Featured
Rimsys Announces Rimsys AI to Eliminate Repetitive Tasks and Enhance Decision-Making for MedTech Regulatory Teams
Rimsys, the leading Regulatory Information Management (RIM) platform for the MedTech industry, today announced the launch of Rimsys AI, a suite of embedded artificial intelligence (AI) agents.
The ultimate guide to the medical device single audit program (MDSAP)
This article is an excerpt from The ultimate guide to the medical device single audit program (MDSAP) ebook.
Table of contents
- What is MDSAP?
- History of MDSAP
- Who is responsible for the MDSAP?
- How does an MDSAP audit work?
- Audit sequence
- You got a nonconformity – now what?
- What does an MDSAP audit cost?
- Why choose the MDSAP certification process?
- Potential disadvantages of the MDSAP
- Ready to participate? – Here’s how to get started
- Completing a successful MDSAP audit
The Medical Device Single Audit Program (MDSAP) was designed and developed to allow a single audit of a medical device manufacturer to be applied to all country markets whose regulatory authorities are members of the program. The MDSAP provides efficient and thorough coverage of the standard requirements for medical device manufacturer quality management systems, and requirements for regulatory purposes (ISO 13485:2016). In addition, there are specific requirements of each medical device regulatory authority participating in the MDSAP that must be met:
- Conformity Assessment Procedures of the Australian Therapeutic Goods (Medical Devices) Regulations (TG(MD)R Sch3)
- Brazilian Good Manufacturing Practices (RDC ANVISA 16)
- Medical Device Regulations of Health Canada (ISO 13485:2003)
- Japan Ordinance on Standards for Manufacturing Control and Quality Control of Medical Devices and In Vitro Diagnostic Reagents (MHLW Ministerial Ordinance No 169)
- Quality System Regulation (21 CFR Part 820), and specific requirements of medical device regulatory authorities participating in the MDSAP program.
This means that a report from a single MDSAP audit of a medical device manufacturer would be accepted as a substitute for routine inspections by all the member Regulatory Authorities (RAs) across the world. There are currently five participating Regulatory Authorities (RA) representing the following countries: Australia, Brazil, Canada, Japan and the USA.
In April, 2021, the RAs released an “Audit Approach” document (MDSAP AU P0002.006) that combines the formerly separate MDSAP Audit Model and Process Companion documents into a single guidance document. It includes guidance for assessing the conformity of each process and includes an audit sequence, instructions for auditing each specific process, and identifies links that highlight the interactions between the processes.
In March 2012 the US FDA announced that they had approved a final pilot guidance document “Guidance for Industry, Third Parties and Food and Drug Administration Staff: Medical Device ISO 13485:2003 Voluntary Audit Report Submission Pilot Program.” This allowed the owner or operator of a medical device manufacturing facility to be removed from FDA’s routine inspection work plan for 1 year upon completing a ISO 13485:2003 audit. This guidance document went into effect in June 2012, and was intended as an interim measure while a single audit program was being developed.
This pilot program was not very successful and few companies signed up because they did not see any advantage in participating. The manufacturer had to pay for a third party to inspect their facilities, generate a report, and share the inspection results back to the FDA. Many companies were reluctant to contract “someone else” to perform their inspection when they could easily wait for the FDA to conduct an inspection for free.
During its inaugural meeting in Singapore in 2012, the International Medical Device Regulators Forum (IMDRF) appointed a working group to develop a set of documents for a harmonized third-party auditor system. Hence, the “Medical Device Single Audit Program” (MDSAP) was formed. The concept was similar to the FDA’s original idea of creating a third-party auditor to help reduce their workload of performing regulatory audits of medical device manufacturers’ quality management systems. This new approach would consist of a single audit that would review regulatory QMS compliance, conducted by a third-party, who would later be called an Auditing Organization (AO).
From January 2014 to December 2016, five countries participated in a Medical Device Single Audit Program Pilot. In June 2017, a report was generated summarizing the outcomes of prospective “proof- of-concept” criteria established to confirm the success of the program. The outcomes are documented in the final MDSAP Pilot Report and recommended that the program become fully active and open to any manufacturer who requested this type of audit.
The governing body of the MDSAP is the Regulatory Authority Council (RAC), which is composed of two senior managers (and a few other staff members) from each participating RA. They are responsible for executive planning, strategic priorities, setting policy, and making decisions on behalf of the MDSAP International Consortium. The RAC also reviews and approves documents, procedures, work instructions, and more. The mission of the MDSAP International Consortium is to jointly leverage regulatory resources to manage an efficient, effective, and sustainable single audit program focused on the oversight of medical device manufacturers on a global scale.
Other international partners that are involved in the MDSAP include:
MDSAP Observers:
- European Union (EU)
- United Kingdom’s Medicines and Healthcare products Regulatory Agency (MHRA)
- The World Health Organization (WHO) Prequalification of In Vitro Diagnostics (IVDs) Program
MDSAP Affiliate Members:
- Argentina’s National Administration of Drugs, Foods and Medical Devices (ANMAT)
- Republic of Korea’s Ministry of Food and Drug Safety
- Singapore’s Health Sciences Authority (HSA)
The observers and affiliate members are not the same as the participating member RA’s. The observers simply observe and/or contribute to RAC activities. Affiliate members, on the other hand, are interested in engaging in the MDSAP program and are subject to certain rules. They are only given access to a certain level of information about the manufacturers, audit dates, and information in audit reports.
They are also invited to attend sessions that are open to members, observers, and affiliates only.
