The EU Medical Device Regulation

What the EU Medical Device Regulation changed

23 min read

The EU Medical Device Regulation replaced the device directives after a breast implant scandal exposed failures in how devices reached the European market and how they were watched once there. It made the framework a set of interlocking regulations, and it changed definitions, classification, clinical evidence, conformity assessment and surveillance in ways that create new documents for writers.

The device directives

The directives were the active implantable medical devices directive 90/385/EEC, the medical devices directive 93/42/EEC and the in vitro diagnostic medical devices directive 98/79/EC. The first two were introduced in 1992 and the third in 1998. The directives defined the essential requirements a manufacturer meets in the design and production of a device, its risk assessment and its marketing to obtain the CE marking. They defined three categories of device based on risk assessment. For a low-risk class I device, the manufacturer was allowed to affix the CE mark and register the device with the national authority, which checked that the manufacturer had complied with all the requirements. High-risk class II and III devices were controlled through conformity assessment and market surveillance procedures by a notified body and a competent authority. Once a device received its CE mark in one country, the manufacturer was free to market it in the other EU countries, so the directives supported the creation of a single market for devices in Europe, but their interpretation and implementation were left to national governments.

The medical devices directive contained some definitions, among them the differences between the device classes. Its Annex X gave a short description of what to do in a clinical study.

Why the directives were replaced

The Poly Implant Prothèse scandal of 2010 and 2011 triggered the review of the medical devices directive that produced the regulation. Poly Implant Prothèse was a French manufacturer of silicone gel breast implants, founded in 1991 and liquidated in 2010 after it became public that it had been using low-quality industrial silicone gel. The company sold an average of 100,000 sets of implants a year over twenty years. After a site inspection in 2000, the FDA prohibited the sale of its silicone breast implants in the United States, which led to a considerable fall in sales worldwide. The company responded with dramatic cost cuts, replacing high medical-quality silicone gel with low-quality industrial silicone without following the regulations for producing medical implants or performing preclinical tests. The new implants had a 500% higher risk of breaking or losing content and were considered to be related to several deaths and to have caused breast cancer. In December 2011 the French government recommended surgical removal, affecting 30,000 women in France, with an estimated 30,000 to 40,000 affected in the United Kingdom, 1,000 in the Netherlands, 2,500 in Sweden, and many more in other European countries, in Latin American countries and in Australia. Breast implants were reclassified as class III devices afterwards.

Poly Implant Prothèse was not the only manufacturer at fault: the M-Implants made by the Dutch company Rofil and the TiBREEZE implants made by the company formerly known as GfE Medizintechnik were also found to be of low quality, so something in the marketing approval process and post-market surveillance was wrong and made low-quality devices easy to get approved. After the scandal, the public, European governments and the competent authorities asked for more transparency in the device market and an improved marketing approval process. The work the competent authorities began in 2011 and 2012 resulted in the Medical Device Regulation (MDR) in 2017, which should ultimately increase patient and user safety.

High-profile device problems, such as the misuse of industrial-grade silicone in the breast implants of Poly Implant Prothèse, undermined confidence in the system. The breast implant scandal erupted in 2010, the FDA published in 2012 a report on devices approved in Europe but not in the United States because of safety concerns, and several other device-related adverse events reported between 2015 and 2018 exposed the need for a regulatory overhaul in the EU. In 2012, after the fraudulent use of non-medical-grade silicone in breast implants was discovered, the European Commission called for "immediate actions – tighten controls, increase surveillance, restore confidence"; four years later revision 4 of MEDDEV 2.7/1 was released with stricter requirements, followed in 2017 by the more comprehensive regulation, to be fully applicable in 2020. CE certification had in the past often rested on limited clinical data, which is one of the reasons the more rigorous revision 4 and regulation were developed. Some notified body certifications were also too lax in the past, which is the reason revision 4 and the regulation were released with significantly more stringent requirements. In one case, an undercover investigation published in 2012 obtained certification for a faulty hip implant similar to one that had been withdrawn from the market.

