Featured
Rimsys Announces Rimsys AI to Eliminate Repetitive Tasks and Enhance Decision-Making for MedTech Regulatory Teams
Rimsys, the leading Regulatory Information Management (RIM) platform for the MedTech industry, today announced the launch of Rimsys AI, a suite of embedded artificial intelligence (AI) agents.
The beginner's guide to the FDA De Novo classification process
This article is an excerpt from The beginner's guide to the FDA De Novo classification process ebook.
Contents
- Introduction
- Chapter 1: What is an FDA De Novo request?
- Chapter 2: Contents of a De Novo request
- Chapter 3: Submitting a De Novo request
- Appendix A: Acceptance review checklist
Congratulations, you have successfully developed a new medical device! Now you need to take it to market. Normally in the United States this would mean completing a 510(k) submission. However, the 510(k) relies on “substantial equivalence”—a comparison to a similar device already on the market (also called a predicate device) to assess the risk profile of the new device. What if your device is totally new, and there isn’t a similar device to compare it to? Enter the FDA De Novo process. The De Novo process provides a pathway to market for novel devices with a low to medium risk profile.
What does De Novo mean?
According to the Merriman-Webster dictionary, de novo is a Latin word meaning “as if for the first time; or anew.” Perfectly fitting that the FDA uses this term “De Novo” to describe market approval requests for new medical devices or technology where there is no comparable predicate device on the market.
The Food and Drug Administration Modernization Act of 1996 provided the FDA with the authority to create the De Novo Classification Process. It's a process that uses a risk-based strategy for a new, novel kind of medical device, in vitro diagnostic, or medical software solution whose type has previously not been identified and/or classified. It’s a process by which a novel medical device can be classified as a Class I or Class II device, instead of being automatically classified as Class III, which may not be appropriate. Before the implementation of the De Novo process in 1997, all the “not substantially equivalent” (NSE) products were required to be initially classified as a Class III device. But for a lot of devices, this risk class didn’t really make sense. The De Novo process provides a pathway for more accurate classifications of novel, lower-risk devices.
October, 2021, the FDA released a final guidance document "De Novo Classification Process (Evaluation of Automatic Class III Designation)" to provide guidance to the requester (also known as the manufacturer) and the FDA on the process for the submission and review of a De Novo Classification Request under section 513(f)(2) of the Federal Food, Drug, and Cosmetic Act (the FD&C Act). This process provides a pathway to an initial Class I or Class II risk classification for medical devices for which general controls or general and special controls, provide a reasonable assurance of safety and effectiveness, but for which there is no legally marketed predicate device. This guidance document replaced the "New Section 513(f)(2) – Evaluation of Automatic Class III Designation, Guidance for Industry and CDRH Staff" document, dated February 19, 1998.
Consistent with the final rule, the FDA updated the guidance documents below to provide recommendations for submitting De Novo requests, as well as criteria and procedures for accepting, withdrawing, reviewing, and making decisions on De Novo requests, effective January 3, 2022.
- User Fees and Refunds for De Novo Classification Requests
- FDA and Industry Actions on De Novo Classification Requests: Effect on FDA Review clock and Goals
- Acceptance Review for De Novo Classification Requests
The 510(k) and the De Novo processes are similar in that they are both pathways to market for medical devices with low to moderate risk, which is Class I and Class II. The biggest difference between the two is that the 510(k) heavily relies on the concept of "substantial equivalence" to an existing medical device. You must prove this to get the clearance of your 510(k) submission. In the De Novo process, there isn’t a product currently on the market that is “substantially equivalent” to yours, so it’s like starting with a clean slate. For more on the 510(k) process, see our Beginner’s Guide to the 510(k) ebook.
A result of the De Novo process to be aware of is that a successful submission will lead to a new predicate device type that someone else can reference to bring their product to market through the 510(k) process. You’ve done all the work, so now it’s available for anyone to use to provide "substantial equivalence".
De Novo history/timeline
Preparing a De Novo request
1. Do your research! Be sure to complete all the necessary research prior to your submission. You want to be sure that your device is not substantially equivalent to an existing device. Resources to review include:
- The Center for Devices and Radiological Health (CDRH)
- U.S. FDA Device Classification Database
- Device Classification Under Section 513(f)(2)(De Novo)
2. A De Novo request can be submitted with or without a preceding 510(k). There are two options for when you can submit a De Novo request:
Option A: After receiving a not substantially equivalent (NSE) determination (that is, no predicate, new intended use, or different technological characteristics that raise different questions of safety and effectiveness) in response to a 510(k) submission.
Option B: If you’ve determined, after extensive research, that there is no legally marketed device on which to base a determination of substantial equivalence.
3. Be sure all fees are paid to the FDA in advance of submitting a De Novo request. The FDA’s fiscal year begins in October and runs through the following September. Fees have increased each year since they were introduced, but the FDA’s percentage of reviews completed within the 150-day window has increased as well.
A business that is qualified and certified as a “small business” is eligible for a substantial reduction in most of the FDA user fees, including De Novo. The CDRH is responsible for the Small Business Program that determines whether a business is qualified.
Medical Device User Fee Amendments (MDUFA) guidance documents can provide more detailed information about all FDA user fees.
