Panel Discussion: European Medical Device Regulations Preparing for the Storm Moderator: Lenita Y. Sims Spears, Senior Quality Consultant/Senior

Panel Discussion: European Medical Device Regulations Preparing for the Storm Moderator: Lenita Y. Sims Spears, Senior Quality Consultant/Senior Regulatory and Compliance Counsel, BioTeknica Panelists: Karl Vahey, Vice President Manufacturing Quality, Cardinal Health Dan O Leary, President, Ombu Enterprises LLC Ibim Tariah, Technical Director, BSI Americas Inc.

MEDICAL DEVICE REGULATION KARL VAHEY VP QA CARDINAL HEALTH

MDR Elevator Speech What is the EU MDR about? Why is EU MDR important? A new regulation in Europe for medical devices and in vitro diagnostic products with many changes compared to the current directives Consolidated trilogue text of EU MDR and EU IVDR were issued in June 2016 and was published in the Official Journal of the European Union in May 2017. After a three-year transition period, all products must be CE certified to EU MDR requirements. There will be impacts across all Businesses and many functions for the commercialized product portfolio and products in development. There will also be impacts to other geographies as products and labelling are updated. 3 Copyright 2017. All rights reserved. CARDINAL HEALTH logo, and the ESSENTIAL TO CARE are trademarks or registered trademarks of Cardinal Health. All other marks are property of their respective owners.

MDR Elevator Speech What will success look like? Recertification of products within the established timelines. Strategic investment opportunity assessment and execution Partnering with Competent Authorities and Notified Bodies to align on a practical compliance strategy 4 Copyright 2017. All rights reserved. CARDINAL HEALTH logo, and the ESSENTIAL TO CARE are trademarks or registered trademarks of Cardinal Health. All other marks are property of their respective owners.

MORE ROBUST TEXT UNDER STRONGER POLITICAL PRESSURE A FEW FACTS MDD 23 articles 60 pages 12 annexes 44 occurrences of "clinical investigation Directive published 1993, amended 2007 MDR 97 articles 355 pages 16 annexes 142 occurrences of "clinical investigation Regulation published May 2017, Full implementation 2020 5 Copyright 2017. All rights reserved. CARDINAL HEALTH logo, and the ESSENTIAL TO CARE are trademarks or registered trademarks of Cardinal Health. All other marks are property of their respective owners.

MDR PROGRAM OVERVIEW IMPACTS OF MDR The EU MDR release focuses on the overall product lifecycle from development through obsolescence. Requirements for CE marking have been enhanced in each stage of the lifecycle. More products require prior approval; Longer review timelines & increased costs; Enhanced clinical requirements; Scrutiny for new products. UDI reqs;; New QMS reqs; Quality agreements; Labeling reqs. Required PMS reporting; Required periodic safety update reports; Required CER updates; New complaint handling reqs. Continued scrutiny on State of Art reqs; More products requiring submissions; Introduction of new audits (MDSAP / Clinical). NPD Launch Market Cert Renewal 6 Copyright 2017. All rights reserved. CARDINAL HEALTH logo, and the ESSENTIAL TO CARE are trademarks or registered trademarks of Cardinal Health. All other marks are property of their respective owners.

MDR PROGRAM OVERVIEW IMPACTS OF MDR Below are examples of the specific requirements of MDR: Regulatory Files Quality System Haz Substance Clinical Evaluation All Tech Files require updates; All Declaration of Conformities require updates; More product families require submission to NB. SOP change to ref MDR Post Market Surveillance reports for all tech files Periodic Safety Update Reports required; product codes require analysis for haz sub; Testing required for any product potentially having haz sub to quantify levels; Can lead to material changes or labeling reqs CER s require review and if necessary updates; CER s require updates annually; Post Market Clinical Follow up required f SSCP require update & annual submission. RA, R&D, DQE, Medical Affairs, PMV QA Man, Ops, DQE, Medical Affairs, RA, PMV QA Man, RA, Ops, R&D, EHS Medical Affairs, PMV, R&D, RA, Commercial 7 Copyright 2017. All rights reserved. CARDINAL HEALTH logo, and the ESSENTIAL TO CARE are trademarks or registered trademarks of Cardinal Health. All other marks are property of their respective owners.

