EU Regulation Recap: Traceability and UDI, Registration, Eudamed, And More From MDR/IVDR Chapter III
Executive Summary
The third chapters of the Medical Devices Regulation and IVD Regulation are substantially similar in addressing UDI, and also in dealing with subjects surrounding device identification and traceability; registration of devices and of economic operators; summary of safety and clinical performance; and the European databank on medical devices (Eudamed). This is the latest in our series of articles delving into the MDR and IVDR, chapter-by-chapter.
Unique Device Identification (UDI) requirements are going to be among the most challenging and costly aspects of implementing the EU’s future Medical Devices Regulation (MDR) and IVD Regulation (IVDR). But what exactly will manufacturers have to do, who else will be involved, and how will the system operate? And will all economic operators have to register in the same way?
Answers to these questions are in the table below, which summarizes the key points within Chapter III of both the MDR and the IVDR documents, and highlights the most important changes from the current status quo that manufacturers and other economic operators will need to address.
Annex V of the MDR and the IVDR contains three parts:
- Part A: Information to be submitted with the registration of devices and economic operators in accordance with Article 25a of the MDR and Article 23a of the IVDR
- Part B: Core data elements to be provided to the UDI database together with the UDI device identifier in accordance with Article 24a of the MDR and Article 22a of the IVDR
- Part C: The European UDI System
The third chapters of both documents are substantially similar in addressing UDI, and also in dealing with subjects surrounding device identification and traceability; registration of devices and of economic operators; summary of safety and clinical performance; and the European databank on medical devices (Eudamed). While Chapter III lays out the framework rules for UDI and other aspects of the regulation, even more detailed information on UDI, as well as on registration of devices and economic operators, is contained in Annex V of both regulations.
The text of the MDR and IVDR have been agreed to but could be subject to minor changes before final adoption – likely in early 2017 – in the light of legal and linguistic reviews. The MDR has a three-year transition period and is likely to fully apply in early 2020, while the IVDR has a five-year transition period and is likely to fully apply in early 2022. These are the main dates to bear in mind, but there a host of other dates that companies will need to know to start preparing. They are different for the MDR and for the IVDR. And there is also a specific set of dates surrounding identification, registration of devices and traceability of devices, as well as governance.
MDR and IVDR summary: Chapter III Bolded article numbers reference the MDR, and the unbolded numbers reference the IVDR.
|
Article |
Topic |
Significant changes |
Additional observations |
|
23, 21 |
Identification within the supply chain |
Economic operators, including manufacturers, distributors, importers and authorized representatives, must be able to identify to the competent authority any economic operator to whom they have directly supplied a device or who has directly supplied them with a device, and any health institution or health-care professional to whom they have directly supplied a device (Article 23/21.2). They must be able to do this for at least 10 years, and for 15 years where implantable devices are involved. |
Distributors and importers must cooperate with the manufacturer or authorized representative to ensure an appropriate level of device traceability (Article 23/21, 1). |
|
23a, 21a |
Medical devices nomenclature |
EU Commission is responsible for ensuring an international medical devices nomenclature is available free to manufacturers and others required to use the nomenclature. |
The Commission should try to ensure nomenclature is available to other stakeholders free of charge, where reasonably practical. |
|
24, 22 |
UDI system |
This lengthy article spells out the basic rules and context for the UDI system. The system is then more fully described in Annex V Parts B and C of the MDR and IVDR. UDI will not be required for custom-made nor investigational devices (Article 24/22.1). Companies must produce a UDI consisting of a device identifier specific to a manufacturer and a device, plus a production identifier that identifies the produced device’s unit and, if applicable, it identifies the packaged devices. The firms must put this UDI on the label of the device or its package (Article 24/22.1). Manufacturers must keep an updated list of all applied UDI as part of technical documentation, and the basic UDI identifier must appear on the EU declaration of conformity. UDI must be used for reporting serious incidents and field safety corrective actions (Article 24/22.4a-c). The Commission must designate one, or several, entities to manage the EU UDI database. In so doing, it must try to ensure that UDI carriers are universally readable regardless of the system used (Article 24/22.2). Much of the finer detail surrounding the application of the UDI system and allowing it to respond to development and progress will be left to implementing and delegated acts that respect confidentiality and data protection, and the convergence of international UDI standards among other aspects (Article 24/22.7, 7a and 8). |
Importantly, the wording of Articles 24/22.5 and 5aa keeps open the possibility for some member states to require, on a local level, more UDI information than other states with regards to the rules for health-care institutions and professionals. In the case of the MDR, economic operators must store and keep UDI for class III implantables or other devices named in future implementing acts. In the case of the IVDR, economic operators must store and keep UDIs of IVD/devices specified in future implementing acts. The MDR also states that member states must “encourage and may require” health institutions to store and keep, preferably by electronic means, the UDI of class III implantables which they have supplied or which they have been supplied with. Both the MDR and the IVDR suggest that for all other devices/IVDs, member states must “encourage and may require,” health institutions and health-care professionals to store and keep the UDI of devices they have been supplied (Article 24/22.5a and 5aa). |
|
24a, 22a |
Electronic system on UDI |
The Commission is responsible for setting up and managing the UDI database and the core data elements will be accessible to the public free of charge (Article 24a/22a.1a and b). It will provide technical and administrative support to manufacturers and other users, and ensure maximum accessibility as well as multi-user access and automatic up and downloads of information (Article 24a/22a.2). To meet this requirement, cross-referencing is needed to Annex V. Annex V, part B of the MDR explains to the manufacturer the core elements to be provided to the UDI database together with the UDI device identifier. |