Besides the scandal, the framework needed to change because of advances in medical science and technology, the expansion of the EU, and changing socio-economic conditions. As the EU expanded and the single market grew to 32 participating countries, important differences emerged in how the directives' provisions were interpreted, so the framework was applied differently across member states, and high-profile adverse incidents also exposed shortcomings in the oversight of notified bodies. Since the medical devices directive was introduced in the early 1990s, device science and technology had advanced significantly. Innovations in information and communications technologies, minimally invasive surgery, nanoscience, tissue engineering and personalised medicine had been transforming how healthcare is delivered and improving patient outcomes, but they challenged the legally defined concept of a medical device and the boundaries of regulation. An ageing population, the rising prevalence of chronic disease and financial pressure on healthcare institutions had increased the mandate for early access to high-quality, cost-effective and safe innovative devices. That mandate placed competing demands on a regulatory system expected to adapt to scientific and technological developments while facilitating innovation and upholding the highest standards of quality and safety.

The framework plays a fundamental role for the medical technology sector: it ensures that only devices exhibiting the highest standards of safety and quality are released onto the single market for sale and clinical use, which is critical both for commercial competitiveness and for early access to innovative devices for patients and healthcare providers. The smooth and proper functioning of the single market is central to promoting internal trade and economic growth and to timely access to innovative devices in the EU. The European device market was the second largest in the world after the United States, worth around $115 billion in 2017, with nearly half a million different types of device made by more than 27,000 companies. About 500,000 devices were available for sale on the single market, and their variation in complexity, risk profile and application had complicated efforts to create a harmonised regulatory process across member states.

The regulations were introduced to overcome weaknesses that allowed devices to stay on the market without sufficient clinical evidence of their safety and performance, and to ensure greater harmonisation of implementation across member states. The regulations aim to account for technological and scientific progress and to improve the clarity, robustness, transparency and traceability of the regulatory system. The directive had many gaps and fuzzy terms, and the regulation addresses them and responds to developments in the device market, such as the increased use of software applications, devices that include medicinal products or nanoparticles, and remote patient monitoring systems working over the internet.

From directives to regulations

The Medical Device Regulation 2017/745 and the In Vitro Diagnostic Device Regulation 2017/746 repealed and replaced the directives in place since the 1990s.

The EU has overhauled its regulatory system for clinical trials and medical devices to create a centralised and transparent procedure of assessment valid throughout the EU. The main regulatory change is one of legal form: the clinical trial, medical device, in vitro diagnostic and data protection directives each became a regulation. A directive is transposed into national law by each member state, whereas a regulation has clearly defined rules that are binding across all member states and some partner states, and it takes effect in every member state without national legislation. The new regulations, among them the MDR, the General Data Protection Regulation and the clinical trial regulation, are all interlinked.

The European market comprises the 28 EU member states, the UK among them, the European Economic Area countries Iceland, Liechtenstein and Norway, Switzerland and Turkey. In one account, the regulations apply to the 27 countries of the European Union and the 4 further countries that together with them make up the European Economic Area. In another, the MDR covers the 28 EU member states together with Iceland, Liechtenstein, Norway and Switzerland, over 500 million consumers, a large proportion of them ageing. In that region the MDR encompasses the laws governing device marketing authorisation, which means obtaining the CE marking.

The medical devices directive had 23 articles, 12 annexes and 60 pages, and the active implantable medical devices directive 17 articles, 9 annexes and 35 pages, together 40 articles, 21 annexes and 95 pages. The proposed MDR had 10 chapters, 97 articles, 16 annexes and 352 pages. A text of that size is not particularly frightening for regulatory managers coming from the pharmaceutical industry, but it is quite scary for regulatory managers and medical writers used to working with the directive. The MDR runs to 175 pages.

The regulation's annexes set out general safety and performance requirements; technical documentation, and technical documentation on post-market surveillance; the EU declaration of conformity; CE marking of conformity; registration information and the unique device identification (UDI) core data elements; requirements for notified bodies; classification criteria; conformity assessment based on a quality management system and assessment of technical documentation, on type examination, and on product conformity verification; the procedure for custom-made devices; certificates issued by a notified body; clinical evaluation and post-market clinical follow-up; clinical investigations; the list of product groups without an intended medical purpose; and a correlation table.