EU MDR CHANGES ARE EXTENSIVE Key EU MDR Changes Business Implications Implicated Business Functions Hazardous Substances Increased Scope and Depth of Requirements Restricted Equivalence Claim (Class III and Implants) Revenue impact from loss in portfolio R&D Supply Chain Notified Body Design Review for Class IIb Implants New (Up-) Classification Expanded Labelling Requirements (including Implant- Information) Increased Time To Market R&D Regulatory Affairs Medical Affairs Quality 8 Copyright 2017. All rights reserved. CARDINAL HEALTH logo, and the ESSENTIAL TO CARE are trademarks or registered trademarks of Cardinal Health. All other marks are property of their respective owners.

EU MDR CHANGES ARE EXTENSIVE Key EU MDR Changes Business Implications Implicated Business Functions Technical Documentation, DoC New Format and Content Expanded Labelling Requirements (including Implant- Information) Administrative Burden R&D Regulatory Affairs Quality Tech. Communication Production QM-System- PMS, Vigilance, PSURs, Trend Reports Clinical Evaluation/Investigation Summary of Safety and Performance UDI and Economic Operators Increased Transparency and Documentation Quality Medical Affairs Regulatory Affairs Regulatory Affairs Supply Chain 9 Copyright 2017. All rights reserved. CARDINAL HEALTH logo, and the ESSENTIAL TO CARE are trademarks or registered trademarks of Cardinal Health. All other marks are property of their respective owners.

MDR PROGRAM OVERVIEW IMPACTS OF MDR TO INDUSTRY Revenu e Product Codes Product Lines Files to Remediate (Risk, Design, Clinical) 10 10 Copyright 2017. All rights reserved. CARDINAL HEALTH logo, and the ESSENTIAL TO CARE are trademarks or registered trademarks of Cardinal Health. All other marks are property of their respective owners.

Risk Management and Some Friends OMBU ENTERPRISES, LLC Dan O Leary CBA, CQA, CQE, CRE, SSBB, CIRM President Ombu Enterprises, LLC Dan@OmbuEnterprises.com www.ombuenterprises.com 12 2017, Ombu Enterprises, LLC. All rights reserved

OMBU ENTERPRISES, LLC Risk Management The MDR has many Risk Management requirements This is risk management in the sense of how could my device harm the patient or user It is not, as in ISO 13485:2016 Clause 0.2, meeting applicable regulatory requirements. Risk Management, in the MDR, has many friends, in the form of records and reports. We will also meet some of them along the way. 13 2017, Ombu Enterprises, LLC. All rights reserved

OMBU ENTERPRISES, LLC The RMS as QMS The journey starts in Article 10 General Obligations of Manufacturers Section 2 requires a manufacturer to establish, document, implement, and maintain a risk management system RMS, as described in Annex I, Section 3 Section 9 requires a manufacturer to establish, document, implement, maintain, keep up to date, and continually improve a quality management system, QMS The QMS includes: A strategy for regulatory compliance Risk management following Annex I, Section 3 A post-market surveillance system, PMSS, following Article 83 14 2017, Ombu Enterprises, LLC. All rights reserved

OMBU ENTERPRISES, LLC Annex I Annex I General Safety and Performance Requirements Section 3 has the basic elements of the RMS such as A risk management plan for each device Analyze known and foreseeable device hazards Eliminate or control risks using Section 4 Evaluate information from the post-market surveillance system, PMSS Section 4 provides the priority order for risk reduction measures Section 5 provides special considerations for risks related to use errors 15 2017, Ombu Enterprises, LLC. All rights reserved

OMBU ENTERPRISES, LLC ISO 14971:2007 ISO 14971:2007 is the international standard for medical device risk management The current Medical Device Directive, MDD, has requirements that are not the same as the international standard EN ISO 14971:2012 enumerates the differences in Content Deviations It is a Harmonized Standard to the MDD At this point, the MDR doesn t have any Harmonized Standards Some of the differences carry over to the MDR, but some do not It is not clear what would be in a version of ISO 14971:2007 harmonized to the MDR 16 2017, Ombu Enterprises, LLC. All rights reserved

OMBU ENTERPRISES, LLC Systems The MDR has many systems that are part of other systems. The linkages are complicated, so it is best to take each system in isolation The systems (not all of which have the word system in the name) are: Quality Management System (QMS) Risk Management System (RMS) Benefit-Risk Determination (BRD) Benefit-Risk Ratio (BRR) Clinical Evaluation (CE) Post-market Surveillance (PMS) Post-market Surveillance Report (PMSR) Periodic Safety Update Report (PSUR) Post-market Clinical Follow-up (PMCF) Summary of Safety and Clinical Performance (SSCP) 19 2017, Ombu Enterprises, LLC. All rights reserved

