Medical Devices and IVDs: Approval, Certification, and CE Marking

Are you developing hardware or software for medical or health-related purposes and want to place it on the market? If so, you’ll face a multitude of laws, regulations, directives, and standards, because before your product can be placed on the market, you must demonstrate that it is safe and fulfills its intended medical purpose. We’re happy to assist you with our many years of experience. Together with you, we’ll bring your new product to the regulated market safely, quickly, and with as little effort as possible.

But first, a clarification of terminology: strictly speaking, there is no such thing as an “approval” for medical devices in Europe. The prerequisite for legally marketing a medical device in Europe is a CE marking on the device. The manufacturer applies this themselves, provided they have demonstrated that their product is safe and fulfills its intended medical purpose.

For Class IIa, IIb, and III medical devices, as well as for Class I products with a measuring function, Class I products placed on the market in a sterile state, and reusable surgical instruments, a Notified Body must be involved to the extent required by regulation. For in vitro diagnostic medical devices (IVDs), a Notified Body is generally required for Classes B, C, and D, as well as for Class A products placed on the market in a sterile state. In the EU, no official product approval is generally required for the regular placing on the market of a medical device. Rather, the manufacturer carries out the relevant conformity assessment procedure and involves a Notified Body, where required. This does not affect official approval, notification, and monitoring procedures, such as those for clinical investigations, performance studies, special approvals, or market surveillance measures.

Nevertheless, the term “approval” has become established even in the context of medical devices. This is hardly surprising, given that the entire approval process is complicated enough as it is. A little linguistic simplification is helpful here. This technical article aims to contribute to that simplification by outlining the basic path to CE marking for medical devices. In addition to this basic path, there are many special rules, exceptions, and specific requirements to consider, which we will not address here. The devil is in the details.

Intended purpose: What exactly is the product supposed to do?

The first step in the approval of a medical device is determining its intended purpose. The intended purpose specifies the purposes for which a product may be used and those for which it may not. The manufacturer defines the intended purpose itself. Use outside the intended purpose specified by the manufacturer may constitute misuse. Responsibility must be assessed on a case-by-case basis. In particular, the manufacturer must take reasonably foreseeable misuse into account in risk management, product design, labelling, and the instructions for use.

In particular, the intended purpose determines whether the product is classified as a medical device for regulatory purposes and whether the European Medical Device Regulations (MDR and IVDR) apply. Furthermore, the intended purpose is a key factor in determining which risk class the product falls into.

A product that is not a medical device must not be used as a medical device. A product that meets the requirements for a medical device but is not intended by the manufacturer for that purpose may generally not be placed on the market in a manner that circumvents the requirements of the MDR or the IVDR. However, drawing the line is difficult on a case-by-case basis and may be subject to legal review.

Key components of the intended purpose include the medical purpose, the indication, the intended patient or target population, the intended users, the environment and location of use, the functional and active principles, contraindications and exclusion criteria, as well as the intended duration of use.

For IVDs, the following must also be described in particular: the parameter for determination or the analyte, the type of information provided, the sample type, the target population, and the intended testing context.

The intended purpose significantly influences the scope of evidence required to demonstrate compliance with statutory requirements. On the one hand, the objective should be to reduce the regulatory burden by narrowing the scope of the intended purpose. On the other hand, a more narrowly defined intended purpose may result in a smaller patient population and thus a smaller market. Small patient populations can also be a disadvantage for clinical evidence if it is difficult to recruit subjects or patients for clinical trials.

Qualification: When is a product considered a medical device?

One of the most frequently discussed questions regarding the approval of a medical device is whether the product is, in fact, a medical device at all. To answer this question, the intended purpose of the product must be compared with the definition of a medical device as set forth in the MDR or the IVDR.

Put simply, the MDR defines medical devices as objects of all kinds, including software, primarily based on their intended uses. These are:

Diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of diseases
Diagnosis, monitoring, treatment, alleviation, or compensation for injuries or disabilities
Investigation, replacement, or modification of the anatomy or of a physiological or pathological process or condition; and
Obtaining information through in vitro examination of samples taken from the human body, including those from organ, blood, and tissue donations.

Medical devices also include products for contraception or fertility assistance, as well as products specifically determined for the cleaning, disinfection, or sterilization of medical devices.

Medical devices must be intended for human use. Furthermore, the mechanism of action is important. The primary intended effect of a medical device is achieved neither by pharmacological or immunological means nor metabolically. However, its effect may be supported by such means. This distinction also applies to the classification of medical software. The MDR also applies to certain products without a medical intended use, such as contact lenses.

