As we are just past the halfway point of the MDR transitional period for the MDR and are well into the one for the IVDR there is one thing that has become very very clear:  the transitional period in the MDR and likely the one in the IVDR is not actually a transitional period for industry and certainly not the one you are looking for. It is more like an extended implementation period for the authorities to complete the regulations that came out of the legislative procedure as finished regulations but as a half-baked regulatory system that required a lot of additional implementation for it to be functional.

As reported in previous blogs, the implementation machine at EU level (which is mostly a concerted effort by national authorities that have a difficult time agreeing on the details of implementation of the CAMD Roadmap). We were initially happy with the prioritization of items in the roadmap, until they unfortunately turned out to be aspirational rather than committal.

Rolling plan

The European Commission has now released a working plan for the remainder of the transitional period, the “rolling plan” with expected timelines and next steps for implementation of items from the MDR – unfortunately also rather non committal.

As you can see in the rolling plan document, most of the things will happen Q4 2019 / Q1 2020, in other words: critical implementation mass at the end of the transitional period. This is an issue for manufacturers seeking to implement the MDR and IVDR, because this means that although the framework of the MDR and IVDR was ready by May 2017, with most of the sometimes very critical details to prepare for to come much later, leaving essentially no meaningful implementation period for industry.

The implementation period is effectively used by the authorities for their own roll-out of the system, rather than to provide industry with a meaningful period to transition each and every device on the EU market to the new system, which is already a Herculian effort with a full three years available.

Eudamed and Single Registration Numbers

A poignant example are the Eudamed Single Registration Number (SRN) process and interfacing specifications (not even starting about Eudamed’s ready for use date as such).  SRNs are the only thing that the EU does not provide – you have to get them on a national level and the member states have to set up mechanisms for issuing them after verification of the identity of the manufacturer, authorised representative or importer.

If you are a company with many products, you need to be able to talk to Eudamed on a machine to machine basis as soon as Eudamed goes online. Without an SRN however it seems you cannot interact with the Eudamed database, which will be necessary when Eudamed becomes applicable.

Have you checked with the competent authority in the member state where you are as manufacturer or where your authorized representative is when they will have an SRN for you and what you need to do for that? 

CS for non-devices

Another one is the common specificiations for non-medical devices: arriving November 2019 while you should be compliant by 26 May 2020. That’s a cool six months to re-invent a product that is not a medical device as a medical device and really not a meaningful transitional period. Good luck with that!

Harmonised standards

And how about the harmonised standards for the MDR/IVDR? Anyone? The regulatory system under the directives was built on the assumption of conformity with the directives if you conformed to a harmonized standard. We are carrying over this system into the MDR and IVDR so these harmonised standards are kind of important if you want to declare or assess conformity with the general safety and performance requirements under the MDR and IVDR and rely on the presumption of conformity that meeting a harmonised standard affords as COCIR points out quite rightly.

 As the rolling plan says: consultation of the member states on the scope of the first mandate is ongoing; expect a decision by Q1 2019. Wait what – first mandate? So there will be more? Yes, apparently we have quite a number of harmonised standards under the current directives, so it looks like the EU will harmonise standards under the MDR in tranches. When what why how? Your guess is as good as mine. I’ve heard that the plan is to start with the most important horizontal standards first. Which are? Surprise! Your guess is as good as mine.

Where is the European Parliament?

Yet, the Commission is playing ‘nice weather’/’these are not the droids you are looking for’ also in European Parliament by saying that everything is on track and that there is nothing to get all excited about. Well, I suppose you could say that even a burning runaway train that is going to arrive late and blow up the station is ‘on track’ in a sense of the literal meaning of the words.

Because where is our fiery European Parliament in all of this? It was so totally prepared during the legislative procedure to call industry by the worst of names (“single use labelling is like printing your own money“, remember?). There will be at least some notified bodies in time – sure, but will they have even close to the capacity requirements to deal with the workload coming their way (see below for more about that)? These are the important questions. An incomplete and under-resourced system is not going to deliver and a failed system is not a successful system. Our guardian of the citizens and its ENVI committee with an opinion about everything devices related seems to be comfortably sitting on its hands watching the European implementation machine fail to deliver a complete regulatory system timely.

The European Parliament will probably blame someone else because they had to make so many compromises to have the rules adopted in the first place. This is seems to be the approach that Ms Roth-Behrend (the wings are on fire again) seems to be saying the media push started by the ICIJ’s Implant Files: blame everybody but us. How convenient. But how about maybe taking some responsibility now? 

Joint assessment process of notified bodies

The Commission also published an update of the joint assessment process of notified bodies. This nothing to become enthusiastic about, even though the Commission tried to put a positive spin on this in European Parliament by saying that more than half of the currently notified notified bodies have applied. Hurray! Does that mean that the capacity the market requires for transition all CE certificates on the market to the new system will be online timely?

Probably not: so far only 6 notified bodies have handed in CAPA plans (which likely means that all of the other applications have not made it to that level because as far as I know no notified body sailed through the joint assessments without CAPAs), only one final JAT opinion was issued for a lucky notified body that might be notified in Q1 2019 (provided that the final designating authority report is also issued) and no final designating authorities reports (which marks the ‘internal’ end of the designation process) have been issued. This means that in the most optimistic scenario notifications will start to trickle in one by one from somewhere in Q1 2019. It’s like I tell my kids over and over again: your homework is not finished until it’s done. And this stuff is so way not done yet.

Let’s take a realistic view at capacity coming online and capacity needed as Medtech Europe has been doing. It is becoming very clear now that several factors are brewing to create a perfect storm of undercapacity of the system as explained in the below MedTech Europe infographic:

• more and more notified bodies are closing down or not applying for MDR/IVDR notification;
• the Brexit is coming up with ~ 40% of the EU notified body capacity in the UK at risk (although this problem is temporarily delayed now – see below);
• fewer and fewer notified bodies do more of the work.

It’s not an exaggeration, this notified body capacity issue. In addition, notified bodies are increasing getting in worse shape, likely resulting from the pressure on their organization to get more work done than they can manage in parallel to the time consuming MDR and/or IVDR accreditation application.

Every week almost I am being contacted by desperate companies that run into catastrophic issues with their notified bodies (mainly the smaller ones), such as:

• certificate expiry because the notified body is unable to schedule and/or complete a timely recertification audit and often does not stick to agreed dates or promised actions, combined on occasion with the ‘solution’ that the deadline may be met if the client pays a considerably higher fee (I’ve seen twice normal rate);
• notified bodies flat out denying having received documentation as an excuse for missing auditing slots so they can skip the audit;
•  notified bodies letting a certificate expire in a certificate in one of the above scenario and rather than taking remedial action charging the company for a full renewed entrance audit for the device and taking a very long time for that;
• suspending a certificate for all devices of the company while the intention was to suspend it only partially for one and then take weeks to reinstate the certificate;
• etc.

I think authorities can be a lot more sensitive to these kinds of things, regardless of whether they are caused by bad faith or negligence, or just by under-capacity, because manufacturers just have no meaningful legal recourse against a misbehaving or blundering notified body. Requesting specific performance under the certification agreement in court almost never works in practice, and internal dispute resolution mechanisms of the notified body will usually find that the notified body is right and take a long time. 

So far I’ve found only one competent authority interested to hear about these things and willing to do something. Others are very standoffish or see it as commercial problem. That, I think, is way too easy if you’re finally responsible for the notified body’s good administration practices as notifying member state. Let’s not forget that the notified bodies are exercising delegated state authority. It would be very nice if the member states responsible would act like they are supervising their own institutions.

These notified body issues will only get worse as we get closer to the date of application of the MDR more notified bodies will keel over or start to exhibit this kind of behavior. Once we’re past the date of application this will really become a problem because then manufacturers cannot change notified body anymore. As long as they do not yet have their first CE certificate, it is unsure whether the MDR regime for delisted notified bodies in article 46 MDR applies and you can imagine how this will impact manufacturers that go for soft transition and then lose their notified body (and, as a consequence, their certificate).

Brexit

It seems that we have white smoke on the Brexit, but don’t get your hopes up yet. Whatever has been agreed (we still don’t know exactly) has to be ratified by a bunch of parliaments. Especially the Brexiteers in the UK parliament could seriously rain on this party.

But suppose the Brexit gets ratified. And then we have a transitional regime that lasts until 31 December 2020 – right in the soft transition period. And no certainty what comes next because that still needs to be agreed during the transitional period.

Implant Files

Then there are the Implant Files, a pretty large investigative journalism project aimed to hammer home the message that we have been hearing for years: CE marking sucks, notified bodies are evil corporations with a built in conflict of interest and government and industry are evil too, covering up piles of unnecessary cases of death and harm caused by faulty medical technology. Sounds dramatic, right? Because that’s news – no drama, no news that people are interested in.

But in my view this is no news at all – in fact this is all very much after the fact. We knew that the EU system could be improved, and that’s what’s happening with the new regulations. We also knew that vigilance reporting could be more transparent, which is why Eudamed is set up and will be much more transparent.

So here is my first reaction – since I’ve been quoted and have spoken to several journalists involved in multiple unsuccessful attempts to explain EU medical devices regulation to them, I feel I am entitled to an opinion in this matter. After all, journalists call me the manufacturers’ darling so I may have something to contribute to the discussion. For full disclosure: keep in mind that this is exactly what I am – manufacturers are my clients and I never make a secret of this so people know where I come from. I do not work for patients. So, believe what you will about facts but I do know the rules.

I think this initiative does underline that it is important what the changes in EU law with the new MDR and IVDR are going to do already: make more information about devices available to the public, such as by means of the Eudamed database that will contain a lot of extra information about devices. This is a good thing and yes, it could have been done earlier, but now it is at least happening. 

However, I think the conspiracy theory assumption underlying many of the publications that this information is deliberately withheld is not productive, because this conspiracy does not exist in my experience. But these days you need a good conspiracy theory to have a good story so how do you create a conspiracy theory? The reporters tried to obtain massive amounts of vigilance reports relating to implants by use of freedom of information requests, because there is no EU law and (that I’m aware of) national law in the EU that allows for access to vigilance data held by authorities. However, vigilance reports are full of confidential technical information of companies about how a device works and sensitive personal data of patients and doctors that you cannot just make public like that. Freedom of information laws have protections built in to protect these interests. It would be kind of strange that anyone (anyone) can just petition authorities for documents containing technical information provided in confidence or personal data concerning health of patients, right? That’s however what they did, and then they were very angry that they did not get all the information they wanted immediately and without redactions in accordance with the law. Only one conclusion possible: it must be a conspiracy! I think that is somewhat disingenuous and frankly quite naive. But it’s good drama, so good news to sell.

I have read most of the German, Dutch, UK, French and Belgian publications that have come out so far and they paint a picture of evil government and evil industry withholding information and making bad devices that fail more often than they should. Nothing new so far – haters are going to hate no matter what and news without drama will not sell. I think that in reality the picture is far more nuanced than presented that but that would not be news of course. CE marking is not a perfect system, but no regulatory system is perfect.

In fact, if you look at how the other regulatory systems for devices perform in the world, they perform no better than the CE marking system. The articles leave out a lot of things that would make them more balanced, like the fact that notified bodies are overseen and accredited by national authorities and that the authorities do diligently follow up every vigilance report that they receive.

A positive development of the Implant Files is more attention for regulation of medical devices, and specifically for resources committed by authorities. The CE marking system has so far performed very well with very little resources committed to it. This is a political choice that all of us are making together, see also what I wrote above here in this post. But it needs to be resourced properly for it to work. Look at the system for medicines: this is resourced much much better than the devices system and lo and behold, it’s the example for other systems. No shit Sherlock, you get what you pay for – also when it comes to regulatory systems. Also this is being addressed in the MDR and IVDR, by the way, with a renewed vigilance and market surveillance system. Now we just need some resources to roll out the system timely, as discussed above.