4. The initial request process serves only to determine if the De Novo request is administratively acceptable based upon the Acceptance Checklist. The initial acceptance is followed by substantive review which will determine the final risk classification of your device.
5. A Pre-Submission (Pre-Sub) is a formal written request for feedback from the FDA that is provided in formal written form, and then followed by a meeting. Although a Pre-Sub is not required prior to a De Novo request, it can be extremely helpful to receive early feedback, especially for devices that have not previously been reviewed under a 510(k). If you think you would like to submit a pre-sub first, there are suggested guidelines for submission you should consider:
- Describe your rationale for a Class I or Class II classification for your device.
- Provide the search results of FDA public databases and other resources used to determine that no legally marketed device and no classification for the same device type exists.
- Provide a list of regulations and/or product codes that may be relevant.
- Provide a rationale for why the subject device does not fit within and/or is different from any identified classification regulations, based on available information.
- Identify each health risk associated with the device and the reason for each risk.
- Briefly describe any ongoing and/or planned protocols/studies that need to be completed in order to collect the necessary data to establish the device’s risk profile.
- Provide information regarding the safety and effectiveness of the device. Cite the types of valid scientific evidence you anticipate providing in your De Novo request, including types of data/studies relating to the device’s safety and effectiveness.
- Briefly describe any ongoing and/or planned protocols/studies that need to be completed to collect the necessary safety and effectiveness data.
- Provide protocols for non-clinical and clinical studies (if applicable), including how they will address the risks you anticipate and targeted performance levels that will demonstrate that general controls or general and special controls are sufficient to provide reasonable assurance of safety and effectiveness.
- Share any proposed mitigation measure(s)/control(s) for each risk, based on the best available information at the time of the submission. Highlight which mitigations are general controls and which are special controls and provide details on each.
- Include any other risks that may be applicable, in addition to those identified in the Pre-Sub, given the indications for use for the device.
- If applicable, provide any controls that should be considered to provide a reasonable assurance of safety and effectiveness for the device.
- Provide any non-clinical study protocols that are sufficient to allow the collection of data from which conclusions about device safety and/or effectiveness can be drawn. These protocols should address whether the identified level of concern is the appropriate level of concern for the device software, and if any additional biocompatibility and/or sterility testing is required.
- If clinical data is needed, provide information to show that the proposed study design and selected control groups are appropriate?
6. The FDA will attempt to review the De Novo request submission within 15 calendar days of receipt of the request to make a determination that the submission is declined or accepted for review. If they are unable to complete the review within the 15 days, your submission will automatically move to “accepted for review” status. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/de-novo-classification-process-evaluation-automatic-class-iii-designation
7. There are times when the FDA will refund your application fee. They have created a guidance document “User Fees and Refunds for De Novo Classification Requests” for the purpose of identifying:
- the types of De Novo requests subject to user fees
- exceptions to user fees
- the actions that may result in refunds of user fees that have been paid
When is a De Novo request subject to a user fee?
When will the FDA refund a De Novo user fee?
What fee must be paid for a new device submission following a De Novo “decline” determination?
To continue reading this eBook including a detailed walk-through of all the Traditional 510(k) components, submission requirements and timelines, and an overview of the other 510(k) forms including the Abbreviated 510(k) and the Special 510(k), please register to download the full version.
The ultimate guide to the medical device single audit program (MDSAP)
This article is an excerpt from The ultimate guide to the medical device single audit program (MDSAP) ebook.
Table of contents
- What is MDSAP?
- History of MDSAP
- Who is responsible for the MDSAP?
- How does an MDSAP audit work?
- Audit sequence
- You got a nonconformity – now what?
- What does an MDSAP audit cost?
- Why choose the MDSAP certification process?
- Potential disadvantages of the MDSAP
- Ready to participate? – Here’s how to get started
- Completing a successful MDSAP audit
The Medical Device Single Audit Program (MDSAP) was designed and developed to allow a single audit of a medical device manufacturer to be applied to all country markets whose regulatory authorities are members of the program. The MDSAP provides efficient and thorough coverage of the standard requirements for medical device manufacturer quality management systems, and requirements for regulatory purposes (ISO 13485:2016). In addition, there are specific requirements of each medical device regulatory authority participating in the MDSAP that must be met:
- Conformity Assessment Procedures of the Australian Therapeutic Goods (Medical Devices) Regulations (TG(MD)R Sch3)
- Brazilian Good Manufacturing Practices (RDC ANVISA 16)
- Medical Device Regulations of Health Canada (ISO 13485:2003)
- Japan Ordinance on Standards for Manufacturing Control and Quality Control of Medical Devices and In Vitro Diagnostic Reagents (MHLW Ministerial Ordinance No 169)
- Quality System Regulation (21 CFR Part 820), and specific requirements of medical device regulatory authorities participating in the MDSAP program.
This means that a report from a single MDSAP audit of a medical device manufacturer would be accepted as a substitute for routine inspections by all the member Regulatory Authorities (RAs) across the world. There are currently five participating Regulatory Authorities (RA) representing the following countries: Australia, Brazil, Canada, Japan and the USA.
In April, 2021, the RAs released an “Audit Approach” document (MDSAP AU P0002.006) that combines the formerly separate MDSAP Audit Model and Process Companion documents into a single guidance document. It includes guidance for assessing the conformity of each process and includes an audit sequence, instructions for auditing each specific process, and identifies links that highlight the interactions between the processes.