The IVDR supplements the MDR’s definition of a medical device with specific aspects characteristic of in vitro diagnostic medical devices (IVDs). Accordingly, an IVD is intended for the in vitro examination of specimens derived from the human body, including blood and tissue donations, and is intended to provide specific information relevant to diagnosis or therapy. An IVD is also considered a medical device.

Both the MDR and the IVDR also define an accessory as an item that, while not a medical device in itself, is determined by the manufacturer to be used in conjunction with a medical device.

Determining whether a product qualifies as a medical device is often difficult. This is the case, for example, with:

Wellness products
Drugs
Cosmetics
Products containing cells or tissues
Biotechnology products
Personal protective equipment
Software

Special rules apply to products that combine a medical device with an IVD or a drug. In the case of a combination with a drug, the manufacturer must, in particular, distinguish the extent to which the device and the drug are intended to be used together and what function the drug component serves in terms of the overall effect. Classification is then determined based on either medical device regulations or drug regulations.

Legal basis: Which laws, regulations, or directives apply?

Both the MDR and the IVDR are European regulations and are directly applicable in all EU member states:

EU Medical Device Regulation (Regulation (EU) 2017/745) (MDR), effective May 26, 2021
EU In Vitro Diagnostic Medical Devices Regulation (Regulation (EU) 2017/746) (IVDR), effective May 26, 2022

Both regulations entered into force in 2017 and have since been amended or corrected several times. Extended transitional provisions under Article 120 of the MDR and Article 110 of the IVDR apply to certain existing products. Their applicability requires, among other things, that the respective legacy requirements continue to be met, that there is no substantial change in design or intended purpose, that no unacceptable risk exists, and that the prescribed steps for transition to the MDR or IVDR have been initiated in a timely manner. The relevant deadlines must be checked based on the product and risk class.

Depending on the type of medical device in question, requirements from other EU regulations or directives may apply. In addition to the European directives and regulations, implementing acts or delegated acts may apply in specific cases to supplement or update existing European legislation. European legislation is supplemented at the national level by additional laws and regulations or transposed into national law. In Germany, these are primarily

The Medical Device Law Implementation Act (“Medizinprodukterecht-Durchführungsgesetz”, MPDG),
The Medical Device Operator Regulation (“Medizinprodukte-Betreiberverordnung”, MPBetreibV), and
The Medical Device User Reporting and Information Regulation (“Medizinprodukte-Anwendermelde- und Informationsverordnung”, MPAMIV).

In addition to the legal framework, there are numerous other regulatory documents, primarily (harmonised) standards and various guidelines, most notably those issued by the Medical Device Coordination Group (MDCG).

Standards and guidelines must be distinguished from common specifications in this context. The application of harmonised standards is generally voluntary but may establish a presumption of conformity for the requirements they cover. MDCG guidelines are not legally binding but represent important, coordinated interpretive aids. Common specifications must be complied with in accordance with the MDR or IVDR, unless the manufacturer can properly demonstrate that its alternative solution achieves a level of safety and performance that is at least equivalent.

Risk class: Which one does the product fall into?

The MDR follows a risk-based approach and classifies products into risk classes I, IIa, IIb, and III. The higher the number, the higher the risk class, and the more stringent the statutory requirements that must be met. The MDR contains 22 classification rules that manufacturers must use to classify a product. The rules involve a range of criteria, including, in particular, technical, design, material, and biological characteristics, invasiveness, duration of contact, site of action, and method of application.

Medical devices classified as Class I that

Have a measuring function (Class Im),
Are reusable surgical instruments (Class Ir), or
Are intended to be placed on the market in a sterile state (Class Is),

constitute a special case. Although these are medical devices in the lowest risk class (Class I), the manufacturer must involve a Notified Body to a certain extent for the declaration of conformity. More on this in the following sections.

The IVDR provides for risk classes A, B, C, and D, with Class A representing the lowest risk and Class D the highest. The IVDR provides for 7 classification rules. Assignment to a risk class is primarily based on the intended use specified in the intended purpose. Class A IVDs that are placed on the market in a sterile state (Class As) represent a special case and require the involvement of a Notified Body. This is always the case for Classes B, C, and D.

The risk classification of medical devices regularly leads to intense discussions regarding the interpretation of regulations for new products and their combinations and always requires a case-by-case assessment. Here, too, specific requirements apply to medical software, including Classification Rule 11 of the MDR.

Economic operators: Who is the person responsible for placing products on the market?

The MDR and the IVDR specify who must meet which requirements in order to be permitted to place a medical device on the European Union market. The regulations distinguish between different economic operators.

