WHITEPAPER

Gearing up for
EU IVDR:
A WHITEPAPER
 INTRODUCTION

htps:/ohsonli e.com/articles/20 /0721/oshas-top-10violations-for2019.aspx

In this whitepaper, we present a deep dive into the European Commission's (EC) In
Vitro Diagnostic Regulation (EU IVDR 2017/746) ‘legislative framework.’ Specifically,
the paper covers the following topics:

1. An overview of the new framework

2. The role of EQMS in meeting the regulatory requirement
3. IVDR’s risk-based approach and new product classification
4. The role of audits and inspections
5. How will this affect the supply chain?

Overall, enterprises that are preparing for this new framework will require a dedicated
team of experts, owing to the complexity of this regulation. Through this paper, we
review the finer details of EU IVDR to help manufacturers and economic operators
start their preparations and design relevant systems and processes ahead of time. We
believe, implementing a robust QMS which truly connects people, processes and
systems will be the key to meeting EU IVDR requirements.

The European Commission's (EC) In Vitro Diagnostic Regulation (EU IVDR 2017/746),
being effective from 26 May 2022, is a ‘legislative framework’ replacing the previous
IVD directive that existed, was originally developed to address the global need for
safe, reliable, and effective IVDs in the market. IVDR being exhaustive and transparent,
brings regulatory changes and requirements to improve safety and efficacy of IVDs
for economic operators and non-EU manufacturers with commercial operations in the
European Economic Area (EEA). All stakeholders in the process shall now be equally
responsible for the European Economic Area in-vitro diagnostics market starting from
research, design and development to technology transfer, commercialization to post
market surveillance activities. Hence, a much larger number of manufacturers will
now require auditing and certification with a notified body versus the traditional
method of “self-certification,” and at the same time, they have to ensure that the
technical documentation and quality management system meets the new require-
ments of various articles and annexes of IVDR.

This whitepaper aims to facilitate manufacturers to understand, review and prepare

for necessary audits, technical documentation, certifications, device classification,
QMS, etc. required by the various articles and annexes under IVDR.

2
 THEN AND NOW:
Unlike IVDD which is a directive, IVDR is a legislation
applicable to all Economic Operators (EO) -
manufacturers, importers, users, notified bodies and
national authorities. EU IVDR is more stringent than the
IVDD because the in vitro medical device industry has
evolved a lot. The present need of the healthcare system
is for IVDs placed in the market to be completely safe
and error free in terms of diagnosis or outcomes.
IVDD IVDR
98/79/EC 2017/746
24 Articles 113 Articles
(10 Chapters)
10 Annexes 15 Annexes
Directive Regulation
A QMS IS INDISPENSABLE:
Among the different requirements which an IVD
manufacturer must comply with, it is essential to have a
well-established, robust and reliable quality
management system (QMS) in place. Although this is
not a new requirement for organizations globally, the
general obligation of a manufacturer as detailed in
Article 10 of IVDR mandates a quality management
system to ensure that manufacturing, change control,
customer complaints, resource management, supplier
and sub-contractor controls and validation, performance
evaluation, quality test, UDI labelling, post market
surveillance etc. are according to the approved QMS and
Post-Market Surveillance (PMS) plans.
“Quality
management is
needed because
nothing is simple
anymore, if
indeed it ever
was”
- Philip “Phil” Crosby,
an author and management
consultant widely recognized for
promoting the concept of “zero
defects”.
Amidst increased regulation and complexities, a-pre-
validated cloud-based EQMS would put manufacturer(s)
at ease. This would also reap incredible long-term
benefits in meeting product expectations for the end
users or healthcare providers. According to W. Edwards
Deming, “Eighty-five percent of the reasons for failure
are deficiencies in the systems and process rather than
the employee. The role of management is to change the
process rather than badgering individuals to do better”.
An investment in a reliable cloud-based EQMS would
become an asset that helps the organization in
numerous ways as shown below.
3
 BENEFITS OF CLOUD BASED EQMS:

Improved Products Consistency Effective Risk Reduction

and Business Compliance

Innovate with an Reduce variability of Ensure quality stand- Provides visibility

adaptable quality
platform
Drive continuous
improvement and
business growth
Deliver exceptional
customer experiences
to build customer
loyalty
Leverage your data for
a factual approach to
decision making
Gain greater efficiency
by getting things right
the first time
materials, waste, and ards are being met between your quality
rework to cut time and processes, product
costs Experience total record, requirements,
traceability issues, and related
Keep quality processes processes
repeatable to increase Turn insights into
knowledgeable staff action Enables teams to
and reduce human easily confirm designs,
error Provide historical audit adjust plans, and
trails to speed resolve issues fast
Prevent delays by compliance
minimizing disruptions Quickly find the root
to stay on time and Become adaptable to cause and speed up
under budget changing or emerging resolution
market conditions and
Improve process to environmental and Predictive analysis of
control to reduce other government data reduces risk of
quality gaps regulations. probable quality failure
Reduce lead time and Limit damages to
increase production profits, reputation, and
yield existing relationships

Organizations currently planning to procure and

establish an EQMS to help meet IVDR should consider
the following six steps:

i Perform a gap assessment and decide the

specific priority to digitalize immediately.

ii Identify a reliable and credible vendor/partner

who can provide a modern cloud-based EQMS
system

iii Ensure the digital transformation is adaptable,

flexible and customizable to the business need

iv Procure only validated EQMS systems

conforming to 21 CFR Part 11, EU GDPR, GMP,
etc. (ask for credentials!)
v Ensure an easy to operate user interface “GUI”
for quick user adoption

vi Involve external SMEs / consultants and experts

during installation and implementation if
required

4

CLASSIFICATION & CONFORMITY
ROUTES:
IVDR focuses on a risk-based approach to classification
of devices requiring increased regulatory oversight. The
Regulation identifies four risk classes: Class A (lowest
risk), Class B, Class C, and Class D (highest risk) while
Annex VIII defines seven classification rules to correctly
classify the products.
IVDD IVDR
98/79/EC 2017/746
Self-Certified
Others Class A
Class A
(Sterile)
Increasing risk
Annex II List A
Class B
Annex II List B
Class C
Class D
A unique feature of the IVDR is that software is also
classified under Rule 1 of Annex VIII, which states
“Software, which drives a device or influences the use of
a device, shall fall within the same class as the device. If
the software is independent of any other device, it shall
be classified in its own right¹”. Thus, there is a scope for
software to be regulated under IVD.
Under IVDD, most of the IVDs are self-certified (93%)
and did not require the involvement of a Notified Body.
While under IVDR, the scenario is going to change
drastically. According to a study “The impact of the new
European IVD-classification rules on the notified body
involvement” by National Institute for Public Health and
the Environment, Bilthoven (Netherlands) RIVM Letter
report 2018-0082, A. van Drongelen et al., nearly 85% of
all IVDs will require Notified Body involvement, leaving
only 15% of IVDs eligible for self-certification². This is a
clear indication that In Vitro Diagnostics (IVDs)
¹REGULATION (EU) 2017/746 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 5 April 2017 on in vitro diagnostic medical devices and repealing Directive 98/79/EC and Commission
Decision 2010/227/EU; ANNEX VIII CLASSIFICATION RULES, 1.IMPLEMENTING RULES Point 1.4 Page 304
²The impact of the new European IVD-classification rules on the notified body involvement; : a study on the IVDs registered in the Netherlands; van Drongelen A, de Bruijn A, Pennings J, van der
Maaden T 32 p in English 2018, RIVM letter report 2018-0082
compliance with this new classification and certification
process. Further, depending on the intended use of the
device and risk class, manufacturers will need to identify
a designated Notified Body and choose the most
appropriate conformity assessment route to
demonstrate compliance with the Regulation. This will
help decide:
“self-certification” for Class A IVD when no
Notified Body would be involved in the
conformity assessment
auditing and CE certification by a Notified Body
and
the involvement of a Competent Authority (CA),
EU reference laboratories, or expert panels via
the European Commission or the Medical
Device Coordination Group (MDCG).
SUPPLY CHAIN MANAGEMENT:
Involves a
Notified
Body
IVD manufacturers depend on various suppliers to
produce and deliver products that are safe, accurate,
and effective for human use. Thus, regulatory and
quality concerns are also evolving when it comes to the
suppliers and sub-contractors. The regulators and
notified bodies are asking legal manufacturers to clearly
document their supplier controls and to demonstrate
with evidence that they have the potential to mitigate the
risk of the product or service provided by the supplier.
On the other hand, lack of supplier control can
immediately put manufacturers at risk of IVDR
noncompliance and in turn not getting products to
market. Therefore, manufacturers should gear up and
proactively communicate to the supply chain about the
following:
New product classification and its impact on
crucial suppliers and sub-contractors
Demonstrating adequate supplier control
throughout the supply chain
Monitor and assure the supply chain is in
compliance to the regulatory aspects of IVDR
Look at the current state of data integrity and
5
3
 and quality of supplier data
Implement robust supplier risk management
and performance monitoring
Periodically audit suppliers based on the
associated risk to the finished products
AUDITS AND INSPECTION:
According to Article 88 of IVDR, Market Surveillance
Activities, competent authorities shall carry out
(announced and unannounced) inspections on the
premises of economic operators, as well as suppliers
and/or sub-contractors, and, where necessary, at the
facilities of professional users. Manufacturers should
include information on identification of all sites,
including suppliers and sub-contractors, where
manufacturing activities are performed in the technical
documentation of design & manufacturing information.
Notified Bodies performing QMS audits shall assess the
QMS, identify links between and allocation of
responsibilities among, the various manufacturing sites,
and identify relevant suppliers and/or sub-contractors of
the manufacturer who may need auditing. Notified
Bodies are responsible to audit the control of processes
on the premises of the manufacturer's suppliers, when
the conformity of finished devices is significantly
influenced by the activity of suppliers, and in particular
when the manufacturer cannot demonstrate sufficient
control over its suppliers. Under post-certification
monitoring, the Notified Body shall make arrangements
for unannounced on-site audits of manufacturers and
sub-contractors or suppliers. They may carry out
product tests and review compliance of any conditions
binding manufacturers and associated parties with
certification decisions, such as updates to clinical data
at defined intervals.
GOOD TO KNOW:
Surveillance assessment
applicable to class C and
class D devices (Annex IX)
Notified Body shall periodically, at least once every 12
months, carry out appropriate audits and assess-
ments. It shall include audits on the premises of the
manufacturer and suppliers and/or subcontractors as
applicable
The notified body shall randomly perform at least
once every five years unannounced audits on the site
of the manufacturer and, where appropriate, the site of
the manufacturer's suppliers and/or subcontractors,
which may be combined with the periodic surveillance
assessment
6
 requirements to ensure their strategy is successful in
TRANSITION FROM DIRECTIVE TO the implementation of IVDR:
REGULATION:
1. Follow a life cycle based approach

The most important and immediate business decision 2. Prepare for stringent control and monitoring by
for an organization is to conclude if they want to Notified Body
continue to place their IVD in the European Economic 3. Comply with obligations for economic operator
Area (EEA). If the answer is ‘yes’, then they will need to in terms of well-established quality
allocate necessary resources including manpower. The management system (QMS)
organization needs to either identify a Notified Body who
4. Tightly manage and control Technical
has been designated under EU IVDR or contact their
documentation (Annex II)
previous Notified Body (if applicable) to check if they
have been designated and have the scope to audit the 5. Performance evaluation (scientific validity,
organization. Followed by obtaining estimates about the analytical performance and clinical evidence)
cost, time required, scope of audit, product code, etc., a will be vital
plan must be prepared accordingly to ensure that the 6. Utilize appropriate risk methodologies based on
whole transition (including the new certification) is product classification
completed before the expiry of their existing IVDD
7. Ensure your QMS includes a post-market
Certificate/Self-Declared Declaration of conformity.
performance follow up plan