In March 2012 the US FDA announced that they had approved a final pilot guidance document “Guidance for Industry, Third Parties and Food and Drug Administration Staff: Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program.” This allowed the owner or operator of a medical device manufacturing facility to be removed from FDA’s routine inspection work plan for 1 year upon completing a ISO 13485:2003 audit. This guidance document went into effect in June 2012, and was intended as an interim measure while a single audit program was being developed.
This pilot program was not very successful and few companies signed up because they did not see any advantage in participating. The manufacturer had to pay for a third party to inspect their facilities, generate a report, and share the inspection results back to the FDA. Many companies were reluctant to contract “someone else” to perform their inspection when they could easily wait for the FDA to conduct an inspection for free.
During its inaugural meeting in Singapore in 2012, the International Medical Device Regulators Forum (IMDRF) appointed a working group to develop a set of documents for a harmonized third-party auditor system. Hence, the “Medical Device Single Audit Program” (MDSAP) was formed. The concept was similar to the FDA’s original idea of creating a third-party auditor to help reduce their workload of performing regulatory audits of medical device manufacturers’ quality management systems. This new approach would consist of a single audit that would review regulatory QMS compliance, conducted by a third-party, who would later be called an Auditing Organization (AO).
From January 2014 to December 2016, five countries participated in a Medical Device Single Audit Program Pilot. In June 2017, a report was generated summarizing the outcomes of prospective “proof- of-concept” criteria established to confirm the success of the program. The outcomes are documented in the final MDSAP Pilot Report and recommended that the program become fully active and open to any manufacturer who requested this type of audit.
The governing body of the MDSAP is the Regulatory Authority Council (RAC), which is composed of two senior managers (and a few other staff members) from each participating RA. They are responsible for executive planning, strategic priorities, setting policy, and making decisions on behalf of the MDSAP International Consortium. The RAC also reviews and approves documents, procedures, work instructions, and more. The mission of the MDSAP International Consortium is to jointly leverage regulatory resources to manage an efficient, effective, and sustainable single audit program focused on the oversight of medical device manufacturers on a global scale.
Other international partners that are involved in the MDSAP include:
MDSAP Observers:
- European Union (EU)
- United Kingdom’s Medicines and Healthcare products Regulatory Agency (MHRA)
- The World Health Organization (WHO) Prequalification of In Vitro Diagnostics (IVDs) Program
MDSAP Affiliate Members:
- Argentina’s National Administration of Drugs, Foods and Medical Devices (ANMAT)
- Republic of Korea’s Ministry of Food and Drug Safety
- Singapore’s Health Sciences Authority (HSA)
The observers and affiliate members are not the same as the participating member RA’s. The observers simply observe and/or contribute to RAC activities. Affiliate members, on the other hand, are interested in engaging in the MDSAP program and are subject to certain rules. They are only given access to a certain level of information about the manufacturers, audit dates, and information in audit reports.
They are also invited to attend sessions that are open to members, observers, and affiliates only.
Audits can also be conducted by MDSAP participating RAs at any time and for various reasons including:
- "For Cause" due to information obtained by the regulatory authority
- as a follow up to findings from a previous audit
- to confirm the effective implementation of the MDSAP requirements
The purpose of audits conducted by the RAs is to ensure appropriate oversight of the AOs MDSAP auditing activities. The AOs are appointed by the RAs and a list of the currently approved AO’s is published on the FDA website. Most AOs offer a broad range of management system certification services, beyond just medical devices. Manufacturers should verify that prospective AOs are clearly trained and perform MDSAP audits of medical devices.
AOs have the final word as to whether a manufacturer has met the requirements for the MDSAP during the execution of the audit and generation of the associated reports summarizing the results. MSDAP RAC participating RAs have the final decision regarding all development, implementation, maintenance, and expansion activities associated with the program.
Although an unannounced visit by an AO is rare, it can happen in circumstances where high-grade nonconformities have been detected.
To continue reading this eBook including a detailed look at the MDSAP audit process and grading, pros and cons of the approach, and how to get started please register to download the full version.
%2520(1755%2520x%2520550%2520px)%2520(855%2520x%2520268%2520px).avif)
Why a RIM System is Critical to Successfully Support MedTech M&A Activities
There was significant M&A activity in the MedTech sector in 2024, and the industry is predicting another big year for mergers and acquisitions. As MedTech companies aim to expand their product lines, enter new markets, innovate faster, and remain competitive in a rapidly evolving space, mergers and acquisitions can be attractive and cost-efficient options. Additionally, some manufacturers are choosing to divest parts of their business to hone their focus, drive additional investment in other key areas, and optimize operations.
For the regulatory affairs professional, M&A activities can be anything but efficient. An influx of new products, registrations, and regulatory information to maintain can wreak havoc on RA teams who are already struggling to effectively manage and maintain compliance amid a seemingly constant state of regulatory change.
In an increasingly complex regulatory landscape, many MedTech teams are turning to RIM systems to help them centralize regulatory information across the business, automate time-consuming, manual processes, and strengthen global compliance. These benefits are even more palpable for companies undergoing mergers, acquisitions, and divestitures, giving them streamlined, fully visible regulatory information management that can scale with their evolving business needs and additional regulatory information to manage.
