Featured
Rimsys Announces Rimsys AI to Eliminate Repetitive Tasks and Enhance Decision-Making for MedTech Regulatory Teams
Rimsys, the leading Regulatory Information Management (RIM) platform for the MedTech industry, today announced the launch of Rimsys AI, a suite of embedded artificial intelligence (AI) agents.
The beginner's guide to the FDA 510(k)
This article is an excerpt from The beginner's guide to the 510(k) ebook.
Table of Contents
- Introduction
- 510(k) basics
- Contents of a Traditional 510(k)
- 510(k) submission and timelines
- Other 510(k) forms
Congratulations! You have successfully developed a new medical device. Now you need to take it to market. In the United States, this often means submitting a 510(k). A 510(k) is a structured package of information about your device and its performance and safety that you submit to the Food and Drug Administration (FDA) for “clearance” before you can sell your device in the U.S. In order to receive clearance from the FDA, your 510(k) will need to demonstrate that your medical device is substantially equivalent to another legally marketed device (called a predicate device). The substantial equivalence approval process is a simple equation that looks something like this:
The 510(k) is generally the most efficient route to market clearance in the U.S. because you show your device is safe and effective based on this substantial equivalence standard, instead of needing to present more extensive clinical trial data.
There are three types of 510(k): Traditional, Abbreviated, and Special. This eBook will begin with a general overview of the 510(k) process, including its purpose and benefits. Next, we will explore the Traditional 510(k) and the sections and components required in depth. Finally, we will look at the Special and Abbreviated 510(k).
FDA: background and device oversight
Before we explain what a 510(k) is let’s first talk generally about the FDA and device oversight. The FDA is the U.S. governmental agency responsible for overseeing medical devices, drugs, food, and tobacco products. When it comes to medical devices, the FDA’s mission is to “protect the public health by ensuring the safety, efficacy, and security of…medical devices.” At the same time, the FDA also has an interest in “advancing public health by helping to speed innovations.” In other words, the FDA’s goal is to make sure devices are safe and effective for public use, while also ensuring that devices have a quick and efficient path to market.
In order to achieve this balance of safety and efficiency, the FDA has three different levels of oversight depending on the risk level of the device: (1) exempt from premarket submission, (2) Premarket Notification, also known as 510(k), and (3) Premarket Approval (PMA).
When is a 510(k) required?
A 510(k) is required for medium risk devices that have a predicate on the market which can be used to demonstrate the safety and effectiveness of the new device. Meanwhile, a PMA is required for high-risk or novel devices which require a higher level of scrutiny to be confirmed safe and effective.
A 510(k) is not only required for new devices, but also for devices that have been modified in a way that could impact safety or effectiveness. This could include changes to the:
- Design
- Components
- Materials
- Chemical composition
- Energy source
- Manufacturing process
- Intended use
You must submit your 510(k) at least 90 days before marketing the device.
What Exactly is Substantial Equivalence?
Now that we know what a 510(k) is, let’s talk about the substantial equivalence standard. You’ll recall from the introduction that your 510(k) must show that the new (or modified) device is substantially equivalent to at least one other legally marketed device, called a predicate device. Substantial equivalence looks at the intended use and the technological characteristics of the two devices.
More specifically, you must show:
- that the new device has the same intended use as the predicate, and
- the differences between the two devices do not raise questions about the safety and effectiveness of the new device.
Now let’s take a closer look at intended use and technological characteristics.
Intended use
Intended use means the general purpose or function of the device. The FDA will look at your proposed labelling and your Indications of Use section of the 510(k) to determine the intended use of your device (this is covered in Chapter 2). Intended use includes:
Technological characteristics
Once the FDA has determined that a predicate device exists and that the new device and the predicate device have the same intended use, it will move on to compare the technological characteristics. Technological characteristics include:
- Materials
- Design
- Energy source
- Other device features
The two devices do not have to be identical, and in fact they almost never are. The key here is to demonstrate that any differences do not have a significant impact on safety or effectiveness. Here’s what to cover when you compare your device’s technological characteristics with that of the predicate device:
Overall description of the device design
- Engineering drawings or diagrams to explain the device and component parts.
- List of component parts and explanation of how each component contributes to the overall use and function of the device.
- Physical specifications: dimensions, weight, temperature, tolerances, etc.
Materials
- Detailed chemical formulation used in all materials of constructions (especially those that come into contact with a patient).
- Any additives, coatings, paint, or surface modifications.
- How materials have been processed and what state they’re in.
Energy Sources
- Use of batteries, electricity, etc.
Other technological features
- Software/hardware
- Features
- Density
- Porosity
- Degradation characteristics
- Nature of reagents
- Principle of the assay method
In deciding whether the differences in technological characteristics impact safety or effectiveness, the FDA will typically rely on descriptive information about the technological characteristics as well as non-clinical and clinical performance data.
Let’s look at an example: A manufacturer submits a 510(k) for a new type of contact lens. Both the new device and the predicate device are indicated for daily wear for the treatment of astigmatism. The predicate device is only available in a clear lens, but the new device comes in a line of colors, including purple tinted lenses.
Who is responsible for submitting a 510(k)?
The following four types of organizations may be responsible for submitting a 510(k):
Manufacturers
- End-of-line device manufacturers who will be placing a device on the U.S. market.
- Note: Does not apply to component part manufacturers unless components will be marketed independently.
Specification developers
- Companies that develop the specifications for a finished device which has been manufactured elsewhere
Repackers or relabelers
- Required to submit a 510(k) if they significantly alter the labeling or condition of the device, including modification of manuals, changing the intended use, deleting or adding warnings, contraindications, sterilization status.
- Note: This is rare. The manufacturer, not the repackager or labeler, is typically responsible for the 510(k) submission.
Importers
- Importers that introduce a new device to the U.S. market may need to submit a 510(k), if it hasn’t already been submitted by the manufacturer.
Now that we’ve covered the basics, let’s explore what actually goes into your 510(k).