The Implant Files articles point at an increase of incidents in total, but they do not place it in the wider context of the increased use of implants for example, which is a missed opportunity to make it less sensationalist and more balanced. Oh wait – less sensation was not the point. Similarly, the assumption underlying the reporting seems to be that any incident in a treatment involving a device is attributable to the device only, while this if of course not necessarily true. Doctors may choose a perfect device for the wrong reasons, as a result of which the treatment will not deliver the results aimed for and the device is blamed. Or, what I often see in my practice: the device may fail as a result of the doctor’s fault. These cases are reported as incidents but are not attributable to the device, even if the device is a causal link in the damage.

It would also have been interesting if they would have compared medicines side effects to medical devices side effects so you can actually say something about acceptability of level of side effects. Medicines, their side effects and medication errors kill loads of people every year. Yet, I don’t hear people advocate for autopsy on every person taking meds that dies outside the hospital, even though enormous amounts of people die from adverse reactions to prescription medicines. Yet, this was proposed in one of the Implant Files items for people with pacemakers / ICDs.

Medicines have more robust trails because they take forever and have lots of people in them, and they have arms, including a placebo arm! But the nuance is again lost there too: you have to test a medicine in a clinical trial delivering results based on statistics because we do not fundamentally fully comprehend human biochemistry and make it transparent, so it’s actually a very crude mechanism. It’s like throwing someone out of an airplane to test a parachute. Maybe a lot of people, so it’s statistically sound. And then we throw some people out without parachute but tell them that we’re not sure if they have one or not to correct for the placebo effect. That is – conceptually – how we test medicines for a lack of better methods.

And did you know by the way that regardless of all that rigorous testing medicines remain incredibly dangerous and kill loads of people? The European Commission estimates that adverse reactions from prescription drugs cause 200,000 deaths per year in the EU, making prescription medicines drugs a major health risk, ranking 4th with stroke as a leading cause of death. Maybe not the best product to compare medical devices too, because I bet medical devices are not the 4th highest cause of death, not even by the estimation of the Implant Files. Would we like an approval mechanism that makes medical devices just as much of a universal killer as medicines? I bet we don’t. That is why these comparisons are so meaningless. 

With devices however you can usually test if the device works or not because they work physically and not systemically, so you need fewer patients and less statistics. It would be quite immoral too to implant people with placebo pacemakers or placebo hips to see if the pacemaker or hip actually works. Because that is how we test medicines statistically for lack of a better way: you cannot observe biochemistry in action the way you can observe and test devices that act physically. It’s that simple, and that’s why we do not need huge populations of trial subjects to arrive at statistically relevant conclusions about how biochemistry functioned and what effects it had. That is why it makes a lot of sense to test medical devices clinically against the standard of care to see if they improve care compared to available solutions and check for unpredicted side effects, but a trail to statistically figure out if they work in the first place is not that ethical mostly.

You can wonder whether some implantable devices based on what companies thought was well understood technology were followed up with patients long enough because they did lead to systemic issues – and we did. It’s why we are experimenting with increased post market clinical follow up requirements under the current rules already, are fixing this too in the MDR and are paying particular attention to new implants, which need more data in advance. The Implant Files are conveniently ignoring that the EU started a major program to improve quality of approval, oversight and clinical evidence for medical devices in 2012 and has been rolling that out ever since, culminating in the new Medical Devices Regulation that entered into force last year and will apply in all aspects soon. But a problem solved is of course no news, so that is why the efforts to improve legislation that has been going on for years is basically not mentioned in the Implant Files.  

Another problem I have with the Implant Files is how the articles and the TV shows blend US and EU requirements as if they are one single thing and draw implicit conclusions from this weird blend for the EU state of affairs. For example, a US expert is interviewed  about how you can misrepresent things on an FDA incident reporting form in the US by selectively ticking boxes concerning cause of death and it is implied that the same is possible and in fact happens in the EU. However, as a starting point the EU model form for incident reporting is structured very differently, and this is not even addressed, nor how you would use that form to manipulate your vigilance reporting. Yet, the message is that this happens in the EU as well. There is no evidence however in the reporting that I came across of how you would do this in the EU. This is strange because the FOI requests provided the journalists with a deluge of EU vigilance reports and forms, which they could have easily checked. But they didn’t. This is just an example of one of the many things that give a wrong impression and I think unduly so.

The above is just a first impression. I will write more about the Implant Files, if only to help correct the sensationalist picture created on often half baked understanding or representation of the EU regulatory system.

Happy new year and welcome to 2019, a truly decisive year for the medical devices industry with interests in the EU. If you haven’t spent any time so far getting ahead of events relating to the MDR and IVDR, this is the year that reality will start catching up with you. This year will determine if a manufacturer goes up, or potentially out.

Why is 2019 so important? Read on, and you’ll agree with me that it is. First, take a look at the below diagram with the transition timelines, to which I have added my own embellishments (the red and orange rectangles):

IVDs

IVD companies will be like: 2022 – so far away! Actually – no. 85% of the IVDs will need to be evaluated by notified bodies compared to 7% currently under the IVDD. This means that 85% needs to be IVDR certified by a notified body and that 78% of the IVDs on the market need to be CE certified by a third party for the first time. This will need to happen by notified bodies that have not been accredited yet (and will be much fewer in number than under the MDR), in accordance with new and stricter rules for performance evaluation. I bet that most of the technical documentation for currently self certified IVDs is a big leap away from where they need to be. IVD companies routinely forget that the IVDR impact on the IVD market is much much bigger than the MDR impact on the medical devices market and the notified body bottleneck much bigger. More on that in follow-up IVD specific posts. One thing at this point already: IVD companies should be well underway with their remediation in 2019, because the soft transition period is two years shorter, so in the end they must be fully compliant with the IVDR at the same time as the general medical devices must be compliant with the MDR.

“One Year of Application” – notified bodies’ perspective

Even the biggest optimists that like to shroud themselves in a cloud of mystery (the notified bodies) have started having open reservations about the regulatory system coming together. Team NB and NB-Med published a note “One Year of Application” in December 2018 that confirms the concerns I’ve been reporting about on this blog:

1.  Implementation period, May 2017 until May 2020, is too short for all stakeholders, taking into account that many details for both, manufacturers and Notified Bodies, are still under discussion 
2. Missing Guidance Documents enabling clear interpretation of specific requirements 
3. Unclear process behind the divergent opinions from the Joint Assessments 
4. Unharmonized interpretations of the Joint Assessment Teams and the various member states 
5. Capacity shortage for some medical device codes 
6. Workload for two legislative frameworks running in parallel for a period of time, from May 2020 until May 2024

In that note notified bodies state loudly and clearly that

• we have to count on not all products and manufacturers being certified under the MDR in time,
• capacity to renew (AI)MDD certificates for soft transition is limited (I read between the lines: ‘also possibly insufficient to renew all certificates timely’)
• it is not certain that all required class I R certificates (class I reusable instruments need a certificate under the MDR) will be granted in time because no notified body has been accredited for this yet.

Another interesting publication from Team-NB is the press release of 18 December “Surveys on MDR designation process steps”, which provides an update as to where the 22 Team-NB notified bodies that provided information are at present in the designation process:

The 22 Team-NB notified bodies are joined in the process (as per end November 2018) by 6 more non-Team-NB members that we know of, as per the amended joint assessment overview published by the Commission in December 2018. This overview states in relation to scope coverage “overall, the entirety of MDR and IVD codes”, which in my lawyer interpretation engine means: not everybody applied for full scope, and probably more than one did not. This makes it important for everybody to know if your notified body applied for the codes that you need.

This shows how (as I reported on this blog) incredibly over-optimistic to the point of being misleading the Team-NB notified bodies were around 26 November 2017, the date that the first applications for designation could be handed in – saying that all of them would immediately apply. It now mysteriously turns out that, for example, the Turkish notified bodies could not even ever apply for designation as Turkey has not transposed the MDR so far and two others have not even handed in their application. Yet, Team-NB was very sure at the time that all members would apply immediately on 26 November 2017, full scope. Scope is another question. While Team-NB says in the One Year of Application note that “All scopes, MDR and IVDR, are covered by the applications. Not a single product scope stays untouched.” I am not sure at all whether this can be interpreted as “every team NB member has applied for full scope MDR and IVDR and will be designated for it”. As “the expectations of the Joint Assessment Teams on resource qualification is dramatically increased compared to the requirements laid down by previous directives” it is by no means sure that notified bodies will come up short for designation (see One Year of Application note), or will have to drop specific codes from their application for which they do not have enough staff.

What is more: this data does not represent all Team-NB notified bodies and (by number) not the half of the notified bodies for the (AI)MDD (22 of 57 for MDD), which leaves big questions about the long tail of smaller notified bodies as the bigger ones are Team_NB members. Given that 6 more applied (and I’m assuming that there were none that applied for IVDR only) this means that 28 out of 57 MDD notified bodies applied so far. Less than half of the total number still. If you are with a notified body that has not applied by now, maybe think very hard about whether this one is right for you.

The notified bodies conundrum and resulting bottleneck is the biggest worry of industry, according to MedTech Europe.

Companies need to plan for two important notified body related windows in 2019:

1. the date on which the notified body needs an application for recertification under the MDD or AIMDD for one last time, in order to benefit from the 2020-2024 regime; and
2. the date on which the notified body needs to receive the MDR conformity assessment application, in order to be able to grant an MDR certificate before end May 2020.

For option 1, discuss with your notified body when this is. It looks like notified bodies will want to first do the MDD and AIMDD recertification applications (because of the insecurities in the MDR designation process), and subsequently the MDR work. BSI has indicated already it needs AIMDD and MDD recertification applications by end Q1 2019 (less than three months from now), but it may vary from one notified body to the other.

If you want an MDR certificate by May 2020 (option 2), count back 6-9 months (generally expected duration) from the date of application (26 May 2020) – this puts you between end August and end November 2019 under the most favourable circumstances. So one way or the other, you will be doing crucial stuff in 2019.

Did I already say 2019 was an important year? It will be an important year. You will remember it as the year in which the company made or broke its EU business.

Member states perspective

Member states keep generally taking the view that the system is ready enough but that they will keep monitoring especially notified body capacity coming online. An interesting account of a member state about the roll out of the EU system in a lot of detail (and with a lot of interesting sidebars to MDR and IVDR legislative history and EU level relevant quantitative information) can be found in the parliamentary documents for the Dutch MDR and IVDR implementation act, specifically the recent note after the first report (in Dutch, obviously – but easy to translate with Deep L, the excellent online translator that beats Google Translate hands down and offers privacy friendly options).

It’s interesting to learn for example that there is an explanatory ISO document for PMS under development and that the implant card format is still subject of inter-member state deliberation.

It also becomes clear now (as I’ve speculated before in presentations at conferences) that  new MDR provisions that are not immediately regulatory still will be subject to competent authority oversight. An example is the requirement of sufficient coverage for product liability (article 10 (16) MDR and article 10 (15) IVDR), containing the mystic formula (see below image) So, the competent authority may ask a manufacturer about their coverage measures implemented and – in case it finds them insufficient – issue an administrative fine or penalty payment. It is my expectation that this will work no different in other member states. Since this applies as of the date of application of the respective regulation, better be ready by then and have some rationale about your application of the mystic formula set out in article 10 (16) MDR and 10 (15) MDR.

The Netherlands as a member state says it’s carefully monitoring the market for signals about possible shortages and disruptions in medical devices supply and how to deal with those, because the government is not sure if that has anything to do with the new regulations. The government says this development may also be caused by manufacturers changing strategy as a result of changing economic circumstances. This is one of those statements of which we say in Dutch (literal translation): “now breaks my wooden shoe”. I don’t think industry can be more vocal about the clear and present danger of this happening. [cue bullhorn sound filter:] “Hello Dutch government: the new regulations change the economic circumstances, and the manufacturers are adapting to that change. It’s really not that complicated, if you are just willing to drop your confirmation bias that the new rules do not cause massive changes. You have been sitting in at many meetings where this was expressed loudly and clearly. I see my clients shed loads of SKUs because it’s just not economically viable to transition them to the new rules. I see hospitals act surprised and be worried about this development. This shit is real, to put it bluntly. If you still do not get this, get over your bias – please.”

The Dutch government emphasises the importance of application of the General Data Protection Regulation on clinical data generated for the purposes of the MDR and IVDR, including incident reporting. Make sure to have your house in order in this regard, as I still see that a lot of manufacturers do not have a handle on this.

The rolling Rolling plan roll-out

As I’ve written in my previous post, a lot of roll-out of the CAMD Roadmap will happen this year. The roadmap did not have any real timing in it, but the rolling plan does, and the Commission has just mentioned that you should read them in conjunction.

It’s about time that the roll-out starts rolling, because there is quite some crucial stuff in there if you want to get your transition right. You might have been almost ready, but without the elements in the Rolling plan you cannot be fully ready, or be sure that you are. In that light it is pretty disappointing that the companies that gave it their all to be ready in time are not rewarded for their efforts.

Especially the Annex XVI non medical devices companies have a really raw deal – zero guidance so far, no common specifications yet (these are being developed and should become clear in the coming months). Just nothing to go on really. For them this transition period is truly not a transitional period at all.

If a company does not manage to roll with the rolling plan and is not ready to submit files to its notified body when it is designated or needs the application to manage workload, the company will likely miss being compliant by end May 2020. And that means market foreclosure after that date.

Brexit – still a very wild wildcard

As they say: “gouverner, c’est prévoir” – governing is looking ahead, precisely what the UK government is not doing with the Brexit dossier by delaying a vote on the Brexit deal negotiated with the EU but not yet accepted by the UK. Let’s sacrifice rationality to politics and populism just a little more, because who needs a functioning economy connected to its biggest international trading partners anyway, right? Even at the date of this blog all options are still on the table according to the papers: no deal Brexit, second referendum to reverse the Brexit, just accepting the negotiated result arrived at on 6 December. In other words, the whole spectrum. We are still nowhere, really.

In the storm of all these prudential politics the MHRA has amended its Brexit technical notice for medicines, devices and clinical trails on 3 January because while the MHRA remains committed to the EU internal market, it’s government certainly is not and a no deal scenario is still firmly on the table. According to the MHRA notice the most important and direct consequence on 29 March in a no deal scenario would be that none of the UK notified bodies would

“be able to assess the conformity of medical devices for devices to receive the CE mark and enter the EU market. Therefore, the MHRA will no longer be able to oversee Notified Bodies in the way that it does now.”

This is obscure and polite language for: all CE certificates issued by UK notified bodies will lose validity on 29 March in a no deal scenario. The UK may still allow these products on the market for some time, but no EU27 member state is obliged to do so (nor has said at this point affirmatively at this point that it will).

So, have you asked your UK notified body if it can switch over your certificates to its EU27 counterpart before end of March? If they cannot, or if you did not ask, all your certificates and the market access that they entitle your company to in the EU (also outside the EU, in countries that ask for a valid underlying CE mark for a national application) are at risk in case of a hard Brexit, so there is absolutely no cause for alarm.

Yes – in a no deal scenario, it’s back to the basics that the Commission outlined in its no-deal notice for goods already a almost year ago. Oh, you never read that, or the company never took this seriously? Well, the joke may be very much on you with less than three months to prepare for this realistic risk. After all, it’s only core business, right? You were maybe thinking that it’s very much like the annoying airplane briefing “in the unlikely event of a sudden loss of cabin pressure yadayadayada” (I think stewardesses may also feel like Regulatory Cassandra) – this will never happen so why even consider this as a scenario worth thinking about. Well there you might be on 29 March with the comfortable airplane having its door blown out and your company fumbling for the oxygen mask during explosive decompression of the airplane. Happy times!

So

Swim or sink this year, up or out for the MDR – however you want to see or call it. Companies that have not been taking preparation seriously so far will have an interesting year, in which they can make or break their EU business, and the outside EU business depending on the EU CE marks. That can be considerable too.

IVD companies should be underway as well, because the soft transition period is two years shorter, so in the end they must be fully compliant with the IVDR at the same time as the general medical devices must be compliant with the MDR (May 2024) while working with a bigger bulge to pass through the bottleneck of notified body capacity.

I’ll be here the whole year to help you weather the storm – ask your questions earlier than later though is my advice. Want me to yell at unresponsive management that doesn’t understand it’s only core business at risk? Let’s do that sooner than later too. Happy 2019!

BSI reports that it has achieved designation as UK notified body for the MDR. So far, it’s the first notified body to appear in the NANDO database with an MDR designation – see here for scope and here that it’s only BSI so far for the MDR (the last link is a dynamic reference to NANDO so more may appear later). The notification appears to have made before Christmas (the date in NANDO is 20 December 2018), but it always takes a few weeks to appear in NANDO.

Hurray!

This first designation is excellent news, because it shows that the designation process can deliver at least one MDR notified body. Apparently that was not enough highlight for the Commission to list it on its medical devices website or issue a press release about, but whatever – I think it’s newsworthy.

No notified body has been designated under the IVDR so far. Yet, BSI and some others did apply for MDR and IVDR simultaneously, but as is clear from the Commission’s JA status overview discussed in my last blog, the focus so far has been on the MDR. IVDR designations should hopefully follow soon as the first JAs were MDR related. Maybe also  IVDR capas take longer to correct, or notified bodies took longer to correct them and decided to focus on the MDR instead at this moment (which makes sense too).

Wait what Brexit

Less good news is that no EU27 notified bodies were accredited yet. If the no-deal Brexit that is becoming more likely by the week proceeds by end of coming March as the UK politicians decide to throw their economy under the bus, then this new MDR notified body capacity will be immediately lost again to the market. A no-deal Brexit would mean that the new UK MDR designation would not count for the EU27, unless at least something of a deal addressing the status of UK notified bodies for industrial goods is made. As said, at this point every possibility is still on the table – according to Tony even a second referendum to reverse the whole circus.

With this cloud hanging over their designation, BSI announced that they “will very shortly confirm when we will commence taking applications to the MDR.” That sounds very prudent, as the Brexit can put a serious stick in that wheel.

BSI’s Dutch notified body achieved designation under the directives as a first step to hedge for Brexit but is not yet designated under the MDR or IVDR. Hopefully that designation is also in the pipeline, as well of the designations of other notified bodies.

Stay tuned

for further developments – the next couple of months will be very very interesting for the medical devices industry with interests in the EU.

At the moment I spend a considerable amount of my lawyering time answering questions concerning Brexit problems. My first question back to the company is: what are your Brexit scenarios? Did you make a plan to cover the scenarios and follow through?

Often the answer is “no, we don’t have a plan, because we don’t know what the Brexit will turn out to be.” If your company is stuck in this groove the good and bad news is that by now you have pretty much run out of options to take meaningful action to manage a no-deal Brexit, because that is scheduled for end March. Yes, next month. Pretty soon. Around the corner so to speak. 33 days from today. That’s really close.

In the mean time the UK is not a single step closer to accepting the separation package agreed with its negotiators in December last year, and things are getting more complicated with increased political fragmentation in the UK parliament. Other EU member states are explicitly warning the UK now that they have tossed the steering wheel out of the window and are flooring the accelerator with having delayed the vote about the Brexit package until 12 March:

So maybe you still think now that a no-deal Brexit is a scenario with a degree of possibility that is worth planning for. That’s fine. I’m also quite sure that there were at least some dinosaurs that did not think that this huge meteor in the sky merited any further attention.

Reality doesn’t care whether you sink or swim

Reality really doesn’t care about whether what is happening is fair or not. Nature is not a moral theatre. The interesting thing about reality is that it has a nasty habit of just moving along, whether you like it or not. Even if you don’t paint yourself in a corner, reality may move the paint steadily towards you leaving you increasingly out of options. That is precisely what I see happening with a lot of medical devices companies at the moment. They wait and see while the paint creeps towards them, reducing their options by the day – literally.

Maybe the company has a Regulatory Cassandra or two doing their Cassandra thing, but we all know how these things work – management is usually not that concerned about things that are more than three months in the future. Why would they be? “It’s only core business, so how can that be important to the company?” I often say to management that is adopting a wait and see strategy for the MDR, the IVDR and/or the Brexit. And then management is not so happy with me. The Brexit only started almost two years ago.

So what can you still do?

So what can you still do? It’s never too late to do something. You can at the very least look at the checklist that the EU provided more than a year ago for CE marked goods:

• Is my notified body in the UK without options to recertify in their EU27 counterpart? If so, then your certificates expire in case of a no deal Brexit and that has the consequence that you need new certificates, which you will need to get elsewhere.
• Do I have an importer in the UK? If so, imports may become an issue after the Brexit, because the importer is not importing into the EU anymore.
• Do I have an authorised representative in the UK? If so, move it to the EU27 because after the Brexit the AR is not in the EU anymore as required for an AR.

If the answer to any of these three questions is yes, action is required, unless of course you like moving all your chips to red or black and spinning the roulette hoping for a no Brexit.  If you are the roulette type, read no further. If you are not, consider the following questions:

• Do I have bridging stock in the UK and in the EU? It may already be too late to ramp up production to produce bridging stock, but you can still move stuff around. Plan for the UK to recognise the CE mark post Brexit for at least some tome (which it announced it will do), but not necessarily the EU recognising CE marks of UK notified bodies post-Brexit. Emergency measures may be taken, but they also might not be taken. Maybe only for essential devices, which your device might not be. Also think about the other things that might happen that may make it harder to move stuff around between the UK and the EU, such as customs requirements. Even if you do not have bridging stock, see how much product you can place on the market in the EU27 before the hard Brexit that may invalidate your certificate. Placed on the market is the safe place to be.
• What is the lead time for putting alternative market access routes in place? In other words – how quickly can you obtain new CE marking in the EU27 for the devices CE marked by UK notified bodies? Do you have contacts with a notified body that can still effect a voluntary transfer before the end of next month (probably not)?
• Also, the Brexit may affect all kinds of activities you have in or with the UK, such as import, production, parts or raw materials suppliers. See for every conceivable notice here. Better make sure that you manage those dependencies too.

In the mean time the UK has published its new design for product marking that will replace the CE mark upon a no-deal Brexit: “CA UK”. This will replace the CE mark and will be the mark resulting from the UK applying legislation post-Brexit that will very much look like the MDR and the IVDR. Or maybe they will do something else – they are on their own and rumour has it that regulatory competition will be an important selling point for the UK post Brexit.

Re-labeling for EU27 notified bodies

The Commission published another notice on 1 February 2019 with Brexit Q&A for industrial products  that confirms the above action points. But it also address the thorny question of relabelling of medical devices with the new notified body number (and don’t forget other relabel items such as authorised representative). Under heading D of the Q&A the Commission clarifies that there is no escaping relabelling when certificates are transferred to an EU27 notified body pre-Brexit (the certs are technically not transferred, because the new notified body issues new ones but anyway). Two important points:

• The transfer of certificates from a UK Notified Body to an EU-27 Notified Body needs to take place before the withdrawal date (in case of no-deal Brexit 29 March midnight CET), on the basis of a contractual arrangement between the manufacturer, the UK Notified Body, and the EU- 27 Notified Body.
• no need to change the Notified Body number for products already placed on the EU-27 market or manufactured before the transfer of certificate has taken place and not yet placed on the EU-27 market. However, products manufactured after the transfer of the certificate has taken place should be marked with the new EU-27 Notified Body number and it will not be possible to continue to use the UK Notified Body number until the end of the validity of the original certificate issued by it. 