What the regulation changes

The regulations aim to make key changes in these areas: the legal framework, with regulations replacing directives as its legal instruments; the scope, extended for technological progress and to take in non-medical devices with a similar risk profile such as cosmetic implants, and devices sold as a distance sale or as an information service over the internet; clarified obligations for the key stakeholders in the supply chain and for healthcare institutions that manufacture devices; clinical evidence requirements reinforced across the device life cycle; updated and additional classification rules; increased scrutiny during conformity assessment; more stringent criteria for the designation and oversight of notified bodies by the competent authorities and the Commission; increased reporting obligations for manufacturers and economic operators across the life cycle; and a unique device identification system to improve traceability. Compared with the directive, the key changes include more stringent requirements for manufacturers, more responsibility for notified bodies, and more transparency and traceability.

The regulation incorporates features of the MEDDEV guidance, the implementation guidance issued under the directives, and shifts from a pre-approval route to CE marking towards a product-lifecycle approach meant to improve the robustness, transparency and traceability of the system. It puts responsibility for high levels of safety and performance on every actor in the lifecycle, and the transition affects every stage of device development, including production, distribution and monitoring.

The regulations are essentially more conservative than their predecessors:

  • Most in vitro diagnostics had not needed to go through a notified body, and 80% to 90% now must.
  • Notified bodies can audit unannounced.
  • Recertification is required more often.
  • An expert panel may review recommendations for the CE mark.
  • The definition of a device widened to products that are not necessarily therapeutic, such as aesthetic devices like tinted contact lenses.
  • Equivalence can be established only with a single CE-marked device that meets all the clinical, technical and biological requirements, and differences between a device and its equivalent must be addressed for safety, performance and clinical benefit, which in practice will limit equivalence to devices with relevant clinical data available, such as predicate devices.
  • The Eudamed database, of data collected and entered by the competent authorities and the European Commission, was implemented under the regulations but not yet established, and was not publicly accessible.
  • The risk of adverse events must be acceptable against a device's potential health benefits, and the risk–benefit assessment must rest on clinical evidence as well as on safety and performance requirements.

Devices are typically on the market for 18 to 24 months before improved versions become available, a fast turnover that poses several challenges for the authorities responsible for controlling safety. The device and in vitro diagnostic regulations are meant to improve coordination mechanisms and the risk management of device use, and they subject devices to higher scrutiny, including a clearer and more transparent certification process, accompanied by expert panels, reference laboratories and an EU-wide device database.

Existing devices are not grandfathered into the regulation: every legacy device must undergo conformity assessment according to its risk level, even if it was approved under the directives.

Scope, definitions and classification

The MDR brought new definitions, new classifications and reclassifications, with software for a medical purpose moving from the margin to a prominent role.

The regulation has 50 definitions, against the directive's 14. They are grouped by concept, such as the concept of a medical device, placing on the market, economic operators and users, and clinical evaluation, and are to be aligned with the Global Harmonization Task Force guidance documents. Many of the new definitions concern the concept of a device, such as procedure pack, for devices used together in a procedure, and aggregate, related to nanomaterials. The regulation adds comments and conditions to the directive's list of devices to which it does not apply and lists the corresponding regulations. It covers some new products the directives did not, and it excludes some older products then on the market in some member states. Whether the regulation is self-consistent and complete had still to be seen in practice. The term medical device now takes in products meant for disease diagnosis, implanted cosmetic devices and products without a direct medical intent, such as sterilisation products, condoms and fillers.