Case Study: Large, Publicly Traded Device Manufacturer Navigates Product Line Divestiture with Ease
A large, publicly traded manufacturer of products for pain management, digestive health, and IV therapy was in the process of divesting one of its product lines to another company. As a result, some of their regulatory employees were transitioned to the company that purchased its product line. The customer leveraged Rimsys’ unique Linked Accounts feature, which allows users to grant external stakeholders controlled access to Rimsys, to give those impacted access to the 100+ registrations associated with the divested products. As a result, the transitioned employees lost no access to their respective products and are able to manage, review, and approve those registrations as they normally would.
“Linked Accounts is a fantastic feature that I didn’t originally appreciate as much. Rimsys made it easy for us to identify the products impacted by the divestiture and provide access to those who need them. It has been a bright spot in the sea of headaches both teams are experiencing when trying to review and approve information in other systems.”
-Program Manager, Regulatory Information Management
When the transaction is complete, the customer will easily be able to export the list of registrations by product tag and archive the registrations in Rimsys for easy management and visibility. The transitioned employees will also still retain access to the information they need in Rimsys as they work to implement their own Rimsys solution to manage those registrations.
Navigating Business and Regulatory Changes with RIM Systems
As the MedTech industry prepares for additional mergers, acquisitions, and divestitures this year, getting a solid regulatory information foundation in place is critical for a successful transition and ongoing compliance. Yet, many MedTech RA teams are using manual processes and siloed systems to manage regulatory information.
One of Rimsys’ goals is to serve as a strategic partner to MedTech RA teams, helping them better understand their current RIM state and the steps they need to advance their processes. This includes the implementation of a RIM system such as Rimsys to centralize their regulatory information, enable easy collaboration with internal and external stakeholders, and automate time-consuming manual processes for strengthened global compliance.
See our Guide to MedTech RIM Maturity, which provides our RIM Maturity Model Framework, for ways to better assess your organization’s current RIM state and incrementally reach new milestones.
Rimsys has helped global MedTech leaders navigate business and regulatory change with unified RIM software that provides full visibility into their regulatory activities. If you’re looking to stay ahead of upcoming strategic activities or are simply looking for a better way to manage your information amid increasing complexity, contact us to learn how Rimsys can help you streamline and automate your processes for long-term success.
Rimsys POV: Updated EUDAMED timeline
The EU Commission has recently announced updates for completing and implementing EUDAMED based on amendment 2024/1860. This article outlines the current EUDAMED timelines and our point of view on these timelines to help industry prepare accordingly.
Current EUDAMED Timelines:
- The target date for the first mandatory application of functional EUDAMED modules is still January 1, 2026. The Vigilance module is expected to be mandatory beginning in Q3 2026 with full EUDAMED functionality planned for Q2 2027.
- The Actor, UDI & Devices, Certificates, and Market Surveillance modules are currently under audit. The independent Minimum Viable Product (MVP) audit is intended to assess and confirm functionality and interconnectivity of the modules that are deemed audit ready. This audit is foreseen to be completed by Q2 2025.
- Mandatory use of each module is to commence six (6) months after the module is declared fully functional through the independent audit and publication in the Official Journal of the European Union (OJEU). The Actor, UDI & Devices, Certificates, and Market Surveillance modules are expected to be declared fully functional at the end of Q2 2025, leading to their mandatory application date of January 1, 2026.
- The Actor, UDI & Devices, Certificates, and Market Surveillance modules are expected to be declared fully functional by the end of Q2 2025 and mandatory for industry use on January 1, 2026.
- The Vigilance module is not part of the ongoing MVP audit and will not be declared fully functional along with the previously mentioned modules. The revised timeline indicates that the audit of that module will occur between Q2 and Q3 of 2025, with the goal of the mandatory application date in Q2 of 2026.
- The development of the Clinical Investigation/Performance Studies (“CI/PS”) module is intended to continue through Q3 2026. An audit to assess the CI/PS module together with the other five (5) modules will be completed once the CI/PS MVP has been developed.
Photo courtesy of the European Commission
Here is how Rimsys views the impact of this announcement for each stakeholder group:
Rimsys
UDI is front of mind as well as future interaction with the Vigilance module. There is no change to our current plans, as Rimsys will continue to develop UDI and Post Market Surveillance functionality regardless of the updated target dates. We also recognize the potential impact of establishing data transfer (DTX) capabilities to interact with EUDAMED in a machine-to-machine (M2M) capacity. With the publication of the final requirements needed for M2M DTX to EUDAMED, Rimsys is positioned to finalize our connection and deliver M2M capabilities as part of the EUDAMED solution.
Industry/customer
Since the European Commission(EC) has made multiple updates to EUDAMED timelines, we expect industry will have some reluctance to accept the new target dates. As a result, this could delay re-engagement with EUDAMED preparations. However, we do not expect the EC to push these updated timelines. Manufacturers that don’t have a plan to submit data to EUDAMED by Q2 this year should expect significant challenges to meet these deadlines. With the audit of expected modules underway with the associated technical documentation published, Rimsys recommends taking steps to organize regulatory data now and submit their information early to all available EUDAMED modules.
