Important changes are happening in the regulation of digital health and medical devices in the EU.

The current system (MDD) will remain open for registration until September 2020, but then all European countries will move to the new regulations (MDR) from May 2021.

In April 2020, AusIndustry’s Entrepreneurs’ Programme, in partnership with ANDHealth, ran an information session to help SMEs understand what they need to do to comply with upcoming changes to the EU medical device regulations, and what the changes will mean to their device and software businesses in the EU.

The workshop was presented by Paul Clark, who has more than 25 years’ experience in the international medtech industry. We caught up with him to summarise his thoughts on the topic.

We needed two half days to provide an overview, so this interview is not going to be enough! But to begin, why are these regulatory changes being made?

The changes address a number of perceived deficiencies in the regulation of medical devices in the EU. The existing medical devices directive (MDD) was implemented way back in 1993 and was seen to be outdated with today’s technology and ways of thinking. The EU wanted to implement more of a life-cycle approach to regulation, including greater emphasis on risk management, clinical evidence and post-market surveillance. This, combined with a number of high-profile issues in the early 2000s, such as the PIP breast implant and surgical mesh scandals and hip implant problems, led to the change to the MDR.

What are your top three high-level tips for digital health companies preparing for the MDR?

Absolutely key are your intended use claims, indications for use and intended purpose. That should be your starting point. They are essential to determining your classification, the quality and amount of evidence required, and the product benefits you can market.

Secondly, clinical data must be available to demonstrate your claims. Plan these well – you will need data to show that your product works correctly in your intended use cases for your intended use by your intended users.

Then, once your device is in market, post-market clinical evaluation is also expected. So plan for it!

What are these changes to software classification in the EU under the MDR that we are hearing about?

The changes are captured in Rule 11, which covers software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes. In the MDR it is classified as lla. But if those decisions have an impact that could result in death or an irreversible deterioration of health, it is in class III. And if it leads to serious deterioration of health, or a surgical intervention, it is in class IIb.

Software intended to monitor physiological processes is classified as class IIa, except if it is intended for monitoring of vital physiological parameters which could result in immediate danger to the patient, in which case it is classified as class IIb. All other software is in class I.

This applies to software which is a medical device (SaMD). What is a medical device, according to the MDR?

A medical device is defined as any instrument, apparatus, software, etc. intended by the manufacturer to be used for one of the following purposes:

  • diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease
  • diagnosis, monitoring, treatment, alleviation of, or compensation for, an injury or disability
  • investigation, replacement or modification of the anatomy or of a physiological or pathological process or state
  • providing information by means of in vitro examination of specimens derived from the human body, including organ, blood and tissue donations

So, because almost any software used for the purpose of diagnosis, monitoring, prediction, prognosis or treatment also provides information which is used to take decisions with diagnosis or therapeutic purposes, you can see why many software-only products will now move from Class I to Class IIa or higher under the new rules.

Companies might say "But I want to be a class I...!"

They might, but there are now only a small number of purposes which justify a class I classification. The first is prevention, such as a cardio training app offering workout recommendations. The second is monitoring, if it’s not used for diagnosis or if there’s no vital threat. One example of that could be an app intended to help fertility into which you enter basal temperature and cycle information and it gives a “traffic light” indication of fertility. The third purpose is prognosis not intended for decision-making. And the fourth is alleviation, such as a biofeedback system not considered as therapy.

OK, so an existing product might no longer be class I. What does that mean at a high level? What are the next actions for companies to take?

As soon as software is no longer classified as class I, manufacturers must involve notified bodies, and in general, establish a certified quality management system.

What else has changed?

Lots! As you can see, there is increased scope and definition of medical devices, also including devices with no medical purpose and those which offer prediction or prognosis.

There will be much tougher requirements for clinical evaluation. Higher-risk devices will require more clinical data, and it will be much harder to use equivalent devices for clinical evaluation. All safety and performance data will have to be published.

Importantly, there will also be an increased emphasis on post-market data. Companies will have to meet tougher requirements for post-market surveillance and submit vigilance reports to the EUDOMED database. There will also be trend reporting, and changes to timeframes for reporting.

Traceability is important, too, under the MDR. All devices and economic operators will have to be registered with EUCOMED, and all devices will need a Unique Device Identification (UDI), as well as comply with new labelling requirements.

The roles and responsibilities don’t just apply to the economic operators of devices. They also apply to their manufacturers, authorised representatives, importers and distributors.

There’s a shift to a life-cycle approach when considering medical devices, which takes into account pre-market, post-market surveillance, ongoing clinical evaluation and post-market clinical follow-up, and ongoing evaluation and registration of products. Companies also have less ability to claim equivalence when seeking approval.

Life will also be different for the notified bodies responsible for assessing medical devices. They will all need to be re-accredited to work with the new regulations. They will be subject to joint and unannounced audits. All of this will increase their costs – which will likely in turn be passed back to manufacturers.

These are big changes. What if I just say that I won’t bother with Europe?

Going into the European market is an individual business decision, but Europe is potentially a large market, depending on your product. Fear of regulation should not stop a business; regulation is something to consider alongside your other business risks. Importantly CE marking of your product opens the doors for entry into other markets in the world, including Australia.

What do I do now?

I’ve made this flow chart, and I encourage companies to get professional help. But I would also strongly encourage companies to put the effort into genuinely understanding the new regulations.