The risk classes I, IIa, IIb and III remain as under the directive, with class III covering the highest-risk products, but the regulation reclassifies certain devices and extends its scope to products the directive left out: products without an intended medical purpose, devices manufactured using non-viable human tissues or cells, and devices incorporating or consisting of nanomaterial. Manufacturers now have to show that their devices meet the revised classification rules. Devices introduced into or absorbed by the body are placed in a separate classification system. Many devices are expected to move to a higher class and so to face additional regulatory requirements, among them changed clinical data requirements and the involvement of a notified body. A clinical evaluation report previously based on an analysis of the literature might then need a clinical investigation or post-market clinical follow-up, which brings writers in to prepare the clinical investigation plan and report.

Classification changed little in the draft regulation: the directive carried 18 rules and the draft 23. The new rules classify nanomaterials and substances absorbed or dispersed in the body by their internal exposure potential, put non-viable tissue of human or animal origin in class III, allow software devices to fall in different risk classes, and put in class III active therapeutic devices with integrated diagnostic functions that automatically influence the therapy delivered, such as an external defibrillator that senses cardiac function and reacts to it.

Clinical evidence

More clinical data is required, and the clinical investigations that provide it come ever closer to what the clinical trial regulation requires for medicines. More clinical trials are required, for CE marking and for recertification. Device and drug trials previously followed very different rules, but device trials will follow procedures that are similar, if perhaps not identical, for submission to ethics committees and competent authorities, for timelines, and for trial registration, results posting and disclosure of trial documents. The device and in vitro diagnostic regulations have integrated and reinforced the requirements for pre- and post-market clinical trials and positioned them as vital to ensuring the safety and performance of a device on the market.

Under the directive, clinical evaluation reports and CE certification had rested on product equivalence. The regulation requires technical documentation for each stage of the product's life. Compliance based purely on equivalence is regulated more tightly, with in-depth assessments, increased expectations of notified bodies and rigorous technical documentation. Stronger clinical data, including post-market safety and performance data, are required for certification and recertification. CE approvals were easier in the past, became harder with revision 4 of MEDDEV 2.7/1 in 2016, and in 2019 were expected to become harder still once the regulation was fully in force in 2020. The regulation's conditions and rules for clinical evaluation and clinical investigations are more stringent and are based on MEDDEV 2.7/1 revision 4 and parts of ISO 14155.

With the regulations on devices and in vitro diagnostics, the device industry is taking a major step towards the strictly regulated world of pharmaceuticals. Clinical data requirements for devices and in vitro diagnostic products have been sharpened considerably, and relying on clinical data from similar marketed products, previously a feasible option, has become very difficult. Many legacy devices, those already CE-marked, therefore need more clinical data, sometimes complemented by slimming their claims to limit the amount of data required, and devices not yet on the market need a plan to collect sufficient clinical data before applying for the CE mark. The market for compiling study documentation for the device industry is therefore booming.

Obligations of manufacturers and other economic operators

The regulation's chapter on making devices available, the obligations of economic operators, reprocessing, CE marking and free movement adds many new concepts and requirements:

  • A qualified person is to be responsible for regulatory compliance inside the manufacturer's organisation, as in medicinal products and in some member states' national law.
  • The reprocessing of single-use devices is regulated.
  • The Essential Requirements become the General Safety and Performance Requirements of Annex I, a list of up to 200 items to be checked.
  • Patient implant cards become mandatory for implantable devices.
  • The concept of state of the art is introduced.
  • Combination devices with software or with substances that diffuse in the body are addressed.
  • Which stand-alone software counts as a device is defined.

Implant cards for every implantable device must carry the device lifetime and follow-up procedures. The minimum content of the technical documentation for the EU declaration of conformity is set out in Annexes II and III.

Every economic operator in the supply chain, whether manufacturer, distributor, supplier, subcontractor, assembler or authorised representative, has responsibilities for the device's technical documentation, labelling, complaint submissions and post-market surveillance.

Coordination, fees and confidentiality

A Medical Device Coordination Group of member-state competent authority representatives contributes to assessing notified bodies, to implementing the regulations effectively and consistently, to monitoring technical progress and judging whether the general safety and performance requirements remain adequate, to developing device standards, and to coordinating the activities of the competent authorities and the member states. It also advises on problems arising in implementation and harmonises administrative practice.