In practice it turns out that it rather depends on

• the EU27 notified body what transfer process they can offer, as not everybody’s competent authority is minded to allow their notified bodies to offer a swift transfer process, while some do. This difference in my view is kind of nuts, because we have the NBOG that is supposed to oversee consistency on this point. Apparently the NBOG competent authorities are not really aligned on this.
• the UK notified body transferring what they can agree to in terms of moving the certificates to the EU27 notified bodies. Some of the UK notified bodies are very hard to work with at the moment, which makes agreeing to a meaningful transfer kind of problematic.

If you are confused and angry with your UK notified body not picking up the phone or answering email anymore (it happens), or just being too busy to even schedule a necessary audit in time to save your certificate (happens too), you are running out of options. Your only meaningful option is to approach an EU27 notified body that is willing to work from its end to see what it can do with the unresponsive UK notified body. And hopefully the competent authorities will have some kind of plan in case it completely goes south on 29 March, but so far they have been keeping their cards close to their chests.

As I’ve said on more than one occasion, it would be so helpful if competent authorities would be more concerned with the quality of notified bodies administrative practice. Issuing and surveillance of medical devices certificates is delegated state authority and we seem all happy to allow notified bodies to apply a standard that we would never ever accept from a government agency, not even from tax authorities.

People that are downplaying the notified body bottleneck may need to start to revisit their position with notified body LRQA now also dropping out of the notified body pool for medical devices and IVDs. This is especially a problem with respect to IVDs, as LRQA is one of the notified bodies traditionally handling a large share of the currently CE certified IVDs in the EU. This expertise and capacity will now be lost and not be available for the IVDR transition and for soft transition under the IVDR. And the general medical devices capacity is also lost of course too.

The case of LRQA

The case of LRQA shows that notified bodies are not only suffering in the end of the long tail, but also at the beginning of the tail. Three things are happening now.

First, LRQA is ceasing its MDD and IVDD services – this means that its current customers need to transfer to another notified body. Customers that had relied on LRQA to support them for soft transition (2020-2024 under MDD or 2022-2024 under IVDD) have to find another currently notified notified body to support them. Since LRQA was servicing a large part of the IVD industry that need CE certificates currently, this will be difficult and a bottleneck in itself. A transfer to another notified body may take longer than you have until the date of application for the MDR (26 May 2020). Also, customers of LRQA will need to transfer as soon as they can, because when a notified body closes down, the certificates will be withdrawn – regardless of the expiry date on the certificate (this is something that many manufacturers still misunderstand). It means that customers of LRQA may need to massively apply for orphaning protection with competent authorities if they cannot complete their transfer before LRQA closes its doors for the directives (90 days as of 12 June 2019).

Secondly, LRQA is abandoning its pursuit of a notified body in the Netherlands – this means that their Brexit hedge is terminated and less of the current capacity of notified bodies in the UK ends up being transferred to the EU27, so less total capacity available.

Finally, they announce that they are not pursuing their MDR and IVDR notification. This means that this capacity will not be available for the IVDR transition, which is a pity given the enormous amount of currently non-CE certified IVDs that need to be CE certified under the IVDR.

LRQA will probably not be the last

So, we are faced with the scenario that notified body capacity is rapidly decreasing, and a lot faster than new capacity is being added. In fact, new capacity is not being added because no new notified bodies are entering the market for certification services under the MDR and IVDR – the only new ones are UK notified bodies transferring to EU27, of which LRQA was one. NSF, the only really new NB on the block that I knew about, has abandoned its IVDR application in the mean time. 9 of of the 22 Team-NB IVDD notified bodies will not apply for IVDR, and the rest is in various stages of application or considering to apply for IVDR. MDR figures are also looking bleak.

You do not need to be a mathematical genius to see that with a projected increase of notified body workload of 780% (source: MedTech Europe) and a rapidly decreasing installed base of capacity of notified bodies, there will a bottleneck of bottlenecks. I predict that LRQA will not be the last notified body to abandon medical devices altogether.

Some Member States are getting kind of worried too. The Germans and Irish drew attention to the bottleneck recently asked for attention to this at the Employment, Social Policy, Health and Consumer Affairs Council session on 14 June 2019 in the general context of implementation of the MDR and IVDR (which, as I have blogged, is far from ideal to begin with):

“[…] based on the number of notified bodies which are expected to be available on time, there will still be significantly fewer notified bodies than currently exist. In addition, data is not available on the capacity these designated bodies will afford the system.

[…] The concerns expressed are that these products cannot continue to be placed on the market under their existing Directive certificate up until 2024, like most other existing medical devices and that this will lead to market shortages.”

In other words – I will translate these euphemisms for you – we are feeling our way along in the coal mine of the new unfinished regulatory system, a cage with a bunch of dead canaries in our hand, and we have no idea if what we are doing is going to produce the regulatory approval capacity we need.

MedTech Europe has recently used uncharacteristically strong language in this regard in an open letter to the European Commission:

“This situation is clearly untenable, and time has run out to build a functioning regulatory system. This set of circumstances will profoundly disrupt the medical technology internal market and create yet another significant ‘Cliff Edge’ putting patient safety, healthcare services and EU healthcare environment in a major disarray.”

I agree completely with them. In the end, this is about continuity of healthcare services – should be kind of important to member states as well.

What to do

For devices companies this means that more than ever you – apart from having your MDR/IVDR transition totally sorted out and on track – have to vigilant to signals from your notified body that they may be closing down, and be in absolute shipshape with your compliance in order to have a chance of a quick transfer to another notified body. In addition, you need to understand how the orphaning process works in case you need it. So plan for different scenarios, and include the worst in them. As I have told several CEOs of devices companies downplaying things in the mean time “It’s only core business – how can that ever be relevant to the company, right?”

MDR and Article 123 (3) (d) cookies courtesy of Medtech Europe’s Katalin Maté who baked them for a meeting – they were delicious!

Just before the Christmas holidays the Commission updated its rolling plan and the MDCG ongoing guidance overview.

As the year draws to an end, the date of application of the MDR is very close now and I see more and more things happen that everybody could see coming for a long time, I would like to take a few moments to give you my version of Dickens’ Christmas Carol story applied to the MDR and the IVDR. This is – as always – a very personal perspective and although I am a very optimistic person by nature I have found that there is not a lot to be optimistic about with respect to the MDR and IVDR at the moment.

Unless there we have some positive surprises in the months to come of course, of which we have not had that many so far. I have a hard time coming up with examples.

While I’d love to write a positive and uplifting story telling everyone that if they just do their best and apply themselves they can tackle this thing but that would just not be true given the circumstances. We are now at a stage that things are necessarly going to fall by the wayside and collateral damage will occur.

Christmas past – confusion everywhere

Confusion everywhere – the expression we used jokingly to refer to the imperfect but working system. This is the baseline that we came from. The MDR and IVDR were supposed to lead to a more coherent EU devices policy and lead to safer devices with better supported clinical benefits.

We had a regulatory system that was not ideal but that performed really very well for the very limited investments that the Commission and the Member States had to make. Compared to the medicinal products system the medical devices system costs very little to maintain. The market mostly paid for market approval directly via the notified bodies, and Member States invested little in enforcement and market surveillance. Coordination in Brussels was opportunistic: we coordinate interpretation in guidance documents, but will never commit to binding coordination other than under literal text of the directives. This is why we for example had a Borderline and Classification group that could not even agree on what a pharmacological mode of action was, and harmonisation so loosely that the ECJ could come to judgments like Lycocentre. Confusion everywhere – not ideal, but manageable.

Because of fraud with implants (which could just as well have been handled under the old system) and because of a perception that clinical evidence that could be better for implants (equivalency issues that could also have been handled under the old system) we decided to shake up things with new but foremost ‘better’ and ‘stricter’ regulation: enter the MDR and the IVDR. Because we partially blamed the notified bodies (‘they work for manufacturers so cannot be impartial’ ) we wanted all of them re-reviewed to higher standards, even though we could just as well have come to the same result under the old directives (and we largely did already as a result of the joint audits of notified bodies).

We embarked on an implementation trajectory in May 2017 for which the competent authorities and the Commission unfortuantely have little to show today, with six months to go to the end of the transitional period, which takes us from the Christmas past to today: Christmas present.

Christmas present – chaos everywhere

Normally you would enter a transitional period for a radical game changer of regulation with most of the regulations and supporting systems complete: everybody can get used to using the new systems, kinks can be ironed out before everybody must comply and all addressees of the new rules can implement the new rules in their organisations. Makes a lot of sense. This is not the choice that was made for the MDR and the IVDR, probably because of the political momentum that required a fix of a system perceived as broken. The Commission and the Member States embarked on a ambitious implementation calendar for implementing acts, common specifications, guidance and accreditation of notified bodies and then failed to deliver sufficiently for the system to work for all actors involved.

At this moment the Commission seems overwhelmed and has started kicking the can down the road with delaying Eudamed for two years (but not at the same being clear about the consequences) and delaying the need for CE certificates for class I devices that would be in a higher risk class under the MDR via the Corrigendum 2. The Commission now states in the December 2019 update of the Rolling Plan:

“It should be noted that, as a result of the Commission’s obligation to verify under a unique procedure the full functionality of the new database (including all relevant modules), the deployment of a fully functional Eudamed is expected by  mid-2022. The Commission is currently working together with Member States to provide guidance related to how certain new MDR provisions will apply in the absence of Eudamed. In order to support harmonisation during the interim period the Commission intends to deliver the actor registration module by May 2020 on a voluntary basis.”

It also states that the ‘Eudamed is ready’- notice (the article 34 MDR notice) is planned to be published in Q2 2022.

In other words: there will be something of Eudamed in 2020, we don’t know how to work with that and what this will mean. Voluntary use – does that mean that this use can be used later? Actor registration means SRNs, but how will voluntary SRNs work? Can they be converted in mandatory SRNs later? Many Eudamed questions remain, with a lot at stake. But guidance is underway – … OK, nevermind. I would really like to believe that the guidance will arrive on time and will be useful except that we are still waiting for most so much guidance.

The Commission and the Member States started the MDR and IVDR accreditation process for notified bodies later rather than earlier (it was not possible to apply before 26 November 2017, well into the transitional period). I have never understood why this process did not get more priority. It took a long time for the first notified bodies to become available (the first one in the second half of January 2019). During 2019 the Commission kept promising that there would be 20 notified bodies accredited (which includes double counting between the MDR and IVDR, so a notified body accredited under both counts as two for the Commission).

By Christmas 2019 we have 12 (Dekra Netherlands appeared as IVDR notified body in NANDO on 24 December 2019 and MedCert on 25 December 2019). The Commission notes in its Rolling Plan of December 2019:

“Ten notifications completed (8 for MDR and 2 for IVDR). Two more expected before the end of 2019  (1 MDR and 1 IVDR). About 20 designations expected to be completed in the course of Q1 2020. About half of existing certificates are covered by the notified bodies that will have a valid MDR designation in NANDO by the end of the year”

This means we have one more notified body to go this year, if the Commission’s statement is true. All of this would be nice except that it takes notified bodies about 300 days from designation to get to full certification speed. This means that the statement about certificates covered looks nice, but it also means that

• the other half of the certificates are not covered in time (except insofar they have managed to renew existing (AI)MDD certificates);
• of those certificates that are covered it is not certain what percentage will receive their certificate in time (300 days ramp up, remember –  almost a year) because an MDR accreditation requires a new review of QMS and technical documentation, so not something that is completed in a few months;
• the manufacturers that are with a notified body that cannot certify in time have no way to move to another notified body that is either MDR accredited or can still renew an existing (AI)MDD certificate (and takes on new customers because basically none is doing that at the moment)

Even if we have 50% of the certificates covered by notified bodies that applied for MDR in Q1 2020, this is not going to avoid the situation that we will have many manufacturers without certificates by the end of May 2020 for various reasons. In some cases they will have themselves to blame, in some cases they will have been dealt bad cards by the system (e.g. they bet on MDR because their notified body says it will be accredited, then find out that their notified body is either not going to be accredited in time or at all, with no possibility any more to transfer in time). These are the cases that are landing on my desk right now. And there are the cases of the companies with certificates in soft transition – they will be facing the situation of their notified body closing business (three months notice, no other requirements) and having to still apply for an MDR assessment that must be completed before end May 2024. And this is a big wave of manufacturers needing this, because either their notified body or the company itself was not ready for an MDR certification.