A Traditional 510(k) should contain all the following components in the list below. In some cases, a particular section may not apply to your device. When that happens, it’s a good idea to include the section anyway and just state “This section does not apply” or “N/A” under that heading.
To continue reading this eBook including a detailed walk-through of all the Traditional 510(k) components, submission requirements and timelines, and an overview of the other 510(k) forms including the Abbreviated 510(k) and the Special 510(k), please register to download the full version
The ultimate guide to the China UDI system and database
This article is an excerpt from The ultimate guide to the China NMPA UDI system and database ebook.
Table of Contents
- Overview
- UDI basics and benefits
- UDI format requirements and issuing entities
- UDI database and submission requirements
- Implementation of UDI and the UDI database in China
The current Chinese medical device regulatory regime kicked-off in 2014 with the Regulation on Supervision and Administration of Medical Devices. This core set of registration requirements, modeled after the United States and European Union systems, established a set of device classifications (class I, II, and III) based on risk and procedures for obtaining market clearance for each type of device.
Medical devices in China are regulated by the National Medical Products Administration (NMPA). Class I devices, such as clinical laboratory equipment or non-invasive skin dressings, require only notification to the NMPA for marketing authorization, and that authorization does not expire. Class II and III devices such as implantable devices or devices with a measuring function require full registration and a formal review before market clearance can be obtained.
These initial regulations have been expanded since their introduction, adding accelerated pathways to market for certain products in certain regions, easing acceptance of clinical data from overseas, and more specific roles and responsibilities for local agents of international manufacturers. In addition, in 2019, the regulations added a provision that medical devices carry a unique device identification (UDI). China’s UDI requirements are similar to those in the US and European Union. They establish specific device ID and labeling requirements, as well as a central, state-administered database of devices.
This eBook walks through the basics of medical device UDIs, the specifics of China’s implementation, and how MedTech companies who market their devices in China can prepare for the full rollout of these regulations in the coming years.
A UDI is a unique alphanumeric code that is designed to identify medical devices sold in a particular country/region from manufacturing, through distribution, to use by a patient. Like other aspects of the medical device regulatory regime, the UDI system in China follows the approach taken by the United States FDA and European Commission, and is based on the guidance from the International Medical Device Regulators Forum (IMDRF). Generally, UDI systems are designed to improve patient safety and optimize care by:
- Increasing the traceability of medical devices, including field safety corrective actions
- Providing an unambiguous identification method for medical devices throughout distribution and use
- Making adverse event reports more accessible
- Reducing medical errors by providing detailed information related to the device
- Simplifying medical device documentation and making it more consistent
There are three components to the UDI system in China:
- UDI code: The actual UDI code can be assigned by one of three (3) issuing agencies and contains information about the product, it’s expiration date, and the manufacturing batch/lot it’s associated with.
- UDI labeling: Put simply, medical devices must carry the UDI code on them. The regulations stipulate how devices and their packaging must be labeled for compliance.
- UDI database: In addition to labeling, all device UDIs must be submitted to a central database that is administered by the NMPA.
The following sections explore each of these components in more detail.
The UDI code
The first element of the UDI system is the code itself. The UDI code is the alphanumeric identifier that is associated with a specific medical device. UDI codes have two (2) elements to them, the UDI device identifier (UDI-DI) or static portion, and the UDI production identifier (UDI-PI) or dynamic portion. You can see the two components in the UDI diagram below:
The UDI-DI contains information about the issuing entity—the organization that is authorized to assign UDI codes. In China, this can be one of three entities: GS1, an international barcode and electronic data interchange standards organization, and two domestic organizations: the Zhongguancun Industry & Information Research Institute (ZIIOT), and AliHealth. Additional details about the issuing agencies are covered in Chapter 2. In addition, the UDI-DI contains information about the manufacturer and the specific model or version of the device.
The UDI-PI contains information about the manufacturing and production of the device. This typically includes information about the lot or batch number in which the device was manufactured, the manufacturing date and expiration date for the device (if applicable), and the specific serial number for the device. Here you can see all of the components marked up using the same UDI example:
Note that each packaging permutation and level for a given device will need to be assigned its own UDI. So for example, let’s say that a company manufactures 5ml enteral (oral) syringes in two packaging options: 1 – packaged individually and 2 – packaged in a box of 5. Each packaging option would need its own UDI, despite the fact that the underlying product is the same.
Now looking at packaging levels, let’s assume that the manufacturer packages the single syringe offering into boxes of 6, and again into larger containers of 24. Each of those packaging options needs its own UDI as well.
Labeling
In addition to obtaining UDI code for each device as outlined in the previous section, medical device manufacturers are required to ensure that devices are appropriately labeled with the assigned UDI. This label is called the UDI Carrier. The UDI is represented in two forms on the UDI Carrier: a machine-readable form and a human-readable form.
The machine-readable form or automatic identification data capture (AIDC) is a barcode or some other technology that can be used to automatically capture UDI information. The NMPA regulations support 3 types of machine-readable formats: 1-dimensional barcode, 2-dimensional barcode, and radio-frequency identification (RFID).
The regulations note that “use of advanced automatic identification and data collection technologies is encouraged”—prompting manufacturers to use more modern 2D and RFID machine-readable carriers where possible. Note, however, that if a device uses RFID, the UDI Carrier must also include the UDI in barcode format.
The human-readable form or human-readable interpretation (HRI) is the numeric or alphanumeric code for the UDI that can be read and manually entered into systems.
The UDI Carrier should be included on the device and on all levels of packaging. The UDI Carrier must be clear and readable during the operation and use of devices. If there isn’t room on the device for both the human and machine-readable forms of the UDI, then manufacturers should prioritize the machine-readable form.
UDI database
The third component of the NMPA UDI system is the UDI database. This is a centralized database of UDI and product information, administered by the NMPA. Manufacturers are required to submit UDI information into the database within 60 days after a product is approved (for sale in China) and before it is commercialized. The database contains a more detailed product record than what is included in the UDI itself, and it is the responsibility of the manufacturer (and/or their in-country representative) to submit the information correctly, and ensure that it’s kept up to date.