The central economic operator is the manufacturer itself, whom the MDR defines as a natural or legal person who engages in product manufacturing or has it developed, manufactured, or reprocessed as new, and markets this product under their own name or brand. Other economic operators include the authorised representative, distributor, or importer, who are subject to different rights and obligations than the manufacturer.

The regulations also define the term “making a medical device available on the market” as any supply of a product, whether for consideration or free of charge, with the exception of investigational devices, for distribution, consumption, or use on the Union market in the course of a commercial activity.

In contrast, placing a medical device on the market refers to the first time a medical device is made available on the market. Alternatively, a medical device may also be “merely” put into service on the market. Putting into service refers to the point in time at which a product - with the exception of investigational devices - is made available to the end user as a product that can be used for the first time on the Union market as a ready-to-use product in accordance with its intended purpose.

The specific context in which a product is developed and made available on the market plays a decisive role in determining the marketing costs incurred, which in turn must be recouped on the market. Therefore, such an assessment should be conducted at the outset of product development and considered as part of business model development.

Manufacturer obligations: What are the specific requirements?

The manufacturer bears full responsibility for a given product and places it on the market with all associated rights and obligations. To this end, the manufacturer must demonstrate that its product meets the requirements of the MDR or the IVDR. The following points, which arise primarily from Article 10 of the MDR or the IVDR, play a central role in this regard:

Clinical evaluation (MDR) or performance evaluation (IVDR)
Risk management system
General safety and performance requirements
Quality management system
Instructions for use and label
Technical documentation
Liability protection
PRRC
Authorised representative
Registration
Declaration of conformity

Even after a medical device has been placed on the market, the manufacturer must continue to fulfill all relevant obligations and requirements. EU regulations consistently emphasize the importance of the entire product lifecycle.

Clinical evaluation or performance evaluation

Manufacturers use clinical data to verify whether a medical device is safe and effective. The MDR refers to this as a clinical evaluation, while the IVDR refers to it as a performance evaluation.

At its core, a clinical evaluation is a systematic collection and analysis of clinical data from a wide variety of sources. According to the MDR, the manufacturer is required to conduct a clinical evaluation throughout the entire product lifecycle. Thus, a clinical evaluation also includes post-market clinical follow-up of the medical device. The clinical evaluation must be part of the quality management system and is closely linked to risk management. These requirements also apply to performance evaluation for IVDs.

The manufacturer must demonstrate that the medical device

Achieves the intended performance,
Has been designed and manufactured in such a way that it is fit for its intended purpose,
Is safe and effective,
Does not endanger the clinical condition or safety of patients, nor the safety or health of users or, where applicable, third parties,
Has an acceptable benefit-risk profile,
Is compatible with a high level of health protection and safety, and
Is based on the generally accepted state of the art.

The clinical benefit-risk profile therefore plays an important role. Manufacturers must weigh the clinical benefits against the clinical risks, including adverse side effects, based on

Type of effect,
Intensity,
Duration, and
Frequency

within the target population and indication defined as precisely as possible, both qualitatively and, if possible, quantitatively.

The performance evaluation required by the IVDR focuses on demonstrating

Scientific validity,
Analytical performance, and
Clinical performance.

Clinical data consists of information regarding the safety or performance of a product and may come from the following sources:

Clinical investigations or performance studies of a product,
Other studies published in the scientific literature regarding a product whose equivalence to the product in question can be demonstrated,
Peer-reviewed scientific literature on other clinical experiences either with the product in question or with a product that can be demonstrated to be similar to the product in question,
Findings obtained from routine diagnostic tests (in the case of performance evaluations), or
Clinically relevant data from post-market surveillance (clinical follow-up).

The MDR uses the term “clinical investigation” instead of the term “clinical study,” which is more commonly used in professional circles. The IVDR refers to “performance studies.”

The determination of whether a clinical investigation is required depends on the level of clinical evidence required for the specific product and already available. New technologies, new intended purposes, or changes relevant to safety or performance may necessitate a clinical investigation if conformity cannot be demonstrated by sufficient other clinical data. For implantable devices and Class III devices, clinical investigations are generally mandatory, unless one of the exceptions set forth in Article 61 of the MDR applies.

At the start of a new project, it should be clear which specific medical application and medical need are being addressed and what product claim is derived from them. The clinical evaluation must provide attestation of this and should therefore be taken into account from the very beginning of the project. For this reason, it is best to begin the clinical evaluation at the same time as the design and development of a new product.

Risk management system

The use of medical devices always involves risks for patients and users. These risks must be as low as possible in relation to the benefits of a medical device. Manufacturers of medical devices must therefore establish a risk management process. Requirements and established methods for risk management in medical devices are described in particular in ISO 14971. The legal obligation to establish, document, implement, and continuously update the risk management system stems from the MDR and IVDR. The EU regulations explicitly require medical device manufacturers to keep risk management up to date throughout the entire product lifecycle.

