There seem to be a lot of misunderstandings in the market about the current status of the MDR. Some think it’s finished (it’s not, at least not formally) and there is a lot of insecurity about when it will enter into force.
Currently the MDR and IVDR are in the process of translation. The trilogue produced negotiated texts but these are still not perfect. Upon close reading one discovers typos and numbering issues as a result of the many amendments. When a group of people translates two very complex and partly overlapping texts in 23 languages from a negotiated text that still contains small mistakes and unclarities, there will be questions that arise about the interpretation of the texts. The texts may also require another look at them if that’s unclear. That is currently happening.
Also, the Council and the Parliament will have to give their formal blessing to the texts as follows:
- Adoption of the Council’s first reading position end 2016
- EP second-reading vote end 2016 / early 2017
When these approvals have been ensured, the MDR and IVDR official texts will be published in the Official Journal. These texts are final and will enter into force 20 days after publication. That will be the ‘date of entry into force’ in the regulations. And everything will unfold from there.
What were the big surprises coming out of the trilogue?
I have written a lot on this blog about how the MDR will work in general and have posted content that will provide you with a good high and even detail level of how the MDR works and what manufacturers should do to become compliant with it.
Some of the surprises in the MDR are also in the IVDR and I will not discuss them in this post (they were discussed in a previous post about the IVDR). These are:
- advertising rules
- competent authorities enlisted in liability cases
What then are the MDR specific items? These are the amended scrutiny procedure, a new classification rule for software and the last minute amendments to the transitional regime.
The scrutiny procedure in the MDR has been revamped and is now called ‘mandatory clinical evaluation consultation procedure’. This ’new’ procedure is essentially repackaging of the scrutiny procedure and it now covers implantable class III devices and class IIb active devices intended to administer and/or remove a medicinal product for which no common specifications have been established. Article 44, which used to be the scrutiny procedure, has been rewritten into a sort of safeguard procure that the competent authorities can use if they feel that the CE marked device should not have been on the market as CE marked after all.
The final scope of devices subject to the scrutiny procedure (implantable devices classified as class III, and class IIb active devices intended to administer and/or remove a medicinal product) was also something of a surprise. Earliest versions of the text of the MDR showed a much larger scope of devices subject to scrutiny and the proposed scope diverged immensely between Commission, Parliament and Council. In that light it is actually not so surprising that the end result of the scope was unexpected.
If your company sells clinical decision support or monitoring software, brace for impact because a new classification rule especially for that kind of software was inserted during the trilogue so we did not see it coming. Rule 10a reads as follows:
“Software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes, is in class IIa, except if such decisions have an impact that may directly or indirectly cause:
– the death or an irreversible deterioration of the state of health, in which case it is in class III;
– a serious deterioration of the state of health or a surgical intervention, in which case it is in class IIb.
Software intended to monitor physiological processes is in class IIa, except if it is intended for monitoring of vital physiological parameters, where the nature of variations is such that it could result in immediate danger to the patient, in which case it is in class IIb.
All other software is in class I. “
Rule 10a consists of three parts that apply to three categories of software:
- Software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes – will now always be class IIa or higher
- Software intended to monitor physiological processes – will be class I, IIa or IIb
- All other software – class I
This rule will increase the burden for software and app vendors considerably if their software is currently a class I medical device under rule 12 of Annex IX MDD and has either clinical decision support or monitoring functionality. This is the case for most clinical decision support software, which is now specifically targeted by the first part of rule 10a. This software will be classified in any of the other available risk classes, which means that clinical decision support software will always be subject to notified body oversight under the MDR. Under the MDR manufacturers and notified bodies classifying such software will need to look at the risks associated with false positives and false negatives that the software can produce. The MDR does not define serious or irreversible deterioration in the state of health, but MEDDEV 2/12 rev. 8 on vigilance does define it. An example of a serious deterioration in the state of health is indirect harm (see paragraphs 5.1.1 and 4.11 of that MEDDEV), which may constitute of misdiagnosis or inappropriate treatment as a result of false positives or false negatives.
The second part of rule 10a is current rule 10 but then applied specifically to software. The reason for this is probably the current unclarity regarding the current rule 10’s application to standalone software.
The third part concerns ‘everything else’, so essentially current rule 12 that most of the standalone software on the market is benefiting from, minus monitoring and clinical decision support software.