The IVDR Article 22a is briefer than the MDR Article 24a, but it cross-refers the MDR. The IVDR also states that before a device is placed on the market, except for purposes of a performance study, the manufacturer must ensure that the necessary information is transferred to the UDI database. |
|
24b, 22b |
Process for registration of devices |
Manufacturers must assign an UDI-device identifier to their device and submit this to the UDI database (Articles 24b/22b.1 and 2) with the core elements. Where manufacturers apply "type examination" coupled with product conformity verification, they must assign the identifier to the device before applying for a conformity assessment procedure by a notified body. The manufacturer must then submit the linked information (Annex V, Part B) to the UDI database after the issuing of the relevant certificate and before placing the device on the market Articles 24b/22b 3). Before placing the device on the market, manufacturers must submit to the Eudamed medical device database a series of details, and keep these updated (Articles 24b/22b 3a). These details are listed in Annex V, this time Part A. |
The MDR makes it clear that this process does not apply to custom-made or investigational devices, nor IVD devices for performance studies. But it does apply to systems or procedure packs that are not custom-made (Articles 24b, 1a). |
|
25, 23 |
Electronic system on registration of economic operators |
The Commission must set up an electronic system to create a single registration number and to process information that is necessary and proportionate to identify the manufacturer, and, where applicable, the authorized representative and importer (Article 25/23.1). At a national level, member states may also maintain or introduce national provisions on registration of distributors of devices that have been made available in their country (Article 25/23, 1b). |
Importers must play a vital role in ensuring that registration information is correctly uploaded to the relevant part of the Eudamed database. They must inform the manufacturer or authorized representative if information is not included or is incorrect based on a search of the database within two weeks of product launch (Article 25/23.3). The importer also needs to add its details to the database entries. |
|
25a, 23a |
Process for registration of manufacturers, authorized representatives and importers, single registration number |
Manufacturers, authorized representatives and importers have to submit registration information to the electronic database before applying to a notified body (if one is involved) and before placing a device on the market. This does not apply in the case of custom-made devices of if they have registered previously (Article 25/23a.1). The competent authority will then allocate a single registration number to the applicant (Article 25a/23a.2). This number must be used when applying to a notified body for certification and for entering the UDI system (Article 25a/23a.3). |
The data will be accessible to the public (Article 25a/23a.6) and the competent authority may use the data to charge a fee to the manufacturer, authorized representative or importer (Article 25a/23a.7a). Economic operators have just a week to update the data in the electronic system of any changes (Article 25a/23a.4). These economic operators must confirm the accuracy of the data within a year of submission and then every second year afterwards (Article 25a/23a.5). |
|
26, 24 |
Summary of safety and performance |
Manufacturers need to draw up a summary of safety and clinical performance for high- risk devices, which is clear to the intended user and to the patient and intended to be made public. After validating it, the notified body will upload the summary report to Eudamed (Article 26/24.1). Article 26/24.1a lists the minimum information that should be included in the summary. The list differs slightly between the MDR and IVDR texts, but includes the identification of the device and the manufacturer, as well as the basic UDI-device identifier and single registration number as well as the intended purpose of the device, including indications, contra-indications and target populations. |
In the case of the MDR, this applies to class III and implantable devices, and in the case of the IVDR to class C and D devices. It does not apply to custom-made devices (Article 26/24, 1). The Commission may set out the form and presentation of the data elements in the summary through implementing acts. |
|
27, 25 |
European databank on medical devices |
The Commission must establish how to create and manage Eudamed in implementing acts (Article 27.7). The Commission will be the controller of Eudamed, including for issues concerning the processing of personal data (Article 27.8). The purpose of Eudamed includes to: keep public adequately informed about devices, certificates, economic operators and clinical investigations; to ensure traceability; and to enable the authorities to carry out their tasks and cooperate together (Article 27.1). Information in Eudamed accessible to different user groups as necessary (Article 27, 4). In designing Eudamed, the Commission should take into account compatibility of national databases and national web-interfaces to allow for the import and export of data (Article 27.2a). Relevant entities should enter their own information into Eudamed (Article 27.3) |
Articles 27 and 25 list Eudamed portals: The Commission must provide for technical and administrative support to users of Eudamed (Article 27.3) and in creating the system should avoid any requirements for double entry of the same information within the same or different modules of the database (Article 27.7). The MDR and IVDR list the various portals within Eudamed as above, but otherwise the IVDR simply cross-refers to Articles 27 and 27a of the MDR for Eudamed rules.
|
|
27a |
Functionality of the European database portal and the UDI electronic system |
The Commission, which is responsible for drawing up the functional specifications for the different portals of the database, including the UDI part, will draw up a plan for implementation of the specifications most likely by early 2018 (i.e., within 12 months of the regulations entering into force) (Article 27a.1). The aim is for the database to be fully functional so that the Commission can publish a notice stating that the necessary conditions have been fulfilled by, at the latest, two months before the full application of the MDR, likely in early 2020 (Article 27a.1). |
The IVDR cross-refers to 27a of the MDR. The Commission will collaborate with the MDCG throughout this process. |
[Editors' note: This is the fourth article in an ongoing series delving into the MDR and IVDR chapter-by-chapter. The first article focused on the scope and definitionsof the two regulations. The second article and third article explored the MDR and IVDR regulations, respectively, on the topics of making devices available and putting them into service, the obligations of economic operators, reprocessing, CE-marking and free movement. Next up is a look at Chapter IV of the regulations, focusing on notified bodies.]
From the editors of Clinica