The next step is to perform a gap assessment to check 8. Set up adequate control and monitoring of
the availability of your resources that are competent to supplier and sub-contractors processes
affecting the finished product
update the technical documentation required under EU
IVDR or engage a qualified external consultant from the 9. Review the revision of the supplier and EU
very early stage of the transition. It is advisable to Authorised Representative agreement (for
organize awareness training (online or onsite, as non-EU manufacturers) under IVDR
applicable) on EU IVDR so that everyone associated in 10. Prepare for EUDAMED and UDI (for labelling)
the organization is aware of the necessary changes.
Reconsider the new classification rule under Annex VIII 11. Develop a system for recording and reporting
incidents and any applicable Field Safety
and check if it has affected previous classifications.
Corrective Action - FSCA (Article 81-83)
Specifically, the quality and regulatory team, along with
an approval from the top management in the 12. Any Class D products would require an EU
organization, has to decide on the conformity reference Lab to verify any performance claims
assessment route (Annex IX, X, XI of EU IVDR³) that will 13. Review and act upon the Confidentiality and
be followed by your organization and initiate the Data Protection Articles 102 to106
technical documentation. Simultaneously, the
organization should also communicate the whole
process to all the suppliers, sub-contractors, or service
providers and their obligations. Having an EQMS or
getting one installed will be of immense automating the
various quality areas and easily show auditors the
process and data quality and integrity.

Initially, manufacturers should start with below

³ REGULATION (EU) 2017/746 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 5 April 2017 on in vitro diagnostic medical devices and repealing Directive 98/79/EC and Commission
Decision 2010/227/EU
ANNEX IX Conformity Assessment Based On A Quality Management System And On Assessment Of Technical Documentation, Page 306
ANNEX X Conformity Assessment Based On Type-Examination, Page 314
ANNEX XI Conformity Assessment Based On Production Quality Assurance, Page 317

7
 CONCLUSION:

The transition to IVDR will require a dedicated
competent team owing to the robustness and
complexity of the new regulation. Organizations
preparing for CE Certification under the new IVDR
should be ready to face new challenges since the
requirements are substantially different and exhaustive.
Manufacturers and economic operators must
demonstrate and implement robust preparation with
respect to quality management system, audit
preparation, technical documentation, risk-based
methodologies based on device classification,
conformity assessment, traceability, process validation,
manufacturing records, test certificates, customer
handling, vigilance and post-market performance
follow-up, UDI, supplier agreements, supplier
evaluations, etc. The impact to an organization could be
huge and have a great impact to the company and its
products. Hence, manufacturers and economic
operators should not underestimate the commercial and
technical transition activities. For the best successful
outcome, manufacturers including other EO’s
(Importers, Authorized Representatives, Distributors)
must work closely and cooperate with the Notified
Bodies, suppliers and sub-contractors the European
Commission, and Competent Authorities to ensure the
legislative framework is successfully adopted and safe
products are continually available to the patients in
need.

ADDITIONAL RESOURCES:
Practical checklists from CQ quality experts:
IVDR Preparedness Assessment
IVDD to IVDR - Strategic Planning & Assessment
Internal Audit Toolkit Part 1
Internal Audit Toolkit Part 2
Post Pandemic Industry Practices for Life Science & Pharmaceuticals Manufacturing
"Records" to be Maintained for an ISO 13485 Certified Device Manufacturer

About ComplianceQuest
ComplianceQuest is the fastest growing, 100% modern cloud Next Generation Enterprise Quality and Safety Management
System (QHSE) natively built and run on the Salesforce platform. Our unified Next Generation QHSE solutions help our
customers of all sizes deliver quality products and services in the safest, most sustainable way by mitigating risk, problems,
and inefficiencies while protecting customers, employees, suppliers and brand.

For more information, or to request a demo with a ComplianceQuest expert, contact ComplianceQuest today.

marketing@compliancequest.com • Call us at 408-458-8343

© ComplianceQuest, Inc. 2021