As more organizations achieve certification, the availability of such examples will increase.
Existing QMS and technical documentation: Medtech firms should not completely write off existing documentation simply because it wasn’t compiled under the MDR. Consider what sources were leveraged in creating the documentation. In several instances, new requirements under the MDR are not new concepts. For example, many organizations are implementing procedures for trend reporting for the first time, while other are simply adapting existing procedures. Although the MDD did not include the same requirement for trend reporting as the MDR, this topic has been addressed in MEDDEV 2 12-1 rev. 82 and GHTF SG2 document N36 “Manufacturer’s Trend Reporting of Adverse Events”3 since 2013 and 2003, respectively. As such, some QMS are already primed for some MDR requirements.
Gap analysis: A gap analysis of current QMS and technical documentation is critical in interpreting the regulation considering an organization’s historical system and information under the MDD. Even in cases where a gap analysis has been performed, more detailed and focused gap analyses on specific elements of the QMS is helpful in elucidating mandates where a broad gap analysis was completed by staff who were diving into the MDR for the first time. The participation of subject matter experts in this detailed assessment is critical in understanding and applying the new requirements.
Publications and white papers: There are numerous sources of digital information that help with interpreting, understanding, and applying MDR requirements. Many trusted consulting organizations, industry publications, and even Notified Bodies provide helpful information through articles, whitepapers, social media content, and infographics that simplify MDR content.
Notified Bodies: Besides publicly available documents, many Notified Bodies have sought to flatten the learning curve for clients by providing information that does not cross the line into prohibited consulting. Such information takes the form of Notified Body policy, forms or templates, and informal feedback during audits and reviews. Companies should consider asking the Notified Body what policy, forms, or other information they have that should be considered in complying with the MDR.
EUDAMED: The increased requirement for publicly available safety and performance information also results in a potential reference point for organizations that have not yet uploaded such information to EUDAMED. As EUDAMED modules are released, such examples will be available for all to see.4 For example, Summaries of Safety and Clinical Performance (SSCP) will be published for implantable and Class III devices. As of early October, the device module is live with device listings for two manufacturers (albeit no devices yet which require the SSCP).
References
Bryan Brosseau’s experience has been forged in 20 years in the medical device and biologics industries. With a varied and in-depth knowledge of quality and regulatory requirements, he drives quality and compliance without impeding progress. Bryan implements, manages, and improves quality management systems for numerous companies and has obtained regulatory approvals for products across a wide range of therapy areas. Bryan received his bachelor’s degree in biology from the University of Georgia, maintains a Regulatory Affairs Certification (U.S.) from the Regulatory Affairs Professionals Society, and is a certified ISO 13485:2016 and MDSAP Lead Auditor.