OMBU ENTERPRISES, LLC QMS The QMS must specifically address some of these systems: Risk Management System (RMS) Clinical Evaluation (CE) Post-market Clinical Follow-up (PMCF) Post-market Surveillance (PMS) Post-market Surveillance Report (PMSR) Periodic Safety Update Report (PSUR) 20 2017, Ombu Enterprises, LLC. All rights reserved

EU Notified Bodies and the AIMD/MDD/IVD Directives Medical Devices Notified Bodies 100 90 80 Total - AIMD, MD, IVD 70 60 50 40 30 20 10 0 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 Copyright 2012 BSI. All rights reserved. 26

Noteworthy NB Designation Timelines NB Application completeness check by CA within 30 days CA submission of NB Assessment report to EU Commission => MDCG EU Commission sets up JAT within 14 Days JAT review of documentation submitted by CA within 90 Days NB close out of NCs & provision of CAPA to CA ( within a specified timeframe ) CA close out of NB NCs => JAT (TBD) Copyright 2012 BSI. All rights reserved. 31/10/2017 28

Noteworthy NB Designation Timelines JAT final opinion on CA report & Draft Designation within 21 Days => EU Commission MDCG recommendation to CA within 42 Days CA publication in NANDO (allows 28 Days for any Objection from other CA s & EU Comm) CA publication in EUDAMED => NB s start activities from that date (TBD) EU Commission publication in NANDO within 42* (if Objection raised 64 Days) Copyright 2012 BSI. All rights reserved. 31/10/2017 29

Timing of Notified Body Designation (Articles 38,39, 40 & 42) Best Case =>18 Months From Start to Finish Approximately Realistic => 21 Months Worse case ~ 24 Months Copyright 2012 BSI. All rights reserved. 30

MDR Transition (Article 120) Entry into Force (OJEC + 20days) (25 May 2017) 05 May 2017 Adoption of MDR Transition period 3 years Date of Application (26 May 2020) MDD/AIMD certificate validity (4 years ) 27 May 2025 No more «placing on the market» of devices covered by MDD/AIMD certificates Annex IV certificates expire (27 May 2022) MDD/AIMD certificates (max 5-year expiry from issue/renewal date) MDR certificates Last MDD/AIMD certificates expire (27 May 2024) NBs designation under MDR 33 Copyright 2012 BSI. All rights reserved. 33

MDR Transition (Article 120) However, the requirements of this Regulation relating to post-market surveillance, market surveillance, vigilance, registration of economic operators and of devices shall apply in place of the corresponding requirements in those Directives. Copyright 2012 BSI. All rights reserved. 34

IVDR Transition (Article 110) Entry in to Force 25 May 2017 Date of Application 26 May 2022 IVDD certificates void 27 May 2024 05 May 2017 Adoption of IVDR Transition period 5 years IVDD certificate validity (2 years ) 27 May 2025 IVDD certificates can be issued/re-issued/renewed No more «making available or putting into service» of devices covered by IVDD certificates NBs can apply for designation 26 Nov 2017 NBs designation under IVDR IVDR certificates 35 Copyright 2012 BSI. All rights reserved. 35

MDR Transition (Article 120) Class I reusable Class III custom made implantable Devices with no Medical Purpose (Once Common Specifications available) Entry in to Force 25 May 2017 Date of Application 26 May 2020 MDD/AIMDD certificates void 27 May 2024 Adoption of MDR 05 May 2017 Transition period 3 years MDD/AIMDD certificate validity (4 years ) 27 May 2025 MDD/AIMDD certificates can be issued/reissued/renewed NBs can apply for designation 26 Nov 2017 NBs designation under MDR MDD/AIMDD Annex IV certificates void on 27 May 2022 No more «making available or putting into service» of devices covered by MDD/AIMDD certificates MDR certificates No significant change to design or intended purpose Post market surveillance Market surveillance Vigilance Registration of economic operators and devices 36 Copyright 2012 BSI. All rights reserved. 36

OMBU ENTERPRISES, LLC Paradigm View In the paradigm model, each system has a plan and a report. The plan has: Required content A location as a record The Report has: Required content Location as a record Conditions to update Conditions to submit it Some systems don t follow this model 41 2017, Ombu Enterprises, LLC. All rights reserved

OMBU ENTERPRISES, LLC Risk Management Required by Article 10(9e) as part of the QMS There is a plan for every device [Annex I, Section 3(a)] The is no report, but the solutions and results become part of Annex II Section 5(a) 42 2017, Ombu Enterprises, LLC. All rights reserved