Since notified bodies are commercial entities and governed by the market, several things happen now that are typical for sellers’ markets where supply is restricted and demand is greater than supply capacity: prices go up, notified bodies choose their clients carefully and it’s very hard to get commitment to delivery dates. Smaller companies have less bargaining power and I see with some notified bodies that these have even more difficulties in dealing with their notified body.  This system is not designed for surges in load and doing the re-accreditation of notified bodies at the same time as re-evaluation of devices for MDR/IVDR compliance was, certainly with hindsight, not a good idea. The temporary spike in regulatory load requires investments in capacity that cannot be recouped and will likely not be needed after the spike, so will likely not be made. Also, it requires capacity that was never needed, and can therefore not be scaled up just like that. Training enough notified body personnel takes years. In the mean time my reality is that I see more and more companies struggle to have a meaningful connection with a notified body in time to meaningfully meet the deadlines. If you want to change notified body now, prepare to wait until autumn next year. And it’s the small ones that suffer the most because they have the least weight to throw around to secure a scarce slot at a notified body.

Regardless of the notified bodies, if you have an Annex XVI device: good luck getting that certified under the MDR by May 2020 because the Common Specifications have still not been established which means that no-one can even start to evaluate these products, nor is it possible to procedure compliant technical documentation. If you need a notified body for your Annex XVI device, there is literally no way that I see that you can be certified in time. Bad news for the contact lenses for example, or for dermal fillers or for laser hair removal devices.

The fact that there are still no definite harmonised standards for the MDR is perhaps the least of our problems. At least you can declare compliance based on state of art.

Then there is all the remaining guidance promised of which the innovation in the December updated ongoing guidance overview is that the MDCG is now planning to issue it – hold on to your seat – mostly in 2020. When in 2020? Good question. So far the guidance development process was characterised by moving goalposts and known unknowns.

To me this looks like a difficult 2020 with potentially many devices that can not possibly be compliant in time. How will the competent authorities of the Member States deal with this? We don’t know that either. Some have been recruiting, like everywbody else. It will have been a tall order for them to meet their recruitment goals as they are fishing in the pond that everybody else is fishing in too.

Rumour has it that some authoroties are talking about harmonisation of possible exemption policy with respect to companies and products that fail to be compliant in time in. Still, imagine having to request national exemptions in each member state based on different, or only partially harmonised policy, based on different forms. This would be integration reversed. And I did warn on this blog: this is a realistic scenario. And then the question remains whether the national authorities have sufficient staff to handle all these applications in a reasonable time frame? And what criteria will they use? How will they avoid that freeriding is discouraged and what would they like to see in terms of good faith efforts to be compliant in time? If they provide exemptions only for devices that are essential to patient care, that will lead to a impoverishment of the scope of medical devices on the market, and not for the right reasons. Impoverishment and shortages, this is I think what Christmas future may look like, and that’s earlier than you think.

Christmas future – catastrophe everywhere?

Will Christmas future (with Christmas 2020 already as a first Christmas future) be a situation of catastrophy everywhere? I hope not but it might be.

I have seen regulatory changes in the life sciences field turn out very bad, especially for the more innovative SMEs. A case in point that unfolded under my eyes is the ATMP Regulation that was supposed provide better and harmonised regulation for tissue, gene and cell therapy products ended up in impoverishment of the EU biotech medicines industry.  The approval process (which for this regulation was ready in time by the way) turned out to be so complex and expensive that almost no-one company was able to see a new product through to authorisation in an industry that – at the time – was characterised by mainly innovative SMEs. This became so bad that the EMA offered to give additional assistance to companies only to encourage applications on top of its normal SME benefits program, just to have something to show for this regualtory pathway. SMEs in the mean time rather chose to sell themselves to bigger companies as soon as they could, or set up outside the EU. The medical devices industry is even more characterised by many SMEs, and I think we risk the same happening in the medical devices industry.

This SME effect may be strongest in IVDs, where the percentage of companies that will need a notified body is much larger and many of these companies are SMEs with a relatively large number of products compared to the ‘general’ medical devices industry. So we have three IVDR notified bodies now out of a total of 11 applications. There do not seem to have been any additional IVDR notified body applications or we probably would have heard about it. The impoverishment effect could therefore be even stronger in the IVD sector because relatively more work needs to happen with less resources, in an industry that I see not yet generally act like they’ve heard the starting gun.

The same is true for the healthcare institutions, which have obligations too and in my experience are also slow to catch on to those kicking in by end of May 2020.

And there are the class I product manufacturers, that also generally do not seem to have much of a clue what it means to be fully MDR compliant by May 2020. The recently published class I devices guidance does not do a lot to instil a sense of urgency as it does nothing to describe the large gaps between MDD class I and MDR class I requirements.

Independent distributors – same thing: general unawareness.

What will this mean for the patients? I will make a safe prediction: there will not be more innovation, not more availability and not better healthcare because of the stress on the system and the insecurity that goes with it. Hopefully all actors, working together, will be able to avoid that the shortages of devices and difficulties of getting new technology on the market because the system is overloaded and clogged with re-approvals of old devices affect the standard of care too much.

MDR and IVDR goals at risk

In the end, it seems to me that the goals of the MDR and IVDR (“to establish a robust, transparent, predictable and sustainable regulatory framework for medical devices which ensures a high level of safety and health whilst supporting innovation” (recital 1 of the MDR)) are starting to become at risk with the way things are developing, at least for the coming few years. It is starting to become more and more clear that the structures in place and under development are not able to support the change process undertaken at the level we would have wanted.

The policy option chosen at the time (I have reread the original impact assessment for the MDR and the IVDR again) was ‘evolution’ of the then current system.

Evolution by the hand of the blind watchmaker is by necessity a brutal process with a lot of collateral damage, because nature is not a moral theatre. But this is not how we would like to work with a regulatory system for an innovative industry that we should be proud of that is supposed to deliver devices for patients that deserve the best possible care available.

Food for thought. I wish you happy holidays, a good start of the new year and as my late grandmother would wish me: “good luck and wisdom”.

And really hope I will be proven wrong over the next year(s) about this gloomy picture.

Welcome to 2020 – happy new year everyone. I don’t care if your conventions do not allow me to wish you best wishes after a certain date anymore. I wish you a happy 2020 because I genuinely hope you will have it. If you are a reader of this blog and you have a happy 2020, it will mean that a lot more went right in the MDR roll-out than I would expect based on the outlook at this moment.

Over the Christmas holidays I wrote my contribution to the Dutch Health Law Association’s 2020 periodical book discussing developments in healthcare regulation  (in case you read Dutch: Preadvies van de Vereniging Gezondheidsrecht), which is about medical devices law this year. It will be published spring 2020 and my conclusion is not different from my not so happy Christmas carol post just during the Christmas holidays 2019 (which I wrote as I was writing the contribution to the book).

The reality of things

The reality of things is that things are heading to an urgent critical mass (or mess, pun intended), because there is less and less time to make a meaningful difference.

We have about five months to go to the date of application of the MDR. Five is not much. It’s the amount of fingers on your hand – I’ll borrow you mine to make the point. See: only five fingers. Not that many. A fast typical conformity assessment under normal circumstances takes at least six months. Six is more than five. This means that even theoretically no additional notified body added in Q1 2020 will make a a difference before May 2020.

When I wrote the Not so happy Christmas carol post last December some people thought I was being overly negative and I even started believing that myself at some point.

But then I resumed work after the holidays and the reality of the devices world washed over me again with clients asking my advice in an avalanche of problems and with signals that I see in the market:

• clients facing massive delays in any interaction with notified bodies;
• clients approaching notified bodies for the first time are not able to find any notified body that will onboard them;
• clients facing notified bodies ‘offering solutions’ that will costs them double or more just for the notified body to renew a certificate in time for it not to expire;
• notified bodies ‘notifiedbodysplaining’ how their capacity is tied up to the extent that they are unable to make any predictions about certification decisions, not for (AI)MDD recertification and not at all about MDR certification;
• health institutions being mostly oblivious about what the MDR and the IVDR will mean for them (or in vicious state of denial about the in-house production regime);
• class I manufacturers mostly having absolutely no idea what the MDR will mean for them and not understand at all that there is a large gap to cross;
• independent distributors far and wide not wanting to touch the MDR with a 10 meter pole (yes, that’s more than 10 feet as the expression is originally phrased) and distributors calling themselves ‘wholesalers’ flat out denying that they are in scope of the MDR and IVDR, even though they evidently are;

And the list goes on. My pessimism is back.

The system is not antifragile and has an agency problem

We ended 2019 with the new Commissioner for Health jedi mindwaving the member states about the status of Eudamed and notified bodies and what that means for availability of medical devices on the EU market. Nobody seemed willing to admit publicly that the EU regulatory system for medical devices has not been designed to deal with the enormous spike in notified body and authority capacity needed for the transition to the MDR and to the IVDR. The system can just about operate at nominal capacity in its fragile equilibrium of structural under-resourcing, but the MDR and IVDR did nothing to make the system antifragile (i.e. capable of becoming sufficiently robust under stress) enough to deal with the efforts required for the enormous bulge in the pipeline resulting from the fact that all notified bodies needed a new accreditation and all certificates need to be re-issued under new criteria. In essence the MDR and IVDR have been set up as a massive agency problem waiting to happen, and that’s exactly how it unfolded, or in the words of Nassim Nicholas Taleb describing the agency problem:

“Situation in which the manager of a business is not the true owner, so he follows a strategy that cosmetically seems to be sound, but in a hidden way benefits him and makes him antifragile at the expense (fragility) of the true owners or society. When he is right, he collects large benefits; when he is wrong, others pay the price. Typically this problem leads to fragility, as it is easy to hide risks. It also affects politicians and academics. A major source of fragility.”

It also affects politicians – and indeed it does for the MDR and IVDR.

The lack of capacity is being felt keenly an acutely by stakeholders, and is mostly managed badly for a lack of options and resources. I have come up with a thought experiment that I would encourage everybody (and especially authorities) to apply to any situation MDR or IVDR related to expose the agency problem. Ask yourself in every situation: “Would we be OK with medicines agencies operating this way?”. Think about it. In many situations ‘the world would be too small’ (paraphrased Dutch expression) because it would be inconceivable in relation to medicines that the system or the government agency responsible operates this way. Notified bodies, however, are almost never government agencies, but they do exercise government authority.  Some examples I have come across, for your consideration:

• After accepting your application the registration authority says it will double registration fees and otherwise not finish your application process in time for your existing authorization to expire.
• The registration authority says it is not going to finish your application in the time frame promised, because it can actually not promise anything because it’s so busy and literally tells you that if you don’t like it, you are welcome to go to another agency.

Would we like the EMA or the national medicines agencies to operate this way? Hands up if we do, and please send in a comment if you think this is a good idea so we can propose amendments to basic principles of good administrative practice.

The bottlenecks summed up (again)

The reality of things is that even if the Commission is emphasizing the small successes (yay, another notified body accredited or look here, another guidance document published) and the Member States are doing their absolute utmost to trust the Commission when it is totally Jedi mind waving them, they’re not fooling anyone else.

MedTech Europe published a very clear and accurate paper that sums up all the bottlenecks, and shows that each of the possible ways to have devices on the market post May 2020 (an MDR certificate, a renewed (AI)MDD certificate or a national/Union-wide exemption) is affected one way or the other by the critical lack of capacity. They also point to potential solutions for each bottleneck, which I am not repeating here – please read the paper, it’s important. Spoiler alert: most of the solutions are to deliver as soon as possible on what should have been delivered years ago. This is also not new, but more urgent than ever.