Chapter 3 of this eBook goes into detail about the specific fields and data requirements for UDI database submissions.
To continue reading this eBook including information about UDI format requirements and issuing entities, implementation timelines, and affected device types, please register to download the full version.
The ultimate guide to the EU MDR/IVDR unique device identifier (UDI) System
This article is an excerpt from The ultimate guide to the EU MDR/IVDR UDI ebook.
Table of contents
- Overview
- UDI basics and benefits
- UDI format requirements and issuing entities
- UDI rules for specific device types
- Implementation of UDI and UDAMED in the European Union
- US vs EU UDI comparison
The EU Medical Device Regulation (2017/745) (“MDR”) and EU In Vitro Diagnosis Regulation (2017/746) (“IVDR”) introduce two new systems for information exchange: UDI (Unique Device Identifier) for device identification and EUDAMED (European Databank on Medical Devices) to centralize and disseminate information. UDI is a specific code assigned to all devices and higher levels of packaging. This will allow for devices being sold in the European market to be identified and traced through a globally harmonized approach. EUDAMED is the IT system developed by the European Commission to replace the EUDAMED2 database previously in place under the Medical Device Directives (MDD). EUDAMED is a multi-functional system that will be used to coordinate device registration, provide information about devices to industry professionals and the public, and highlight necessary safety details.
The EU MDR and IVDR UDI system is based upon the guidance of the International Medical Device Regulators Forum (IMDRF). It’s a globally harmonized system that’s designed to increase patient safety and optimize care.
UDI system goals
Increase patient safety
- Improve tracing of devices
- Reduce the presence of counterfeit devices
Ensure access to accurate information
- Unambiguous identification of devices throughout distribution and use
Improve post-market surveillance
- Improve accessibility of adverse event reports
Enhance supply chain Management
- Streamline supply chain process and inventory management
- Simplify medical device documentation processes
The UDI system has four key elements
Element 1: Assignment of UDI (UDI Components)
The first element of the UDI system is the assignment of a UDI. The UDI is a code of alphanumeric characters that acts as the access key to information about a specific medical device on the market. The EU MDR and EU IVDR requires that a UDI be assigned to all medical devices except for custom-made or investigational devices. There are three components of a UDI:
- Basic UDI-DI
- UDI (consisting of UDI-DI and UDI-PI)
- Packaging UDI (Note: This is not an official term used in the EU MDR and IVDR, but we’re using it to help explain the concept. The Packing UDI is part of the UDI itself.)
1. Basic UDI-DI
The Basic UDI-DI identifies the device group that a particular device fits into. A device group is a group of products that all share the same intended purpose, risk class, essential design, and manufacturing characteristics. A device group is generally classified by medical device manufacturers as a “Product Family” or “Product Category,” depending on the internal nomenclature used within the company. The Basic UDI-DI functions as a parent or higher-level descriptor of a device.
NOTE: There can only be one Basic UDI-DI per UDI-DI.
The Basic UDI-DI is not printed on the product itself or on the packaging of a product, but rather it must be included in the following documents and applications:
- Certificates (Including Certificate of Free Sale)
- EU Declarations of Conformity
- Techical Documentation
- Summary of Safety and Clinical Performance
2. UDI (UDI-DI and UDI-PI)
The second component is the UDI itself, which consists of two parts:
Device Identifier (DI)
Production Identifier (PI)
The UDI-DI (Device Identifier DI, also referred to as “static”) identifies specific, detailed information about a particular device. If any of the below details should change, the device will need a new UDI-DI.
- Name or trade name of the device
- Device version or model
- If labelled as a single use device
- Packaged as sterile
- Maximum number of uses
- Need for sterilization before use
- Quantity of devices provided in a package
- Critical warnings or contra-indication
- CMR/endocrine disruptors
NOTE: There can be several UDI-DIs for one Basic UDI-DI.
Meanwhile, the UDI-PI (Production Identifier PI, also referred to as "dynamic") contains manufacturing information (including serial number, lot/batch number, software identification, and manufacturing or expiry date or both types of dates.)
To better illustrate this concept of Basic UDI-DI and UDI (UDI-DI and UDI-PI), let’s use a syringe as an example. The Basic UDI-DI would identify the category of a syringe, for example, "Enteral (Oral) Syringe."
A 5ml Enteral (Oral) Syringe – Sterile (Color: Purple) would get a unique UDI-DI and a 10m Enteral (Oral) Syringe – Sterile (Color: Orange) would get a unique UDI-DI. Both products would be associated to the same Basic UDI-DI. In this case, the "Enteral (Oral) Syringe," which defines the category.
Each time that 5ml Enteral (Oral) Syringe – Sterile (Color: Purple) is manufactured at the same revision, it will get a new UDI-PI per lot. See the graphic below.
Each product is identical and therefore has the same UDI-DI. However, the UDI-PI changes to reflect the manufacturing date, lot number, expiry date, and serial number, as applicable.
The UDI will contain all device-specific information and have the same functions as the comparable database (GUDID) of the United States FDA. The main difference (in EUDAMED) is that the UDI data is divided into components of Basic UDI-DI, UDI, and Packaging UDI.
3. Packaging UDI
The third component of UDI is the Packaging UDI. (Note: This is not an official term used in the EU MDR and IVDR, but we’re using it to help explain the concept.)
Each level of packaging, except shipping containers, must receive its own unique UDI. Packaging UDI refers to the unique UDI assigned to higher levels of packaging instead of the device itself.
In the event of significant space constraints on the unit of use packaging, the UDI Carrier may be placed on the next higher packaging level.
Returning to our earlier example of syringes, if a manufacturer first packages a single sellable syringe into an individual box, this package would receive its own UDI-DI and UDI-PI.
If then the manufacturer packages those individual boxes into containers of six (6), those containers would receive their own UDI-DI and UDI-PI.
And finally, if the manufacturer packages those six (6) containers into cases of four (4), those cases would receive their own UDI-DI and UDI-PI.
Each of those levels of packaging must be assigned its own UDI-DI and UDI-PI. The initial syringe did not change, but the way it is packaged did, therefore, requiring its own UDI-DI and UDI-PI.
