Many people ask me these days: why the urgency with IVDs? The IVDR’s date of application (26 May 2022) is still almost two years away. Why the hurry?
The hurry has everything to do with simply counting back from the date of application and understanding the requirements of the IVDR.
Notified bodies are very scarce
By now, everybody will know that 85% of the IVDs under the IVDR need conformity assessment by a notified body as a result of a radically new classification mechanism – also the devices already on the market. Just like the MDR the IVDR does not do grandfathering. For those who have missed entirely what the IVDR is about, here is a summary:
Because the IVDR does not do grandfathering this means that unless your IVD is a class A IVD (instruments, specimen receptacles and general lab use products etc.) under the IVDR, you will need a notified body to perform a conformity assessment that hopefully results in a CE certificate.
Do notified bodies for the IVDR grow on trees? They certainly do not. In fact, there are very few of them – you would like them to go on trees. At the moment there are de facto only two (BSI and Dekra Germany at the moment), with two more in the pipeline for notification in the short term. If all notified bodies that applied for designation will finally be designated we will have about eight or nine. That is much less than we had for the IVDD (22), who were responsible for a much smaller share of the IVDs under the IVD Directive. In other words: much less notified bodies that have to do much more work. Sounds like a bit of planning to make sure that you are top of the list is a sensible thing to do.
Since a notified body needs time to perform a conformity assessment, you have to count back from the date of application to know when you should file your application for conformity assessment. Notified bodies will generally need a year from application to CE certificate, if there are no hick-ups and the dossier is completely impeccable.
This puts you in May 2021 for having handed in your IVD conformity assessment application, if you are going to cut it as close as possible and are not going to plan for any unforeseen delays in the assessment procedure (second wave of COVID 19 anyone?) and are willing to apply to a very limited number of notified bodies when everybody else is doing the same. Sounds like solid risk management, right? So maybe you want be apply earlier than that, say end 2020.
End 2020 you say? That’s end of this year! Indeed, and that is assuming that you have all the data required for the application. Chances are that you do not, so read on.
Clinical performance study data or justification of absence is needed
As a rule the IVDR requires clinical performance studies as a source of clinical performance data (article 56). The IVDD generally did not put that much emphasis on clinical performance data, but was more concerned with scientific validity and analytical performance data.
This means that many IVD manufacturers have not done clinical performance studies, ever. At best they have some post market performance data that may or may not include clinical performance data. The rule is that they must do clinical performance studies unless it is duly justified to rely on other sources of clinical performance data.
This means that a manufacturer
- needs to have an idea about the gap of clinical performance data,
- needs a plan to close the gap before submitting the conformity assessment application to the notified body and
- preferably has an idea about whether this plan is sufficient for the notified body, so will need to have engaged with the notfiied body about this.
If there is a gap (start with that as a safe assumption) then the manufacturer must either generate new clinical performance data for the IVDR conformity assessment application, even if the test has been on the market for many years under the IVD Directive. Maybe he can justify relying on other sources, like some data Rembrandts in the attic in the form of a hoard of post market (clinical) performance follow-up data that he has accumulated methodically over the years.
Where the manufacturer relies on literature searches or other data in the technical documentation of a legacy IVD (especially the self declared ones), it may be good to realize that the bar has gone up regarding presentation of that data as well. The MDCG guidance on clinical evidence for legacy devices refers to sections of MEDDEV 2.7/1 rev. 4 that are considered relevant to MDR as they contain helpful information regarding how to perform activities associated with clinical evaluation, including literature searches. While this guidance applies to the MDR only, it does give an insight in expectations of activities associated with clinical evaluation. A number of other MDCG guidance documents relating to clinical / performance evaluation explicitly apply to both the MDR and IVDR (such as MDCG 2020-1 on clinical/performance evaluation of software and there are non-clinical/performance evaluation ones that also apply to both, such as MDCG 2019-7 on the PRRC). Other guidance that is does not necessarily applies to clinical evaluation that only applies to the MDR may be relevant to take into account under the IVDR too.
This gives you the period between now and end of 2020 to compile, and if necessary, generate any performance data required and integrate it in your technical documentation for the conformity assessment application.
And if you need to do an additional clinical performance study to close the gap, can you do this in half a year? You might already be too late when you read this.
For a lot of detail and very practical guidance on clinical evidence requirements under the IVDR I suggest (again) that you absorb the excellent MedTech Europe document Clinical Evidence Requirements for CE certification under the In-Vitro Diagnostic Regulation in the European Union and make good use of it.
EU GDPR compliance for performance studies required
Ah, but not to worry! We have performance data from samples, and worst case we still have access to old samples that we can run a study on.
However, there is a catch: samples relate to persons and personal data is protected in the EU – and the IVDR takes this very seriously. The performance study (including those using left over samples or relied on other secondary use of samples) must have been performed in accordance with the EU General Data Protection Regulation or its predecessor directive (article 57 (3) IVDR).
But, few – the samples were anonimised because they cannot be directly linked to patients anymore. This is actually not what anonimised means in Europe: as long as it is still possible to link a sample to a person (e.g. by using the key that the hospital has) then the data is not anonimised but pseudonomised and still subject to full data protection controls because the EU takes protection of personal data concerning health very seriously.
See about all of this a presentation of mine from a long time ago at the RAPS Convergence in Washington DC (September 2017), long ago at a time that we could still travel:
This was by the way also the conference at which people expressed absolute disbelief about the theory that there might be only five notified bodies for the IVDR. And with a window to reliably file before the end of this year, we now have two of them – so here we all are. Maybe I was not so wrong here after all.
Long story short: the notified body may inquire about how this data protection compliance has been arranged, and then you need to be able to demonstrate that you acquired the data lawfully.
Data protection authorities in the EU may also ask you to explain, and can prohibit the use of data not processed lawfully – and they know a lot more about lawful data processing than notified bodies.
In both cases, falling short of meeting the standards would be a setback, because the data will be useless.
This means deadlines in the future are closer than you think
So there you have it: the May 2022 deadline is actually around the corner.
“But Erik, they must move this deadline like they did with the MDR, right? There is no other option.”
Well, we needed the COVID-19 pandemic to happen just before the date of application for the MDR to move. By now however the COVID-19 restrictions are a given. And don’t forget, the IVDR already had a deliberately longer transitional period of five years (compared to three years under the MDR), starting more than three years ago by now. COVID-19 may be an excuse if the notified bodies cannot start a conformity assessment because of the restrictions (since remote audits are not possible for new applications – even if this guidance would be applied to the IVDR), but are you even at that point already?
Remember also with the MDR DoA move: only the DoA moved, but the end of the transitional regime did not move. This would mean for the IVDR that the May 2022 to May 2024 period of two years would shrink to one (1) year. One year for the few IVDR notified bodies to process all remaining applications, because everyone would file just before May 2023, right? Cramming all these assessments in just one year would create an enormous bottleneck and would not solve your problem.
Of course you can bet on the deadline being moved. If it’s all you have then it may be your only option. But if it’s not, I really recommend lighting a fire under your IVDR remediation. Who knows it will turn out that we need a full zombie apocalypse, AI singularity running amok or alien invasion for the IVDR DoA to move?