DAY I:

Regulatory changes

The Medical Device world is in transition and this can be good news for some and a really bad for
others.

In fact, if you look at the outcome of this change, you can think that we are streamlining the
regulations as we are going from 3 Directives to 2 Regulations.
The objective of these changes is mainly to strengthen the regulatory requirements across the
European Union.

This will ensure patient safety and will simplify the rules.
How? By improving transparency with more Post-market Surveillance report from
manufacturers and improving product traceability with the implementation of UDI and
EUDAMED. There will be more requirements to follow, an important power to oversee
implementation and also a stronger harmonization.
What are the main changes that you will notice?

 Youwill see that the regulation is more stringent. You will also notice that it will be
more oriented around clinical evidence and the performance of the device will be
continuously assessed.

 Something new which is copied from the pharma industry is that the new regulation
defines the Technical Documentation content.

 More surveillance

 Changes to the Post-marketing Surveillance and Vigilance

 EUDAMED - European Database of Medical Devices introduced

 Update of the requirements on Importers and Distributors

Background

You should also understand why all those changes happen.

The regulation of Medical device was unchanged since the 90s. The new technologies that are
coming onboard (3D Printing, Medical Apps, robots…) and also some few scandals forced the
regulators to initiate a complete update of the laws.

One of the famous scandals was about breast implants coming from the French company PIP.
They intentionally changed the approved breast implant gel made for human use with an
industrial gel that cost less.

The company with its employees intentionally hides that to everyone following the instructions
of the CEO...
What was also interesting with this case is the fact that the Notified Body was judged guilty and
was asked to pay for the damages.

It changed completely the vision of the Notified Body roles & responsibility.

Timelines

Now that the stage is set up, let’s talk about the schedule for all this transition.

Both the Medical Device Regulation MDR 2017/745 and In-Vitro Diagnostic
Regulation IVDR 2017/746 were released on May 5th, 2017 and entered in force on 26 May
2017.

 The MDR will have a 3 years transition period. So it will be effective by May 25th,
2020

 For IVDR the transition period will be longer, 5 years. Will become effective by May
25th, 2022

But to be honest it's more complicated than that. I tried to summaries this on the figure below. Or
if you prefer you can also look at the Video.

But one thing that you should know is the fact that for MDD and IVDD there will be no more
Certification allowed from May 25th, 2024.

What is important to know is that during this transition period, a lot of new information will
arrive. For example, the EUDAMED introduction which is not in place at the release.
DAY II

Today we'll speak about the Economic Operators and some other stakeholders.

 Manufacturer
 Authorized Representative
 Importer
 Distributor

Ok let's go!
Roles of the Stakeholders

I want to introduce you to important stakeholders that you will have to deal with if you are
on the Medical Device field.

First, let’s start with the Competent Authority (CAs). It’s a member state entity
responsible for market surveillance to ensure that devices comply with legal requirements
and do not endanger health, safety or any other aspect of public interest protection.

The Notified Body is an entity designated by the designating authorities (DAs) of that
member state to undertake conformity assessment activities in accordance with legal
requirements of that member state.

In many Member States, the same national agency are both CA and DA. But not in all
cases. E.g., in Germany, the DA is the ZLG, and the CA role is shared by different bodies
depending on the device category (BfArM, the Paul Ehrlich Institute, etc.)

Here are our Economic Operators:

Now it’s your turn :-) The Manufacturer is an entity that markets a device under its name
or trademark.

An important actor for a foreigner is the Authorized Representative or EC Rep. It’s an

entity that is located in the European Union which acts on behalf of a manufacturer, located
outside the European Union, in relation to the manufacturer legal obligations. Check below
the video answering the question "What is a European Authorized Representative?".

The Importer is an entity within the European Union the places a device from a third
country on the union market.

Lastly, the Distributor is an entity other than the manufacturer or the importer, that makes
a device available on the market, up until the point of putting into service.
 VIDEO
I have created a video to help you understand who is the Person Responsible for
Regulatory Compliance.

Authorized Representative (Article 11 of MDR)

 Under the MDR, Authorized Representatives will be held jointly and severally
liable for defective medical devices.

 For
a manufacturer not established in the EU, designate a sole Authorized
Representative for a Device group.

 The designation
of tasks of Authorized Representative will be documented in a
Mandate between Manufacturer and Authorized Representative.

 Verify that
the EU Declaration of Conformity and Technical Documentation have
been drawn up.

 Keepavailable a copy of the Technical Documentation, the EU Declaration of

Conformity and if applicable the relevant certificate, including any amendments
and supplements.

 Registeras the authorized representative, and verify the manufacturer has complied
with registration obligations

 Immediately inform the manufacturer about complaints and reports about suspected
incidents related to a device for which they have been designated.

 Respond
to requests from Competent Authorities and provide them with necessary
documentation.

 Forwardto the Manufacturer any requests from the Competent Authorities for
samples or access to the device.
READ MORE: Top 11 Questions about the Authorized Representative

What is a European Authorized Representative?

Importers (Article 13 of MDR)

 Verify that the device has been CE marked and the EU Declaration of Conformity
has been drawn up.

 Verify a manufacturer is identified and designated an Authorized Representative.

 Verify the device is properly labelled and accompanied by the required instruction
for use.

 Verify the manufacturer has assigned a UDI (Unique Device Identifier).

 The importer keeps a register of complaints, of non-conforming devices, and of

recalls/withdrawals, and provide the information to the manufacturer, authorized
representative and distributors.

 In case of re-labelling or change of the packaging such obligations (see Article 16

for further details) are limited to the need to have a certified Quality Management
System.

 They must have mechanism to report issues to Manufacturer.

 Ensure that device is stored and transported within the requirements defined by the
Manufacturer and Authorized Representative.

Distributors (Article 14 of MDR)

 Verify that the device has been CE marked and the EU Declaration of Conformity
has been drawn up.
  Verify the manufacturer has assigned an UDI (Unique Device Identifier).

 Verify the device is properly labelled and accompanied by the required instruction
for use.

 Ensure that
device is stored and transported within the requirements defined by the
Manufacturer.

 Distributorsthat have received complaints or reports from healthcare professionals,

patients or users forward the information to the manufacturer, the authorized
representative, and the importer.

 Verify that
importer has met their obligation and sample product to verify that
requirements have been met.

 Verify that importer has complied with requirements.

 Not place non-conforming product on the market and inform the Manufacturer and
where appropriate the Authorized Representative and Importer for serious
risk/falsified device, the Competent Authorities should also be informed.

Who can be PRRC?

To be Person Responsible for Regulatory Compliance on your organization there are 2 options.

Which one will you choose?

Option 1

 You have the right diploma, and

 You have 1 year of experience in regulatory affairs or quality management systems on
medical devices.

What kind of Diploma is required?

There is no fix choice but it should be a diploma in:

 Law
 Medicine
 Pharmacy
 Engineering
 Another Scientific Discipline

And for the experience, it is 1 year in Regulatory Affairs or in Quality Management System on
Medical Devices.
But I suppose that it’s not mandatory to be a manager role.

The interest of all this is to have a person that is competent and know what we are talking about.

Remember that Medical Devices are saving lives so it’s quite important to have someone that is
qualified to take care of the job.

I’ll tell you after what will be its roles and responsibility.

Note: if you have a pharma diploma but no experience in medical device, I

would recommend you to justify if your pharma experience is equivalent to a medical device
industry.

They are both in a regulated environment but the requirements are different. But try to prove that
you are knowledgeable by also performing a training on Medical Device Regulatory
Compliance.

The wording is saying specifically Medical Device experience, so an auditor can really challenge
you. So put everything on your side to prove that you are really credible regarding this specific
regulation.

Option 2

We understand that some people learned everything directly when they started their professional
careers.

So, you can also become PRRC if you have 4 years of experience in Regulatory Affairs or in
Quality Management System on Medical Devices.

Really nice.

It’s true that someone that survived 4 years in this function had enough time to get the
experience and make mistakes. So congratulation. You can already mention your name to your
boss if you want to become a PRRC.

What if no one is qualified to be PRRC?

In that case, there are 2 choices:

 Hire a new employee that will fulfill this role

 Hire a consultant for a certain period of time until one of your internal employees gets
trained.

In fact, in case the candidate you would choose for a PRRC has only 2 years of experience in the
industry but no diploma, you can still offer him a training so he can learn what is the role of a
Regulatory Compliance person.
But this should not be only a 1-day training as you can see sometimes which are more here to
tick a box than to really learn. You really need to have performed a training that is showing some
theoretical part and some practices.

The auditor can challenge you regarding the content of that training.

However, you need to start that before the EU MDR is in place. So put a strategic development
plan to one of your employees to be ready on May 2020.

Micro and small enterprises

I know, I know.

I already hear some CEOs of micro and small businesses who are saying that they don’t have this
kind of person available at their site.

So, what to do? Do you need to budget this PRRC?

No, the EU commission heard you also and they said that for Micro and Small enterprises they
still need to have a PRRC but not within their organization.

This role can be with a consultant for example, but there is a but. This person should
be “Permanently” and “Continuously” at the disposal of these enterprises.

I know it can be confusing.

What does mean “Permanently” and Continuously” if they are not part of your organization?

It means that as soon as you need this person, it should be available for you. I only suppose that
we are talking about office hours. Because asking someone to be available continuously can cost
a lot.

This service can be a good business for some consulting organizations if they have the right
persons available on their team.

Or maybe a lot of new 1 person organizations will be created to fulfill this requirement.

So, start to look now for this kind of person if you are a Micro or Small enterprise.

DAY III

Classification of Medical Devices

Now that we know our product is a Medical Device we can talk about classification.

All devices will be classified into one of four risk classes.

Risk classification is defined in MDR (Annex VIII) and is based on:

  Intended use

 Type of device

 Patient exposure

 Duration of Use

 Invasiveness

 Severity of harm/Level of Risk

A serie of 22 Rules is used to determine product classification.

To help you understand more on the EU Medical Device Classification, I propose you to read
one of my post where I provide you with a PDF form that will help you on this exercise.

Class of Medical Devices

On the Medical Device Regulation there are 4 classes:

 Class I
 Class IIa
 Class IIb
 Class III

Nota: I forgot to tell you something. For Class I there are some sub classes.

 Class Is: Product under class I delivered sterile

 Class Im: Product under class I with a measuring function
 Class Ir: Surgical instrument under class I reusable

See below more detail with this infographic. It includes examples and also if you need a Notified
Body or not.
CE Mark: Route to Market

Let's summarize.

 You defined if your product is a Medical Device

 You know the class of your product.

So what to do with all that? We now have enough information to choose which route we want to
follow to obtain the CE mark.

How?
Define for each class what is the route to market. Depending on your classification, you will
need to follow some specific requirements to be able to put your product on the market.

On the figure below you can see an overview of it.

But for each class there are also some specificity like for custom-made devices or active
implantable device. So to get more detail you'll need to read the annexes.

Below I show you the route to take for each class. If you see Class I*, it correspond to the
products under class I with a specific feature.

Day 4 of the Mini-Course MDR 2017/745. It was hard yesterday no. The Route to market
graph confused you. But remember that you only have to look at the route dedicated to
your product classification.

I recommend looking at it again. After 1 night it can look easier.

Today we'll focus on some technical aspects that the manufacturers have to follow.

 Clinical
Evaluation
 Technical Documentation
 Post-Market Surveillance

On this course, you will see also some references to some podcast episodes. This is not
mandatory to listen but it is more for a deep dive on some subjects.

You're ready? so let's start!

 Clinical Evaluation (Chapter 6 of MDR)

Under the Medical Device Directive 93/42/EC the lower risk devices should have Clinical
Evaluation Reports (CERs) and for higher risk devices the manufacturer needed to
compile Clinical Data.