Element 2: Placing UDI on the device and/or packaging
The second element to the UDI system is the placing of the UDI on the device or on its packaging through what is referred to as a “UDI Carrier.” The UDI Carrier is the part of the label that contains the UDI information that is applied directly to the device or included on the device packaging. The UDI Carrier should have both a machine-readable portion (AIDC) and a human-readable portion (HRI). (Specific details about each element of the UDI will be covered in Chapter 2.)
- Machine-readable form – AIDC – (Automatic Identification and Data Capture) is a barcode or other machine-readable technology that can be accessed automatically by scanning the UDI information.
- Human-readable form – HRI – (Human Readable Interpretation) is the numeric or alphanumeric code, which can be manually entered into the system for access to the UDI information.
If there are space constraints limiting the use of both the AIDC and HRI on the label, then only the AIDC is required to appear. However, on devices that are intended to be used in home-health care or other non-medical facility settings, the HRI would be required to appear.
Single-use devices may contain the UDI Carrier on its lowest level of packaging rather than on the device itself.
Reusable devices must include the UDI Carrier on the device itself, unless any type of direct marking would interfere with the safety or performance of the device, or if it is not technologically feasible to directly mark the device. If so, this should be properly documented in your design history file.
Most importantly, the UDI Carrier must be readable for the intended lifecycle of the device.
Below is an example of a GS1 AIDC and HRI barcode label.
Element 3: Storage of UDI information by Economic Operators
Storage of UDI information by "Economic Operators" is the third element of the UDI system. 2017/745 Articles 2(35), 22(1), and 22(3) define an economic operator as:
- A manufacturer
- An authorized representative
- A distributor
- An importer
- An investigator for clinical investigations
- A person who sterilizes systems or procedure packs
Class III, implantable device:
According to EU MDR 2017/745 Annex II, the manufacturer shall keep an updated list of all UDIs that it has assigned. Economic operators and all health institutions are required to store, preferably by electronic means, the UDI of all the devices for which they have supplied or with which they have been supplied.
For Devices Other than Class III:
Member States are encouraged, and in some cases require, health institutions to store, preferably by electronic means, the UDI of the devices with which they have been supplied. The UDI must also be included in any field safety notice for reporting serious incidents and field safety corrective actions.
The EU MDR and EU IVDR also give the European Commission authority to make additional requirements regarding the submission or maintenance of UDI information. In making those decisions, the European Commission must consider six (6) areas:
- Confidentiality and data protection
- Risk-based approach
- Cost-effectiveness of the additional measures
- The need to avoid duplications in the UDI system
- The needs of the healthcare systems of the member states
- Harmonization with other medical device identification systems
To continue reading this eBook including information about the EUDAMED database, UDI format requirements and issuing entities, implementation timelines, and key differences between the EU and US UDI systems, please register to download the full version
%2520(1755%2520x%2520550%2520px)%2520(855%2520x%2520268%2520px).avif)
Why a RIM System is Critical to Successfully Support MedTech M&A Activities
There was significant M&A activity in the MedTech sector in 2024, and the industry is predicting another big year for mergers and acquisitions. As MedTech companies aim to expand their product lines, enter new markets, innovate faster, and remain competitive in a rapidly evolving space, mergers and acquisitions can be attractive and cost-efficient options. Additionally, some manufacturers are choosing to divest parts of their business to hone their focus, drive additional investment in other key areas, and optimize operations.
For the regulatory affairs professional, M&A activities can be anything but efficient. An influx of new products, registrations, and regulatory information to maintain can wreak havoc on RA teams who are already struggling to effectively manage and maintain compliance amid a seemingly constant state of regulatory change.
In an increasingly complex regulatory landscape, many MedTech teams are turning to RIM systems to help them centralize regulatory information across the business, automate time-consuming, manual processes, and strengthen global compliance. These benefits are even more palpable for companies undergoing mergers, acquisitions, and divestitures, giving them streamlined, fully visible regulatory information management that can scale with their evolving business needs and additional regulatory information to manage.
Case Study: Large, Publicly Traded Device Manufacturer Navigates Product Line Divestiture with Ease
A large, publicly traded manufacturer of products for pain management, digestive health, and IV therapy was in the process of divesting one of its product lines to another company. As a result, some of their regulatory employees were transitioned to the company that purchased its product line. The customer leveraged Rimsys’ unique Linked Accounts feature, which allows users to grant external stakeholders controlled access to Rimsys, to give those impacted access to the 100+ registrations associated with the divested products. As a result, the transitioned employees lost no access to their respective products and are able to manage, review, and approve those registrations as they normally would.
“Linked Accounts is a fantastic feature that I didn’t originally appreciate as much. Rimsys made it easy for us to identify the products impacted by the divestiture and provide access to those who need them. It has been a bright spot in the sea of headaches both teams are experiencing when trying to review and approve information in other systems.”
-Program Manager, Regulatory Information Management
When the transaction is complete, the customer will easily be able to export the list of registrations by product tag and archive the registrations in Rimsys for easy management and visibility. The transitioned employees will also still retain access to the information they need in Rimsys as they work to implement their own Rimsys solution to manage those registrations.
Navigating Business and Regulatory Changes with RIM Systems
As the MedTech industry prepares for additional mergers, acquisitions, and divestitures this year, getting a solid regulatory information foundation in place is critical for a successful transition and ongoing compliance. Yet, many MedTech RA teams are using manual processes and siloed systems to manage regulatory information.
One of Rimsys’ goals is to serve as a strategic partner to MedTech RA teams, helping them better understand their current RIM state and the steps they need to advance their processes. This includes the implementation of a RIM system such as Rimsys to centralize their regulatory information, enable easy collaboration with internal and external stakeholders, and automate time-consuming manual processes for strengthened global compliance.
See our Guide to MedTech RIM Maturity, which provides our RIM Maturity Model Framework, for ways to better assess your organization’s current RIM state and incrementally reach new milestones.
Rimsys has helped global MedTech leaders navigate business and regulatory change with unified RIM software that provides full visibility into their regulatory activities. If you’re looking to stay ahead of upcoming strategic activities or are simply looking for a better way to manage your information amid increasing complexity, contact us to learn how Rimsys can help you streamline and automate your processes for long-term success.
Rimsys POV: Updated EUDAMED timeline
The EU Commission has recently announced updates for completing and implementing EUDAMED based on amendment 2024/1860. This article outlines the current EUDAMED timelines and our point of view on these timelines to help industry prepare accordingly.
Current EUDAMED Timelines:
- The target date for the first mandatory application of functional EUDAMED modules is still January 1, 2026. The Vigilance module is expected to be mandatory beginning in Q3 2026 with full EUDAMED functionality planned for Q2 2027.
- The Actor, UDI & Devices, Certificates, and Market Surveillance modules are currently under audit. The independent Minimum Viable Product (MVP) audit is intended to assess and confirm functionality and interconnectivity of the modules that are deemed audit ready. This audit is foreseen to be completed by Q2 2025.
- Mandatory use of each module is to commence six (6) months after the module is declared fully functional through the independent audit and publication in the Official Journal of the European Union (OJEU). The Actor, UDI & Devices, Certificates, and Market Surveillance modules are expected to be declared fully functional at the end of Q2 2025, leading to their mandatory application date of January 1, 2026.
- The Actor, UDI & Devices, Certificates, and Market Surveillance modules are expected to be declared fully functional by the end of Q2 2025 and mandatory for industry use on January 1, 2026.
- The Vigilance module is not part of the ongoing MVP audit and will not be declared fully functional along with the previously mentioned modules. The revised timeline indicates that the audit of that module will occur between Q2 and Q3 of 2025, with the goal of the mandatory application date in Q2 of 2026.
- The development of the Clinical Investigation/Performance Studies (“CI/PS”) module is intended to continue through Q3 2026. An audit to assess the CI/PS module together with the other five (5) modules will be completed once the CI/PS MVP has been developed.
Photo courtesy of the European Commission
Here is how Rimsys views the impact of this announcement for each stakeholder group:
Rimsys
UDI is front of mind as well as future interaction with the Vigilance module. There is no change to our current plans, as Rimsys will continue to develop UDI and Post Market Surveillance functionality regardless of the updated target dates. We also recognize the potential impact of establishing data transfer (DTX) capabilities to interact with EUDAMED in a machine-to-machine (M2M) capacity. With the publication of the final requirements needed for M2M DTX to EUDAMED, Rimsys is positioned to finalize our connection and deliver M2M capabilities as part of the EUDAMED solution.
Industry/customer
Since the European Commission(EC) has made multiple updates to EUDAMED timelines, we expect industry will have some reluctance to accept the new target dates. As a result, this could delay re-engagement with EUDAMED preparations. However, we do not expect the EC to push these updated timelines. Manufacturers that don’t have a plan to submit data to EUDAMED by Q2 this year should expect significant challenges to meet these deadlines. With the audit of expected modules underway with the associated technical documentation published, Rimsys recommends taking steps to organize regulatory data now and submit their information early to all available EUDAMED modules.
EU Commission
The EC strongly recommends industry continues to establish its solution and to submit data on a voluntary basis. Do not wait. The commission’s position is that submitting data early will give companies an advantage by having their data “in” before the onslaught of the entire global MedTech industry, all trying to add data at the same time EUDAMED becomes mandatory. These companies will also be in front of the line to work with the commission resources if data submission issues occur.
* Note - this article includes regulatory interpretations and opinions from the Rimsys team. We try to be as informative as possible, but this information isn’t intended to serve as a substitute for official guidance from regulatory authorities.
%2520(1).avif)
Using EUDAMED as the Foundation for a Global UDI Strategy
If your company is selling medical devices in the European Union, you’re likely thinking about EUDAMED. If you’re not, it's time to start. Come January 2026, medical device manufacturers will be required to submit their UDI data to EUDAMED. EUDAMED’s data requirements and interconnectivity are complex. Not only is it easy to underestimate the time it will take to organize and verify UDI data, but many manufacturers are still using manual processes such as spreadsheets or internally built systems to manage this information. And with a number of organizations treating UDI data management and submission as an IT or supply chain process, some RA teams don’t even know where their UDI data is.
Getting your UDI data EUDAMED ready for submission by January 2026 is going to take some time, but there is a tremendous opportunity amidst the extensive preparation. With a little bit of foresight, RA teams can position the data output of their EUDAMED compliance project as the foundation for a global UDI program. Here are some reasons why using EUDAMED as the primary building block for a global UDI strategy will enable long-term success:
The product data needed for EUDAMED can be applied to current and future global UDI requirements
With many required data attributes and Basic UDI family groupings, establishing EUDAMED compliance for UDI is going to take some careful planning, detailed organization of current data, and careful consideration of your regulatory strategy for the European market. Many manufacturers need to start with the basics: locating current UDI data to understand how it is currently managed and transmitted to the respective regulatory bodies. This process is also going to require an assessment of your UDI data. Do you have information populated for all of the required attributes?Is this information current and accurate? Finding answers to these questions is going to take thoughtful collaboration among all stakeholders, but it’s also going to set your organization up with a solid data foundation that will help you meet additional market requirements.
It’s going to require an audit of your people, processes, and systems
Industry is focused on establishing UDI data in EUDAMED to align with current requirements for timing but transmitting your UDI interaction with EUDAMED is not a one-time process as it may be currently treated for other regulators. New devices, device changes, UDI data updates, and commercial availability may require EUDAMED updates or establishing new UDI profiles altogether. Are your current processes able to support you long-term? Manual processes are going to make it nearly impossible to keep pace and compliance, and internally built systems are going to require regular validation and subject matter expertise to keep up with evolving requirements and EUDAMED version updates. Taking the time to make sure you have the proper expertise and systems to maintain EUDAMED compliance will more easily allow you to scale your UDI management as your business grows and the regulatory landscape evolves.
