The new Medical Devices Regulation (EU) 2017/745 (MDR) and the In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746 (IVDR) aim to bring EU/EEA legislation into line with technological advances and changes in medical science. At the same time, the two Regulations introduce further regulatory requirements which the industry needs to be prepared for.

The EU has been working since 2012 to prepare the two new Regulations with the aim of strengthening patient safety and ensure a uniform regulatory framework for all EU/EEA states.

In Norway, the MDR and IVDR have recently been implemented through a new Act on Medical Devices which entered into force on 26 May 2021. This means that the MDR is applicable in Norway from the said date and the IVDR will be applicable from 26 May 2022, i.e. the same dates as in the EU.

 What are changed with the new regulations?

Although the MDR and the IVDR have many of the same basic requirements as the previous directives, the new Regulations introduce stricter regulatory standards in several respects and enhance traceability.

The main changes introduced by the MDR are:

• Reclassification of certain devices and broadening of the scope of application: For example are all devices for cleaning, sterilisation, or disinfecting other medical devices are covered by the scope. Establishing the risk class of a device is crucial for determining the regulatory steps that are required for obtaining CE Marking, e.g. with respect to conformity assessment procedure and clinical requirements. The MDR sets out 22 rules for determining the risk classes while there under the Directive was 18 rules. This implies that manufacturers must check whether more of their devices are covered by the MDR compared to the previous legislation and also check whether some devices will be reclassified or will need to be reviewed by a Notified Body.
• Notified Bodies are designated under the MDR. Notified Bodies under the MDR have to meet more strict criteria than under the Directives, especially with respect to clinical competence. There is a database of Notified Bodies (NANDO) that shows Notified Bodies in all EU/EEA states.
• The assessment of conformity that has to be carried out to obtain CE marking for a device varies according to the risk class and the features of certain devices. The involvement of a Notified Body is necessary for all Class IIa, Class IIb, and Class III devices and some Class I devices. For implantable Class III devices and for some Class IIb devices a new clinical evaluation consultation procedure by an independent expert panel has to be carried out. This consultation procedure shall be based on the clinical evaluation assessment report of the Notified Body.
• The requirements for clinical evaluation are enhanced and constitute one of the biggest changes introduced by the MDR. As before a clinical evaluation include a collection of clinical data that are already available in the literature and to set up necessary clinical investigations. It will still be possible in some situations to use already existing clinical data for equivalent products, but the MDR is tighter than the previous legislation and clinical data for equivalent products can only be used in a limited number of situations. Under the MDR, with only certain exceptions, all implantable and Class III medical devices must go through clinical investigations to obtain CE marking. For all Class III devices and for Class IIb devices for administering or removing a medicinal product from the body the manufacturer has the option to consult a group of European experts to get an upstream review of its clinical development strategy.
• Manufacturers shall draw up a summary of their safety and clinical performance for Class III devices and implantable devices in a form that intended users can understand. The summary will be a part of the technical documentation that shall be sent to the Notified Body.
• A new Unique Identification (UDI) system that will enhance traceability and effectiveness of post-market safety-related activities. Each medical device shall have a UDI composed of a device identifier (UDI-DI) specific to a device, and a production identifier (UDI-PI) to identify the unit producing the device.
• Increased transparency with respect to information regarding devices and studies through the new European Database for Medical Devices – EUDAMED. Manufacturers have the responsibility for entering the necessary data on the EUDAMED, which comprises the UDI database, and for keeping EUDAMED up to date.
• Obligations for manufacturers of medical devices are clearly stated and comprise obligations to:
  • Have systems for risk management and quality management (QMS)
  • Compile technical documentation
  • Apply a conformity assessment procedure
  • Have a named person responsible for regulatory compliance
  • For some implantable devices; provide an implant card for the patient
  • Draw up a declaration of conformity and apply CE marking to their devices (when the obligations mentioned above are fulfilled)
• Manufacturers are responsible for their devices that are on the market and must have in place systems to cover their potential financial liability for harm caused.

The IVDR

The main changes that will be introduced by the IVDR are:

• The definition of an In Vitro Device (IVD) has been broadened and clarified. The definition covers tests intended to predict a medical condition or a disease and software. Further, IVD devices and testing services offered over the internet that is accessible in the EU/EEA must comply with the IVDR.
• A new more flexible rule-based risk classification system replaces the current list-based system. Instead of naming specific IVD devices or medical conditions, the risk classification of a device under the new system is determined by its intended purpose and takes into account the individual risk and the risk to public health. To classify a device, the manufacturer should consult the rules listed in annex VIII of the IVDR. If more than one rule applies, the rule resulting in the highest risk classification should be adopted. The four risk classes are:

1. low individual risk and low public health risk
2. moderate individual risk and/or low public health risk
3. high individual risk and/or moderate public health risk
4. high individual risk and high public health risk

While Class A devices will be self-certified by their manufacturers unless they are sold as sterile, devices in Classes B, C, and D will require conformity assessment by a Notified Body. In the first instance, the classification of a device is the responsibility of the manufacturer. If the Notified Body disagrees with the manufacturer’s classification, the matter must be referred to the Competent Authority of the country in which the manufacturer is located. For Norway, the Competent Authority is the Norwegian Medicines Agency.

• The obligations for manufacturers of IVDs are the same as for manufacturers of medical devices, see item 2.2 above.
• The IVDR introduces a system of unique device identifiers in the same way as the MDR, see item 2.2 above.
• The level of clinical evidence needs to demonstrate the conformity of a device increases as the risk class increases. A new requirement is a requirement for post-market performance follow-up to update the performance evaluation throughout the life cycle of the device.
• Notified Bodies are designated under then IVDR in the same way as under the MDR, cf. item 2.2 above.
• The assessment of the conformity of a device for CE marking varies according to the risk class and certain features of specific devices. The involvement of a Notified Body is necessary for all Class B, C, and D devices, as well as sterile Class A devices. For some Class D devices, there is a new performance evaluation by an independent expert panel to be carried out, and when an EU Reference laboratory has been designated for this kind of Class D devices, the laboratory should verify by the testing the performance claimed by the manufacturer.

Transitional arrangements – from what point in time do manufacturers need to comply with the MDR and the IVDR

From 26 May 2021, all new certificates for medical devices have to be issued in accordance with the MDR and from 26 May 2022, all new certificates for IVDs have to be issued in accordance with the IVDR. However, certificates that already are delivered according to the prior legislation before 26 May 2021 and 26 May 2022 will be valid until their date of expiry, but for a maximum of four years, i.e. they will expire on 27 May 2024 at the latest. This means that products that are certified under the old rules and the MDR and the IVDR will coexist on the market for a period. The requirements of the MDR and the IVDR relating to post-market surveillance, market surveillance, vigilance, and the registration of economic operators and devices shall apply from 26 May 2021 and 26 May 2022 also for already issued certificates. Products that are certified under the previous legislation and are still in the supply chain, but have not reached their final user on 26 May 2025 are no longer allowed to be marketed and must be withdrawn from the market.

How to be ready for the MDR and the IVDR?

If this is not already in place manufacturers should make sure:

• that all their products are classified appropriately in accordance with the MDR/IVDR;
• all product documentation and evidence of compliance conforms with the MDR/IVDR; and
• that they have the necessary systems in place to handle clinical evaluation, quality management, post-market surveillance, and liability for defective device

Note: On 26^th May the European Commission has published an official Questions & Answers: Application of Regulation on Medical Devices – EU rules to ensure safety of medical devices that can be found here.

For more information visit Advokatfirmaet Thommessen | Oslo, Bergen, Stavanger, London | Advokatfirmaet Thommessen or contact: