RAPS Swiss Chapter | Live Q&A on MDR/IVDR

Where do you get training in the basics of IVDR and MDR?
TÜV SÜD has a sister company, TÜV SÜD Akademie. TÜV SÜD Akademie provides training mainly in German but also in other languages. Training is also available outside Germany. You can get a trainer to come to your facility for training purposes. Other organisations do training as well.

How much clinical data is necessary for the new MDR regulation?
This is an exceedingly difficult question that does not have a precise answer. The amount of clinical data required depends on the device, including the risk and the novelty of the device. Sometimes, it is possible to get MDR approval with a limited amount of data, and in other situations, you will need to do several studies with hundreds of patients to satisfy the MDR’s requirements. Since the MDR needs to cover half a million medical devices, it is intentionally vague about what is needed and there isn’t one standard answer – it does depend on various factors.
For more information about MDR requirements, there is a lot of guidance from the MDCG. You can also look at guidance from earlier regulations up to the latest revision. These will give you an impression of how clinical data needs to be collected, evaluated and summarised. Though these should guide you in a direction that should be okay, it isn’t guaranteed to make you fully MDR compliant.

What is the definition of state-of-the-art?
This is open to interpretation. At TÜV SÜD, state-of-the-art is fundamental to all compliance proofs. This is because everyone wants safe medical devices. As things develop in the market, standardisation is always about a year to ten years behind. It is often said that state-of-the-art is the harmonisation of standards but under the MDR there aren’t harmonised standards. What state-of-the-art looks like can change overnight and as a constant, ongoing activity each organisation needs to find out what state-of-the-art means for them. It is the responsibility of the manufacturer to state their point of view and the responsibility of the Notified Body to challenge that. If these two do not have a similar understanding of this, there needs to be a discussion.

Are Notified Bodies ready for MDR and IVDR?
Though some Notified Bodies are not accepting applications under MDR at this stage, TÜV SÜD is completely ready.

What is your response to companies that say they tried to get in touch with TÜV SÜD but they are getting no response or their responses are taking way too long?
It could be that there was a delay in the past because of the huge number of requests we had, in addition to the MDD/AIMDD activities that TÜV SÜD was still doing. There is a web page where you should register if you want MDR certification with us – the TÜV SÜD MDR enquiry contact form. This submission will go to the right people and it should be handled quickly.

How do cybersecurity requirements play out in the MDR?
The MDR is requesting some new general safety and performance requirements. If your device is active and it is running software or is connected to a network, you need to make sure that that data is protected. Cybersecurity already became an issue before the MDR was published. Cybersecurity is a matter that comes back to risk management and the MDR doesn’t change much concerning risk management. If you have data on your device or you handle data in some way, then there’s a risk that someone can attack or steal it.

How many MDR certificates has TÜV SÜD released?
We cannot release this information for confidentiality, but there are many.

What is the status of TÜV SÜD with regards to accepting applications for IVDR? How can companies apply for IVDR certification?
We are open to receiving applications. If you are already in contact with us, it is best to approach us through your TÜV SÜD representative. For new applications, the MDR enquiry form will be extended to include IVDR enquiries as well. It is not up and running yet but will be soon. In the meantime, you are welcome to use the contact form on the TÜV SÜD website and request the service.

Are there test labs with expertise in MDR?
Though we are a Notified Body, we are also a testing organisation. What can be done depends on what kind of testing you need. You can approach your regional TÜV SÜD representative so that we can try to assist.

How will the current COVID-19 situation affect the rollout of the new regulations? Do you think, based on your interaction with manufacturers, that they will have enough time to implement the regulations?
The fact that there were uncertainties shouldn’t have stopped anyone from implementing the MDR and most manufacturers that I know of have done this already. If you haven’t implemented the MDR by April this year already, you are extremely late and you need to hurry up. COVID-19 has made things more uncertain and unclear and nobody knows whether another COVID-19 wave could cause another postponement. However, the biggest impact of COVID-19 lies in the fact that some manufacturers aren’t allowing Notified Bodies on-site and as a result, on-site auditing isn’t possible. That is a challenge because we are obliged to go into facilities and we can’t cover all relevant aspects with a remote audit. But if an on-site audit cannot be performed at this stage, your technical documentation should at least be ready so that we can start activities on that.

The date of application for IVDR has not been impacted and now the days of application for MDR and IVDR are closer together than what they were, making the timeline tighter. Do you think we will see a postponement for IVDR?
There is no way of knowing this, but there must be a good reason why it wasn’t postponed in the first place, so why would that change now? From a practical perspective, the deadline shouldn’t matter so much. You need to change your systems to comply and there isn’t a good reason to delay that. In the long run, those who start early are at an advantage over those who postpone.

With regards to MDCG guidance on significant changes under article 120 – which now has flowcharts to aid in decision-making – would these flowcharts need to be included in a justification of whether a change is significant?
There is no risk in documenting things this way and it may actually assist in providing clarity. However, there is no requirement to do it that way. Everything that supports clarity is good so if you are considering using these charts, feel free to do so.