Audits can also be conducted by MDSAP participating RAs at any time and for various reasons including:
- "For Cause" due to information obtained by the regulatory authority
- as a follow up to findings from a previous audit
- to confirm the effective implementation of the MDSAP requirements
The purpose of audits conducted by the RAs is to ensure appropriate oversight of the AOs MDSAP auditing activities. The AOs are appointed by the RAs and a list of the currently approved AO’s is published on the FDA website. Most AOs offer a broad range of management system certification services, beyond just medical devices. Manufacturers should verify that prospective AOs are clearly trained and perform MDSAP audits of medical devices.
AOs have the final word as to whether a manufacturer has met the requirements for the MDSAP during the execution of the audit and generation of the associated reports summarizing the results. MSDAP RAC participating RAs have the final decision regarding all development, implementation, maintenance, and expansion activities associated with the program.
Although an unannounced visit by an AO is rare, it can happen in circumstances where high-grade nonconformities have been detected.
To continue reading this eBook including a detailed look at the MDSAP audit process and grading, pros and cons of the approach, and how to get started please register to download the full version.
The beginner's guide to the FDA 510(k)
This article is an excerpt from The beginner's guide to the 510(k) ebook.
Table of Contents
- Introduction
- 510(k) basics
- Contents of a Traditional 510(k)
- 510(k) submission and timelines
- Other 510(k) forms
Congratulations! You have successfully developed a new medical device. Now you need to take it to market. In the United States, this often means submitting a 510(k). A 510(k) is a structured package of information about your device and its performance and safety that you submit to the Food and Drug Administration (FDA) for “clearance” before you can sell your device in the U.S. In order to receive clearance from the FDA, your 510(k) will need to demonstrate that your medical device is substantially equivalent to another legally marketed device (called a predicate device). The substantial equivalence approval process is a simple equation that looks something like this:
The 510(k) is generally the most efficient route to market clearance in the U.S. because you show your device is safe and effective based on this substantial equivalence standard, instead of needing to present more extensive clinical trial data.
There are three types of 510(k): Traditional, Abbreviated, and Special. This eBook will begin with a general overview of the 510(k) process, including its purpose and benefits. Next, we will explore the Traditional 510(k) and the sections and components required in depth. Finally, we will look at the Special and Abbreviated 510(k).
FDA: background and device oversight
Before we explain what a 510(k) is let’s first talk generally about the FDA and device oversight. The FDA is the U.S. governmental agency responsible for overseeing medical devices, drugs, food, and tobacco products. When it comes to medical devices, the FDA’s mission is to “protect the public health by ensuring the safety, efficacy, and security of…medical devices.” At the same time, the FDA also has an interest in “advancing public health by helping to speed innovations.” In other words, the FDA’s goal is to make sure devices are safe and effective for public use, while also ensuring that devices have a quick and efficient path to market.
In order to achieve this balance of safety and efficiency, the FDA has three different levels of oversight depending on the risk level of the device: (1) exempt from premarket submission, (2) Premarket Notification, also known as 510(k), and (3) Premarket Approval (PMA).
When is a 510(k) required?
A 510(k) is required for medium risk devices that have a predicate on the market which can be used to demonstrate the safety and effectiveness of the new device. Meanwhile, a PMA is required for high-risk or novel devices which require a higher level of scrutiny to be confirmed safe and effective.
A 510(k) is not only required for new devices, but also for devices that have been modified in a way that could impact safety or effectiveness. This could include changes to the:
- Design
- Components
- Materials
- Chemical composition
- Energy source
- Manufacturing process
- Intended use
You must submit your 510(k) at least 90 days before marketing the device.
What Exactly is Substantial Equivalence?
Now that we know what a 510(k) is, let’s talk about the substantial equivalence standard. You’ll recall from the introduction that your 510(k) must show that the new (or modified) device is substantially equivalent to at least one other legally marketed device, called a predicate device. Substantial equivalence looks at the intended use and the technological characteristics of the two devices.
More specifically, you must show:
- that the new device has the same intended use as the predicate, and
- the differences between the two devices do not raise questions about the safety and effectiveness of the new device.
Now let’s take a closer look at intended use and technological characteristics.
Intended use
Intended use means the general purpose or function of the device. The FDA will look at your proposed labelling and your Indications of Use section of the 510(k) to determine the intended use of your device (this is covered in Chapter 2). Intended use includes:
Technological characteristics
Once the FDA has determined that a predicate device exists and that the new device and the predicate device have the same intended use, it will move on to compare the technological characteristics. Technological characteristics include:
- Materials
- Design
- Energy source
- Other device features
The two devices do not have to be identical, and in fact they almost never are. The key here is to demonstrate that any differences do not have a significant impact on safety or effectiveness. Here’s what to cover when you compare your device’s technological characteristics with that of the predicate device:
Overall description of the device design
- Engineering drawings or diagrams to explain the device and component parts.
- List of component parts and explanation of how each component contributes to the overall use and function of the device.
- Physical specifications: dimensions, weight, temperature, tolerances, etc.
Materials
- Detailed chemical formulation used in all materials of constructions (especially those that come into contact with a patient).
- Any additives, coatings, paint, or surface modifications.
- How materials have been processed and what state they’re in.
Energy Sources
- Use of batteries, electricity, etc.
Other technological features
- Software/hardware
- Features
- Density
- Porosity
- Degradation characteristics
- Nature of reagents
- Principle of the assay method
In deciding whether the differences in technological characteristics impact safety or effectiveness, the FDA will typically rely on descriptive information about the technological characteristics as well as non-clinical and clinical performance data.
Let’s look at an example: A manufacturer submits a 510(k) for a new type of contact lens. Both the new device and the predicate device are indicated for daily wear for the treatment of astigmatism. The predicate device is only available in a clear lens, but the new device comes in a line of colors, including purple tinted lenses.
Who is responsible for submitting a 510(k)?
The following four types of organizations may be responsible for submitting a 510(k):
Manufacturers
- End-of-line device manufacturers who will be placing a device on the U.S. market.
- Note: Does not apply to component part manufacturers unless components will be marketed independently.
Specification developers
- Companies that develop the specifications for a finished device which has been manufactured elsewhere
Repackers or relabelers
- Required to submit a 510(k) if they significantly alter the labeling or condition of the device, including modification of manuals, changing the intended use, deleting or adding warnings, contraindications, sterilization status.
- Note: This is rare. The manufacturer, not the repackager or labeler, is typically responsible for the 510(k) submission.
Importers
- Importers that introduce a new device to the U.S. market may need to submit a 510(k), if it hasn’t already been submitted by the manufacturer.
Now that we’ve covered the basics, let’s explore what actually goes into your 510(k).
A Traditional 510(k) should contain all the following components in the list below. In some cases, a particular section may not apply to your device. When that happens, it’s a good idea to include the section anyway and just state “This section does not apply” or “N/A” under that heading.
To continue reading this eBook including a detailed walk-through of all the Traditional 510(k) components, submission requirements and timelines, and an overview of the other 510(k) forms including the Abbreviated 510(k) and the Special 510(k), please register to download the full version
The ultimate guide to the China UDI system and database
This article is an excerpt from The ultimate guide to the China NMPA UDI system and database ebook.
Table of Contents
- Overview
- UDI basics and benefits
- UDI format requirements and issuing entities
- UDI database and submission requirements
- Implementation of UDI and the UDI database in China
The current Chinese medical device regulatory regime kicked-off in 2014 with the Regulation on Supervision and Administration of Medical Devices. This core set of registration requirements, modeled after the United States and European Union systems, established a set of device classifications (class I, II, and III) based on risk and procedures for obtaining market clearance for each type of device.
Medical devices in China are regulated by the National Medical Products Administration (NMPA). Class I devices, such as clinical laboratory equipment or non-invasive skin dressings, require only notification to the NMPA for marketing authorization, and that authorization does not expire. Class II and III devices such as implantable devices or devices with a measuring function require full registration and a formal review before market clearance can be obtained.
These initial regulations have been expanded since their introduction, adding accelerated pathways to market for certain products in certain regions, easing acceptance of clinical data from overseas, and more specific roles and responsibilities for local agents of international manufacturers. In addition, in 2019, the regulations added a provision that medical devices carry a unique device identification (UDI). China’s UDI requirements are similar to those in the US and European Union. They establish specific device ID and labeling requirements, as well as a central, state-administered database of devices.
This eBook walks through the basics of medical device UDIs, the specifics of China’s implementation, and how MedTech companies who market their devices in China can prepare for the full rollout of these regulations in the coming years.
A UDI is a unique alphanumeric code that is designed to identify medical devices sold in a particular country/region from manufacturing, through distribution, to use by a patient. Like other aspects of the medical device regulatory regime, the UDI system in China follows the approach taken by the United States FDA and European Commission, and is based on the guidance from the International Medical Device Regulators Forum (IMDRF). Generally, UDI systems are designed to improve patient safety and optimize care by:
- Increasing the traceability of medical devices, including field safety corrective actions
- Providing an unambiguous identification method for medical devices throughout distribution and use
- Making adverse event reports more accessible
- Reducing medical errors by providing detailed information related to the device
- Simplifying medical device documentation and making it more consistent
There are three components to the UDI system in China:
- UDI code: The actual UDI code can be assigned by one of three (3) issuing agencies and contains information about the product, it’s expiration date, and the manufacturing batch/lot it’s associated with.
- UDI labeling: Put simply, medical devices must carry the UDI code on them. The regulations stipulate how devices and their packaging must be labeled for compliance.
- UDI database: In addition to labeling, all device UDIs must be submitted to a central database that is administered by the NMPA.
The following sections explore each of these components in more detail.
The UDI code
The first element of the UDI system is the code itself. The UDI code is the alphanumeric identifier that is associated with a specific medical device. UDI codes have two (2) elements to them, the UDI device identifier (UDI-DI) or static portion, and the UDI production identifier (UDI-PI) or dynamic portion. You can see the two components in the UDI diagram below:
The UDI-DI contains information about the issuing entity—the organization that is authorized to assign UDI codes. In China, this can be one of three entities: GS1, an international barcode and electronic data interchange standards organization, and two domestic organizations: the Zhongguancun Industry & Information Research Institute (ZIIOT), and AliHealth. Additional details about the issuing agencies are covered in Chapter 2. In addition, the UDI-DI contains information about the manufacturer and the specific model or version of the device.
The UDI-PI contains information about the manufacturing and production of the device. This typically includes information about the lot or batch number in which the device was manufactured, the manufacturing date and expiration date for the device (if applicable), and the specific serial number for the device. Here you can see all of the components marked up using the same UDI example:
Note that each packaging permutation and level for a given device will need to be assigned its own UDI. So for example, let’s say that a company manufactures 5ml enteral (oral) syringes in two packaging options: 1 – packaged individually and 2 – packaged in a box of 5. Each packaging option would need its own UDI, despite the fact that the underlying product is the same.
Now looking at packaging levels, let’s assume that the manufacturer packages the single syringe offering into boxes of 6, and again into larger containers of 24. Each of those packaging options needs its own UDI as well.
Labeling
In addition to obtaining UDI code for each device as outlined in the previous section, medical device manufacturers are required to ensure that devices are appropriately labeled with the assigned UDI. This label is called the UDI Carrier. The UDI is represented in two forms on the UDI Carrier: a machine-readable form and a human-readable form.
The machine-readable form or automatic identification data capture (AIDC) is a barcode or some other technology that can be used to automatically capture UDI information. The NMPA regulations support 3 types of machine-readable formats: 1-dimensional barcode, 2-dimensional barcode, and radio-frequency identification (RFID).
The regulations note that “use of advanced automatic identification and data collection technologies is encouraged”—prompting manufacturers to use more modern 2D and RFID machine-readable carriers where possible. Note, however, that if a device uses RFID, the UDI Carrier must also include the UDI in barcode format.
The human-readable form or human-readable interpretation (HRI) is the numeric or alphanumeric code for the UDI that can be read and manually entered into systems.
The UDI Carrier should be included on the device and on all levels of packaging. The UDI Carrier must be clear and readable during the operation and use of devices. If there isn’t room on the device for both the human and machine-readable forms of the UDI, then manufacturers should prioritize the machine-readable form.
UDI database
The third component of the NMPA UDI system is the UDI database. This is a centralized database of UDI and product information, administered by the NMPA. Manufacturers are required to submit UDI information into the database within 60 days after a product is approved (for sale in China) and before it is commercialized. The database contains a more detailed product record than what is included in the UDI itself, and it is the responsibility of the manufacturer (and/or their in-country representative) to submit the information correctly, and ensure that it’s kept up to date.
Chapter 3 of this eBook goes into detail about the specific fields and data requirements for UDI database submissions.
To continue reading this eBook including information about UDI format requirements and issuing entities, implementation timelines, and affected device types, please register to download the full version.
Brexit overview for medical device manufacturers
What is Brexit?
Brexit - meaning "British exit" is the process of the official withdrawal of the United Kingdom (UK) from the European Union (EU) on January 31, 2020, at 11:00 PM (GMT). The UK had been a member state of the EU since January 1, 1973, when it was known as the European Communities.
Leaving the EU was no easy task for the UK and it was six years in the making before it was final. When they “left” in January 2020, a discussion and negotiation transition period with the EU began. The negotiation process was both politically challenging and deeply isolating. Under the UK Prime Minister, Boris Johnson, the country continued to participate in many EU institutions during the one-year transition period in order to ensure frictionless trade until a long-term relationship could be agreed upon. Trade deal negotiations continued up until just days before the scheduled end of the transition period (December 31, 2020) and the EU–UK Trade and Cooperation Agreement was signed on December 30, 2020.
Following Brexit, EU law and the Court of Justice of the European Union no longer have power over British citizens and companies, with the exception of select areas related to Northern Ireland. Under the terms of the Brexit withdrawal agreement, Northern Ireland continues to participate in the European Single Market in relation to goods and to be a de facto member of the EU Customs Union.
The European Union Referendum Act 2015 set the wheels in motion. This Act of the Parliament of the United Kingdom made a legal provision for a referendum to be held on whether it should remain a member state of the European Union or leave it completely. The related legislation was introduced to the House of Commons in May of 2015, and it was passed on its third review in the House of Commons in early September 2015 and approved by the House of Lords in December 2015. The Act went into full legal force on February 1, 2016.
The initial withdrawal in March 2019 was delayed by the deadlock in the British parliament after the June 2017 general election. This deadlock then led to three extensions of the UK’s Article 50 of the Treaty of European Union (TEU), which began the member states’ withdrawal, known as Brexit.
Brexit’s effect on medical device regulations
All medical devices, including IVDs, custom-made devices, and systems or procedure packs must be registered with the UK’s Medicines and Healthcare Products Regulatory Agency (MHRA) before they can be placed on the UK market. The MHRA is developing a new regulatory framework for medical devices, designed to safeguard and advance the health of its people by enabling early access to a high-quality supply of safe, effective, and innovative medical products. CE marked devices will initially be recognized in the UK, but manufacturers will have to obtain UK Conformity Assessment (UKCA) certification and follow the marking requirements per UK MDR 2002, beginning July 1, 2023. CE-marked devices will be allowed in the UK market until June 30, 2023, as long as they have been CE marked under one of the following:
- Directive 90/385/EEC - active implantable medical devices
- Directive 93/42/EEC
- Directive 98/79/EC - in vitro diagnostic medical devices
- Regulation 2017/745
- Regulation 2017/746
Medical device manufacturers continue to be able to self-certify CE marked devices until June 30, 2023 - providing the certificates remain valid for the EU market under the transitional timelines listed in the EU MDR and IVDR.
From January 1, 2022, non-UK manufacturers will require a UK Responsible Person for the purposes of registering devices. A Northern Ireland-based Authorized Representative will no longer be able to register devices on a manufacturer’s behalf for Great Britain.
You will need to use the new UKCA marking before January 1, 2023, if your product:
- will be marketed in Great Britain, and
- is covered by legislation that requires the UKCA marking, and
- requires mandatory third-party conformity assessment, and
- conformity assessment has been carried out by a UK conformity assessment body.
This does not apply to existing stock if your goods were fully manufactured, CE marked, and placed on the market before January 1, 2021.
Northern Ireland – the rules are different
In some circumstances, it is a requirement of the UK MDR 2002 that you inform the MHRA when you first place your device on the Northern Ireland market. Under the Northern Ireland Protocol, different rules apply than those in Great Britain. The precise requirements depend on the location of the manufacturer, the location of the Authorized Representative, and the device class. For more information on the regulatory system for medical devices in Northern Ireland, refer to the Regulation of medical devices in Northern Ireland.
