A Brief Look at the European Union’s New Medical Device and In Vitro Diagnostic Regulations

Medical Device Regulation Overview
Adopted in April 2017, the Medical Device Regulation (MDR) replaced the existing Medical Device Directive (MDD). According to the European Commission, the change was a result of "[p]roblems with diverging interpretations of the current Directives as well as the incident concerning fraudulent production of the PIP silicone breast implants[, which] highlighted weaknesses in the legal system in place at the time and damaged the confidence of patients, consumers and healthcare professionals in the safety of medical devices." See European Comm'n, Medical Devices, Regulatory Framework, The New Regulations on Medical Devices.

The MDR, which contains a series of improvements aimed at modernizing the current system, technically entered into force in late May 2017 but will take full effect after a three-year transition period. Significantly, this three-year transition period is not absolute for all devices. For Class I medical devices, there is a hard deadline on the date on which the MDR takes full effect (May 2020), although early compliance is permitted. Higher-risk devices may only switch to MDR certification once their "notified bodies" have been designated for the MDR. In addition, manufacturers can continue to use the MDD certificates, provided they have not expired, for four years after the date of application—until May 2024. Certificates issued under the MDD Annex 4 or the Active Implantable Medical Device Directive (AIMDD) Annex 4, however, will remain valid until either they expire or two years after the date of application (May 2022), whichever comes first. Notably, there are some conditions for using this "grace period." For example, no significant changes are allowed, the device needs to remain compliant with the MDD, and new MDR vigilance and post-market surveillance requirements must be applied.

One of the more significant changes under the MDR is stricter pre-market review of high-risk devices, including certain aesthetic devices, such as colored contact lenses and liposuction equipment. In general, the MDR expanded the scope of the MDD to include new product lines and devices that do not have a medical purpose, such as aesthetic products that present the same characteristics and risk profile as analogous medical devices. This review process requires consultation with a pool of independent experts taken from European Union (EU) member states before the device may be placed on the market. Controls will also be tightened on clinical trials as well as on the bodies that can approve the marketing of medical devices. In addition, the new regulation bolsters post-market surveillance requirements for manufacturers. Manufacturers are required to perform post-market clinical follow-up (PMCF) studies and deliver periodic safety update reports. These results must be taken into account for clinical evaluation and risk management. In general, all medical device manufacturers operating in Europe will need to establish risk management systems and quality management systems. To comply with all of these requirements, the MDR also requires manufacturers to identify at least one person within an organization who is ultimately responsible for all aspects of compliance.

In addition to the annual safety and performance reporting by device manufacturers required by the MDR, the new regulation also strengthens the designation criteria for notified bodies and requires more oversight. For example, notified bodies are now required to perform unannounced audits of critical suppliers once every five years. Moreover, notified bodies will conduct periodical product sample checks and product testing. In addition, national authorities will have stronger supervision powers over notified bodies.

The MDR also establishes a comprehensive EU database on medical devices and a device traceability system based on Unique Device Identification (UDI). Each medical device will have to be assigned a UDI. A manufacturer must obtain a UDI code from a UDI supplier, upload device-specific data into Eudamed—the European Databank on Medical Devices—and then link the UDI to that data set. After that, the UDI must be placed on the device label before distribution can occur. Not only will this database strengthen transparency of information for consumers, but manufacturers now will only have to register their device once at the EU level. The UDI system will also enable a swift and effective response to safety problems (e.g., recalls). Similarly, the MDR provides for improved coordination mechanisms between EU countries in the fields of vigilance and market surveillance. For example, clinical trials taking place in more than one member state will be subject to a single coordinated assessment, instead of multiple national assessments, as was the case under the MDD. In addition, under the new regulations, EU countries will coordinate more closely to circulate the performance data manufacturers are required to collect.

The introduction of "implant cards" represents another change included in the MDR. The card will contain information about implanted medical devices for all patients. Another MDR innovation is a financial mechanism that ensures patients are compensated in case defective medical devices harm them.

In terms of device classification, the vast majority of medical devices will not be reclassified under the new regulation, although there are new labeling rules. Examples of devices that will be reclassified to Class III devices are spinal implants, devices that control and monitor active implants, nanomaterials, apheresis machines, and combination products. For these devices, the impact of the changes could be significant. For example, products that are up-classified to Class III will require a more significant notified body review and will be subject to greater scrutiny in terms of the clinical data that are available.

Manufacturers have at least three years to adapt to these changes. Notably, many of the changes included in the MDR had previously been enacted in the form of "MEDDEVs." Therefore, manufacturers that have been following these as best practices need not be unduly concerned. The biggest transition will be for manufacturers whose products will either be reclassified or were never previously considered "medical devices."

