The New EU Medical Device Regulation (MDR) An Active Device Lifecycle Approach Implementation and Remediation Activities

visit usdm.com The New EU Medical Device Regulation (MDR) An Active Device Lifecycle Approach Implementation and Remediation Activities Jay Crowley VP and Practice Lead UDI Services and Solutions jcrowley@usdm.com +1-805-880-2591 1

Conceptual establish a robust, transparent, predictable, sustainable regulatory framework which ensures a high level of safety and health this Regulation sets high standards of quality and safety for medical devices all manufacturers should have a quality management system and a post-market surveillance system which should be proportionate to the risk class and the type of device the risk management and clinical evaluation processes should be interdependent and should be regularly updated demonstration of compliance with general safety and performance requirements should be based on clinical data the conformity assessment procedures, clinical investigations/evaluation, vigilance and market surveillance should be significantly reinforced, whilst provisions ensuring transparency and traceability regarding medical devices Copyright USDM Life Sciences - not for further distribution or use 2

Overview of EU MDR UDI Regulations (1) a fundamental revision of those Directives is needed to establish a robust, transparent, predictable and sustainable regulatory framework for medical devices which ensures a high level of safety and health whilst supporting innovation. (4) Key elements of the existing regulatory approach, such as the supervision of notified bodies, conformity assessment procedures, clinical investigations and clinical evaluation, vigilance and market surveillance should be significantly reinforced, whilst provisions ensuring transparency and traceability regarding medical devices should be introduced, to improve health and safety. Intended to focus on the life-cycle of the device 3

Overview of EU MDR UDI Regulations (74) Manufacturers should play an active role during the post-market phase by systematically and actively gathering information from post-market experience with their devices in order to update their technical documentation and cooperate with the national competent authorities Manufacturers should establish a comprehensive PMS system, set up under their quality management system and based on a PMS plan. Relevant data and information gathered through PMS, as well as lessons learned from any implemented CAPAs, should be used to update any relevant part of technical documentation, such as those relating to risk assessment and clinical evaluation, and should also serve the purpose of transparency. 4

Overview of EU MDR UDI Regulations The new European Medical Device Regulation (MDR): Signed into law on 5 April 2017 Published in the Official Journal of the European Union on 5 May 2017 Entry into force on 25 May 2017 (start of transition period) Applies from (date of application) 26 May 2020 Phased implementation requirements through 2025 The in vitro diagnostic medical device regulation (IVDR) was also publsihed with a date of application of 26 May 2022 The Commission expects the Regulations to improve the quality, safety and reliability of medical devices, while also strengthening the transparency of information for consumers, and enhancing vigilance and market surveillance. 5

Transitional Provisions Article 5 A device may be placed on the market or put into service only if it complies with this Regulation (99) The requirements of this Regulation should be applicable to all devices placed on the market or put into service from the DofA In order to provide for a smooth transition it should be possible, for a limited period of time from that date, for devices to be placed on the market or put into service by virtue of a valid certificate issued pursuant to the MDD/AIMD Article 120(2) Certificates issued by NBs in accordance with the MDD/AIMD: prior to 25 May 2017 remain valid until end date (w/some exceptions) from 25 May 2017 valid until end date (not>5 years) latest 27 May 2024 6

Sell Off Provision After DoA, devices placed on the market pursuant to the MDD/AIMD may continue to be made available until 27 May 2025 provided they continue to comply and there are no significant changes in the design and intended purpose. However, the requirements of the MDR relating to: post-market surveillance, market surveillance, vigilance, registration of economic operators and of devices [Unique Device Identification] shall apply in place of the MDD/AIMD requirements. 7

Application to Class I Legacy Devices Since most class I devices do NOT have certificates issued by NBs: Class I devices placed on the market before 26 May 2020 may continue to be made available until 27 May 2025 ( sell-off period) Only those class I devices with measurement function or in sterile condition covered by a valid MDD certificate can be placed on the market after DoA MDR requires NB oversight for class I devices that are placed on the market in sterile condition, have a measuring function, or are reusable surgical instruments (class I s/m/r) However, the requirements of the MDR relating to post-market surveillance, market surveillance, vigilance, registration of economic operators and of devices shall apply in place of the MDD/AIMD requirements 8