The future of medical device regulations under Brexit
As you can see, the rules have changed and may continue to be refined until June 30, 2023. Currently, the CE marking is only valid in the UK for areas where both UK and EU rules remain the same. The UKCA marking is not recognized in the EU market, therefore, products will need the CE marking to sell in the EU. The UK MDR 2002 is up to date with all changes known to be in force on or before June 28, 2022. However, there may be changes that will be brought into force at a future date.
For more information on the EU MDR and IVDR requirements, read our Ultimate guide to the EU MDR/IVDR unique device identifier (UDI) system and Ultimate guide to the EU MDR GSPR - general safety and performance requirements.
The RegUP rundown
What is a RegUP?
The medical device industry is, by its very nature, a high-stress one. New medical technologies are being created all the time, and as a result, regulations are constantly changing. Being a regulatory professional in the medtech industry requires extraordinary attention to detail and nerves of steel. Rimsys was founded by regulatory pros for regulatory pros, and we understand the need to unwind in a professional environment with other leaders in the industry. That’s why we came up with the idea of the RegUP.
So, what’s a RegUP? It’s short for “Regulatory Meetup,” and it’s a small gathering of regulatory professionals, not a large conference. We’ll enjoy delicious food and beverages as we get to know each other and discuss regulatory trends and best practices.
When and where?
Boston - Sept 29th
Our first RegUP event will be held on the East Coast in Boston, MA, on September 29, 2022, at Democracy Brewing. Democracy Brewing, nestled in historic Downtown Crossing (one of the oldest neighborhoods in the United States), is the first cooperative brewery in Boston. Their menu features plenty of delicious craft beers and an eclectic selection of cuisines ranging from Mediterranean to classic American bar food.
San Jose - Oct 13th
Our second event will be held on the West Coast in the San Jose area on Oct 13, 2022, at Big Dog Vineyards. Big Dog Vineyards is a locally owned and operated winery in the picturesque Milpitas Hills, CA. Their Winery & Tasting Room opened in 2009, right beside the estate vineyard, which was planted in 1997.
What should you expect at a RegUP event?
As mentioned, we understand that regulatory professionals in the medical device industry are under constant pressure to ensure they keep up with ever-changing trends and best practices. And if you are like us, the opportunity to hone your trade and sharpen your skills and knowledge in a more casual setting will be welcome.
Here’s the agenda for RegUP Boston to give you an idea of what to expect at our events:
- 12:00 - 12:30 pm Welcome: Increasing confidence in regulatory planning. Many regulatory challenges are driven by a lack of visibility into regulatory timelines, resources, and needs. A comprehensive regulatory data strategy can help RA teams build more resilient plans, and shift their organizational posture from reactive to proactive.
- 12:30 - 1:15 pm Catered lunch
- 1:15 - 1:45 pm TBD Regulatory best practices case study
- 1:45 - 2:15 MDR/IVDR information essentials: MDR/IVDR compliance remains top of mind for RA teams. New information requirements including GSPRs, UDI/EUDAMED, and Post-market surveillance and reporting require a new approach to regulatory information management.
- 2:15 - 4:00 pm Brewery tour, tasting, and networking
Rimsys Speakers
- James Gianoutsos - Founder & CEO
- Bruce McKean - Director of Regulatory (Boston)
- Adam Price - Director of Product, Post Market (San Jose)
We hope to see you there!
Our RegUP events in Boston and San Jose will be the first of many opportunities for us to network, further regulatory knowledge and processes, and even enjoy each other’s company over tasty beverages. Best of all, these events are free for Rimsys customers and qualified guests.
Of course, you can also expect these events to get bigger and better with time. Nonetheless, you don’t want to miss out on the first of these opportunities to get to know us and our industry better. We hope to see you there! If you are unable to attend though, keep an eye on our LinkedIn page for future RegUP events in a city near you.
To get more information and register for our upcoming events, click the links below:
- RegUP Boston: https://regup-boston.eventbrite.com/
- RegUP San Jose: https://regup-sanjose.eventbrite.com/
IVDR: In Vitro Diagnostic Regulation within the European Union
What is the IVDR In Vitro Diagnostic Regulation?
The European Union’s In Vitro Diagnostic Regulation (IVDR) 2017/746 applies to IVD devices and came into force on May 26, 2022. The IVDR is a major change over the In Vitro Diagnostic Directive (IVDD), which it supersedes. The new regulation is designed to better protect patients and address changes in IVD technology through new requirements and stricter controls. As a Regulation, unlike a Directive, the IVDR becomes a requirement in every EU country on the same day, which means that compliance with the IVDR is paramount for market access within the EU.
Major changes in the IVDR
The IVDR includes changes to IVD classification, increased documentation requirements, and UDI specifications. It is critical for manufacturers and their European representatives to understand and implement the new regulations as soon as possible. There is significant concern that notified bodies will not have sufficient resources to handle the increased need for their services.
The major changes between the IVDR and its predecessor, IVDD, are as follows:
Changes to the classification system
Under the IVDD only a small percentage of IVD products were assigned a higher risk classification (based on a predefined list of products). All other products were exempt from notified body oversight and allowed for manufacturers to self-certify through conformity procedures. Under the IVDD, only 10%-20% of IVD products were subject to notified body oversight, whereas, under the IVDR, 80%-90% of IVD products will be subjected to notified body oversight.
Unlike the IVDD, the IVDR defines 4 risk classes based on risk profile:
- Class A: Lowest risk (e.g. specimen containers)
- Class B: Low to moderate risk (e.g. pregnancy tests)
- Class C: Moderate to high risk (e.g. cancer screening products)
- Class D: High risk (e.g. HIV tests)
It is important that IVD manufacturers re-classify their products using the new classification rules as soon as possible. Notified body oversight is required for IVDs in class B through class D.