The risks of non-compliance are too steep to ignore
Those who fail to submit UDI data to EUDAMED in line with the required timelines are at risk of audit findings, financial penalties, product delays, and worst of all, having to remove products from the market. Not only does product removal have lasting productivity, competitive, and economic impacts on the manufacturer, but it also decreases the availability of life-changing medical devices to end users. These risks are simply too significant to ignore and necessitate a comprehensive global compliance strategy that can meet the needs for EUDAMED and additional countries as global regulations change.
Additional regulators are establishing UDI requirements and big data technologies
As the value of UDI is recognized, More global markets are adopting UDI requirements to enhance the traceability of their devices and improve patient safety. For instance, Australia has established UDI requirements with mandatory compliance for data submission expected in the summer of 2025. Additionally, Rimsys expects the competent authorities from Switzerland and the United Kingdom to adopt their own UDI requirements following their exit from the European Union. Even though each regulator has varying requirements to some degree, organizing product data to meet EUDAMED’s robust set of data attributes and requirements will put you in a position to more easily meet additional global UDI requirements.
How Rimsys supports a global UDI strategy
Both the regulatory and technology requirements for UDI continue to grow in complexity. Rimsys has an integrated, automated UDI solution that provides medical device manufacturers the ability to manage their UDI data alongside their regulatory activities for total visibility and control.
Not only does Rimsys have the expertise necessary to help MedTech manufacturers navigate UDI data and transmission to EUDAMED for January 2026, but we're also dedicated to supporting MedTech companies with solutions and strategies that go beyond EUDAMED compliance to support a scalable and efficient global UDI program to meet the needs of evolving regulatory requirements. Rimsys provides MedTech manufacturers with a single-sourced UDI solution that allows them to manage their UDI data and status alongside regulatory activities.
Our novel Universal UDI® approach centrally stores common data attributes across global markets for simple management, reduced compliance risk, and increased efficiency. Using data established in Rimsys for EUDAMED as a baseline, we’re enabling MedTech companies to more easily meet additional global UDI requirements in a unified RIM solution that applies these common attributes between various market requirements (with more coming soon!):
Ready to increase your team’s efficiency and compliance with integrated and automated UDI management to support your long-term goals? Request a custom Rimsys UDI demo here!
%2520(1).avif)
Assessing RIM Maturity: Takeaways from our Expert Panel
Rimsys recently hosted a webinar, Assessing RIM Maturity for Your Regulatory Management Strategy, to help RA teams put together a practical RIM transformation plan for their MedTech company. Featuring industry leaders, Adrian Bishop of Boston Scientific, Brian Williams of KPMG, Steve Gens of Gens Associates, and James Gianoutsos of Rimsys, the discussion centered on the evolving MedTech regulatory information management (RIM) landscape, using the RIM Maturity Model Framework to guide your regulatory information management strategy, a RIM maturity case study, and AI’s role in regulatory information management. Here's a quick recap of the insights we discussed:
The Growing Need for MedTech RIM Modernization
The session underscored the increasing complexity of global regulatory requirements in the MedTech sector. From EU MDR to the adoption of EUDAMED, the shifting regulatory environment is pushing companies to modernize their RIM processes to ensure compliance and avoid operational inefficiencies. Steve Gens shared key insights from his 2024 World Class RIM Study research that by 2024, 52% of life sciences companies had fully adopted global RIM programs, a significant leap from 32% in 2022. However, many MedTech organizations remain in the early stages of RIM maturity, reflecting the need for process harmonization and robust digital solutions.
“The manual nature of spreadsheets and desktop authoring tools is no longer sustainable with all the different regulations and the global operating model that most companies have where you're trying to quickly get submissions out to different markets and then have to keep track of where your products are registered and where there are renewals, and where there are expiration dates. Having that information in informal spreadsheets and SharePoint sites is really not sustainable and creates a lot of compliance risks." - Brian Williams, KPMG
The RIM Maturity Model: A Framework for Transformation Progress
Our panel also explored the new RIM Maturity Model framework from Rimsys, which was built to help MedTech teams modernize their processes no matter where they are in their transformation journey.
“MedTech teams want to modernize their processes but don't know where to start from a business or data collection standpoint. They don't have a framework that takes their current processes into account." - James Gianoutsos, Rimsys
The RIM Maturity Model categorizes organizations into six levels based on their current regulatory information management processes:
- Level 0 - Unaware
- Level 1 – Aware
- Level 2 – Reactive
- Level 3 – Proactive
- Level 4 – Well Managed
- Level 5 – Optimized
Most MedTech teams fall between Levels 0 and 2, relying on siloed data and manual processes and reactive regulatory information management. Progressing toward higher maturity levels involves:
- Data Harmonization: Establishing consistent definitions and processes across business units.
- Process Transformation: Moving beyond "firefighting" modes to proactive regulatory planning.
- Technology Adoption: Implementing a RIM system that centralizes data, automates tasks, and facilitates cross-functional alignment. This is a critical step to reaching fully optimized regulatory information management.
“If you're considering a RIM adoption or are already going through one, make sure you understand your own expectations. You can't get to a spacecraft without without getting into a horse and buggy, Data collection and harmonization is milestone-driven and progression-based. You're not going to get to an optimized state on Day 1. But as long as you keep continuing to make well-informed decisions with your data and aligning internally on key terms in that data digitization processes, you will… get there." - James Gianoutsos, Rimsys
"As you're progressing, you need to be really thoughtful about the cost benefit of any initiatives that you're undertaking, Make sure that you have clear objectives that can be measured and that you can report value against and really just make sure that you create recognition with your management teams and with your operational teams that this is going to be a phased journey. You're not going to get there overnight and set expectations appropriately, but try to make measurable steps along the way. And as you do that, you start to build confidence, you build awareness and you build trust that you're delivering on the kind of the objectives that you set out to deliver. It's really a journey.” - Brian Williams, KPMG
Case Study: RIM Maturity Lessons from Boston Scientific
Adrienne Bishop from Boston Scientific shared her company’s journey toward RIM maturity. After previous attempts to implement global systems, the team learned to prioritize readiness, secure buy-in from stakeholders, and leverage external expertise.