Remediation and Implementation Activities These 2 workstreams need to be considered in parallel as many of the activities in #2 need to be started now in addition to the work in #1: 1. For legacy devices by 26 May 2020 to continue to place on the market: Post-market surveillance, market surveillance, and vigilance Registration of economic operators and devices UDI Marking (phased implementation) and Traceability Enhanced responsibilities of other economic operators 2. For most class I, new (or significantly changed), and expired certificate devices all of the above requirements and these additional requirements: CE Marking certificates issued (or self-certify) according to the MDR QMS developed according to ISO 13485:2016 (deemed to meet MDR) 9

Workstream #1 To place any device on the market, including legacy devices with valid MDD/AIMD certificates, after 26 May 2020 the devices must meet the MDR requirements related to: 1. Post-market surveillance 2. Market surveillance 3. Vigilance 4. Registration of economic operators 5. Registration of devices 6. Unique Device Identification 7. Enhanced responsibilities of other economic operators 8. Identification of devices in the supply chain and Traceability 10

Post-market Surveillance Ongoing Oversight Manufacturers must develop the appropriate plans and processes to address the following articles and annex (for all legacy devices distributed after DOA): Article 83 Post-market surveillance system of the manufacturer Article 84 Post-market surveillance plan Article 85 Post-market surveillance report Article 86 Periodic safety update report Article 87 Reporting of serious incidents and field safety corrective actions Article 88 Trend reporting Article 89 Analysis of serious incidents and field safety corrective actions Annex III Technical Documentation on Post-Market Surveillance (related to Articles 83 to 86) 11

Input Post-Market Surveillance System Article 84 Post-market surveillance plan The PMSS is based on a post-market surveillance plan the requirements for which are described in Annex III, Section 1.1. Article 83 Post-market Surveillance System (PMSS) Manufacturers shall plan, establish, document, implement, maintain and update a PMSS for each device The PMSS shall actively and systematically gather, record and analyse relevant data on the quality, performance and safety of a device throughout its entire lifetime The PMSS will include the requirements to determine, implement and monitor any preventive and corrective actions. 12

Output Reports PMSR or PSUR Article 85 Post-market Surveillance Report (PMSR) Manufacturers of class I devices shall prepare a PMSR summarising the results and conclusions of the PMSS together with a rationale and description of any CAPAs taken. The report shall be updated when necessary. Article 86 Periodic Safety Update Report (PSUR) Manufacturers of class IIa, IIb and III devices shall prepare a PSUR summarising the results and conclusions of PMSS (including main finding of PMCF) together with a rationale and description of any CAPAs taken. For class IIb and III devices, the PSUR shall be updated at least annually. For class IIa devices, the PSUR shall be updated at least every two years. 13

Incidents and Reporting Article 87 Manufacturers shall report to the relevant competent authorities: (a) serious incidents involving devices except those subject to trend reporting (b) field safety corrective action, including any in a third country. Article 88 Manufacturers shall report any statistically significant increase in the frequency or severity of incidents which have led or may lead to risks to the health or safety of patients, users or other persons that are unacceptable when weighed against the intended benefits. Article 89 Following the reporting of a serious incident, the manufacturer shall perform the necessary investigations. This shall include a risk assessment of the incident and field safety corrective action. 14

Registration All economic operators and devices must be appropriated registered in Eudamed (for all devices): Article 25 Identification within the supply chain Article 29(1) Registration of devices in the UDI Database referencing: Article 27 UDI System and Article 28 UDI Database Article 29(4) Registration of devices (Annex VI (2)(A)) 26 November 2021 Article 30 Electronic system for registration of economic operators Article 31 Registration of manufacturers, ARs, and importers Annex VI Information to Be Submitted: Part A Registration of Devices and Economic Operators Part B Core Data Elements to be Provided to the UDI Database 15