Increased technical documentation requirements
Under the IVDD, technical documentation requirements were vague and left largely to the discretion of the manufacturer. The IVDR, however, details specific requirements for the content of technical documentation. Annex I details the General Safety and Performance Requirements, Annex II details primary technical documentation requirements, and Annex III details requirements for technical documentation for post-market surveillance.
Unique Device Identification (UDI) requirements
IVDs now require UDI labeling and registration in the European Union Database of Medical Devices, more commonly known as EUDAMED, in the same way as other medical devices. A UDI must be assigned to all medical devices, with some exceptions for custom-made and investigational devices.
Each UDI consists of multiple elements, including a Basic UDI-DI (also known as “BUDI”), a device identifier (DI) with static device information, and a product identifier (PI) with dynamic information provided by the manufacturer (such as serial number and manufacturing date). In addition, manufacturers can now register their device in EUDAMED, though this is not yet required.
Quality management system requirements
All IVD manufacturers are expected to have a quality management system in place, even though only those manufacturing class B to D devices require certification of conformity assessments by a notified body.
Person Responsible for Regulatory Compliance (PRRC)
Manufacturers will now be required to designate at least one person to monitor compliance with regulatory requirements. A PRRC must be qualified by way of a relevant degree and a minimum of one year of professional experience, or at least 4 years of experience in medical device regulatory affairs or quality management. Note that smaller manufacturers do have the option to subcontract their PRRC functions, but one person cannot act as a PRRC for a manufacturer based outside of the EU and for an Authorized Representative.
IVDR deadlines
Manufacturers who were able to self-declare conformity under the IVDD, but require a notified body under IVDR may continue to place IVDs on the market assuming they had issued a declaration of conformity prior to the original May 26, 2022 deadline, introduce no significant changes to the product, meet all post-market surveillance and vigilance requirements, and register in EUDAMED as specified in the IVDR. Assuming that these requirements are met, the new transition dates are as follows:
- May 26, 2022 - All new devices and non-sterile self-declared devices
- May 26, 2025 - Class D devices
- May 26, 2026 - Class C devices
- May 26, 2027 - Class B devices and Class A sterile devices
IVD regulations outside of the EU
This article is specific to requirements in the EU. It is important to note that other countries, such as the United States, have their own regulations related to In Vitro Diagnostics that are covered by the country’s medical device regulations. Each country with medical device regulations has its own classification scheme that may cause your device to be regulated in a different way. During the initial phase of planning for global commercialization of a product and throughout the product life cycle, it is imperative that you consider international regulations, their classification schemes, and the registrations that each country will require.
For additional information, The ultimate guide to EU MDR and IVDR general safety and performance requirements and also The Ultimate Guide to EU MDR/IVDR UDI.
CE marking guide for medical devices in the European Union
This article is an excerpt from the CE marking guide for medical devices in the European Union.
Table of Contents
- What is CE marking?
- Why is CE marking important?
- CE marking responsibilities
- What countries require or accept CE marking?
- Which medical devices require a CE mark?
- Technical documentation
- What are the costs associated with CE marking?
- How do you apply the CE marking?
- CE mark and UDI
- Does the CE mark expire?
- Do I need to CE mark my software?
- Final steps
CE marking is a symbol that consists of “CE, “ which is the abbreviation of the French phrase "Conformité Européene" meaning "European Conformity". The term initially used to describe “CE” was "EC Mark" but it has officially been replaced by "CE marking" according to the EU Directive 93/68/EEC. CE marking is used in all EU official documents, although you will still see "EC Mark" being used in common language. If you are using EC Mark in your documentation, you should change that terminology to CE marking in the future.
The letters ‘CE’ appear on many products traded on the Single Market in all the member states of the European Union plus Iceland, Liechtenstein, Norway and Switzerland. Simply put, The CE mark is a mandatory compliance mark, informing the consumer that the product is compliant with all applicable EU directives and regulations where the CE mark is required.
The Single Market was established in 1993 and is still considered one of the most significant achievements of the European Union. The main goal was to ensure the movement of goods and services freely within all the member states and to establish high safety standards for consumers. The CE mark indicates that goods and services do not need to be verified when shipping into another member country. To further support this movement, in April 2011, the Single Market Act was established to boost growth and strengthen confidence in the economy even further.
CE marking is required for many types of products, not just medical devices. The CE symbol can be found on bicycle helmets, toys, laptop batteries, wheelchairs, construction equipment, gas appliances and cell phone chargers - to name a few. CE marking is required for products manufactured anywhere that are sold in the EU, and only for those products for which EU specifications exist and require CE marking. The CE marking signifies that the product has been found to meet the general safety and performance requirements (GSPRs) of the European health, safety and environmental protection legislation and allows the product to be sold in the EU.
Manufacturer responsibilities for CE marking
Medical device manufacturers are responsible for properly and legally CE marking products before they leave the warehouse.
Most Class II and III medical devices, along with IVDs and some Class I devices, require a conformity assessment performed by a Notified Body to ensure that all legislative requirements are met before it can be placed on the market. Manufacturers of most Class I devices can self assess conformity. This process needs to demonstrate that all the legislative requirements are met, including any testing and inspections, and that all necessary certifications are obtained.
The European Commission lists 6 steps that manufactures should follow to affix a CE marking to their devices:
- Identify the applicable directive(s) and harmonized standards - see EU standards for Medical Devices, In Vitro Diagnostic (IVD) devices, and Implantable Medical Devices.
- Verify product specific requirements using the essential principles identified in the above standards.