When medical devices are used, both intended and unintended effects occur. The intended effects are part of the intended use of medical devices. The unintended effects are ‘side effects’ or ‘adverse effects.’ In addition, unexpected events may occur that can lead to adverse effects. During the risk evaluation, the manufacturer systematically analyses these effects and assigns severity levels to them.

In addition to severity, the probability of occurrence is crucial, that is, the probability of an adverse effect occurring combined with the probability that an adverse effect will result in harm. A risk is the combination of the probability of harm occurring and the severity of that harm. In risk management, the manufacturer identifies hazards, analyses foreseeable consequences of events and hazardous situations, assesses and evaluates the resulting risks, and establishes appropriate risk control measures.

First, the manufacturer establishes documented criteria for risk acceptance and reduces risks in accordance with the order of priority specified in Annex I of the MDR or IVDR: first through inherently safe design, then through protective measures, and finally through safety information. The manufacturer then reviews the remaining individual risks and the overall residual risk, as well as the benefit-risk ratio. A positive benefit-risk assessment does not replace the required risk control.

At this point, the connection between risk management and clinical evaluation also becomes clear. There, too, the (clinical) benefit-risk profile is the focus of consideration. The MDR and IVDR therefore explicitly require that both processes be appropriately linked.

The manufacturer’s definition of an adequate benefit-risk profile is crucial for the subsequent marketing of the product. For a company, this involves risks related to reputation, liability, and financial harm. Manufacturers are therefore well advised not to leave this decision to individual persons. Involvement of different expert perspectives and top management is important at this stage.

General safety and performance requirements

The MDR and the IVDR define comprehensive general safety and performance requirements. In each individual case, the applicability of the safety and performance requirements depends on the type of product. For example, a medical app does not need to meet requirements related to the surface properties of a material. Or the design and development of a novel wound dressing generally do not require consideration of exposure to ionizing radiation. The manufacturer therefore identifies the safety and performance requirements applicable to its product. To do so, the manufacturer relies in particular on the results of the risk management process.

The next step is to demonstrate that the individual requirements are met. To do this, the manufacturer generally relies on technical standards. The EU regulations explicitly require consideration of the state of the art and refer to the use of harmonised standards. Harmonised standards are listed in the Official Journal of the EU and have the advantage of triggering a presumption of conformity. If a manufacturer applies a harmonised standard, it is presumed that the corresponding safety and performance requirement of the EU regulation has been met.

Unfortunately, the process of harmonizing standards has stalled in recent years. Currently, there are very few harmonised standards that reference the safety and performance requirements of the MDR and the IVDR. The standards harmonised with the EU Directives and listed in the Official Journal of the EU do not trigger a presumption of conformity with the EU Regulations. Furthermore, in most cases, the listed harmonised standards have been superseded by more recent editions.

The use of standards is not mandatory. Manufacturers may also use other technical documents. Ultimately, the goal is to meet the requirements of EU regulations and to provide technical justification for doing so. When selecting a version of a standard, manufacturers should consider its harmonization status, the current state of the art, any specified transition periods, and the scope of the changes. If the manufacturer deviates from the latest relevant edition, they should provide documented justification as to why the version used—or an alternative method—remains suitable for meeting the regulatory requirements. It is also advisable to always use documents that are presumed to have the broadest possible acceptance and high technical quality. This supports the use of international ISO or IEC standards, which were developed through an international consensus process.

In many cases, product verification is required to demonstrate compliance with safety and performance requirements. In most cases, the testing requirements are specified in the relevant standards. Product verification can be performed by technically qualified internal or external testing laboratories. The manufacturer must demonstrate the suitability of the test methods, the competence of the laboratory, and the reliability and traceability of the results. Accreditation according to ISO/IEC 17025 increases the acceptance of the results and may be required or advisable in individual cases due to standards, certification schemes, or requirements of the Notified Body.

Quality management system

The quality management system is a central component of a medical device manufacturer’s operation. With the MDR and the IVDR, the importance of quality management has increased even further. Even manufacturers of Class I medical devices are required to have a quality management system. Many other requirements are directly linked to quality management.

The objective of quality management is to consistently achieve defined quality objectives. To this end, an organization systematizes all workflows, defines processes on that basis, and documents them. The quality management system therefore encompasses all of an organization’s workflows, including their documentation.

A quality management system is not static. The objective is to achieve continuous quality improvements and to meet the requirements of all stakeholders. Therefore, the organization must continuously monitor its processes and implement improvement measures. The PDCA cycle model plays an important role here, describing a cycle of Plan > Do > Check > Act. The latter step includes ongoing correction and preventive actions (CAPA).