The regulation lets member states levy fees for the activities it sets out, to be set transparently and on cost-recovery principles. Whether those fees would impose a considerable burden on small and medium local manufacturers was not yet known. Eventually they could lead to "fee dumping" by member states seeking to attract manufacturers, or to the business concentrating in a few large international corporations able to carry the regulatory costs.

Personal data, commercially confidential information, trade secrets and intellectual property rights are protected under the regulation unless disclosure is in the public interest. Whether that would give the press access to sensitive information on the results of audits and inspections was not yet clear, and it depends on how the public interest is defined or interpreted.

Interpreting the regulation's wording

How the regulation affects the device market, and whether it improves patient and user safety, depends on how the notified bodies and the competent authorities interpret each word, paragraph and definition in it, and a single word might make quite a difference. The MDR's general requirements say a device can be made available if it is safe and effective, whereas the directive it replaced said a device could be marketed if it was safe and performed according to the intended use the manufacturer defined. The word raises the question whether a manufacturer will now have to demonstrate clinical efficacy when the intended use is tied to treating a specific disease or symptom, as for a cardiac pacemaker. It also raises the question whether companies will define intended use more cautiously in response, so that an implantable pump delivering intrathecal baclofen does only that rather than relieving spasticity symptoms in cerebral palsy.

Suppose a manufacturer wants to market a device that stimulates the increase of a factor and thereby shortens the healing time of acute non-infected wounds. The question is what efficacy evidence the notified bodies will require: only in vitro studies showing that the device increases the factor, or at least one serious clinical study showing that healing is faster than with standard treatment, the evidence one scientist would expect. A clinical study then has to define an acute non-infected wound. Surgical wounds are acute and non-infected, but they range from a thoracotomy to a limb amputation to an appendicectomy, so the study might have to enrol thousands of patients across all types of surgical wound, or the intended use might narrow to the procedures actually studied. A new medicine could be argued to raise the same difficulty in defining its studies, but the companies differ greatly. Pharmaceutical companies have a different financial capacity, years of experience in evidence-based medicine, the infrastructure to supply investigational product to study centres, and very long planning processes, whereas device companies are often small, have very little clinical research experience, often have only a few prototypes as investigational devices, and plan to very short marketing timelines. So the manufacturer of such a device will probably think twice before starting.

That case arises from a one-word difference, and the many differences between the directive and the regulation will most probably raise a long list of such questions. Their answers are likely to crystallise slowly out of precedent cases and accumulated experience of working with the authorities and the notified bodies. What the notified bodies and competent authorities decide in difficult cases will be the result of the quality of the documents the manufacturers and their writers provide. Complying with the regulation's requirements as far as possible, and clearly explaining in specific cases why they cannot be met, will be key to creating precedent cases that are coherent, well documented and useful for all stakeholders.

Expected effects

The changes are expected to produce clearer requirements applied more uniformly across member states, and a more robust CE marking process from the combination of tighter conformity assessment and stronger clinical evidence, which should improve standards for the safety and quality of the devices released onto the single market. Compliance requires manufacturers to assess the impact of the changes and plan for them, which might mean gathering additional clinical evidence, renegotiating supply chain agreements, and altering documentation, quality management systems and product labelling. These changes may affect operational costs, time to market and staff competency requirements, and so may also affect product lines.

The regulation requires manufacturers to supply clinical data before and after marketing as evidence of a device's performance and safety, to higher standards and for more devices than before, in an effort to harmonise the quality of data and devices throughout the EU. That demand is a significant challenge for manufacturers, because clinical trials are among the most expensive and time-consuming parts of launching a device. Small and medium-sized enterprises, which make up 95% of EU device manufacturers, are likely to be hit hardest by the new financial burden, as they tend to have more limited resources, a higher dependency on a single market and more reliance on the success of a single product. Manufacturers will have to write more clinical investigation plans, reports, systematic reviews and vigilance documents, so the cost of regulatory management could increase so much that they might think twice before expanding a product portfolio.