EU Commission
The EC strongly recommends industry continues to establish its solution and to submit data on a voluntary basis. Do not wait. The commission’s position is that submitting data early will give companies an advantage by having their data “in” before the onslaught of the entire global MedTech industry, all trying to add data at the same time EUDAMED becomes mandatory. These companies will also be in front of the line to work with the commission resources if data submission issues occur.
* Note - this article includes regulatory interpretations and opinions from the Rimsys team. We try to be as informative as possible, but this information isn’t intended to serve as a substitute for official guidance from regulatory authorities.
%2520(1).avif)
Using EUDAMED as the Foundation for a Global UDI Strategy
If your company is selling medical devices in the European Union, you’re likely thinking about EUDAMED. If you’re not, it's time to start. Come January 2026, medical device manufacturers will be required to submit their UDI data to EUDAMED. EUDAMED’s data requirements and interconnectivity are complex. Not only is it easy to underestimate the time it will take to organize and verify UDI data, but many manufacturers are still using manual processes such as spreadsheets or internally built systems to manage this information. And with a number of organizations treating UDI data management and submission as an IT or supply chain process, some RA teams don’t even know where their UDI data is.
Getting your UDI data EUDAMED ready for submission by January 2026 is going to take some time, but there is a tremendous opportunity amidst the extensive preparation. With a little bit of foresight, RA teams can position the data output of their EUDAMED compliance project as the foundation for a global UDI program. Here are some reasons why using EUDAMED as the primary building block for a global UDI strategy will enable long-term success:
The product data needed for EUDAMED can be applied to current and future global UDI requirements
With many required data attributes and Basic UDI family groupings, establishing EUDAMED compliance for UDI is going to take some careful planning, detailed organization of current data, and careful consideration of your regulatory strategy for the European market. Many manufacturers need to start with the basics: locating current UDI data to understand how it is currently managed and transmitted to the respective regulatory bodies. This process is also going to require an assessment of your UDI data. Do you have information populated for all of the required attributes?Is this information current and accurate? Finding answers to these questions is going to take thoughtful collaboration among all stakeholders, but it’s also going to set your organization up with a solid data foundation that will help you meet additional market requirements.
It’s going to require an audit of your people, processes, and systems
Industry is focused on establishing UDI data in EUDAMED to align with current requirements for timing but transmitting your UDI interaction with EUDAMED is not a one-time process as it may be currently treated for other regulators. New devices, device changes, UDI data updates, and commercial availability may require EUDAMED updates or establishing new UDI profiles altogether. Are your current processes able to support you long-term? Manual processes are going to make it nearly impossible to keep pace and compliance, and internally built systems are going to require regular validation and subject matter expertise to keep up with evolving requirements and EUDAMED version updates. Taking the time to make sure you have the proper expertise and systems to maintain EUDAMED compliance will more easily allow you to scale your UDI management as your business grows and the regulatory landscape evolves.
The risks of non-compliance are too steep to ignore
Those who fail to submit UDI data to EUDAMED in line with the required timelines are at risk of audit findings, financial penalties, product delays, and worst of all, having to remove products from the market. Not only does product removal have lasting productivity, competitive, and economic impacts on the manufacturer, but it also decreases the availability of life-changing medical devices to end users. These risks are simply too significant to ignore and necessitate a comprehensive global compliance strategy that can meet the needs for EUDAMED and additional countries as global regulations change.
Additional regulators are establishing UDI requirements and big data technologies
As the value of UDI is recognized, More global markets are adopting UDI requirements to enhance the traceability of their devices and improve patient safety. For instance, Australia has established UDI requirements with mandatory compliance for data submission expected in the summer of 2025. Additionally, Rimsys expects the competent authorities from Switzerland and the United Kingdom to adopt their own UDI requirements following their exit from the European Union. Even though each regulator has varying requirements to some degree, organizing product data to meet EUDAMED’s robust set of data attributes and requirements will put you in a position to more easily meet additional global UDI requirements.
How Rimsys supports a global UDI strategy
Both the regulatory and technology requirements for UDI continue to grow in complexity. Rimsys has an integrated, automated UDI solution that provides medical device manufacturers the ability to manage their UDI data alongside their regulatory activities for total visibility and control.
Not only does Rimsys have the expertise necessary to help MedTech manufacturers navigate UDI data and transmission to EUDAMED for January 2026, but we're also dedicated to supporting MedTech companies with solutions and strategies that go beyond EUDAMED compliance to support a scalable and efficient global UDI program to meet the needs of evolving regulatory requirements. Rimsys provides MedTech manufacturers with a single-sourced UDI solution that allows them to manage their UDI data and status alongside regulatory activities.
Our novel Universal UDI® approach centrally stores common data attributes across global markets for simple management, reduced compliance risk, and increased efficiency. Using data established in Rimsys for EUDAMED as a baseline, we’re enabling MedTech companies to more easily meet additional global UDI requirements in a unified RIM solution that applies these common attributes between various market requirements (with more coming soon!):
Ready to increase your team’s efficiency and compliance with integrated and automated UDI management to support your long-term goals? Request a custom Rimsys UDI demo here!
