On the 25th May 2017 there was a significant change in the European Union (EU) legislation relating to medical devices. The previous legislation that applied to Medical Devices has now been replaced by the EU Medical Device Regulation 2017/745, known as MDR. Prior to this medical device legislation was based on the EU Medical Device Directives (93/52/EEC and 90/385/EEC), known as MDD.
The MDR approach is more focussed on full product lifecycle, with much greater emphasis on clinical data and clinical evaluation. There is a transition period from the MDD of 2017, to the MDR, with full compliance required for standalone medical software that has a medical purpose, by 26th May 2020
To date, both medical devices (Hardware) and medical devices with their own software (Hardware + Software) have required conformance with MDD and regulatory classification and CE marking. Software has not been effectively captured by the MDD. Now though, MDR, will in addition, cover standalone medical software. This applies to all formats for use of software, e.g. mobile applications, deployed programs and applications and websites etc.
Why has this happened, and why does it matter?
The drivers for this move to MDR from MDD have been to improve the quality and safety of all medical devices with MDR considered, in general, to be stricter than MDD. MDR also particularly recognises the impact on patient safety of current healthcare software and the software elements that are collectively known as ‘Artificial Intelligence’ (AI). These regulatory changes are occurring on a global scale.
Currently, CE marked regulated standalone medical software is more the exception than the rule. However, now under the MDR the landscape for SaMD has significantly changed. The UK competent authority, the MHRA, will require all SaMD to comply with MDR. This will apply for all current and new software deemed to be standalone software which is deemed to have a ‘medical purpose’. This is not a one-off task; on-going compliance and regulatory surveillance will be necessary throughout the product lifecycle. As such, the ramifications for both current and future healthcare software are significant.
Assessment is required now for any software ‘intended to provide information which is used to take decisions with diagnostic or therapeutic purposes’
What are the important features of MDR and the impact on NHS Scotland?
There are a myriad of aspects to consider on SaMD / MDR. Some key initial ones are:
1. Who is the ‘Manufacturer’ – this would be the holder of the CE mark, and where the legal liability lies.
2. The Manufacturer will need to appoint an appropriately qualified ‘Responsible Person’.
3. Manufacturers need to register with a Notified Body (NB) who will perform conformity assessments. This process may take 3 to 6 months currently.
4. Does the software have an output that is intended to affect the treatment of an individual?
5. Does the software have a stated intended purpose which is a medical purpose? (Prevention, diagnosis, monitoring, treatment or alleviation, compensation for injury/handicap, investigation/replacement/modification of anatomy/physiology, or control of contraception)
6. Previous healthcare institution exemption is now very unlikely to apply, particularly for SaMD.
7. Brexit – whether we leave, or remain in the EU, MDR will apply.
8. For Manufacturers and Distributors, there is an obligation to check any supplier’s device compliance.
9. Timeframes to generate a Quality Management System (QMS), advisable before seeking registration with a notified body, is likely to be in the region of 4 – 12 months, depending on resources available.
10. The preparation of the ‘Technical File’ for any SaMD application will need considerable clinical informatics input, as will the on-going post-marketing surveillance processes.
Whilst, classification for SaMD will not be required for all software, it will be required for some. As a ‘Manufacturer’ you will require to embark on this process. As a ‘Distributor’ you must be knowledgeable enough of the process to appropriately manage MDR certified software procurements.
Obtaining CE Certification for SaMD is likely to be a complex and lengthy process, specialist external advice may be required if this does not exist within your company.
HIAP staff are currently unable to provide this detailed specialist advice, however we may be able to suggest other sources of information and assistance.