On MDR, the Clinical Evaluation should be conducted in accordance to Article 61 and

to Part A of Annex XIV.

In Annex XIV, part A of the EU MDR, the CER is still required. But in addition, a public
summary of safety and clinical performance (Article 32 of EU MDR) is now required for
certain category of devices.

To summarize, the manufacturer must

 Plan, conduct and document a clinical evaluation.

 Confirm conformity with general safety and performance requirements.

 Evaluate undesirable side-effects.

 Evaluate acceptability of the benefit-risk ratio.

A Clinical Evaluation shall include:

 Evaluation of scientific literature.

 Evaluation of clinical investigations.

 Consideration of available alternative treatment options.

The results of the clinical evaluation shall be documented in a Clinical Evaluation

Report (CER).

The clinical evaluation and its documentation shall be updated throughout the device life
cycle with clinical data obtained from Post-Market Clinical Follow-up and Post-Market
Surveillance.

Technical Documentation (Annex II and III of MDR)

This one is really new and will help a lot. Like the Pharmaceutical Regulation, now Medical
Device does also have a guidance on how to build their Technical Files.

The Support of IMDRF was great to build a guidance on the STED format. So more voluntary
than an obligation.
The EU MDR defines now the contents of Technical Documentation for each Medical Device
(Annex II) which is a compilation of all aspects of device design, manufacture, installation
and use applicable to the device.

Technical documentation is a full set of information not limited to the following (Annex II):

 Device description and specification.

 Reference to previous and similar generations of the device.

 Labels and Instructions for Use in official languages of the EU.

 Design and Manufacturing information.

 General Safety and Performance Requirements.

 Risk Analysis and Risk Management.

 Product Verification and Validation including Pre-clinical and clinical data.

 Information on post market surveillance activities (Annex III).

Technical documentation also includes post market surveillance elements (Annex III):

 Post-market surveillance plan.

 PSUR (Periodic Safety Update Report).

 Post Market Surveillance Report.

Archiving period
Withing MDD, the archiving period of the Technical file was 5 years after the manufacturing of
the last device. But for implants, it was 15 years.

With the new MDR, it's now 10 years. And for implants, we remain with 15 years.

Post-market Surveillance (Chapter VII and Annex III of MDR)

Post market surveillance encompasses all activities to proactively collect and review experience
gained from devices on the market.
This includes collection and utilization of information including:

 Serious and non-serious incidents.

 PSURs (Periodic Safety Update Reports).

 Field Safety Corrective Actions.

 Undesirable side-effects.

 Trend reporting.

 Specialist or technical literature, databases and/or registers.

 Feedback and complaints.

 Publicly available information about similar medical devices. (510k substantial

equivalence)

The results of post market surveillance are used as inputs to the device risk management life-
cycle:

 Benefit-risk determination.

 Design and manufacturing information.

 Clinical evaluation and clinical evaluation report.

 Preventive, corrective or field safety corrective action.

 Post market surveillance of other devices with similar risks.

 Detect trends.

Unique Device Identifier (UDI) (Article 28)

The EU MDR mandates the use of a Unique Device Identification (UDI)
system which will allow the identification and facilitate the traceability of devices

The UDI will consist of:

 Both Device Identifier (UDI-DI) and a Production Identifier (UDI-PI) elements.

o UDI-DI

 Primary Identifier of a device model.

  Provides link to UDI database.

 Referenced in relevant certificates and declaration of

conformity.

o UDI-PI

 Numeric or alphanumeric code that identifies the unit of

device production.

 Includes serial number, lot number, software identification

and manufacturing or expiry date or both types of date.

 Application of the UDI on the label of the device or on its packaging;

 Recording of the UDI by economic operators, health institutions and healthcare

professionals.

 Establishment of an electronic system for Unique Device Identification (‘UDI

database’).

The UDI data will be registered on the EUDAMED database.