I will summarise the bottlenecks (again) and invite you to read the MedTech Europe paper for the solutions.

MDR certificates

There are insufficient MDR notified bodies accredited to make the difference, essential guidance is lacking and the system is not ready in many respects and for certain devices. It takes notified bodies considerable time to get up to full accreditation speed after they have been accredited and even under the best of circumstances it takes at least half a year to process a conformity assessment application. The fact that a notified body has been accredited does not mean that it will be able to make the difference before 26 May 2020. The notified bodies accredited in Q1 2020 (including the remaining eight promised for 2019) will likely not issue a single certificate before the date of application of the MDR.

Renewed (AI)MDD certificates

There is not even enough capacity to renew all the existing certificates for the 2020-2024 grace period, and there is complete unclarity about what the duties of notified bodies overseeing these certificates past May 2020 are. As things stand, they can give any manufacturer three months notice, leaving the manufacturer in a situation where it will never ever be able to have an MDR certificate at another notified body (too busy, and takes (much) more than three months) and it is uncertain whether the orphaning procedure in article 46 MDR applies only to MDR certificates or also to (AI)MDD certificates valid past May 2020 based on article 120 (3) MDR. And there is still the uncertainty around the interpretation of the concept of significant change, which can invalidate certificates just like that. The fact that the guidance promised by the CAMD in December 2017 is still not here is quite frankly astounding.

Also, there is (still) no solution for notified bodies not renewing a certificate in time, or refuse to accept the renewal application.

National and EU exemptions

As under the old directives the primate of exemptions to CE marking remains with the Member States under the MDR. There is a possibility for extending a national exemption to the whole Union territory pursuant to article 59 (3) MDR – which means that there must first be a national exemption that applies to one Member State. Each member state may use their own criteria for that, which often involve that the exemption is the exception, i.e. not intended as a general alternative market access mechanism for everyone that could benefit from it. You will also often need to show that you are on board with a notified body already, which is kind of problematic because most are not accepting new customers at the moment.

Subsequent extension of the exemption to the whole Union (so the manufacturer does not have to make an application in each Member State) based on article 59 MDR is limited to ‘exceptional cases relating to public health or patient safety or health’, so not intended as a general exemption for everyone in trouble it would seem. And each exemption needs its own implementing act under the MDR to be adopted under the examination procedure, which looks like this:

As you can see, not complicated and slow at all – not. Quickly change the MDR for a more streamlined and quicker process perhaps? Not enough time to do this before May 2020.

Furthermore, it is not clear whether it is allowed for devices exempted this way to affix (or keep affixed) CE marking. If this is not allowed, this will  severely impact exports to third countries that allow devices on their markets based on CE marking.

You finally really seem to be doing it

One of the most powerful images that I can come up to underline the sense of urgency of this all is the final scene of the first Planet of the Apes movie.

Charles Heston’s character realizes at the end of the movie that the barren and primitive place in which he found himself the whole movie was in fact the post-apocalyptic earth. Would we like a health system just as barren as that of the planet of the apes? Maybe watch the movie for yourself to get an impression but (spoiler alert): the planet of the apes is missing a lot of nice to have and innovative medical technology that used to be available because it is kind of primitive. Of course this is a dramatic example, but I am running out of ways to express the urgency of the problem.

MedTech Europe politely captions its paper with “A Call to Action” because they have to be polite. I have less constraints and will be less polity because I am a (potential) patient myself, I have family members that depend on medical technology for their life, and others for their quality of life. And I am truly upset and disappointed about what we have to show for the MDR implementation at this moment (and don’t even get me started about the IVDR). I would like the best regulatory system so everyone can have access to the best and most innovative medical technology, not to the bare necessities only because we could not be bothered to make the regulatory system work.

Of course in the end the politicians will say it is nobody’s fault (agency problem anyone?), except that this would be wrong. The writing of things coming to this critical mass has been on the wall for a very long time, just read back this blog three years.

Let’s realize that we are all (potential) patients and want the best for our loved ones, ourselves and why not society at large, and make this thing work by adding clearly needed antifragility now that there still is some time. All the solutions are there, we know them, MedTech Europe helpfully repeated them. And the rest is politics.

On 16 March 2020 the Commission published the Commission Recommendation (EU) 2020/403 of 13 March 2020 on conformity assessment and market surveillance procedures within the context of the COVID-19 threat.

While this recommendation has been flagged here and there as ‘this may be important’ without real further comment I have been thinking about this recommendation myself and here is my take on what it means and may lead to.

What is this recommendation about?

Obviously this recommendation is an attempt of the Commission to manage administative barriers to placing PPE (personal protective equipment) and medical devices on the market that would be needed in the struggle to get the current Covid-19 pandemic under control. In my view you can also see this as a template for the next pandemic that has already started to affect the medical devices industry: the bottleneck caused by date of application of the MDR.

Let’s see what the recommendation does: it addresses two kinds of administrative barriers: conformity assessment procedures and market surveillance procedures.

With regard to conformity assessment procedures the recommendation recommends member states to

“the possibility for Member States to authorise derogations from conformity assessment procedures should also be considered, according to Article 11(13) of Directive 93/42/EEC and Article 59 of Regulation (EU) 2017/745 once the latter becomes applicable, also when the intervention of a notified body is not required.”

In other words: please Member States, think about your options to propose national CE marking exemptions for devices that can be transformed into a pan-European measure by means of the article 59 MDR procedure. The Commission cannot take its own initiaves on this point but can recommend the membe states to do this. Article 59 MDR procedure allows the Commission to make measures taken by one member state mandatory for the whole Union, which is a pretty useful feature. If one member state decides to allow a device on the market without CE mark and notifies the Commission, the Commission can validate the exceptionality and need of the measure at Union law and make an implementing act to make the measure mandatory for the whole Union, which becomes applicable after the members states and the EU parliament allow it through the implementing act procedure.

With regard to market surveillance the recommendation recommends member states to:

1. The relevant market surveillance authorities in the Member States should as a matter of priority focus on non-compliant PPE or medical devices raising serious risks as to the health and safety of their intended users.
2. Where market surveillance authorities find that PPE or medical devices ensure an adequate level of health and safety in accordance with the essential requirements laid down in Regulation (EU) 2016/425 or the requirements of Directive 93/42/EEC or Regulation (EU) 2017/745, even though the conformity assessment procedures, including the affixing of CE marking have not been fully finalised according to the harmonised rules, they may authorise the making available of these products on the Union market for a limited period of time and while the necessary procedures are being carried out.
3. PPE or medical devices not bearing the CE marking could also be assessed and part of a purchase organised by the relevant Member State authorities provided that is ensured that such products are only available for the healthcare workers for the duration of the current health crisis and that they are not entering the regular distribution channels and made available to other users.

The first point addresses dangerous non-compliant devices. I already see a spike in placebo medical devices and non-compliant Covid-19 self tests of which nobody knows where they come from or whether they even work for this intended purpose. Needless to say, authorities should clamp down on those.

The second point seems to be a reference to the article 97 (3) MDR procedure, under which the Commission can specify appropriate measures by implementing act for devices that are non-compliant administratively but do not present an unacceptable risk to health and safety of patients. This is an interesting procedure because unlike the article 59 procedure it allows for block exemptions.

The third option is also a good option: member states allow devices purchased according to certain specifications for the duration of the health crisis. This works especially well when devices are purchased via tenders.

So this recommendation, if you realize the at the Commission does not have any direct power under the MDR to take emergency measures, is really something. But it can also be a stepping stone for the way the EU handles the consequences of the bottleneck in medical devices approval caused by the way the MDR was set up, and which is now compounded by the Covid-19 health crisis.

What does/could this mean for the MDR and its date of application?

Everybody and their mother wants the date of application of the MDR moved for obvious reasons – with the Covid-19 pandemic happening notified body capacity is collapsing, and manufacturers have facilities closed down so are unable to receive physical audits. Even though everybody does what they can remotely, the processes are even more delayed and are delayed severely. We may not even out of lockdown in many place by the DoA of 26 May 2020.

The DoA, abbreviation for Date of Application, is starting to be cynically used as ‘Dead on Arrival’ by now. The situation is really getting out of control, even if everybody, including notified bodies, are doing their best to keep working the problem.

Yet, there is no mechanism in the MDR for moving up the DoA quickly because the EU is not set up this way. Clamoring for that is therefore not going to work.

A change of the DoA requires a legislative change, which cannot happen quickly. Reopening the MDR would lead to a situation where everybody would propose amendments or disagree, and that would bog down the process even more. Even if everyone agrees and does not propose amendments, the process takes several months. So that won’t work anymore now.

Emergency measures then? Since the EU is not a federation we have not delegated that much in terms of actual decision making power to the EU institutions, especially not in healthcare. The Commission is allowed to propose and the EU may adopt internal market measures that have a health dimension, but it is totally not allowed for the EU to intervene in emergency health situations on its own initiative with binding measures. Member states closely guard their national competence in that field and are not going to hand that over to Brussels. This pandemic shows that doing exactly that may not be such a bad idea – as they say, never waste a good crisis.

All emergency procedures in the MDR therefore start with a member state or an MDCG initiative, which is subsequently made binding by the Commission with an implementing act. The implementing act can always be blocked by member states or the Parliament. So this is how the EU works: nothing happens unless everyone agrees. Usually this works fine. In pandemics, it’s not so efficient.

The only way to move the MDR date of application is to start a new legislative procedure and change the date of application. Nobody wants to start a new legislative procedure at the moment however. Why? Because first, it is a slow process. Secondly, everybody will put in amendments because they can, slowing down the process enormously because nobody is going to agree with the amendments of everybody else just like that.

My thinking is that a version 2.0 of this recommendation would solve a lot of problems, without needing to go through a legislative procedure to amend the MDR. It would be appropriate too, because the Covid-19 pandemic and the date of application overlap and compound issues. Many of the bottleneck problems that we were having already with respect to notified body capacity have been steeply exacerbated by the Covid-19 pandemic.

A new recommendation drafted with the date of application in mind could provide the necessary coordinative template for member states to solve the unavailability of safe devices as a result of administrative problems, because the Commission does not have the power to do this. The recommendation 2.0 would provide a template for concerted and efficient use of the article 59 and 97 (3) MDR procedures. Everybody wins and the patients the most. Would’t that be great?

Again, why not the IVDs?

As we have seen with the Joint Implementation Plan, this Covid-19 recommendation also does NOT apply to IVDs – it only mentions medical devices under the MDD and the MDR. I don’t understand how you can ignore IVDs when the whole healthcare system is complaining about a lack of tests? In any pandemic, access to sufficient relevant tests is vital. I can for the life of me not understand how it is possible to ignore IVDs in this scenario.

Any recommendation 2.0 aimed at fixing the medical devices bottleneck should address IVDs too. The writing is on the wall that the bottleneck will be far worse for IVDs. 

A little side note on standards

Everybody is frustrated about the delay in harmonised standards for the MDR and IVDR, but this is no reason for delay as such. The recommendation reiterates in recital 18 that

“compliance with the harmonised standards is not mandatory. Manufacturers are free to choose other technical solutions provided that the specific solution which is retained ensures that the medical device complies with the applicable essential health and safety requirements.”

So, absent the harmonised standards manufacturers must think about what the state of art really is, and how a GSPR can really be met by their solution. Good time to think out of the box. The recommendation impresses in recital 22 on notified bodies to be flexible in this, and not be hung up on standards per se.

So – outlines of a way out

Use the recommendation 2.0 route could be the best compromise under the circumstances – a tried remedy that everyone should be able to live with and has a good chance of solving a lot of problems related to the conformity assessment bottleneck exacerbated by the Covid-19 pandemic. A true European solution! Now we just have to do it.

When it rains guidance, it pours. The MDCG just released Guidance on temporary extraordinary measures related to medical devices Notified Body audits during COVID-19 quarantine orders and travel restrictions. The guidance takes immediate effect and is valid for the whole period of duration of the pandemic COVID-19 as declared by the World Health Organisation.