Basic UDI-DI (not a UDI) The Basic UDI-DI is the main key in the database and relevant documentation (e.g. certificates, declaration of conformity, technical documentation and summary of safety and clinical performance) to connect devices with same intended purpose, risk class and essential design and manufacturing characteristics. It is independent/separate from the packaging/labelling of the device and it does not appear on any trade item. Each certificate shall identify and cover all devices associated with the same Basic UDI-DI. A UDI-DI shall be associated with one and only one Basic UDI-DI. Does not (necessarily) apply to e.g. systems or procedure packs, software 16

Registration of Economic Operators and Devices Article 29(1,2) Before placing a device, system or procedure pack on the market, the manufacturer must assign a Basic UDI-DI and provide it to the UDI database with the core data elements in Annex VI, Section 2, Part B. Article 29(4) Before placing a device on the market, the manufacturer shall enter or verify the device registration information in Annex VI, Section 2, Part A and keep the information updated. Article 31(1) Before placing a device on the market, the manufacturers, authorised representatives and importers shall submit the information required in Annex VI, Section 1, Part A to obtain a Single Registration Number (SRN).. 17

Article 29(1,2) The UDI Database For every UDI-DI the core data elements referred to in Part B of Annex VI: 1.Quantity 2.The Basic UDI-DI 3.The type of PI(s) 4.The unit of use DI 5.Manufacturer s name and address 6.The SNR 7.AR name and address 8.Medical Device Nomenclature 9.Risk class 10.Trade/brand name 11.Model, reference, or cat. number 12.Clinical size 13. Product description (optional) 14. Storage and/or handling conditions 15. Additional trade names 16. labelled as single use 17. Restricted number of reuses 18. Device packaged sterile 19. Need for sterilisation before use 20. labelled as containing latex 21. labelled as carcinogenic, mutagenic or toxic to reproduction 22. URL for additional information (optional) 23. critical warnings or contraindications 18

Article 29(4) The Registration of Devices 1. Basic UDI-DI, 2. Type, number and expiry date of the certificates 3. Member State in which the device is placed on the market 4. For class III and IIa/b - member states where the device is made available 5. Risk class of the device 6. Reprocessed single-use device (y/n) 7. Presence of a substance considered to be a medicinal product 8. Presence of a substance derived from human blood or plasma 9. Presence of tissues or cells of human or animal origin 10. Where applicable, the number of the clinical investigation(s) 11. For Annex XVI products, intended purpose other than medical 12. Contact information for devices designed/manufactured by another person 13. For class III/implantable devices summary of safety and clinical performance 19

UDI Application Article 27(4) The UDI (AIDC and, if applicable, its HRI) shall be placed on the label of the device and on all higher levels of packaging by: Implantable devices and for class III devices due 26 May 2021 Class IIa and class IIb devices due 26 May 2023 Class I devices due 26 May 2025 For reusable devices that shall have the UDI carrier on the device itself due two years after the applicable class compliance date Article 18 Implant card including UDI for any implantable device distributed with a certificate issued according to the MDR (phased implement with class) 20

Enhanced Responsibilities of Other Economic Operators authorised representative means any person established within the Union who has a written mandate from a manufacturer, located outside the Union, to act on the manufacturer's behalf. importer means any person established within the Union that places a device from a third country on the Union market. distributor means any person in the supply chain, other than the manufacturer or the importer, that makes a device available on the market, up until the point of putting into service. economic operator means a manufacturer, authorised representative, importer, distributor or person making systems or procedure packs 21

Authorised Representative The AR, with the help of the manufacturer, will: (a) verify that the EU DoC and Technical Documentation have been drawn up and conformity assessment has been carried out by the manufacturer; (b) keep a copy of the TD,, the EU DoC, and a copy of the relevant certificate, (c) comply with the registration obligations and verify that the manufacturer has (d) in response to a CA request, provide information and documentation (e) forward to the manufacturer any CA request for samples or access to device (f) cooperate with CAs on any CAPA taken to eliminate or mitigate the risks (g) immediately inform the manufacturer about complaints and reports from healthcare professionals, patients and users (h) terminate the mandate if the manufacturer acts contrary to its obligations 22