The quality management system considers three types of processes:

Management processes,
Core processes, and
Support processes.

The core processes encompass value-adding workflows; that is, this is where the organization plans, develops, produces, and markets its products or services. The support processes relate, for example, to material procurement or corrective and improvement actions. The management processes, in particular, define quality objectives, provide resources and infrastructure, and communicate the quality philosophy throughout the organization.

ISO 9001 is the internationally recognized standard for quality management systems. It focuses on improvement of customer satisfaction. For medical devices, however, this is not the sole decisive requirement. In this context, the quality objective of patient safety is of particular importance.

For this reason, the ISO 13485 standard expands the requirements for a quality management system when it comes to the provision of medical devices and related services. Manufacturers must meet both customer requirements and the statutory requirements specified in detail by the MDR and the IVDR. The standard can also be applied by suppliers who provide products or related services.

Instructions for use and label

The EU regulations require manufacturers to provide comprehensive and clearly defined information about the product. Such information may appear on the product itself, on labels, on the packaging, or in the instructions for use. The general safety and performance requirements include a list of information that must be included in the instructions for use or as part of the product labeling.

The instructions for use (“user manual”) is the information provided by the manufacturer that informs the user about the intended purpose and correct use of a product, as well as any precautions that must be taken. Residual risks identified as a result of risk management and of which a user must be informed are included in the instructions for use or on the labels as restrictions, contraindications, precautions, or warnings.

Instructions for use must generally be provided with the product. For MDR Class I and IIa products, they may be omitted in exceptional cases if the product can be used safely and in accordance with its intended purpose without instructions for use and no other regulation requires instructions for use. For IVDs, the specific requirements and exceptions of Annex I of the IVDR apply. In certain cases, the instructions for use may also be made available to the user exclusively in electronic form.

Labeling refers to written, printed, or graphically presented information affixed either to the product itself, to the packaging of each unit, or to the packaging of multiple products. The label includes, among other things, the name or trade name of the product, the manufacturer’s address, and details for identifying the product. This also includes the Unique Device Identifier (UDI), newly introduced by the MDR and IVDR, as a unique product identifier. The UDI concept is explained in further detail in the following sections.

Labeling and instructions for use must be provided in the official language(s) of the Member States in which the product is made available to the user or patient, unless the Member State in question accepts or requires a different language. The applicable national language requirements and any exceptions for professional users must be tested prior to market entry. Information on the safety of the device (e.g., precautions, warnings) must always be displayed in the local languages. For implantable devices, an implant card containing the required patient information must generally be provided, unless the product falls under one of the exceptions specified in Article 18 of the MDR.

Technical documentation

The technical documentation is a compilation of all relevant documents pertaining to a product. It must be kept up to date throughout the entire product lifecycle. The technical documentation serves as the basis for the conformity assessment and, consequently, for a product’s CE mark.

The MDR and IVDR specify in detail how technical documentation should be structured. Technical documentation is also part of the documentation requirements after placing the product on the market. The manufacturer must keep the technical documentation, the EU declaration of conformity, and, where applicable, relevant certificates available to the competent authorities for at least ten years after the last product covered by the EU declaration of conformity has been placed on the market. For implantable devices under the MDR, the period is—with a few exceptions—at least 15 years.

If a competent authority verifies whether a review by a Notified Body was conducted properly, this also includes the technical documentation for a medical device. In addition, a Member State in which a Notified Body is established may require that documents, including the technical documentation, be made available.

The EU regulations structure the technical documentation as follows:

Product description: This section serves to clearly describe and identify the product. It specifies the product’s functional elements and mode of action, as well as how it achieves its intended performance in accordance with its intended purpose. The manufacturer also presents the product’s risk classification and explains why it is a medical device. In addition, this section contains information on the UDI, the Declaration of conformity, and the Summary of safety and clinical performance (SSCP) in the case of implantable devices and Class III medical devices.
Information to be provided by the manufacturer: This section includes, in particular, the complete labels and instructions for use in the language versions required for the target markets. In addition, separate technical documentation on post-market surveillance in accordance with Annex III of the MDR or IVDR must be prepared and kept up to date.
Design and Manufacturing: In this section, the manufacturer describes the phases of product design and development. There is a close integration with quality management.
General safety and performance requirements: The manufacturer systematically outlines which general safety and performance requirements apply to a medical device and whether these requirements are met. This includes a justification in cases where they are not met.
Benefit-risk Analysis and risk Management: The results and documents from the risk management process are directly incorporated into the technical documentation. These primarily consist of the risk management plan, the risk analysis (including control measures), and the risk management report, which contains the review of the benefit-risk ratio.
Verification and validation: In this section, the manufacturer documents all analyses, tests, inspections, studies, etc., that serve to demonstrate the conformity of the medical device. In addition to laboratory data, simulation data, or results from preclinical studies, this section specifically includes the results of the clinical evaluation and its documentation.