It addresses alternative solutions to carrying out on-site audits by notified bodies under the medical devices directives and under circumstances the MDR and IVDR under specific circumstances, which includes the possibility to perform remote audits under certain conditions.

Covered audits

Although

“this guidance applies to the medical device Directives only, for Regulations (EU) 2017/745 (MDR) and 2017/746 (IVDR) in the event that the availability of devices is affected by COVID-19 restrictions the principles in this guidance may apply.”

The guidance covers the following audits:

• surveillance audits under the medical devices Directives,
• audits conducted for re-certification purposes under the medical devices
  Directives,
• in cases where a manufacturer submits a change notification to a notified body that would typically require on-site audit or verification,
• in cases where a manufacturer terminates (voluntarily or involuntarily) its contract with a notified body and enters into a contract with another notified body in respect of the conformity assessment of the same device(s).

IVDR is covered ‘in principle’! This is the first time I see something positive in guidance in relation to the IVDR. IVD companies, make this count and use this time to not give up on or start conformity assessment with the few notified bodies there are for the IVDR before these are completely crowded. This will also help fast track clearance for self-tests for COVID-19 under the IVDD and IVDR covered COIVD-19 tests. Hurrah!

Not covered audits

Generally initial certification audits or audits to extend the scope of certification under the Directives should not be performed using these temporary extraordinary measures. However, notified bodies may apply these extraordinary measures on a case-by-case basis for such audits in cases where devices are considered relevant to ensure medical care, especially if clinically necessary during the period of COVID-19 restrictions.

How?

Within the confines of audits covered and not covered the notified bodies have wide discretion on how to work, provided that the measures are covered by appropriate procedures. The guidance gives a number of examples of temporary alternative extraordinary measures and arrangements to on-site audits. The procedures should be carefully assessed and documented by notified bodies on a case-by-case basis and performed using a risk-based approach. This risk-based approach should be based on a review of the notified body’s

“files relating to the status and operations of the manufacturer related to the audit in question, for example the activities conducted at the site to be audited, its quality management system, and its level of compliance from previous audits. Following this review, a risk analysis should be made as to whether or not the audit could be performed with alternative measures. Where a postponement cannot be justified, the notified body should assess which alternative extraordinary measure should be performed (e.g. remote audit; off-site document review; conference calls with relevant personnel of the manufacturer).”

More detail coming

The guidances mentions that the MDCG NBO working group is tasked with the development of guidance to define the operational implementation details of this guidance document. More detail will no doubt follow.

When the Commission recently published the Notice on the application of Sections 2.3 and 3.3 of Annex IX to Regulation (EU) 2017/745 and Regulation (EU) 2017/746 with regard to notified bodies’ audits performed in the context of quality management system assessment on 11 January, there was much rejoicing in the medical devices community. Yay!

It looked like one of the big stumbling blocks of hold up of issuance of MDR certificates was finally cleared. But, this is actually not the case. Or, it depends how you look at it. More precisely, it depends how the member states authorities look at it.

What was the problem again?

What was the problem again? There is this COVID pandemic going on, which tends to cause a lot of restrictions in the movement of persons as a result of national measures to prevent it from spreading. At the same time the MDR and the IVDR require site visits as a condition for the notified body to grant an MDR or IVDR certificate (see sections 2.3 and 3.3 of Annex IX in either regulation). No travel is no site visit, and no site visit is no MDR or IVDR certificate. As the epidemic persists and the date of application of the MDR and IVDR creep closer, you don’t need to be a rocket scientist to see that this will create a big problem.

In 2020 the MDCG had already issued guidance on remote audits (discussed on this blog here about MDCG 2020-4 that was further clarified in MDCG 2020-17), but this did not (fully) cover the MDR and the IVDR and moreover it did not cover initial audits, which are the audits everybody needs for their first MDR and IVDR certificates. So, too bad so sad – no remote audit for you in case of an initial application until the auditors can physically travel again.

In the mean time in the medicines field

In the mean time the authorities for medicinal products were surprisingly more lenient and practical in allowing first GMP audits. The HMA notice of 20 April 2020 on the subject (see paragraph 2.2) is quite clear about that

“For new sites/facilities in the EEA that have never been inspected and authorised, a distant assessment may be conducted in order to evaluate if the site could be authorised without a pre-approval inspection. In such cases, it should be indicated that the certificate has been granted on the basis of a distant assessment. Moreover, an on-site inspection should be conducted when circumstances permit.”

and

“For new sites/facilities in third countries where an inspection is required, and where there is no operational mutual recognition agreement (MRA) or the scope is not covered by the MRA, a distant assessment by an EEA supervisory authority may be conducted. A GMP certificate may be granted depending on the outcome of the assessment. In such cases, it should be indicated that the certificate has been granted on the basis of a distant assessment. Moreover, an on-site inspection should be conducted when circumstances permit.”

And if circumstances do not permit to do a distant assessment, there is a clock stop until they do. The notice furthermore contains some good guidance on how to make the risk assessment to determine if the circumstances so permit, for example whether the manufacturer concerned has been naughty or nice in the past, and how to actually implement a remote audit in a practical way.

The EMA Guidance on remote GCP inspections during the COVID- 19 pandemic (dated 20 May 2020) even contains a complete template and roadmap for how to set up a functioning remote audit and also contains more detail on the risk assessment of the manufacturer audited.

So the Heads of Medicines Agencies in the EU and the EMA are very aligned on this, and had no issues in drafting a pretty clear notice that applies across the board. Enter the world of devices, in which things are completely different for no apparent reason.

The MDR and IVDR notice

The notice of the Commission is really kind of a non-notice. It turned out this way because it is very clear that the member states could not agree on this like they were able to do for medicines. Because, you know, medicines are really important. Ventilators, IC beds, COVID tests, who needs those in these times – right? Like in the Brexit agreement that fails to address devices but does address medicines also with respect to remote audits the lack of ambition on the part of member states is striking. It’s like member states still haven’t discovered devices as the crucial pillar underneath the healthcare system that they are. If the member states would have been aligned, we would have had MDCG guidance, which would apply across the board. But they are not, and here we are.

So what does the notice really say? You can see that the Commission had a difficult situation to work with, and tried to do the best it could under the circumstances. The notice reiterates legal requirements and the needs for remote audits under the circumstances, but then goes on to state that this is really a member state game, because

“the national authorities responsible for notified bodies shall monitor the notified bodies established on their territory and their subsidiaries and subcontractors, to ensure on-going compliance with the requirements and the fulfilment of obligations set out in the medical devices Regulations.”

which is legally completely correct. In other words, because the member states can’t align between themselves in the MDCG, it’s every member state for itself for as long as they cannot agree. This means that, as we are seeing, some member states are willing to allow remote audits, and others do not.

While the Commission does give outlines of a framework for determining if a remote audit can take place in the notice, this is a lot less practical than the HMA and EMA guidances discussed above for medicines. Personally, for the life of me I cannot see why this could not be harmonised better. In many member states the authority for medical devices and IVDs is even the same as the one for medicines. Not everywhere, I know that, but even then they can talk to each other you would think. So what the [beep] is the major malfunction here?

The Commission ends the notice with a call on the member states to at least keep the Commission involved of what they are doing and how they implement this. That’s the best that could be achieved under the circumstances, apparently.

What to do now?

This weird situation means that the possibilities will differ from one notified body to the next, depending on how the notified body fills in the broad criteria, which in turn is based on what the notified body’s notifying member state is willing to allow. EU harmonisation at its finest! Team NB is working on at least seeing if it can align its own members in this respect, and aims to have this done by end January. Let’s see what this brings, but in the mean time the clock is relentlessly and mercilessly ticking towards the date of application.

So what can you do as manufacturer? You do what Brian Boytano’d do: you make and plan and you follow through. Be proactive, and engage with your notified body about how whether and how it will apply this because you cannot assume that there will be aligned standard practices across notified bodies (except maybe if they are notified by the same member state). If they are waiting for alignment via Team NB, indicate your willingness to receive a remote audit. Look at the criteria in the Commission notice and in the HMA GMP and EMA GCP inspections notices, think about how you can demonstrate why a remote audit would be justified and that your case passes the required risk assessment, and think about what you can offer the notified body to make the remote audit practical (what would they want to see in normal circumstances, and how can you show this remotely in a way that they can consider it audited sufficiently?).

In terms of legal recourse you could, in extreme cases, consider taking legal action against a member state that does not allow its notified body/ies to do remote audits or imposes disproportionate measures compared to other member states or compared to the medicines notices.

You might find yourself in a situation that the certificate really does not arrive in time and new products can no longer be placed on the market, under which you could be forced to consider a local exemption or article 59 MDR based exemption, although the criteria for the latter option are very strict.

Try to stay positive

Personally, I am not rejoicing very much in view of this development and have a hard time staying optimistic about it. I had a spike of enthusiasm when I saw that a notice about this had been published. And then the disappointment came. Now I’m just trying to stay positive and hope this sorts itself out for the best. Maybe there will be alignment after all in the last months before the date of application – oh, wait. Thats where we are already.

To me it seems we need a change of culture in the EU because this non-notice shows how the member states are failing the patients, failing them badly. This is low hanging fruit. There is a precedent in medicines. What more do you need?

If there is one thing that the COVID epidemic has shown that one the one hand member states are ill-equipped to deal with bigger healthcare challenges by themselves, but on the other hand are too stubborn to equip the Commission with the tools to at least create aligned policies. This goes back to article 168 TFEU, which provides that medicines and devices are basically to regulated as widgets in the internal market, with secondary healthcare aspects. But otherwise the EU should stay off of any real healthcare policy (this is a bit simplified, but essentially what it comes down to). Yes, there is some movement with joint vaccine procurement and a very general healthcare policy, but this is not very much and certainly not a revision of article 168 TFEU.

At the same time we see member states under-resource national competent authorities for medical devices because we have European laws and a system that sort of took care of itself historically, right? This leads to the terrible situation where the lame (the Commission with insufficient competences to make a difference) has to herd the blind running all over the place doing their own thing (the member states that don’t see the need for a coordinated healthcare policy and underresource national devices authorities) – which is not productive at all. And how can this be explained to patients? That’s quite a challenge if you ask me. The reality now is that for example German restrictions on their notified bodies may lead to Swedish patients not having access to certain essential devices. That is the reality of the internal market and the reason why this problem is bigger than any single member state. By necessity, this means that the solution must also be bigger than any single member state, and that, unfortunately, requires a culture change that I have been advocating for a long time.

The notice contains an almost cynical closing statement by the Commission in relation to a request for member states to at least inform the Commission:

“In particular, given the difficulties to fully quantify the extent of the problem in advance, namely the need to recourse to extraordinary temporary measures in order to ensure continuous availability of devices and prevent the potential risk of shortages, it is vital to carefully follow how these measures are applied in practice.”

So, member states, please show some ambition here and know your limitations. If the problem is bigger than you can handle yourself, enable action at EU level. Europe is supposed to have the best healthcare system in the world, but looking at this mess you would really not think that. Nothing to be proud of, especially since a proven solution is right in front of you.

But before I get too cynical (this epidemic takes its toll on everyone including me these days) let’s see how things develop. The best thing to hope for is quick alignment between member states after all, and a very clear and detailed MDCG guidance. If the member states can agree about this stuff for medicines, why not for devices?

Let see if we can make this work for the better, rather than have it disfunction for no apparent reason.

Happy IVDR day my readers! My apologies for the low level of activity on this blog the last time. I’ve been very busy with MDR and IVDR work.

And of course I have been working hard on the second edition of the big book, the Enriched MDR and IVDR, which is nearing completion and will additionally cover regulation amendments, new guidance, amended guidance and other developments during the period of early April 2021 to the date of application of the IVDR. Hundreds of pages of additional content, outdated content revised, updated graphics, updated flowcharts, added flowcharts, added graphics, added tables – it was (and at the moment still is) a lot of work. When the content is ready we’ll do another InDesign pass for numbering and layout issues in the first edition, have it reviewed by the fabulous group of people that reviewed the first edition, and then we’ll have something interesting and worthwhile I hope. When, you ask? Well, soon. People that have bought the first edition have received a code for a reduction on the second edition. Competent authorities (not notified bodies) will get a free copy if they ask for it, just like with the first edition.

Something old, something new, something legacy

Happy IVDR day – the IVDR is now applicable and that means that the world will not be the same as before. As a result of the legislative change in January 2022 the IVDR has gone all out in legacy devices without an IVDD certificate during the staggered risk class determined grace periods, more so than the MDR. Given the relatively low number of IVDs that already had a CE certificate under the IVDD (and of course the low number of IVDR certified IVDs), becoming a legacy device has become sort of the rule under the IVDR.

As of now, the IVD world in the Union is devided in three IVD categories (see MDCG 2022-8 on legacy devices):

• Old devices (devices placed on the market under the IVDD before the date of application);
• New devices (devices placed on the market under the IVDR, regardless of the date of application); and
• Legacy devices (devices with an IVDD CE certifcate valid past the date of application and IVDD devices with a valid declaration of conformity issued before the date of application).

Note that the IVDR applies differently to each of these three categories! So it’s pretty important that you know in which category your device falls. MDCG 2022-8 describes in quite a lot of detail what parts of the IVDR apply for what group of devices. Essentially it comes down to this:

To determine if your device is an old device or a legacy device it is pretty important to get the details on placing on the market of the device right. Not a week goes by that I am not advising MDR and IVDR clients on placing on the market. It’s a complex and often misunderstood concept, as you can see in my discussion of it here.

A legacy device is not a walk in the park, as I’ve seen first hand being underestimated by manufacturers. Often the grace period was mistaken for a ‘delay’ in which the manufacturer did not do much, but this is mistaken. You should compare a legacy device to a large passenger airplane that is almost out of fuel: you want it on the ground safely as soon as you can, but landing a machine like that is a process that takes time. You do not continue flying at cruising altitude until the fuel gauge reaches zero and then hope you’ll magically find yourself safely on the ground.

Significant changes

Just before the date of application the MDCG released guidance on significant changes for IVDs specifically (MDCG 2022-6). Although on the rather late side, it was nevertheless useful to have this guidance for two reasons:

• Operationalisation of the concept of significant change specifically for IVDs;
• Some little steps of evolution in thinking on the part of the MDCG about formalities around significant changes.

In terms of evolution of MDCG thinking about signifiant changes there were two little gems in the MDCG 2022-8 document that stood out for me: one footnote and one little piece of text conspicuously left out. 

First: in footnote 5 there is a significant statement stating in relation to the requirement that legacy device certificates must remain valid during the grace period:

“This does not exclude the possibility that during the transition period an EC certificate for the manufacturer’s approved quality system issued in accordance with Annex IV or Annex VII IVDD, which has become invalid, is replaced by a EU QMS certificate issued in accordance with Annex IX, chapter 1, IVDR, provided that the EC design examination certificate issued under Annex IV, section 4, IVDD or EC type-examination certificate issued under Annex V IVDD remains valid.”

This is an important statement because it shows that the MDCG thinks that is is possible to exchange an expired QMS certificate for a legacy device with a new QMS certificate under the IVDR. This is not only relevant for the IVDR but also under the MDR, since footnote 6 of that same guidance mentions that the MDCG 2020-3 guidance should be aligned with MDCG 2022-6, where needed. This makes me somewhat optimistic that this will also be allowed under the MDR now, as I have seen more than one client get in trouble because the legacy QMS certificate supporting a legacy design examination certificate expired or otherwise became invalid. This would be an important development because I have experienced notified bodies categorically stating that this is not possible. Well, now it is.

The second interesting point is an omission of which I hope that it is significant, concerning administrative changes that are allowed, specifically in relation to M&A or corporate reorganization. MDCG 2020-3 under the MDR stated that permitted administrative change is:

“administrative changes of organisations are considered in principle as non-significant. This includes changes of the manufacturer’s name, address or legal form (legal entity remains) or changes of the authorised representative.”

MDCG 2022-6 phrases this as:

“changes of the manufacturer’s name, address or legal form, including a merger or acquisition involving the manufacturer;”

Why is this relevant? I have seen companies structure M&A projects wrong in the way that the legal entity of the manufacturer did not ‘remain’ and suffer the consequences: notified body did not want to cooperate with certification of new legal entity become manufacturer for a complete business unit that otherwise remained intact. It seems that the leaving out of the requirement that the legal entity remains could (might) be reason for optimism that this requirements has been dropped, thus making asset transactions that involve a new legal manufacturer possible without triggering a significant change (dear devices unit of the Commission, if I’m wrong on this point, would you kindly correct me please?)

Then there is the substance on what is considered a change to the intended purpose or design of the device, specifically operationalized for IVDs in MDCG 2022-6. The below table is a combination of MDCG 2020-3 extrapolation and MDCG 2022-8 added wisdom setting out a non-exhaustive overview of changes that are prima facie candidates for significant changes, conveniently put together for you:

In-house produced devices

There is another group of actors that is sucked into the IVDR, in kicking and screaming denial: the health institutions for the in-house produced devices. Kicking and screaming, you say, it can’t be that bad? Yes it is, I’ve seen from personal experience that this new group of addresses of the IVDR is mostly stuck somewhere on the low end of the Kübler Ross curve of acceptance of a dramatic situation that they did not choose for themselves, but on the other hand allowed to happen to them in all the worse ways because they never saw it coming and subsequently denied that it existed or downplayed the effort needed. 

Specifically I’ve seen very vocal arguments for example that ISO 15189 compliance basically covers most of the gaps (spoiler: it most certainly does not) and more specifically, that ISO 15189 is an appropriate production quality system for devices (as required in article 5 (5) (b) IVDR), which it is not. Any person advocating that position is very welcome to engage me in discussion and point out to me where in ISO 15189 manufacturing quality management system requirements are imposed. I have not come across them in this standard, because the standard is not concerned with manufacturing quality but with testing quality and competence, which is not manufacturing quality. Lab activities, not manufacturing activities. It specifies how to set up and run a test lab and procure outside materials used in the lab for testing, but not how to actually manufacture tests. Receipt and storage of tests, yes. Acceptance testing of tests, sure. But not actual manufacturing of the tests! Fortunately MDCG guidance on in-house produced tests is imminent now, and we’ll see who is right on this point.

Article 5 (5) IVDR applies to in-house produced devices, which were not in scope of the IVDD, and imposes a ‘CE marking light’ regime on them, basically regulating in-house produced devices roughly speaking somewhat like class A self certified devices under national competent authority supervision (with optional national exemptions). However, that does not mean that the requirements are a light regulatory touch. For example, each in-house produced device needs to have documentation showing compliance to Annex I General Safety and Performance Requirements of the IVDR, which is a substantial regulatory task to complete.

In the January 2022 amendment of the IVDR some, but not all, of the regulatory deadlines for in-house produced devices were moved. This means that some of the requirements (actually the ones causing the most work) apply already, and since the IVDR does not grandfather the installed base, must also be applied to in-house produced tests that were developed before the date of application but still produced and used after the date of application. See below for my handwritten overview of deadlines (you need to put 26 May before each year mentioned):

So, regardless of whether health institutions are happy with these rules or not, the regime already applies partially and health institutions not meeting the requirements that already apply can be enforced against for non-compliance. They will also need to inform their liability insurance that they are applying non-compliant tests (if they are) and any incidents with patients suffering damage as a result of non-compliant in-house devices will normally be outside the health institution’s insurance policy cover. Maybe that is sufficient for hospital management to make this more urgent agenda item.

It’s funny with these things how stakeholders like to shoot the messenger rather than fix non-compliance in their own situation. I’ve actually been accused of raising these issues just to make money. How rude – it just shows powerless frustration about the situation.  

Bye bye Switzerland – yet another Swixit, this time for IVDR

Completely as expected and right on schedule we received the Commission’s Notice to Stakeholders that Switzerland is out of the Union for yet another MRA (the one concerning the IVDD) and will not be part of the Union for the IVDR as of the date of application, which is quite unfortunate. Would you like to know the back story? Check out my analysis of the Swixit for the MDR. It’s a pity that Swiss politicians have sold the advantages of being part of the internal market to badly at home. But then again, this is something you can say about a lot of EEA and Turkish politicians too unfortunately.

The Swiss will fix their legislation to mimic the IVDR as closely as possible just like they did for the MDR, and hope for the best.

But no Turkxit

Just like with the MDR, there is no Turkxit for the IVDR – meaning that Turkey is also part of the Union for the purpose of IVDR just like it is for the purpose of the MDR, as was confirmed in another Notice to Stakeholders. Mind you, Turkey is not a member state of the European Union, but it is part of the Union for the purpose of the MDR. 

It shows that people that refer to the MDR’s and IVDR’s geographic scope as EU have mistaken conception of the scope of the geographic scope of the Union: the EEA member states (which includes all EU member states plus non-EU member states Iceland, Norway and Liechtenstein) plus Turkey, which is four more countries than the EU. So next time someone refers to the EU as place where the MDR and the IVDR apply you can ask them why they ignore Icelanders, Norwegians, Liechtensteiners and Turks.

So don’t sell the Union short please, people, and please stop using the actually pretty offensive term ‘rest of world’ to denote that you can’t be bothered to understand what is going on internationally. It is really not that complicated.

The capacity elephant

Whenever there is something to celebrate on a party there is also an elephant in the room, like an uncle that always gets just a little too drunk and ruins the party for everyone. In this case it is the notified body capacity elephant, which stands to put a serious dent in the IVDR project, regardless of the measures taken with the recent amendment. If you want to read and weep, you can read the updated (post amendment) Joint Implementation Plan for the IVDR. If you want your hair to stand up, read the recently published 2021 member survey of Team NB. It basically contains all the data that the MDCG says in the Joint Implementation Plan that they do not have. What do we learn from the Team NB document?

Well, first of all IVD manufacturers have not at all started to apply under the IVDR en masse. The IVD sector seems very much bent on making the same mistakes as MDR manufacturers, although the low number of applications may also be caused by the low availability of slots at notified bodies.

Another worrying development is that at least half of the submissions to notified bodies are incomplete. Apparently either notified bodies explain badly what they need, or manufacturers are bad at making complete applications. Either way, there is a serious disconnect that is costing everybody time.

Capacity, capacity, capacity is the theme. The notified bodies indicate that it will not be possible to issue a number of certificates under the MDR that is even close the number of still to expire in 2024. Team NB states ominously:

“There is a risk to the continuous availability of some device with expiring certificates in 2024. To avoid this risk, solutions have to be found as it will not be feasible to issue 14 063 certificates in a year.” [estimated capacity for 2024 is 6 300 per year]

Press release Team-NB sector survey 2021, p. 8

Regardless of the recent change to the IVDR, the IVDR will be in the same boat by 26 May 2025, when the first grace period under the IVDR expires. With the number of notified bodies notified for the IVDR, and the speed at which this happens, I predict the exact same issues with the IVDR. At some point MedTech Europe had calculated that we needed a 780% increase in notified body capacity for the IVDR, while at this point we are still working to have the same notified bodies notified again under the IVDR, of which not all actually applied, and not even half of the applicants have been notified at this point. As we can see from the most recent overview of notified body notification process for IVDR, it will take quite a while before the next IVDR notified body will be notified. As you can see in the overview the next two notified bodies are stuck in the JAT CAPA review phase, which can easily take a year, and the others are not even at that stage. Not a good sign.

So

Happy IVDR day – there is a lot to do for industry, notified bodies, competent authorities and the Commission. Let’s not disappoint the health system and the patients!