I made a nice little flowchart for the application of the rule:
A surprise within the surprise is that this classification clause is not mirrored in the IVDR, because also in the IVD field decision support software (the expert system functionality mentioned in MEDDEV 2.1/6, of which a new version has just been published by the way) becomes more and more important. I would have thought that software for the support of decisions based on interpretation of various IVD results could also have different risk profiles. Software for interpreting genetic test results for life threatening hereditary diseases would have a different risk profile than software for interpreting test results for the presence of pregnancy associated hormones. With the absence of a rule 10a analogue in the IVDR stand alone software will need to be qualified not by its functionality but what test results it tests for.
If you are interested in more detail about this classification rule, check out my article in eHealth Law and Policy in which I describe the rule and its consequences in detail.
As expected a ‘solution’ was found to address the constraints preventing all medical devices to be transferred into the new system before the end of the transitional period, such as lack of notified body capacity, limited remainder of transitional period after re-notification of notified bodies, etc.
To that end the MDR contains the following transitional regime:
- There is a three years transitional period running from the date of entry into force to the date of application (article 97 (2));
- Certificates issued by notified bodies in accordance with Directives 90/385/EEC and 93/42/EEC prior to the entry into force of the Regulation shall remain valid until the end of the period indicated on the certificate, except for certificates issued in accordance with Annex 4 of Directive 90/385/EEC or Annex IV of Directive 93/42/EEC which shall become void at the latest two years after the date of application of the Regulation (article 94 (2)).
- Certificates issued by notified bodies in accordance with Directives 90/385/EEC and 93/42/EEC after the entry into force of the Regulation shall remain valid until the end of the period indicated on the certificate, which shall not exceed five years from its delivery. They shall however become void at the latest four years after the date of application of the Regulation (article 94 (2) 2nd paragraph).
- Devices which were lawfully placed on the market pursuant to Directives 90/385/EEC and 93/42/EEC prior to the date referred to in Article 97(2) may continue to be made available on the market or put into service until five years after that date (article 94 (3a)).
Devices that benefit from transitional provisions that allow MDD or AIMDD covered devices on the market after the date of application remain covered by these directives as regards vigilance, registration of manufacturer and authorised representative, Eudamed contents for the devices concerned and clinical investigations with these devices (article 96). Not sure how this works in practice, especially because the MDR is not clear about whether they are covered by the MDR for the other aspects – if that would be the case, the manufacturers of these devices would nonetheless be faced with a lot of new obligations, for example the new PMS obligations. If the MDR does not apply for the other items, then these devices would exist in a relative regulatory empty space, which would be unlikely to be intended. This is one of the big known unknowns under the MDR.
When you lay it out on a timeline I think the options in the transitional regime look a bit like this:
In the mean time, there are also other grave concerns
Governance and surveillance
There are serious concerns (by member states themselves no less) about the ability of member states to be able to staff all the functions required under the MDR, like staffing the MDCG, looking in the EUDAMED database, doing things with information from the EUDAMED database, etc. We will need to see how this plays out. Member states have traditionally been reluctant to allocate sufficient resources to medical devices surveillance and policy, so now is the time for them to step up and put their resources where their mouth is.
The notifications under the MDD will remain in place during the transitional period so notified bodies will still be able to issue certificates under the transitional rules under the MDD and AIMDD, but there is no telling what notified bodies will be notified under the MDR when. More and more are going bankrupt or just ceasing business. An application for notification will remain voluntary and while the assessment of the application is not the member state’s sole prerogative, there is also no deadline for completing the process.
Nobody has any idea how long it will take for notified bodies to be notified under the MDR – I hear estimates ranging from 12 to 18 months. This means that for one third to half of the transitional period no certificates under the MDR will be issued and that the first certificates will be issued towards the end of the transitional period. This means that the capacity of notified bodies for certificates that are planned during the transitional period will be very limited. If your company’s transition strategy revolves around this, make sure that you keep your notified body very very close in your planning and execution of your company’s transition strategy.
Your company should by now be planning for the transition of its products and doing a gap assessment on what is needed to go from the MDD/AIMDD to the MDR. This is not something to be underestimated, because if you do it may cause severe disruptions: certificates expiring with no new certificate on the horizon. New clinical data to be generated that is not there, new procedures to be implemented that no one knows were necessary, devices being classified in higher classes (especially software (rule 10a) and substance based devices (rule 21)).
If you don’t know where to start, start with the BSI white papers on the MDR – I’m mentioning these because I know they are good quality and have contributed to several of them. BSI recently published a white paper on how to do a transition plan, which is a good overview of what is needed. You can also visit the panel I am moderating at the Advamed Conference in Minneapolis tomorrow (2.15 to 3.30 pm), which will concentrate on this.
Missed the session? I’m working on MDR transition plans for several big and small(er) manufacturers and would be happy to help leverage that knowledge for the benefit of your company – just let me know.