Since medical devices can vary greatly, the requirements for their verification and validation also vary. Consequently, the corresponding technical documentation differs in terms of structure and content. The documentation includes not only test results but also all information on methodology and test design, as well as study protocols. Depending on the type of medical device and the resulting requirements, test results are primarily documented in the following areas:

Materials used
Biocompatibility
Physical, chemical, and microbiological parameters
Electrical safety
Electromagnetic compatibility
Software validation (in conjunction with hardware and software configurations)
Stability and shelf life
Pharmaceutical ingredients
Tissues or cells of human or animal origin as a component of the Medical device
Pharmacology (absorption, distribution, metabolism, excretion, interactions, tolerability, and toxicity)
Sterility parameters
Connection configuration parameters for interconnected medical devices
Sample types
Measurement function parameters
Measurement accuracy and measurement ranges
Sensitivity and specificity

Liability protection

EU regulations require manufacturers to take precautions to ensure adequate financial coverage for their potential liability. These precautions must be commensurate with the risk class, the type of product, and the size of the company.

The manufacturer of medical devices is liable for harm caused by defective products. These are primarily technical and design defects or, in the case of software, errors in the program code. However, there are a number of other potential causes of liability, such as inadequate instructions for use, missing warnings, false marketing claims regarding product performance, inadequate data protection, or copyright infringements. The manufacturer of medical devices is therefore liable if it fails to fulfill its contract with a customer. In practice, this usually revolves around whether a particular medical device has a defect and thus fails to meet the contractually agreed-upon condition. The defect does not necessarily have to pose a safety risk. In the event of damage, protracted and costly disputes often arise because the customer and the manufacturer have not reached precise agreements regarding important performance characteristics of a product. In such cases, it is unclear whose area of responsibility the defect falls under.

Furthermore, the manufacturer of medical devices can generally be held liable for defects caused by a faulty product. Since life, health, and property are protected by law, there is consequently no contract with an individual affected person in such cases. The manufacturer has various obligations to prevent its medical devices from infringing on the rights of others. It may also be held liable for harm resulting from a defect in a medical device, regardless of whether it is at fault or not.

Product liability insurance is the tool of choice for limiting liability risks and meeting the requirements of the MDR and the IVDR. The amount of financial coverage depends on the specific type and risk class of the medical device in question, as well as the size of the company. The exact terms of the policy are determined on a case-by-case basis and should involve a risk analysis. Depending on where a medical device is to be marketed, country-specific conditions may also play a role.

Person Responsible for Regulatory Compliance

The EU regulations have introduced the role of the Person Responsible for Regulatory Compliance (PRRC), who is accountable for compliance with regulatory requirements. This primarily concerns the manufacturing of medical devices and their post-market surveillance. Manufacturers must designate at least one PRRC. This person must possess the “necessary expertise in the field of medical devices.”

The responsibilities of the PRRC are:

Verifying the conformity of products with the established quality management system prior to their release,
Preparing and continuously updating the technical documentation and the EU declaration of conformity,
Fulfilling the obligations arising from the post-market surveillance of medical devices,
Fulfilling the reporting obligations arising from vigilance requirements,
Issuing a declaration of “safety” for investigational devices intended for clinical investigations.

The organisational structure must be designed such that the PRRC are employees of the manufacturer. The responsibilities listed above may be distributed among several persons, provided this is clearly defined in writing. If there are multiple manufacturers within a corporate group, each individual manufacturer must have at least one PRRC.

Micro and small enterprises are exempt from this requirement, i.e., companies that employ fewer than 50 people and whose annual turnover or annual balance sheet total does not exceed €10 million. Such manufacturers must be able to “rely on a PRRC on a permanent and continuous basis.” This means that external service providers can fully assume the role of PRRCs for small and micro-enterprises, provided there is a corresponding contractual arrangement. This exception also applies to authorized representatives of manufacturers not established in the EU.

The new role of the PRRC under the MDR may result in decisions regarding product safety and patient protection conflicting with the manufacturer’s operational or commercial interests. This conflict of interest can lead to increased personal risk for the PRRC. For this reason, EU regulations stipulate that PRRCs must not be disadvantaged in connection with the proper performance of their duties. This applies to both employed and external PRRCs.