%2520(1).avif)
Assessing RIM Maturity: Takeaways from our Expert Panel
Rimsys recently hosted a webinar, Assessing RIM Maturity for Your Regulatory Management Strategy, to help RA teams put together a practical RIM transformation plan for their MedTech company. Featuring industry leaders, Adrian Bishop of Boston Scientific, Brian Williams of KPMG, Steve Gens of Gens Associates, and James Gianoutsos of Rimsys, the discussion centered on the evolving MedTech regulatory information management (RIM) landscape, using the RIM Maturity Model Framework to guide your regulatory information management strategy, a RIM maturity case study, and AI’s role in regulatory information management. Here's a quick recap of the insights we discussed:
The Growing Need for MedTech RIM Modernization
The session underscored the increasing complexity of global regulatory requirements in the MedTech sector. From EU MDR to the adoption of EUDAMED, the shifting regulatory environment is pushing companies to modernize their RIM processes to ensure compliance and avoid operational inefficiencies. Steve Gens shared key insights from his 2024 World Class RIM Study research that by 2024, 52% of life sciences companies had fully adopted global RIM programs, a significant leap from 32% in 2022. However, many MedTech organizations remain in the early stages of RIM maturity, reflecting the need for process harmonization and robust digital solutions.
“The manual nature of spreadsheets and desktop authoring tools is no longer sustainable with all the different regulations and the global operating model that most companies have where you're trying to quickly get submissions out to different markets and then have to keep track of where your products are registered and where there are renewals, and where there are expiration dates. Having that information in informal spreadsheets and SharePoint sites is really not sustainable and creates a lot of compliance risks." - Brian Williams, KPMG
The RIM Maturity Model: A Framework for Transformation Progress
Our panel also explored the new RIM Maturity Model framework from Rimsys, which was built to help MedTech teams modernize their processes no matter where they are in their transformation journey.
“MedTech teams want to modernize their processes but don't know where to start from a business or data collection standpoint. They don't have a framework that takes their current processes into account." - James Gianoutsos, Rimsys
The RIM Maturity Model categorizes organizations into six levels based on their current regulatory information management processes:
- Level 0 - Unaware
- Level 1 – Aware
- Level 2 – Reactive
- Level 3 – Proactive
- Level 4 – Well Managed
- Level 5 – Optimized
Most MedTech teams fall between Levels 0 and 2, relying on siloed data and manual processes and reactive regulatory information management. Progressing toward higher maturity levels involves:
- Data Harmonization: Establishing consistent definitions and processes across business units.
- Process Transformation: Moving beyond "firefighting" modes to proactive regulatory planning.
- Technology Adoption: Implementing a RIM system that centralizes data, automates tasks, and facilitates cross-functional alignment. This is a critical step to reaching fully optimized regulatory information management.
“If you're considering a RIM adoption or are already going through one, make sure you understand your own expectations. You can't get to a spacecraft without without getting into a horse and buggy, Data collection and harmonization is milestone-driven and progression-based. You're not going to get to an optimized state on Day 1. But as long as you keep continuing to make well-informed decisions with your data and aligning internally on key terms in that data digitization processes, you will… get there." - James Gianoutsos, Rimsys
"As you're progressing, you need to be really thoughtful about the cost benefit of any initiatives that you're undertaking, Make sure that you have clear objectives that can be measured and that you can report value against and really just make sure that you create recognition with your management teams and with your operational teams that this is going to be a phased journey. You're not going to get there overnight and set expectations appropriately, but try to make measurable steps along the way. And as you do that, you start to build confidence, you build awareness and you build trust that you're delivering on the kind of the objectives that you set out to deliver. It's really a journey.” - Brian Williams, KPMG
Case Study: RIM Maturity Lessons from Boston Scientific
Adrienne Bishop from Boston Scientific shared her company’s journey toward RIM maturity. After previous attempts to implement global systems, the team learned to prioritize readiness, secure buy-in from stakeholders, and leverage external expertise.
“The added benefit of a MedTech solution is also that with these external partners, we can understand what is industry standard and that can help us with our change management.” -Adrienne Bishop, Boston Scientific
Key lessons they learned include:
- Start with Data: Define data fields clearly and cross-check sources to ensure accuracy.
- Limit Customization: Avoid over-customizing solutions that can hinder transformation; instead, adopt proven industry-standard processes.
- Invest in Change Management: Equip teams with the skills and mindset to embrace transformation.
Boston Scientific’s phased approach—beginning with foundational product registration data and expanding capabilities over time—demonstrates the importance of incremental progress. Boston Scientific, for example, has made strides in adopting a RIM system by focusing on transformation rather than harmonization alone, emphasizing the importance of cross-department collaboration and clear data governance.
"The solution we picked works for other people, so we can make it work for us. We also realized that what we were doing before maybe wasn't wrong, but it was definitely inefficient. We now have different inputs and different regulations. And now we need to change to get there." - Adrienne Bishop, Boston Scientific
AI and Automation in RIM
The panel distinguished the key differences between automation and AI, noting that while automation focuses on rule-based processes, AI serves as a good starting point for handling complex, abstract tasks. While AI can reduce time spent on tasks, it’s important for RA teams to verify the source information and the outputs for accuracy.
“There's a lot of anxiety about really what AI will deliver. But I think a lot of people that have been working with it, they see it as the virtual assistant or assisting. So it's more augmentation because there's a lot of concern.” - Steve Gens, Gens and Associates
Both automation and AI are important to regulatory modernization. Specific use cases include:
- Automation: Streamlining data ingestion, workflows, and compliance monitoring.
- AI: Mining historical regulatory data, collecting regulatory research, and enhancing regulatory intelligence.
Despite the attention around AI, the panel emphasized that its effectiveness hinges on high-quality, harmonized data. Poor data foundations can render even the most advanced AI tools ineffective, highlighting the need for a phased, data-first approach to digital transformation.
“There are some benefits you can definitely achieve with AI. But first and foremost data is going to be the most challenging yet the most effective way to get to that holy grail that I think everybody wants out of a regulatory information management system.” - James Gianoutsos, Rimsys
Looking Ahead: The Future of RIM As the MedTech industry advances
Achieving higher levels of RIM maturity will require strategic investment in technology, data, and talent. Organizations must treat RIM modernization as a holistic transformation, integrating robust processes and aligning cross-functional teams. With automation poised to play an increasingly significant role, companies that prioritize data governance and process maturity today will be well-positioned to leverage advanced technologies like AI tomorrow.
RIM modernization is not just a compliance imperative but a competitive advantage. By adopting a structured maturity model, focusing on data quality, and embracing RIM solutions like Rimsys, MedTech organizations can streamline regulatory processes, reduce risk, and drive innovation. If your organization is considering RIM modernization, now is the time to assess where you stand and take the first steps toward a holistic transformation.
For more insights, listen to the webinar recording here!
.avif)
5 Reasons It’s Time to Stop Managing Your UDI Data in Spreadsheets
UDI data management is continuously getting more complex. Not only do global markets have varying UDI requirements, but new markets are expected to come online in the coming months. Additionally, the mandatory application of EUDAMED will begin in January of 2026, meaning that MedTech manufacturers selling products in the European Union will have to submit their UDI information to EUDAMED.
Submitting UDI information to EUDAMED will require careful and thorough preparation to ensure that manufacturers have all of the required data attributes necessary to meet the EU’s requirements and that they have a strategy in place to organize, review, and submit all of their information.
MedTech regulatory affairs processes are largely manual and siloed, and UDI management is no different. Many teams are still managing their UDI data in complex spreadsheets. While the forthcoming mandatory EUDAMED requirements have prompted many manufacturers to start planning more comprehensive UDI strategies, managing a high volume of UDI data in spreadsheets is unsustainable long term.
Efficient and scalable UDI management requires deep expertise, collaboration, and full visibility into your products’ global regulatory activities that spreadsheets simply can’t match. Here are 5 reasons it’s time to move away from managing your UDI data in spreadsheets:
1. They’re setting you up for compliance risks
UDI management involves a high volume of data across different markets and regulator IT systems. Not only are the assembly and maintenance of those data in a spreadsheet prone to human error, but they don’t enable the regulatory expertise necessary to ensure that your requirements for each applicable market are up to date. Further, siloed spreadsheets aren’t connected to systems that help you unlock regulatory insights. The responsibility is yours to make sure your spreadsheet has current, accurate, and reliable information.
With cumbersome version history and change tracking (or lack thereof), spreadsheets also lack the traceability needed for audits, making it difficult and time-consuming for MedTech companies to effectively demonstrate compliance. This not only adds time to the audit, but opens your organization up for audit findings, financial penalties, product delays, and revenue loss.
2. They’re time-consuming and difficult to manage
When multiplying the markets you’re selling in by the number of products you’re selling, it’s easy to see how complex UDI spreadsheets can get. Since there’s no automation to ensure the attributes and data in your spreadsheet are up to date, it’s up to you to validate it periodically and research the updated requirements. If you do establish a process to validate that UDI data, this adds critical time for Medtech teams that are already tasked to execute faster with limited team members. If you do not periodically validate UDI data, you take on an increased risk of non-compliance.
Additionally, new market regulatory and IT requirements make managing UDI information even more difficult each time a new market is added. With several countries expected to mandate or enact new UDI requirements and systems over the next couple of years, the complexity is only going to grow with time.
3. They limit collaboration across your team
Multiple stakeholders working within the same spreadsheet can easily create confusion. Not only is it difficult to track changes, but there’s a likelihood of overwriting critical information. This can not only lead to the compliance risks mentioned above, but spreadsheets also impact your team’s ability to effectively collaborate. Team members often duplicate the spreadsheet and work off of different versions when there are limited controls in place to prevent this from happening.
On a strategic level, spreadsheets impact your team’s ability to share knowledge with one another. There’s no way to effectively share detailed notes and tasks, and there’s also limited functionality to track transmission status and troubleshoot transmission errors with your team.
4. They don’t provide full visibility into your products’ selling statuses
UDI spreadsheets are usually designed for one purpose, UDI data management. However, UDI is just one facet of obtaining market clearance for your product. The product must also be approved and registered in each respective market. Many manufacturers have multiple teams and spreadsheets to track regulatory activities where UDI responsibilities may lie outside of the regulatory team. This approach limits their ability to get full visibility into the status of their products and integrate this information with other relevant applications across the business. With regulatory information scattered and siloed, it’s easy to miss the connection between UDI data and upcoming expirations and renewals.
5. They don’t easily scale with your business and growing market requirements
As you create new products and bring existing ones into new markets, do you have a plan in place to help you scale effectively? The regulatory activities along with the expanding UDI requirements associated with new product introductions and market expansions are high enough, and spreadsheets simply can’t keep pace with business growth.