- Identify whether an independent conformity assessment by a Notified Body is necessary. Notified bodies will be required to verify compliance with relevant Essential Requirements for most medical devices classified as IIa, IIb, or III - along with sterile class I devices. See the Notified and Designated Organization (NANDO) database for available notified bodies.
- Test the product and check its conformity.
- Create and keep available the required technical documentation.
- Affix the CE marking and create the EU Declaration of Conformity.
Importer responsibilities for CE marking
If you are importing medical devices into the EU, it is your responsibility to review all the technical documentation and maintain a copy, or to make sure that it’s available to you upon request.
You should verify:
- That the device has been CE marked and that the EU declaration of conformity has been completed.
- That the manufacturer has designated and established an authorized representative.
- That the device is labeled appropriately and contains instructions for use (IFU).
- When applicable, that a UDI has been assigned to the product.
- Whether or not the product is registered in EUDAMED (registration is currently voluntary).
Take action:
- List your name and address on the device or packaging, in addition to the manufacturer’s information.
- Keep records of complaints, non-conformities, recalls, etc. on file.
- Report any noticed non-conformity or product complaints from end users to the manufacturer and authorized representative immediately.
- Maintain a copy of the EU declaration of conformity and any other relevant certificates.
Distributor responsibilities for CE marking
If you are a distributor, you are responsible for reviewing the technical documentation provided to you so that you can verify the product is safe to put on the local market. You must also be sure the product is labeled correctly with the CE marking symbol clearly visible. The technical file documentation contains all of the information that is necessary to show conformity of the product to the applicable requirements.
You should verify:
- That the device has been CE marked and that the EU declaration of conformity has been completed.
- That the device includes all the appropriate labeling, including instructions for use.
- That if imported, the importer has complied with all the EU regulations.
- When applicable, that a UDI has been assigned to the product.
Take action:
- Report any noticed non-conformity to the manufacturer, importer, and authorized representative immediately.
- If a product appears to be out of compliance to the regulations and could pose a serious risk, the information should be reported to the Competent Authority, and to the manufacturer, importer and authorized representative.
- Any complaints or reports from end users about the product should be reported to the manufacturer and, if necessary, to the importer and authorized representative.
Important note: If the importer or distributor markets the product under their own company name, then they become responsible for CE marketing, and take over that role from the manufacturer.
CE marking is mandatory when importing products into the European Union, which is part of the larger European Economic Area (EEA). The EEA Agreement, established in 1992 and made official in 1994, is an international agreement that enables the extension of the European Union’s single market to non-EU members. It consists of the 27 EU countries plus the four European Free Trade Association (EFTA) countries - Iceland, Liechtenstein, Norway and Switzerland. Today, the EFTA has 29 Free Trade Agreements (FTAs) with 40 countries and territories outside the EU. Because these countries operate in the single market, this allows free movement of goods and services across all of the EEA.
Source: European Environment Agency (EEA).
All medical devices sold in the EU require a CE mark. While a CE mark is not required for items such as chemicals and pharmaceuticals, it can be required for combination devices and medical device software. For these two situations, how do you know if your product requires a CE mark?
To continue reading this ebook, including an overview of CE mark costs, and the associated technical documentation/general safety and performance requirements (GSPRs) that manufacturers are required to maintain please register to download the full version
Ask us Anything ... about UDI!
Your UDI questions answered
Our first “Ask us Anything” webinar last week focused on the topic of Unique Device Identification (UDI). We had so many great questions that we couldn’t answer them all during the session! We have picked the most common questions and put them together here with the answers from our expert panel.
For additional information on this topic, see the following resources:
- Quick reference guide - global medical device UDI requirements and timelines
- BUDI-DI - Basic UDI explained
- The ultimate guide to the EU MDR/IVDR unique device identifier (UDI) system
- Watch a replay of the Ask us Anything about UDI webinar!
Q: I’ve heard that the EUDAMED timeline has been pushed back. Is that true?
Yes, that is true. The European Commission recently pushed back EUDAMED deadlines by one year. It is important to note that this does not affect UDI labeling requirements and timeframes, only the mandatory entry of UDI data attributes into EUDAMED (now Q2 2026). The industry should not relax their efforts in regards to collecting and submitting UDI data. We make every effort to keep our Quick reference guide: global UDI requirements and timelines up-to-date and deadlines and regulations change.
Q: Are we expecting the FDA to be actively enforcing UDI regulations against class I manufacturers after September 2022?
Following this session, the FDA announced that they do not intend to enforce GUDID submission requirements for class I and unclassified devices, other than implantable, life-supporting, or life-sustaining devices.
Q. What governing body controls the correctness of GUDID data?
While the manufacturer is responsible for the accuracy of data they input into GUDID, the FDA is the agency that oversees the requirements.
Q: I have a UDI for a software device (SaMD) that includes features that will be included in a clinical study and features that will be part of the commercialized release version. Do I need to have separate UDIs or can I add the IDE label under a single UDI for the clinical version and keep the UDI for the market released version?
To fully answer this question, we might need a little more information. However, if the device involved in the clinical study is not released (i.e. marketed), then it would not require a UDI. If additional features are introduced during the clinical trial and a new product is released as a result, then a new UDI would be required.
Q: Can you provide insight into machine-to-machine transmission of UDI information?
Currently, the U.S. UDI database, GUDID, has the capability to accept machine-to-machine data transmission. More information can be found on the FDA website here. Most other major markets are working on providing this capability.
Q: How do I make a UDI implementation plan for the QMS process? What things need to be covered?
This is a broad question and there could be many different answers based on your product, QMS, and company structure. Generally speaking:
- UDI should be integrated within your Design Controls/Development processes, including the company product release process. You cannot market your device into a country without complying with their UDI requirements. Some countries require UDI information as part of the device registration process (e.g., EU and China).