Authorised representative

If the manufacturer of a product is not established in one of the EU member states, it must carry out the designation of an authorized representative. The authorized representative is mandated in writing by the manufacturer and must also accept this mandate in writing. The authorized representative then carries out the tasks specified in the mandate. These include:

Reviewing that the EU declaration of conformity and the technical documentation have been prepared and that the manufacturer has carried out the appropriate conformity assessment procedure
Maintaining a copy of the technical documentation, the EU declaration of conformity, and, where applicable, certificates of change, etc.
Compliance with registration requirements
Providing all information and documentation necessary to demonstrate a product’s conformity upon request by a competent authority
Forwarding to the manufacturer any requests from a competent authority of the Member State in which the Authorised representative has its registered place of business for samples or access to a product
Cooperation with the competent authorities regarding all preventive or corrective actions or the mitigation of product hazards
Immediately notify the manufacturer of complaints and reports from healthcare professionals, patients, and users regarding suspected incidents related to a product
Termination of the mandate if the manufacturer breaches its obligations under the MDR or IVDR.

The mandate cannot delegate all of the manufacturer’s obligations. The MDR and IVDR define exceptions in this regard. However, the authorised representative is jointly and severally liable for defective products on the same basis as the manufacturer if the manufacturer has failed to comply with the general obligations of the MDR or IVDR and is not established in a Member State.

Registration

Before a product may be placed on the market, various registrations are required:

Registration of the manufacturer, Importer, and Authorised representative in the European database on medical devices (EUDAMED)
Registration of products in the UDI database (part of EUDAMED)

After registration in EUDAMED, the manufacturer receives a “Single Registration Number” (SRN). The SRN is required to apply for a conformity assessment with a Notified Body and to gain access to EUDAMED. This access is necessary to comply with notification and reporting obligations.

The UDI database is part of EUDAMED. UDI stands for Unique Device Identification and is used to identify individual products on the market. The UDI code is a unique alphanumeric string. There are 3 different types of UDI codes:

Basic UDI-Device Identification (Basic UDI-DI)
UDI-Device Identification (UDI-DI)
UDI-Production Identification (UDI-PI)

The Basic UDI-DI is a registration number for a group of products with the same intended purpose, the same risk class, and comparable design and manufacturing characteristics. It can be regarded as an identifier for a product model.

The Basic UDI-DI does not appear on a product’s label or packaging. It is used, among other things, in the manufacturer’s declaration of conformity and technical documentation. The Basic UDI-DI primarily serves to summarize information about a specific medical device model.

The UDI-DI serves to uniquely label a product. The UDI-PI contains information regarding the manufacturing of a product, such as lot and serial numbers or manufacturing and expiration dates.

The manufacturer registers the product with the UDI-DI base identifier along with other required data elements in the UDI database. If certification by a Notified Body is required, the registrations must be completed beforehand. The Notified Body references the UDI-DI base identifier on the certificate. The data entered in EUDAMED must be reviewed regularly and kept up to date.

Declaration of conformity: How do I obtain the CE mark?

Every medical device placed on the market in Europe must comply with the requirements of the MDR or the IVDR. The manufacturer declares the product’s conformity in a Declaration of conformity, the minimum requirements for which are specified by the MDR and IVDR. In doing so, the manufacturer formally assumes responsibility for the medical device placed on the market.

Prior to this, the product undergoes a conformity assessment procedure based on the documentation described in the preceding sections, which serves to demonstrate conformity. Only after completing the conformity assessment procedure the manufacturer may affix the CE mark to the product.

The MDR describes several possible conformity assessment procedures. The selection and design of the procedure depend on many factors, primarily related to the type of medical device and its risk class. As a general rule, the higher a product’s risk class, the more demanding - and thus more complex - the conformity assessment procedure is.

The quality management system also plays an important role. In the simplest case - that is, for a Class I or Class A product - it is sufficient for the manufacturer to have a quality management system that meets the requirements of the MDR or IVDR. In this case, neither certification of the quality management system nor a review of the product dossier by a Notified Body is required.

For products in higher classes, manufacturers usually opt for the conformity assessment procedure involving a comprehensive quality management system certified to ISO 13485. Here, the manufacturer establishes a comprehensive quality management system (if one does not already exist) and has it certified by a Notified Body, including the relevant technical documentation for the product. In this way, the manufacturer ensures compliance with the requirements through the implementation of the quality management system.

An alternative conformity assessment procedure is the product conformity assessment. This may also be accompanied by a quality management system certified by a Notified Body that pertains to production (production quality assurance). Alternatively, individual product testing may be conducted. In addition, a Type examination, including a review of the technical documentation, may be required.