Should companies be waiting for announcements on EUDAMED?
It is understandable if there are some technical IT-related challenges in terms of changing interfaces and registering devices, etc. that need to wait for more clarity about how an interface will look. But this is the only part of the activities that you can postpone – not the activities before that. Where the interface comes into play it will be all right to justify that with the non-existence of EUDAMED. However, you still have to collect data, analyse information and report incidents. Do the best you can.

How can compliance with the requirements for product registration in EUDAMED be ensured while the system is still not in place? What steps does a company need to take before the launch of EUDAMED and what can Notified Bodies require from manufacturers?
You must do everything up to the point where you need to upload information into EUDAMED. Also, every activity that is connected to EUDAMED, you must do. However, the problem is that you can’t receive data that you need from EUDAMED if EUDAMED isn’t there. Remember that that doesn’t mean you can’t perform an activity.
For example, if you need to upload documents to EUDAMED and these need to be forwarded to the Notified Body in EUDAMED and the Notified Body needs to do something with these documents, the only thing that is missing is EUDAMED. That doesn’t relieve the manufacturer or the Notified Bodies from their responsibility to perform activities. Notified Bodies will be looking at how manufacturers implement EUDAMED requirements into their quality management system. That’s something we will require to be in place during an audit. The requirements need to be performed and they don’t need EUDAMED to be there, as long as you are stopping at the interface.

A common scenario faced in the pharmaceutical industry is that the exact same platform is used in a drug-delivery device combination product for many, many drugs. Would you envision a time when manufacturers would be able to get a delivery device combination approved that could be used for multiple drug product applications?
I have certain doubts because it is necessary to look at the interaction of a specific substance and the medical device. The chemistry is always going to play a role. I would be sceptical that there would be a wildcard provided for syringes for a particular organisation.

Do all medical devices need indications?
I am not familiar with all 500 000 devices but my general answer to that would be “yes.” Indications, intended purpose and contra-indications belong together and you need these to define a medical device.

Should a manufacturer employ a person responsible for regulatory compliance (PRRC) because of MDR?
If you are a small to medium company, you do not need to have someone employed for this – you can use service providers. But if you are above a small to medium enterprise (as defined by the EU), you must absolutely have that person available in your organisation. That is a clear requirement from the MDR.

Do manufacturers need to go and hire a new person to be their PRRC, or is there another way to do it? For example, could the responsibility be assigned to an existing employee?
If you have an existing employee who is available and has the right qualifications, this could be an option. You may not want to put this responsibility onto the shoulders of someone who is already loaded with work. You have the option to either allocate this internally or hire someone new.

What is the average time that an MDR technical documentation review is active?
This depends on the risk class of the product as well as the quality of the documentation provided. It could be very quick, as in a few weeks or it could take months. The assessment of technical documentation of a Class III product (which is the most complex) at TÜV SÜD follows basically the same time lines as under the directives.

What about a substance-based device that is locally dispersed in the skin but not locally dispersed into the body? Do you think rule 21 is applicable? Can one approach a Notified Body?
This would probably be a question of classification. If you place an application with a Notified Body, then you reference what classification will be applicable for your device. If there is a difference of opinion between you and the Notified Body, it will be assessed in the conformity assessment. You can discuss this with the authority. Just note, if you contact a Notified Body and you just want a quick answer, that is seen as consulting, which Notified Bodies are not allowed to do. At the end of the day, it is the responsibility of the manufacturer to find the right classification rule and requirements for the device. If you want to get this confirmed by a Notified Body you need to go through a conformity assessment.

How does TÜV SÜD want the intended purpose when it comes to IVDR? Should manufacturers spread it throughout the instructions or should it be a separate item describing the exact intended purpose of the assay with all the items that the regulations ask for (the type of population, sample, method, etc.) in one item?
The real question here is: as a user or patient and as a Notified Body, what would you expect? Clarity is needed concerning a device. Probably the clearest way to do this is to put it in one place. You will need to ask yourself who will do something with this information and what is best for them.

Now that the MDR has been delayed, can new devices still be CE marked under MDD? What would you say if a company has been refused a CE mark under MDD by their Notified Body?
If the AIMDD and MDD are still applicable, then legally, you can still start conformity assessments for that. You need to look at the date, though, and ask yourself whether you really want to start that process now. Due to COVID-19, some companies are wanting to delay their MDR activities but this may not be the best way. If you want to do an MDD submission, talk to your Notified Body. If they still allow it and you are convinced you will make it, it could be an option. Remember though that it will only be valid until 2024 and then you have to spend money again on an MDR certification.

Is TÜV SÜD still accepting MDD applications?
We follow a legal basis but our focus is on MDR. There might be situations where MDD might still be the right route to take but this is a case-by-case situation. Stay in close contact with your Notified Body and be aware of the challenges, including the time pressure that this will bring about.