In Vitro Diagnostic Regulation Overview
The In Vitro Diagnostic Regulation (IVDR), which was also adopted in April 2017, will take full effect after a five-year transition period. The IVDR, which replaced Directive 98/79/EC on In Vitro Diagnostic Medical Devices (IVDD), establishes requirements and conformity assessment procedures that manufacturers and authorized representatives need to comply with to ensure the efficacy, quality, and safety of their products.

In vitro devices are defined more broadly in the IVDR than under the IVDD. The definition, set forth below, includes devices intended to predict treatment results as well as a patient's predisposition to a particular medical condition. Under the IVDR, in vitro devices are defined as follows:

• a reagent, reagent product, calibrator, control material, kit, instrument, apparatus, equipment, software or system, whether used alone or in combination, intended by the manufacturer to be used in vitro for the examination of specimens, including blood and tissue donations, derived from the human body, solely or principally for the purpose of providing information:
  

  (a) concerning a physiological or pathological state;
  (b) concerning a congenital abnormality;
  (c) concerning the predisposition to a medical condition or a disease;
  (d) to determine the safety and compatibility with potential recipients;
  (e) to predict treatment response or reactions;
  (f) to define or monitor therapeutic measures.

The IVDR's procedure for device classification represents one of the regulation's most significant changes. The IVDR's risk-based classification scheme, which is based on the Global Harmonization Task Force classification scheme, replaced the "general IVD" category with four new device classifications: A, B, C, and D (from the lowest risk to highest risk). An IVDD's class is determined by seven rules set forth in Annex VII of the IVDR. Classes B through D require an assessment of the technical documentation by a notified body. This technical documentation must include three types of clinical evidence:

1. scientific validity: association of an analyte to a clinical condition or physiological state;

2. analytical performance: ability of an IVDD to correctly detect and measure the analyte (limit of detection (LOD), limit of quantitation (LOQ), accuracy, precision, and reproducibility); and

3. clinical performance: ability of the device to yield results that relate to a particular clinical condition for the intended use and in accordance with the target population and the intended user (if applicable).

Moreover, the European Commission determined that Class D devices require further oversight; thus, the IVDR established EU reference laboratories. EU reference laboratories will verify the claimed performances of Class D devices with the applicable common specifications and carry out testing on samples of Class D IVDDs.

Several of the IVDR's changes mirror the MDR changes. For example, the IVDR includes requirements for how the clinical and performance data may be obtained as well as minimum requirements to analyze the data for conformity. The IVDR states that the clinical evidence the manufacturer uses to support its device's intended purpose must be "based on a continuous process of performance evaluation, following a performance evaluation plan." This clinical evidence is vital for the IVDD's initial approval, as well as for the IVDD's continued conformity throughout its lifetime on the market. In a performance evaluation, the manufacturer analyzes and assesses the clinical and performance data it collects regarding its IVDD, and establishes how its device conforms to the regulations, confirms its performance, and confirms its risk-benefit ratio. Class C and D performance evaluations, and the summaries of safety and performance, need to be updated at least annually with the data that the manufacturer collects from its post-market surveillance.

Similar to the MDR, the IVDR emphasizes additional oversight. Accordingly, all IVDDs will be subject to performance evaluations, and studies targeting incapacitated subjects, minors, pregnant and breast-feeding women, and emergency situations will have to meet additional requirements. In addition, the IVDR provides for unannounced audits of critical suppliers and subcontractors by the notified bodies. Moreover, manufacturers themselves are required to appoint "persons responsible for regulatory compliance" to handle batch releases, technical documentation, and post-market surveillance and vigilance. Furthermore, the IVDR, like the MDR, provides for a UDI database to be established to validate, collate, process, and make the core data elements for UDIs accessible to the public.

Although there is a five-year transition period, manufacturers should begin preparing for IVDR to take full effect, as the new classification system will drastically alter the current system. Because a device's class drives many of the manufacturer's requirements for clinical evidence, performance evaluations, and conformity assessments, correctly determining the device's class from the outset remains critical. In the upcoming years, IVDD manufacturers should carefully assess their products with respect to the IVDR to determine the proper classification of their IVDD.

^{Copyright © 2018, American Bar Association. All rights reserved. This information or any portion thereof may not be copied or disseminated in any form or by any means or downloaded or stored in an electronic database or retrieval system without the express written consent of the American Bar Association. The views expressed in this article are those of the author(s) and do not necessarily reflect the positions or policies of the American Bar Association, the Section of Litigation, this committee, or the employer(s) of the author(s).}