OMBU ENTERPRISES, LLC Benefit-Risk Ratio Benefit-Risk Determination means the analysis of all assessments of benefit and risk of possible relevance for the use of the device for the intended purpose, when used in accordance with the intended purpose given by the manufacturer [Art. 2(24)] Clinical Benefit means the positive impact of a device on the health of an individual, expressed in terms of a meaningful, measurable, patient-relevant clinical outcome(s), including outcome(s) related to diagnosis, or a positive impact on patient management or public health [Art. 2(53)] Risk means the combination of the probability of occurrence of harm and the severity of that harm [Art. 2(23)] 43 2017, Ombu Enterprises, LLC. All rights reserved

OMBU ENTERPRISES, LLC Benefit-Risk Ratio Clinical Evaluation helps evaluate the acceptability of the benefitrisk ratio [Art. 61(1)] Post-market Surveillance helps update the benefit-risk determination [Art. 83(3a)] The Periodic Safety Update Report, PSUR, sets out the conclusions of the benefit-risk determination [Art. 86(1a)] To reduce risks as far as possible means the reduction of risks as far as possible without adversely affecting the benefit-risk ratio [Anx. I(2)] 44 2017, Ombu Enterprises, LLC. All rights reserved

OMBU ENTERPRISES, LLC Benefit-Risk Ratio Evaluate the impact of information from the post-market surveillance system on the overall risk, benefit-risk ratio, and risk acceptability [Anx. I(3e)] The Technical Documentation contains information on the benefitrisk analysis [Anx. II(5a)] The Post-market Surveillance Plan covers suitable indicators and threshold values used in the continuous reassessment of the benefit- risk analysis [Anx. III(1.1b)] 45 2017, Ombu Enterprises, LLC. All rights reserved

OMBU ENTERPRISES, LLC Clinical Evaluation Required by Article 61 Clinical Evaluation The Clinical Evaluation Plan s content is described in Annex XIV(1a) It is a record in Annex II(6.1c) The Clinical Evaluation Report s content is described in Annex XIV(4) It is a record in Annex II(6.1c) It is updated throughout the life cycle using PMS and PMCF data, Art. 61(11) For Class III and Implants, the PMCF Report is updated annually, Art. 61(11), so, presumably the Clinical Evaluation Report is also updated annually 46 2017, Ombu Enterprises, LLC. All rights reserved

OMBU ENTERPRISES, LLC Post-Market Surveillance Required by Article 83 Post-market Surveillance System of the Manufacturer The PMS Plan s content is described in Annex III(1.1) The PMS Plan includes the PMCF Plan It is a record under Annex II and Annex III(1.1) The are two reports, depending on the device class The PMS Report is for Class I devices The Periodic Summary Update Report, PSUR, is for Class IIa, IIb, and III devices 47 2017, Ombu Enterprises, LLC. All rights reserved

OMBU ENTERPRISES, LLC Post-Market Surveillance Required by Article 83 Post-market Surveillance System of the Manufacturer The PMS Report s content is described in Article 85 It is a record in Annex III(1.2) It is updated when necessary It is submitted to the Competent Authority upon request The PSUR s content is described in Article 86 It is a record in Annex II and Annex III(1.2) For Class IIa devices it is updated every two years For Class IIb and Class III devices it is updated annually For Class III and Implantable devices it is submitted to the NB 48 2017, Ombu Enterprises, LLC. All rights reserved

OMBU ENTERPRISES, LLC Post-Market Clinical Follow-up Required by Article 61 Clinical Evaluation Section 11 The PMCF Plan is required by Annex XIV(6) and Annex III(1.1b) The plan s content is described in Annex XIV(6.1 & 6.2) The plan is a record under Annex II(6.1d) The PMFC Report is required by Annex XIV(7) The report s content is in Annex XIV(7) It is a record under Annex XIV(4) and Annex II(6.1d) For Class III and Implants it is updated Annually 49 2017, Ombu Enterprises, LLC. All rights reserved

OMBU ENTERPRISES, LLC Summary of Safety and Clinical Performance It is required by Article 32 Summary of Safety and Clinical Performance It applies to Class III and Implantable devices The content is described in Article 32(2) The summary s target audience is the intended user or the patient The summary is updated annually The Manufacturer submits it the NB The NB submits it to Eudomed, where it is publically available 50 2017, Ombu Enterprises, LLC. All rights reserved