Importers and Distributors In order to place a device on the market, importers and distributors shall: Verify that the device is CE marked and has EU DoC Verify that an authorised representative has been designated (importer) Verify that the importer has complied with the requirements (distributor) Verify that the device is labelled correctly and accompanied by IFU Verify that a UDI has been assigned by the manufacturer Verify that the manufacturer/ar and device are registered (importer) Keep a register of complaints, non-conforming devices, recalls + withdrawals Immediately forward to manufacturer, AR, (distributor importer) complaints or reports from HCPs, patients or users about suspected incidents Not place a device on the market if they consider it is not in conformity Inform the CA if the device presents a serious risk or is a falsified device. 23

Becoming the Manufacturer A distributor, importer or other person shall assume the obligations of the manufacturer if it: makes available on the market a device under its name, registered trade name or registered trade mark changes the intended purpose of a device modifies a device in such a way that compliance with the applicable requirements may be affected. 24

Identification in the Supply Chain & Traceability Economic operators (the manufacturer, authorized representative, importer, distributor, and system or procedure pack producers or sterilizers) must: Have processes and system in place to be able to identify: (a) any economic operator to whom they have directly supplied a device; (b) any economic operator who has directly supplied them with a device; (c) any health institution or healthcare professional they have directly supplied a device. Keep (preferably by electronic means), the UDI of these devices that they have BOTH supplied and been supplied with: Class III implantable devices, and Other devices the EC adopts through delegated acts. 25

Workstream #2 For class I devices without certificates placed on the market after 26 May 2020, (except those legacy class I devices with measurement function or placed on the market in sterile condition covered by a valid MDD certificate), new or significantly changed devices, and devices with expired MDD/AIMD certificates in addition to the post-market surveillance, registration, and UDI requirements in Workstream #1 these devices must meet these MDR requirements: 1. CE Marking certificates issued (or self-certify) according to the MDR 2. QMS developed according to ISO 13485:2016 (deemed to meet MDR) 26

Overview of EU MDR UDI Regulations May 2017 MDD Recertification MedDev 2.7.1 Rev 4 Compliance May-2020 PMS Economic Operators Product Registration including UDI May-2021-27 UDI label and package marking UDI direct marking 2020-2025 Certification Clinical Evaluation/ Investigation PMCF, PSUR GS&PR 27

Development of information needed to CE Mark a device according to MDR: Article 32 Summary of safety and clinical performance Article 52 Conformity assessment procedures Article 61 Clinical evaluation/investigation and Clinical Evaluation Report Annex I General safety and performance requirements Annex II Technical documentation Annex IV EU Declaration of Conformity For class I s/m/r and all other risk classes a Notified Body will audit the QMS and Technical File before issuing a certificate For all other class I self-certify CE Marking 28

Summary of Safety and Clinical Performance Article 32 Implantable and class III devices must have a summary of safety and clinical performance, including the: (a) identification of the device and the manufacturer (BUDI-DI and SRN) (b) intended purpose, indications, contraindications and target populations (c) description of the device, any accessories, other devices and products, which are intended to be used in combination with the device; (d) possible diagnostic or therapeutic alternatives; (e) reference to any harmonised standards and CS applied; (f) summary of clinical evaluation and post-market clinical follow-up; (g) suggested profile and training for users; (h) information on any residual risks and any undesirable effects, warnings and precautions. 29

Conformity Assessment Annex IX - Conformity Assessment Based on a Quality Management System and an Assessment of Technical Documentation: Chapter I Quality Management System (QMS) [class III, IIa/b, I s/m/r] Chapter II Assessment of the Technical Documentation [class III and IIb] Chapter III Administrative Provisions [class III, IIa/b, I s/m/r] Manufacturers or Authorized Representatives must have: the EU declaration of conformity, documentation on the manufacturer's quality management system substantial changes to the quality management system the technical documentation associated with the design, manufacture and performance of the device the decisions and reports from the notified body 30