- The company needs to establish accounts with the Issuing Agency (e.g., GS1) and with the country UDI databases (e.g., U.S. FDA GUDID)
Main things to consider:
- Labeling: Barcoding software and a process for creating the labeling
- Product UDI data attributes: All product related characteristics that are required to be recoded in the country UDI database. The specific characteristics/attributes can be found in the various country UDI guidance documents.
- Define methods for capturing, storing, controlling, transmitting data attributes (e.g., a RIM system, PLM system or both).
- Establish processes for maintaining the data including the country requirements (timeframes) for updates to the UDI data and periodic audits (reference country UDI guidance documents).
Q: How do I know what UDI information needs to be supplied to regulators?
The FDA regulations and data dictionary are mature and include information and required data fields to complete successful transmission of data. Data field details include information on whether data is required or conditional on other data, lists of standardized values, and guidance on the data that is expected for each field. EUDAMED has taken a similar approach, and also includes information that is expected for BUDI. The EUDAMED data dictionary is still in flux. We expect a similar approach from other countries.
Q: When you are implementing UDI and have a kit or system pack, do you need to have a separate UDI for the device, accessories for that device, and a separate UDI for the kit (which would have those components)?
Generally, the UDI is assigned at the lowest sellable product level. In the case of kits, procedure packs, or systems - each would be given a unique UDI as well.
Q: Is the GUDID barcode and the UDI barcode on the product label the same?
There is no GUDID barcode, but the information on the UDI barcode is contained within the GUDID database. The barcode or human-readable numbers provide high level information about the device. They act as an access key to all of the device attribute data within the GUDID database. The expected barcode on the product is the full UDI including the device identifier (DI) and the production identifier (PI). The GUDID is the FDAs regulatory database where labelers are required to submit information about the UDI DI.
Oh No! How to recover lost medical device certificates
Imagine that you have started working in a new position at a medtech company, and you’re trying to organize your current knowledge of the products, registrations, and information now under your charge. However, something feels off, and you realize that you cannot find all of your company’s current medical device certificates.
Lost medical device certificates are a more frequent occurrence in our industry. In fact, it’s my experience with the frustration of recovering lost medical device certificates that finds me writing this brief post about what it’s like to lose a medical device certificate and the strategies I’ve used to recover the lost information. We’ll even discuss what you can do to prevent having to live “The Tales of the Lost Document” in the future.
How do certificates get lost?
The most common factor in misplaced or lost certificates is human error stemming from lax filing systems with disjointed practices and team member departures. Many large medtech companies have a complex structure of emails and document storage sites (such as Sharepoint or Dropbox). These storage sites are often siloed, with different regulatory teams having varying excel spreadsheets, folder structures, and naming conventions to organize their regulatory submission workload.
In many companies, managing global medical device certificate information is a manual and burdensome process. The problem could be as simple as a file-naming mixup, or it could be a document your company hasn’t needed the certificate in so long that they simply lost track of it. Now let's talk about ways you can recover your lost certificates or information that’s missing from them.
How can you recover lost certificates?
The good news is that you can recover your lost documents in many cases, though it may take a bit of legwork. There are two primary strategies for finding lost medical device certificate information, and utilizing both is the best way to ensure you recover your lost certificates and information.
The first and often most successful pathway is to search through your internal resources.
Strategies for Searching through internal resources:
- Have you found every Sharepoint site used in the past five years?
- Have you checked previously recorded submissions of that medical device?
- Have you contacted IT to see if they can recover emails from a departed colleague? They might have sent emails with the certificate attached to them. Many regulatory professionals email a copy of the certificate to announce to the marketing teams they can begin product sales.
- Are you working with a distributor? Contact them and request knowledge on all of the current medical device certificates.
Other channels are available if you can’t find what you’re looking for in your company’s local storage.
The second strategy is to use governmental medical device registration databases. For example, if you’re registration information for a class 2 medical device, you could look it up in the FDA 510(k) database. Here are some examples of the international regulatory databases that may help in your situation:
United States - FDA
Canada - Health Canada
European Union
Australia
Belgium
Brazil - ANVISA
Singapore - Health Sciences Authority
Saudi Arabia - SFDA
If you are looking for a certificate that was approved by a notified body and not in a current database, you can contact the notified body, but you should expect to pay a fee for their services. It’s also important to note that not all countries and regulatory bodies have a database that allows companies to look up their certificates.
You may also have to accept that you can’t recover your medical device certificate or information. Not every country has a medical device database, and even those with a database often don’t contain the certificate itself. That’s why it’s critical to the efficacy of your RA operations that your team has the tools necessary to store, track, and share regulatory information and documents securely and efficiently.
How do you make sure this never happens again?
We understand that trying to find missing certificates is an administratively heavy burden. When you can’t find a certificate or its missing information, there’s no way to tell whether it’s lost forever until you’ve exhausted all possibilities and channels, which is why it’s much better to prevent losing documents altogether.
With the right tools, your RA team can store, locate, and share documents in a secure and largely automated environment. That means no more awkward conversations where you have to tell your boss you can’t find the expiring certificate for your company’s flagship medical device.
Rimsys is regulatory information management (RIM) software created by RA professionals from the medtech industry with RA professionals in mind. It empowers RA teams to store and track all certificates by product and country and even provides a portal where you can see all of your regulatory documents in a centralized view. Furthermore, you’ll receive emails when a certificate is about to expire, allowing you to act in ample time to prevent lapses in compliance and continue market access per your company’s global device strategy.
Learn more about how a RIM system can help your organization keep track of all its regulatory information in our “RIM Buyer’s Guide.”