In general, the regulation is likely to make device use safer, and most probably also to bring increased healthcare costs and marketing approval delays from a shortage of qualified personnel.

Whether the directive needed so thorough a revision depends on whom one asks. The victims of the breast implant scandal would most probably support the changes, while physicians keen to test and use the latest technological advances might not like all of them. Manufacturers forced to generate, update and manage far more documentation would be unhappy, notified bodies might struggle with the new workload, and competent authorities might welcome the new control mechanisms that protect patients and prevent future scandals.

Documents the regulation creates for writers

The demand for more and new documentation presents challenges but also opportunities, especially for medical writers. Medical writers have taken a more important role in the device industry. The regulation's more stringent rules for clinical evaluation and clinical investigations are particularly good news for freelance writers who have an engineering background and specialise in devices.

The clinical and performance aspects of the two regulations are one of the major overhauls of the legislative framework for devices. Scientifically sound and well-written clinical sections of the technical files are important, and medical writers have a role in them.

The additional regulatory requirements entail more regulatory documents, some of them new to the device field, under these articles of the regulation:

  • clinical evaluation reports, under Article 61, with more stringent requirements and a higher update frequency for certain device classes
  • clinical investigation plans and clinical investigation reports, under Articles 61 and 62
  • post-market surveillance plans, under Article 84, and post-market surveillance reports, under Article 85, for all device classes
  • the periodic safety update report, under Article 86, long required for medicines and new for devices
  • the summary of safety and clinical performance, under Article 32

The additional clinical trials bring the writer more documents: the clinical investigation plan, the clinical investigation report, an investigator's brochure for the investigational device, the informed consent form, and the lay summary, which is new on the device and the pharmaceutical side alike.

Beyond the clinical evaluation plan and report, a device may also need, depending on its class, a post-market clinical follow-up evaluation plan and report, a summary of safety and clinical performance, a risk management report, a periodic safety update report, and a post-market surveillance plan and report. Four of the new documents, the clinical evaluation plan, the post-market clinical follow-up evaluation plan and report, and the summary of safety and clinical performance, each fit at their own point in the development and post-market phases of a device.

Under the lifecycle approach, data have to be generated and analysed across the device's whole life, and updates and reporting are more stringent and more frequent. The focus on post-market surveillance, with the frequency of reporting set by device class, invasiveness and risk, and reporting more stringent and more frequent the higher the risk, gives the writer more documents: the clinical evaluation plan and clinical evaluation report, plans and reports for post-market clinical follow-up studies, and the periodic safety update report. The lifecycle also brings more requirements for publications, posters and presentations on the medical communications side.

Where the legislation and guidance are published

The key regulations a device writer works with can all be downloaded except the ISO standard. The European Commission's medical devices unit landing page gives access to the three directives, on active implantable devices, on medical devices, and on in vitro diagnostic medical devices, and to the two regulations replacing them, Regulation 2017/745 on medical devices and Regulation 2017/746 on in vitro diagnostic medical devices. These texts describe the content requirements of the study documents a writer produces, such as the clinical investigation plan and the patient informed consent, and documents newly required, such as the periodic safety update report. The MEDDEV guidelines, the guidance documents that supplement the regulations, are reachable from the same page. They mostly relate to clinical research, and the ones relevant to a writer include the 2.1 documents on the scope, field of application and definition of a device, revision 4 of 2.7/1, which specifies the content requirements of a clinical evaluation report, and revision 2 of 2.12, on post-market studies. Some MEDDEV guidance documents remain relevant beside the new guidance written for the regulation.

The European Competent Authorities for Medical Devices, an umbrella group of national competent authorities, was working in 2018 on guidance and templates to help implement the new regulations. Transitional frequently asked questions on the two regulations, a roadmap for them and a joint action on market surveillance of devices are published. The notified bodies publish implementation support, including a guide explaining the terms notified body, competent authority and CE mark, information and webinars on the regulation, and a series on the diagnostics regulation.

Sources behind this topic

12 sources · 68 passages

Follow the evidence

Supporting passages

The source text behind this topic. Read it in context.