NB Involvement in Class I Devices For class I devices that are placed on the market in sterile condition, have a measuring function, or are reusable surgical instruments (class I s/m/r) the NB involvement is limited to: sterile aspects relating to establishing, securing and maintaining sterile conditions measuring function aspects relating to the conformity of the devices with the metrological requirements reusable surgical instruments aspects relating to the reuse of the device, in particular cleaning, disinfection, sterilization, maintenance and functional testing and the related instructions for use 31

CER PMSS PMCF Clinical evidence Clinical investigation CER Quality, performance and safety PMSP PMCF Clinical data 32

Clinical Evaluation Report (CER) Article 2(44) clinical evaluation means a systematic and planned process to continuously generate, collect, analyse and assess the clinical data pertaining to a device in order to verify the safety and performance Article 61(1) Manufacturers shall plan, conduct and document a Clinical Evaluation see also Annex XIV, Part A Article 61(3) A Clinical Evaluation must be defined and methodologically sound including: (a) a critical evaluation of the relevant scientific literature (b) a critical evaluation of the results of all available clinical investigations, (c) a consideration of currently available alternative treatment options, if any. Article 61(12) the Clinical Evaluation, its results and the clinical evidence derived from it shall be documented in a CER (see Annex XIV, Section 4). 33

Clinical Investigation Article 2(45) means any systematic investigation involving human subjects, undertaken to assess the safety or performance of a device Article 61(4,6) a clinical investigation is required for implantable and class III devices, except if the: device is a modification of one already marketed by the manufacturer, modified device is equivalent to the marketed device, and clinical evaluation of the marketed device can demonstrate conformity of the modified device with the safety and performance requirements. device has been placed on the market in accordance with the MDD/AIMD and the clinical evaluation already contains sufficient clinical data device is a suture, staple, dental filling, dental brace, tooth crown, screw, wedge, plate, wire, pin, clip or connectors 34

Post-market Clinical Follow-up (PMCF) Article 61(11) The clinical evaluation and its documentation shall be updated throughout the life cycle of the device with clinical data from the PMCF plan (Annex XIV, Part B) and the post-market surveillance plan (Article 84). Annex XIV, Part B PMCF is a continuous process that updates the clinical evaluation (Article 61) and is addressed in the manufacturer's post-market surveillance plan. The PMCF plan shall specify the methods and procedures for proactively collecting and evaluating clinical data. For class III and implantable devices, the PMCF report and the summary of safety and clinical performance shall be updated at least annually. 35

General Safety And Performance Requirements Article 5(2) devices must meet the general safety and performance requirements Annex I General Safety And Performance Requirements document that: 1. Device shall: achieve the performance intended by their manufacturer be designed and manufactured for their intended purpose be safe and effective 2. Manufacturer has reduced risks as far as possible without adversely affecting the benefit-risk ratio 3. Manufacturer has established, implemented, documented and maintains a risk management system. 36

Annex II Technical Documentation The technical documentation shall be presented in a clear, organised, readily searchable and unambiguous manner and shall include 1. Device description and specification, including variants and accessories 2. Information to be supplied by the manufacturer 3. Design and manufacturing information 4. General safety and performance requirements 5. Benefit-risk analysis and risk management 6. Product verification and validation 37

Annex IV EU Declaration of Conformity (DoC) 1. Name and address (and SRN) of manufacturer, and, if applicable, its AR 2. A statement that the DoC is the sole responsibility of the manufacturer 3. The Basic UDI-DI 4. Product and trade name, product code, catalogue number or other 5. Risk class of the device 6. A statement that the device is in conformity with the MDR 7. References to any CS used and in relation to which conformity is declared 8. The name and identification number of the NB, a description of the conformity assessment performed and identification of the certificate issued 9. Where applicable, additional information 10.Place and date of issue and name, function and signature of responsible person 38

MDR Certificate Decision and Planning Tool Total Estimation of cost/effort should include factors such as: Dates for MDR certificates Effort for new certificates SKU rationalization 39

QMS ISO 13485:2016 For all devices, a manufacturer must have a QMS developed according to ISO 13485:2016 (deemed to meet the requirements of the MDR). 40

Questions? 41

Thank You! Web: usdm.com Email: usdm@usdm.com Phone: 888-231-0816 42