“The added benefit of a MedTech solution is also that with these external partners, we can understand what is industry standard and that can help us with our change management.” -Adrienne Bishop, Boston Scientific
Key lessons they learned include:
- Start with Data: Define data fields clearly and cross-check sources to ensure accuracy.
- Limit Customization: Avoid over-customizing solutions that can hinder transformation; instead, adopt proven industry-standard processes.
- Invest in Change Management: Equip teams with the skills and mindset to embrace transformation.
Boston Scientific’s phased approach—beginning with foundational product registration data and expanding capabilities over time—demonstrates the importance of incremental progress. Boston Scientific, for example, has made strides in adopting a RIM system by focusing on transformation rather than harmonization alone, emphasizing the importance of cross-department collaboration and clear data governance.
"The solution we picked works for other people, so we can make it work for us. We also realized that what we were doing before maybe wasn't wrong, but it was definitely inefficient. We now have different inputs and different regulations. And now we need to change to get there." - Adrienne Bishop, Boston Scientific
AI and Automation in RIM
The panel distinguished the key differences between automation and AI, noting that while automation focuses on rule-based processes, AI serves as a good starting point for handling complex, abstract tasks. While AI can reduce time spent on tasks, it’s important for RA teams to verify the source information and the outputs for accuracy.
“There's a lot of anxiety about really what AI will deliver. But I think a lot of people that have been working with it, they see it as the virtual assistant or assisting. So it's more augmentation because there's a lot of concern.” - Steve Gens, Gens and Associates
Both automation and AI are important to regulatory modernization. Specific use cases include:
- Automation: Streamlining data ingestion, workflows, and compliance monitoring.
- AI: Mining historical regulatory data, collecting regulatory research, and enhancing regulatory intelligence.
Despite the attention around AI, the panel emphasized that its effectiveness hinges on high-quality, harmonized data. Poor data foundations can render even the most advanced AI tools ineffective, highlighting the need for a phased, data-first approach to digital transformation.
“There are some benefits you can definitely achieve with AI. But first and foremost data is going to be the most challenging yet the most effective way to get to that holy grail that I think everybody wants out of a regulatory information management system.” - James Gianoutsos, Rimsys
Looking Ahead: The Future of RIM As the MedTech industry advances
Achieving higher levels of RIM maturity will require strategic investment in technology, data, and talent. Organizations must treat RIM modernization as a holistic transformation, integrating robust processes and aligning cross-functional teams. With automation poised to play an increasingly significant role, companies that prioritize data governance and process maturity today will be well-positioned to leverage advanced technologies like AI tomorrow.
RIM modernization is not just a compliance imperative but a competitive advantage. By adopting a structured maturity model, focusing on data quality, and embracing RIM solutions like Rimsys, MedTech organizations can streamline regulatory processes, reduce risk, and drive innovation. If your organization is considering RIM modernization, now is the time to assess where you stand and take the first steps toward a holistic transformation.
For more insights, listen to the webinar recording here!
.avif)
5 Reasons It’s Time to Stop Managing Your UDI Data in Spreadsheets
UDI data management is continuously getting more complex. Not only do global markets have varying UDI requirements, but new markets are expected to come online in the coming months. Additionally, the mandatory application of EUDAMED will begin in January of 2026, meaning that MedTech manufacturers selling products in the European Union will have to submit their UDI information to EUDAMED.
Submitting UDI information to EUDAMED will require careful and thorough preparation to ensure that manufacturers have all of the required data attributes necessary to meet the EU’s requirements and that they have a strategy in place to organize, review, and submit all of their information.
MedTech regulatory affairs processes are largely manual and siloed, and UDI management is no different. Many teams are still managing their UDI data in complex spreadsheets. While the forthcoming mandatory EUDAMED requirements have prompted many manufacturers to start planning more comprehensive UDI strategies, managing a high volume of UDI data in spreadsheets is unsustainable long term.
Efficient and scalable UDI management requires deep expertise, collaboration, and full visibility into your products’ global regulatory activities that spreadsheets simply can’t match. Here are 5 reasons it’s time to move away from managing your UDI data in spreadsheets:
1. They’re setting you up for compliance risks
UDI management involves a high volume of data across different markets and regulator IT systems. Not only are the assembly and maintenance of those data in a spreadsheet prone to human error, but they don’t enable the regulatory expertise necessary to ensure that your requirements for each applicable market are up to date. Further, siloed spreadsheets aren’t connected to systems that help you unlock regulatory insights. The responsibility is yours to make sure your spreadsheet has current, accurate, and reliable information.
With cumbersome version history and change tracking (or lack thereof), spreadsheets also lack the traceability needed for audits, making it difficult and time-consuming for MedTech companies to effectively demonstrate compliance. This not only adds time to the audit, but opens your organization up for audit findings, financial penalties, product delays, and revenue loss.
2. They’re time-consuming and difficult to manage
When multiplying the markets you’re selling in by the number of products you’re selling, it’s easy to see how complex UDI spreadsheets can get. Since there’s no automation to ensure the attributes and data in your spreadsheet are up to date, it’s up to you to validate it periodically and research the updated requirements. If you do establish a process to validate that UDI data, this adds critical time for Medtech teams that are already tasked to execute faster with limited team members. If you do not periodically validate UDI data, you take on an increased risk of non-compliance.
Additionally, new market regulatory and IT requirements make managing UDI information even more difficult each time a new market is added. With several countries expected to mandate or enact new UDI requirements and systems over the next couple of years, the complexity is only going to grow with time.
3. They limit collaboration across your team
Multiple stakeholders working within the same spreadsheet can easily create confusion. Not only is it difficult to track changes, but there’s a likelihood of overwriting critical information. This can not only lead to the compliance risks mentioned above, but spreadsheets also impact your team’s ability to effectively collaborate. Team members often duplicate the spreadsheet and work off of different versions when there are limited controls in place to prevent this from happening.
On a strategic level, spreadsheets impact your team’s ability to share knowledge with one another. There’s no way to effectively share detailed notes and tasks, and there’s also limited functionality to track transmission status and troubleshoot transmission errors with your team.