There are several exceptions and special requirements for certain products that will not be elaborated on here. For all conformity assessment procedures, the manufacturer subsequently issues an EU declaration of conformity. The manufacturer then affixes the CE marking to the product. If a Notified Body is involved, the CE mark must include the Notified Body’s 4-digit identification number. Custom-made devices or products manufactured and used in health institutions are exempt from the conformity assessment procedure. “Streamlined” rules apply to these products.

Post-market Surveillance: What happens after placing a product on the market?

Manufacturers of medical devices monitor their products on the market. The MDR and IVDR require manufacturers to systematically and actively collect information on product use after a product has been placed on the market in the European Union (post-market surveillance, PMS).

Based on this, manufacturers keep the technical documentation for their products up to date and cooperate with the national authorities responsible for vigilance and market surveillance. The objective is to enhance the safety and performance of medical devices. The manufacturer continuously assesses whether correction or preventive actions are necessary and, if applicable, notifies the competent authorities or the Notified Body.

If the manufacturer identifies a serious incident or initiates a Field Safety Corrective Action (FSCA), it must report this immediately. The MDR refers to this separately regulated reporting procedure as vigilance.

Post-Market Clinical Follow-Up (PMCF) for medical devices (or Post-Market Performance Follow-Up (PMPF) for IVDs) refers to the clinical monitoring of a product after it has been placed on the market. It is an ongoing process that keeps the clinical evaluation of the product up to date. Post-Market Clinical Follow-Up is part of post-market surveillance. To this end, the manufacturer collects and reviews clinical data on its product in the market. The product must bear a CE mark and be used for its intended purpose. The manufacturer also uses PMCF to determine whether its product is potentially being used systematically incorrectly - that is, in a defective manner or in a way that exceeds the authorized indications. In this way, the manufacturer reviews whether the intended purpose has been appropriately defined.

Market surveillance is carried out by the competent authorities. These authorities perform testing to verify whether products on the market comply with the requirements of the MDR and do not pose a hazard. To this end, the competent authorities may inspect medical devices on a random basis. In extreme cases, the authorities may order a product to be withdrawn from the market. Details are regulated by the respective national laws.

Manufacturers establish a post-market surveillance (PMS) process as part of their quality management system. This process must be appropriate to the risk class and type of product and ensure that data on the quality, performance, and safety of a product are actively collected and analysed throughout the product’s entire lifecycle. The results of post-market surveillance must be documented in the required reports. For MDR Class I products and IVDR Class A products, a post-market surveillance report must generally be prepared and updated as needed. For MDR Classes IIa, IIb, and III products, as well as IVD Classes B, C, and D products, a Periodic Safety Update Report (PSUR) must be prepared and updated at the prescribed intervals.

The manufacturer must then, based on the collected data,

Update the risk management and benefit-risk assessment of its product,
Update the product manufacturing process, the instructions for use, and the label,
Update the clinical evaluation (PMCF),
Update the Summary of safety and clinical performance (SSCP),
Determine the need for preventive or corrective actions and implement them as necessary,
Notify the competent authorities or the Notified Body, if necessary,
Identify any serious incidents, initiate Field Safety Corrective Actions (FSCA), and report them,
Determine how the product’s usability, performance, and safety can be improved,
Identify and report trends, and
Update the technical documentation.

Manufacturers are required to report serious incidents and Field Safety Corrective Actions (FSCA) via EUDAMED. The deadlines for reporting depend on the nature and severity of the incident.

If it becomes apparent that a medical device will no longer be available or will be available only to a limited extent, and this could pose risks to patients or public health, the manufacturer must inform the competent authorities and affected market participants in a timely manner. As a general rule, this notification should be provided at least six months before the interruption or discontinuation of supply.

Conclusion

The approval of a medical device requires expertise, adequate financial resources, and time. The devil is in the details, as the practical implementation of the requirements usually raises the question “How?” - that is, how should a specific requirement be designed in an individual case, and how can compliance with the requirement be implemented in practice through a process that is as streamlined and compliant as possible?

The MDR and IVDR have increased the effort required for CE marking of medical devices. The transitional period complicates the conformity assessment and market access process for medical devices, for example due to a lack of capacity at Notified Bodies, long processing times, or ambiguities in the design of the various requirements.

This makes it all the more important to plan in detail for the workload and methodological challenges a manufacturer will face. Many problems can be avoided early on if regulatory requirements are taken into account from the very beginning and missteps are prevented.

We are happy to assist you with the approval of your medical devices and, working together with you, bring your new product to the European market safely, quickly, and with as little effort as possible. If you first need a detailed roadmap for your medical device, along with an estimate of the costs and duration of the approval process, we recommend our “CE Roadmap.”