It has been sort of hanging over the medical devices market for quite a long time: the TÜV Rheinland case about the PIP breast implants. This case is the direct result of the PIP breast implants scandal, which had a profound influence on the new EU MDR in the making.
We had the Advocate General’s opinion in this matter from 15 September 2016, which was already a very good pointer on where things would land at the EU Court.
The EU court delivered its much awaited judgment on 16 February.
Since the outcome is unsurprising in the light of the AG opinion and EU law as it currently stands, I feel comfortable starting this blog with a blatant spoiler.
For all the effect it has had on the MDR process, its outcome is in my opinion unsurprising, and I have predicted it from the start:
- a notified body is not under a under a general obligation to carry out unannounced inspections, to examine devices and/or to examine the manufacturer’s business records. However, in the face of evidence indicating that a medical device may not comply with the requirements laid down in Directive 93/42, the notified body must take all the steps necessary to ensure that it fulfils its obligations within the powers it has under the MDD; and
- national law determines the conditions under which culpable failure by that body to fulfill its obligations under the directive may give rise to liability vis-à-vis end users.
See the European Court’s convenient press release about the case for a succinct summary.
I have never found it a realistic possibility that the Court would rule that notified bodies are no-fault (or even fault based) product liable for the products that their manufacturers make. The Court has merely convinced that they have to exercise their duties diligently within the mandate that the law imposes on them.
But, I admit, crazy stuff has happened before with regard to product liability (product batch liability, authorised representatives jointly and severally liable with the manufacturer for product liability under the MDR), so you cannot be certain what to expect these days. Even if it’s unlikely.
What was this about again? French breast implant manufacturer PIP at some point decided that it was going to use industrial silicone rather than surgical grade silicone in its breast implants. The Court found that TÜV Rheinland, the notified body that granted the CE certificate for the breast implants concerned,
“in the course of its involvement during the period 1998 to 2008, […] made eight visits to the manufacturer’s premises, all of which were announced in advance. During that period, TÜV Rheinland never inspected business records or ordered that the devices be inspected.”
In 2010, the competent French authority established that the manufacturer in question had produced breast implants using industrial silicone which did not comply with quality standards.
The case that led to the referral to the EU Court was brought by a German citizen that had the implants concerned fitted in Germany end 2008, and had them removed in 2012. She claimed that TÜV Rheinland was liable for her damages (material and immaterial). She alleged that TÜV was liable because it had not fulfilled its obligations satisfactorily, since (she claimed)
“an inspection of the delivery notes and invoices would have enabled TÜV Rheinland to ascertain that the manufacturer had not used an approved form of silicone.”
Her claims were rejected by the first and second instance courts in Germany because the purpose of a notified body’s activity is not to protect patients nor was TÜV culpable because TÜV Rheinland had made regular announced visits, which must be deemed sufficient in the absence of any suspicion of improper production practices. The second instance court did however refer questions of law to the European Court concerning the scope of a notified body’s duties
“in particular with regard to the level of supervision and scrutiny required of that body when it carries out inspection visits at the manufacturer’s premises”.
The questions referred by the German court were (essentially) as follows:
1) Does a notified body, in the event of a culpable infringement of its obligations, have direct and unrestricted liability towards the patients concerned?
2) Does a notified body have a general obligation to examine devices, or at least to examine them where there is due cause?
3) Does it follow from the aforementioned sections of Annex II to Directive 93/42 that, in the case of Class III medical devices, the notified body responsible for auditing the quality system, examining the design of the product and surveillance is subject to a general obligation to examine the manufacturer’s business records and/or to carry out unannounced inspections, or at least to do so where there is due cause?’
All these questions were asked in the context of a class III medical device under Annex II, so also in the frame of the MDD obligations for these devices.
Duty to examine devices and/or to carry out unannounced inspections?
During the crazy wings on fire period of the MDR being amended by the European Parliament especially European Parliament members expressed surprise and indignation about the notified body not even inspecting the produced devices and not performing unannounced inspections. The ensuing political outrage resulted in the Commission recommendation for unannounced audits and the member states making notified bodies do this.
The Court found that while notified bodies must periodically undertake appropriate inspections and assessments under Annex II as it currently stands, but
“the provisions of Annex II to Directive 93/42 do not impose a general obligation on the notified body to carry out unannounced inspections, to examine devices and/or to examine the manufacturer’s business records.” (point 40)
Yet, what is the scope of what a notified body must do under Annex II? All parties concerned agreed that the scope of a notified body’s discretion is broad and that a notified body may conduct an unannounced audit based on Annex II 5.4, but differed on how this translated to actual duties.
“45 […], the obligations laid down in Article 16(6) of the directive and those set out in paragraph 41 above would be a dead letter if the degree of discretion knew no limits. The notified body would not be able to fulfil its function under the procedure relating to the EC declaration of conformity if it were free not to take any steps in the face of evidence indicating that a medical device might not comply with the requirements laid down in Directive 93/42.
46 Consequently, as they are required to establish whether EU certification may be maintained pursuant to Article 16(6) of Directive 93/42, notified bodies are under a general obligation to act with all due diligence when engaged in a procedure relating to the EC declaration of conformity.
47 It follows […] that a notified body is under a duty to be alert, with the result that, in the face of evidence indicating that a medical device may not comply with the requirements laid down in Directive 93/42, that body must take all steps necessary to ensure that it fulfils its obligations under Article 16(6) of the directive, as well as those set out in paragraph 41 above [paragraph 41 mentions: pursuant to Sections 3.2, 3.3 and 4.1 to 4.3 of Annex II to Directive 93/42, first, to analyse the application for examination of the design dossier lodged by the manufacturer, which must describe the design, manufacture and performance of the product in question and, second, to ascertain whether the application of the quality system contemplated by the manufacturer ensures that the products fulfil the relevant requirements under that directive. Moreover, it is apparent from Section 5.1 of that annex that the notified body must satisfy itself that the manufacturer duly fulfills the obligations imposed by the approved quality system].”
Conclusion: broad discretion on how to fulfill obligations, which makes it difficult in practice to determine if the notified body did or did not meet its obligations. Especially by national first instance judges in general courts who are not experts in these matters and never deal with this kind of case.
Direct liability vis-a-vis patients?
The Court makes some important points here that I have made myself before: the Member States have responsibilities with regard to market surveillance, but certification by notified bodies under the MDD is to ensure protection for the health and safety of persons too. That means that notified bodies do not work for manufacturers alone, they have a larger task in the overall protection of public health.
But, that does not make them liable vis-a-vis patients on the basis of the MDD just like that. It was already EU case law that:
“it does not necessarily follow from the fact that a directive imposes surveillance obligations on certain bodies or the fact that one of the objectives of the directive is to protect injured parties that the directive seeks to confer rights on such parties in the event that those bodies fail to fulfil their obligations, and that is the case especially if the directive does not contain any express rule granting such rights” (point 55)
The Court reiterated that the MDD does not contain any express liability regime and the Product Liability Directive allows for the application of other systems of contractual or non-contractual liability based on other grounds, such as fault. This is nothing new and we knew this from the Court’s quite steady case law in the field (see for example here in relation to the Court’s specific view on additional national liability rules concerning medical devices). Ergo, it’s a national matter said the EU Court, subject to the principles of equivalence and effectiveness. This case is now going to be decided on a national level with the Court’s guidance in mind.
Why did the claimant go after the notified body in the first place and not after the manufacturer for product liability? Product liability quickly became an irrelevant pathway to pursue as PIP, the manufacturer, quickly went bankrupt.
This means that for TÜV this case is way not finished – we have a lot of member states in the EU in which PIP implants were used. We also have a lot of national laws that have their own theories of culpability / fault based liability. This case can therefore play out differently in different member states. The various claimants in national cases will change tack insofar necessary (and if they have not already done this) and will pursue fault and/or lack of diligence based claims against TÜV in national courts, as was happening in the current case.
The current EU Court judgement may be helpful to those national cases to a point because it gives some guidance on the scope of MDD mandated tasks of notified bodies and the level of diligence they are to exercise in the fulfillment of these tasks, and in that notified bodies also have work for the public good, which includes the patients and end users. The national court will now need to look into whether TÜV was sufficiently diligent given that on the one hand
“the notified body is not under a general obligation to carry out unannounced inspections, to examine devices and/or to examine the manufacturer’s business records”
but that on the other hand
“in the face of evidence indicating that a medical device may not comply with the requirements laid down in Directive 93/42, the notified body must take all the steps necessary to ensure that it fulfils its obligations under Article 16(6) of the directive and Sections 3.2, 3.3, 4.1 to 4.3 and 5.1 of Annex II to the directive” (point 48).
Did TÜV take all necessary steps to ensure that it fulfilled its obligation? This may play out differently in different member states in which TÜV is being sued (which include France and Germany in any event). Hopefully the harmonisation of notified body requirements as a result of the joint assessment project and the more detailed requirements under the MDR will contribute somewhat to harmonisation of fault based liability of notified bodies. Is this liability new? Not in my view. It was never harmonised on EU level and therefore always existed in member states that provided for this. If notified bodies did not insure for this liability yet, they may have to and costs will increase. Notified bodies will seek to pass on these costs.
When the outcome of notified body fault based liability in member states will differ considerably from one member state to another this will have consequences.
Effects on the MDR
This case had profound effects on the MDR, but will not change the text anymore now the judgment been rendered. However, as far as I can see it did have a profound impact on the MDR in a number of ways. One of them fundamentally, others more specific.
How much did it change the MDR fundamentally?
An unknown effect is how much the PIP scandal in the end changed the MDR, which the Commission initially intended to be a modest mid-life update, because the MDD was performing very well and outcompeting other jurisdictions left and centre in time to market. This we will probably never know, because the Commission had to change tack on the double when the political outrage about the PIP scandal started. The result was the initial proposal for the MDR back in 2012. But we do know that the impact on the MDR must have been profound, for example because of ideas to get rid of CE marking altogether and just make medical devices pre-market access EMA competence.
I would go as far as saying the EU (and its member states) have finally started to see medical devices as an industry that deserves an upgrade in policy and associated resources. This however seems not to have resulted in allocation of significantly more resources on EU level. The medical devices unit at DG Growth is still woefully understaffed while the Commission’s duties under the MDR and IVDR are enormous. It has to crank out a lot of delegated and implementing acts to even make the two regulations effective and make a plan to make sure that the process of redesignation of notified bodies under the MDR and IVDR and recertification of ALL devices on the market in the EU will not crash and burn in what looks like the mother of all transitional bottlenecks. Even competent authorities are publicly saying that this is a serious problem and that the Commission has to come up with a plan to make sure that these things unfold predictably and reliably.
Unannounced audits under MDR
One of the most direct effects on the MDR is the now hardwired obligation for notified bodies to conduct unannounced audits (article 52 and Annex VII, points 4.5.1 and 4.10 and Annex IX, point 3.4). Up to the MDR there is no real harmonised legal standard for unannounced audits except that there is a recommendation of the Commission to the Member States about what they might require from notified bodies in terms of unannounced audits.
Still, I remain unconvinced of how much the unannounced audits will do to prevent PIP type cases. Fraudsters be fraudsters, and as the Court reiterated in the TÜV case, notified bodies can ask for things if they have a suspicion, but they are not equipped nor authorised for market surveillance. If a company sets out to really go dark and hide things from a notified body, they will succeed. The first thing it will do is doctor precisely the documentation and locations that the claimant in the TÜV case argued that the notified body should have audited.
In my view, PIP remains a case that demonstrates very painfully how member states’ market surveillance failed the patients. It is disconcerting if you look at the facts of that case how little international cooperation there was between the competent authorities when the first signals of things being seriously wrong became available. That, I think, is the real scandal in this case. If you compare the resources allocated to medical devices market surveillance to those that went to medicines and other products surveillance at that time it’s not a pretty picture. And resources for surveillance are purely political choices. Blaming the notified body for doing exactly what it was supposed to do under applicable law feels a lot like wagging the dog to me.
That’s why unannounced audits still feels a bit like member states passing on the surveillance buck to notified bodies and I am not convinced at all we will prevent more PIP types cases of deliberate fraud that way. Yet, there may be some benefit. What we may achieve is that manufacturers will be more diligent in having their technical documentation and QMS in order all the time and closing out CAPAs quickly and according to plan, rather than allowing them to stay open for years because they know exactly when the next audit will be. The MDR also requires this (having all documentation in order and up to date all the time), and I think this certainly is progress.
Market surveillance under MDR
Member states have learned in the mean time and market surveillance is taken much more seriously under the MDR with more EU level capabilities and an (in theory so far) robust underlying IT infrastructure that allows competent authorities to quickly share information about infringements.
However, with all the new tools and possibilities there now are doubts about whether the Member States will be able to pony up the resources to actually staff the system and afford it. The MDR however contains a provision allowing member states to pass costs for market surveillance on to the market, as happens already in certain other industries (like financial services). I see some member states invest considerably in resources and pilot projects in view of the upcoming MDR and IVDR. A lot is happening in behind the scenes cooperation in order to get all the competent authorities at the same level.
Product liability under MDR
The PIP case influenced thinking about product liability for medical devices in the EU considerably. The only problem is that these thoughts had nowhere to go except into wishful statements.
With the political impossibility to amend the Product Liability Directive for medical devices alone (that directive is up for evaluation for a long time because is was not evaluated since its entry into force in 1985 but the project is moving very very slowly) something else was needed for political gain. The EU legislator, motivated by ardent political wishes to ‘do something with this’ decided to include some provisions in the MDR regarding manufacturer and authorised representative product liability of which I have blogged that they are not well-thought out, see also this more recent presentation that includes a discussion of the clauses in the MDR. Good for lawyers, bad for everybody else.
By the way, the texts of the MDR and IVDR are still not completely final, but the agenda for adoption does not seem to have changed: still looking at entry into force this summer. However, there are still commas being moved. The fat lady still has not sung, but she’s close. When she finally has I will follow up with a blog on the last changes made before adoption. Prepare for some surprises: there are some changes that still will affect some products considerably, like design dossier review requirements for class IIb active devices intended to administer or remove a medicinal product. This was already in the MDR for class IIb implantable devices but this has been extended to class IIb active devices intended to administer or remove a medicinal product.