4. They don’t provide full visibility into your products’ selling statuses
UDI spreadsheets are usually designed for one purpose, UDI data management. However, UDI is just one facet of obtaining market clearance for your product. The product must also be approved and registered in each respective market. Many manufacturers have multiple teams and spreadsheets to track regulatory activities where UDI responsibilities may lie outside of the regulatory team. This approach limits their ability to get full visibility into the status of their products and integrate this information with other relevant applications across the business. With regulatory information scattered and siloed, it’s easy to miss the connection between UDI data and upcoming expirations and renewals.
5. They don’t easily scale with your business and growing market requirements
As you create new products and bring existing ones into new markets, do you have a plan in place to help you scale effectively? The regulatory activities along with the expanding UDI requirements associated with new product introductions and market expansions are high enough, and spreadsheets simply can’t keep pace with business growth.
Moving your UDI management off spreadsheets is going to set you up for a successful, long-term UDI program. MedTech companies not only need to be aware of the forthcoming mandatory EUDAMED application timelines, but they also need a sustainable solution as additional UDI requirements come online. Finding a solution that’s built with the complexities of UDI data management in mind, automates time-consuming, manual processes, and offers complete visibility into all of your regulatory activities is going to help you ensure that your UDI program is compliant and scalable to meet your evolving business needs.
The Rimsys RIM platform allows you to manage your UDI program in a single-sourced, unified, and connected solution that enables you to track your UDI activities alongside your product registrations and selling status to give you confidence in your compliance. Additionally, Rimsys has a novel Universal UDI approach that captures common attributes across various market requirements to reduce administrative burden and help you submit your UDI information consistently and with ease.
Want to see how a purpose-built MedTech RIM solution can offer you a compliant, scalable, and comprehensive approach to UDI management? Request a demo to see Rimsys in action!
.avif)
Rimsys secures $5 million in growth financing round
Rimsys recently secured $5 million in a growth financing round from Global Opportunity Pennsylvania Fund II, L.P. (GO PA Fund), Riverfront Ventures, and existing investor, Innovation Works. GO PA Fund, Riverfront Ventures, and Innovation Works have a strong commitment to fostering innovation and creativity in Pennsylvania, which makes them great financial partners for Rimsys.
“We’re ecstatic to have support from GO PA Fund, Riverfront, and existing investors as we enter a new growth phase at Rimsys,” said James Gianoutsos, Rimsys Founder and CEO. “Our next phase of growth builds on our mission to increase accessibility to life-changing medical technologies with a focus on regulatory intelligence, submissions management, and UDI enhancements and thoughtfully incorporating advanced technologies like AI into our roadmap to meet growing demand and changing global regulatory requirements. We are grateful to work with firms that are committed to nurturing innovation in the Pittsburgh region, which has given so much opportunity to us.”
Our growth financing will help ensure that Rimsys provides a world-class, unified regulatory information management (RIM) solution for the medtech industry and that it meets the challenges that come with a frequently evolving regulatory landscape.
Those interested in learning more can read the press release from GO PA Fund and a recent Post-Gazette interview with our founder, James Gianoutsos:
ABOUT GO PA FUND
Formed by Ben Franklin Technology Partners of Southeastern Pennsylvania, with collaboration from Ben Franklin of Northeastern Pennsylvania, Ben Franklin of Central and Northern Pennsylvania, and Innovations Works from Southwestern Pennsylvania, the GO PA Fund invests in technology-based ventures throughout the Commonwealth of Pennsylvania. The GO PA Fund primarily invests as a follow-on fund to companies selected from Ben Franklin’s statewide portfolio of more than 600 burgeoning ventures throughout Pennsylvania. The Fund leverages Ben Franklin’s best-in-class multi-year/multi-round due diligence to ensure access to qualified and vetted opportunities while minimizing costs of investment. Visit us at gopafund.com.
ABOUT BEN FRANKLIN TECHNOLOGY PARTNERS OF SOUTHEASTERN PENNSYLVANIA
Ben Franklin Technology Partners of Southeastern Pennsylvania (“Ben Franklin”) is the Philadelphia region’s Partners with a Purpose. Nationally ranked among the most active seed and early-stage investors, Ben Franklin helps high-growth innovative enterprises plant and nurture their roots, creating both immediate connections and lasting economic growth. The nonprofit has supported more than 2,000 companies to deliver an impact of more than $5 billion and 32,000 jobs in the Philadelphia region. Whether in tech, life sciences, manufacturing, or industries and breakthroughs yet discovered, Ben Franklin works to raise the community of innovation higher, to benefit present and future generations of Pennsylvanians. Visit us at partnerswithapurpose.org, or follow us at @bftp_sep.
ABOUT INNOVATION WORKS
Innovation Works is one of the most active early-stage investors in the country and the most active in Pennsylvania. Since its inception of the seed fund in 1999, Innovation Works has invested in over 760 companies that have gone on to raise $3.3 billion in follow-on funding. Portfolio companies have generated and retained over 20,000 jobs in Pennsylvania. Innovation Works is part of the Ben Franklin Technology Partners network, which has catalyzed economic growth over the last 30 years by providing access to capital and networks that help foster innovation and technology-based economic development in Pennsylvania. Learn more at innovationworks.org.
ABOUT RIVERFRONT VENTURES
Riverfront Ventures is an early-stage venture capital fund based in Pittsburgh, PA focused on investing in early-growth stage tech companies. Learn more at riverfrontventures.com.
ABOUT RIMSYS
Rimsys is improving global health by accelerating delivery and increasing availability of life-changing medical technologies. Rimsys Regulatory Information Management (RIM) software digitizes and automates regulatory activities, helping medtech regulatory affairs teams to plan more effectively, execute more quickly, and confidently ensure global regulatory compliance. Rimsys is designed around medtech workflows and supports a full breadth of regulatory activities including registrations, submissions, UDI, essential principles, and standards management in a single, integrated platform. For more information, visit www.rimsys.io.