Moving your UDI management off spreadsheets is going to set you up for a successful, long-term UDI program. MedTech companies not only need to be aware of the forthcoming mandatory EUDAMED application timelines, but they also need a sustainable solution as additional UDI requirements come online. Finding a solution that’s built with the complexities of UDI data management in mind, automates time-consuming, manual processes, and offers complete visibility into all of your regulatory activities is going to help you ensure that your UDI program is compliant and scalable to meet your evolving business needs.
The Rimsys RIM platform allows you to manage your UDI program in a single-sourced, unified, and connected solution that enables you to track your UDI activities alongside your product registrations and selling status to give you confidence in your compliance. Additionally, Rimsys has a novel Universal UDI approach that captures common attributes across various market requirements to reduce administrative burden and help you submit your UDI information consistently and with ease.
Want to see how a purpose-built MedTech RIM solution can offer you a compliant, scalable, and comprehensive approach to UDI management? Request a demo to see Rimsys in action!
.avif)
Rimsys secures $5 million in growth financing round
Rimsys recently secured $5 million in a growth financing round from Global Opportunity Pennsylvania Fund II, L.P. (GO PA Fund), Riverfront Ventures, and existing investor, Innovation Works. GO PA Fund, Riverfront Ventures, and Innovation Works have a strong commitment to fostering innovation and creativity in Pennsylvania, which makes them great financial partners for Rimsys.
“We’re ecstatic to have support from GO PA Fund, Riverfront, and existing investors as we enter a new growth phase at Rimsys,” said James Gianoutsos, Rimsys Founder and CEO. “Our next phase of growth builds on our mission to increase accessibility to life-changing medical technologies with a focus on regulatory intelligence, submissions management, and UDI enhancements and thoughtfully incorporating advanced technologies like AI into our roadmap to meet growing demand and changing global regulatory requirements. We are grateful to work with firms that are committed to nurturing innovation in the Pittsburgh region, which has given so much opportunity to us.”
Our growth financing will help ensure that Rimsys provides a world-class, unified regulatory information management (RIM) solution for the medtech industry and that it meets the challenges that come with a frequently evolving regulatory landscape.
Those interested in learning more can read the press release from GO PA Fund and a recent Post-Gazette interview with our founder, James Gianoutsos:
ABOUT GO PA FUND
Formed by Ben Franklin Technology Partners of Southeastern Pennsylvania, with collaboration from Ben Franklin of Northeastern Pennsylvania, Ben Franklin of Central and Northern Pennsylvania, and Innovations Works from Southwestern Pennsylvania, the GO PA Fund invests in technology-based ventures throughout the Commonwealth of Pennsylvania. The GO PA Fund primarily invests as a follow-on fund to companies selected from Ben Franklin’s statewide portfolio of more than 600 burgeoning ventures throughout Pennsylvania. The Fund leverages Ben Franklin’s best-in-class multi-year/multi-round due diligence to ensure access to qualified and vetted opportunities while minimizing costs of investment. Visit us at gopafund.com.
ABOUT BEN FRANKLIN TECHNOLOGY PARTNERS OF SOUTHEASTERN PENNSYLVANIA
Ben Franklin Technology Partners of Southeastern Pennsylvania (“Ben Franklin”) is the Philadelphia region’s Partners with a Purpose. Nationally ranked among the most active seed and early-stage investors, Ben Franklin helps high-growth innovative enterprises plant and nurture their roots, creating both immediate connections and lasting economic growth. The nonprofit has supported more than 2,000 companies to deliver an impact of more than $5 billion and 32,000 jobs in the Philadelphia region. Whether in tech, life sciences, manufacturing, or industries and breakthroughs yet discovered, Ben Franklin works to raise the community of innovation higher, to benefit present and future generations of Pennsylvanians. Visit us at partnerswithapurpose.org, or follow us at @bftp_sep.
ABOUT INNOVATION WORKS
Innovation Works is one of the most active early-stage investors in the country and the most active in Pennsylvania. Since its inception of the seed fund in 1999, Innovation Works has invested in over 760 companies that have gone on to raise $3.3 billion in follow-on funding. Portfolio companies have generated and retained over 20,000 jobs in Pennsylvania. Innovation Works is part of the Ben Franklin Technology Partners network, which has catalyzed economic growth over the last 30 years by providing access to capital and networks that help foster innovation and technology-based economic development in Pennsylvania. Learn more at innovationworks.org.
ABOUT RIVERFRONT VENTURES
Riverfront Ventures is an early-stage venture capital fund based in Pittsburgh, PA focused on investing in early-growth stage tech companies. Learn more at riverfrontventures.com.
ABOUT RIMSYS
Rimsys is improving global health by accelerating delivery and increasing availability of life-changing medical technologies. Rimsys Regulatory Information Management (RIM) software digitizes and automates regulatory activities, helping medtech regulatory affairs teams to plan more effectively, execute more quickly, and confidently ensure global regulatory compliance. Rimsys is designed around medtech workflows and supports a full breadth of regulatory activities including registrations, submissions, UDI, essential principles, and standards management in a single, integrated platform. For more information, visit www.rimsys.io.
