New EU Framework for In Vitro Diagnostic Medical Devices – are you “IVDR ready”?

Today (26 May 2022) marks an important day for everyone dealing with in vitro diagnostics (IVDs), i.e. devices such as self-tests for pregnancy and blood glucose tests for diabetics or COVID-19 tests: The new In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746 (IVDR) finally becomes applicable throughout the European Union. Enacted already in 2017, the IVDR replaces the In Vitro Diagnostic Medical Devices Directive (IVDD). The IVDR, being directly applicable in all EU Member States, now provides more legal certainty and sets higher standards of quality and safety for IVDs. In doing so it introduces a risk-based classification system with four risk classes of IVDs, stricter control for high-risk IVDs, and defines clear obligations not only for manufacturers, but also for their EU-representatives (so called “Authorized Representatives”), distributors and EU-importers. 

The IVDR follows suit to Medical Devices Regulation (MDR), which has already been in force since last year and has similar goals (see our related blog post here).

What does the IVDR mean for your products?

In general, IVDs placed on the EU market must now comply with the IVDR, where they face a new classification system. While the IVDD took a list-based approach to assigning risk classes depending on which conditions or pathogens the IVD was designed to diagnose, the IVDR introduces a risk-based classification system: It assigns IVDs to one of four classes, ranging from class A (lowest risk) to D (highest risk), based on the intended purpose of the device and its inherent risk. Seven rules govern the concrete classification (see details in the respective MDCG guidance document). Products for general laboratory use, for example, are classified as class A, while devices intended for the detection of highly critical laboratory values (e.g. to assess their suitability for transplantation) are classified as class D. It is expected that, unlike before, the vast majority of IVDs will receive one of the higher-risk classifications under the IVDR. This also means that IVDs can no longer be a self-certified by their manufacturer but now require the involvement of a third-party auditor, the so called “Notified Body”.

Given the (still ongoing) serious shortage of notified body capacity (only seven are currently accredited, down from 19 under the previous IVDD), the IVDR provides for liberal transitional periods:

(i) IVDs with a valid certificate of conformity issued by a notified body in accordance with the IVDD before today may continue to be placed on the EU market until the certificate of conformity expires or May 2025 at the latest. 

(ii) IVDs for which a declaration of conformity in accordance with the IVDD has been drawn up prior to today and that are, under the IVDR, subject to a conformity assessment involving notified bodies for the first time may also continue to be placed on the EU Market until a time determined by its future IVDR risk class: Until May 2025 (class D), until May 2026 (class C), or until May 2027 (class B and A sterile), at the latest. 

This comes at a price: Grandfathered IVDD products may not be significantly altered, otherwise they lose their grandfathered status. This includes changes to their design or intended purpose but also its legal manufacturer. The former limits the commercialization of products until they are IVDR certified. The latter complicates transactions in the IVD sector, often requiring comprehensive contractual workarounds to ensure the continued marketability of products.

Leaving transitional provisions aside, the IVDR fully applies as of today to CE-marked IVDs that do not require involvement of a notified body under the IVDD (i.e. class A non-sterile devices) and “new” devices (i.e. those devices that have neither a notified body certificate nor a declaration of conformity under IVDD). In addition, from today on, the rules on vigilance and market surveillance will also apply to IVDs that benefit from the transitional periods. 

What does the IVDR mean for you as manufacturer?

Manufacturers of IVDs should take note of a number of relevant changes to the legal framework they have been familiar with:

• The definition of an IVD has been significantly broadened and covers genetic tests, tests intended to predict a medical condition or disease, “companion diagnostics” and software. 
• The IVDR spells out concrete minimum requirements for software, e.g. interoperability that is reliable and safe. 
• The previous 13 essential requirements for an IVD set out in the IVDD are extended and replaced by 20 general safety and performance requirements.
• Manufacturers are required to establish and demonstrate an effective quality management system. It must address, among others, organisation, processes and responsibilities, as well as a strategy to ensure conformity, risk management and market surveillance.
• Manufacturers must conduct a conformity assessment procedure before they draw up a declaration of conformity and affix a CE marking to their IVDs. The details depend on the risk class the IVDR falls into. Class D IVDs may require the involvement of an EU Reference Laboratory and an independent expert panel.
• In addition to harmonised standards, the European Commission may introduce further so-called common specifications which may need to be complied with. 
• Whereas the technical documentation required under the IVDD was largely subject to the discretion of the manufacturers, they must now draw up and keep up to date a technical documentation with more than fifty specific elements defining its content.
• Similar to the MDR, manufacturers must now formally appoint a person responsible for regulatory compliance.
• Manufacturers are required to report key data on their products to EUDAMED, the European database on medical devices. That is, once EUDAMED becomes fully functional (see state of play here).
• A unique device identifier (UDI) will need to be affixed to each IVD and there are increased requirements concerning the content on labels, promotional materials and the availability of information in different languages of the EU.
• Post-market surveillance requirements and performance follow-ups have become more stringent and wider under the IVDR.

What does the IVDR mean for you as EU importer / distributor?

The IVDR now imposes for the first time specific obligations on EU importers and distributors – these are very much similar to the respective obligations set out in the MDR:

• EU importers may only place IVDR compliant IVDs on the EU market. With the actual manufacturer being located outside of the EU, it is essentially the responsibility of the EU importer to ensure that (i) the medical device has been CE marked and that a declaration of conformity has been drawn up, (ii) the manufacturer is identified on the packaging and that – where necessary - an Authorised Representative for regulatory purposes has been designated, (iii) the medical device is correctly labelled and accompanied by the required instructions for use, and (iv) where applicable, a UDI has been assigned. In addition, EU importers have to keep a register of complaints, of non-conforming devices and of recalls and withdrawals. EU importers are also required to cooperate with manufacturers, the manufacturer's authorised representative and competent authorities to mitigate potential hazards caused by medical devices placed on the EU market.
• Distributors now need to meet similar requirements. In particular, distributors have to verify, that (i) the medical device has been properly CE marked and that a declaration of conformity has been drawn up, (ii) the medical device is properly accompanied by the information to be by the manufacturer, and (iii) where applicable, a UDI has been assigned. Further, distributors also have to set up a complaint management system and have certain information and cooperation obligations towards the manufacturer, the manufacturer's authorised representative, the importer and competent authorities.

In practice this means that EU importers and distributors may need to expand additional resources to meet these new regulatory requirements. EU importers and distributors should also review existing customer agreements to ensure regulatory responsibilities and risks of non-compliances are clearly distributed.

What should I be thinking about next?

• Manufacturers of IVDs should confirm their IVDR readiness and confirm the work that still needs to be done. If IVDs are currently grandfathered under IVDD, any more substantial changes to the devices and the way they are manufactured should be carefully considered.
• Importers and distributors of IVDs need to familiarize themselves with their new obligations under the IVDR and determine whether they need to expand additional resources to meet these requirements. Contracts with customers and suppliers should be reviewed to make sure regulatory responsibilities are clearly distributed.
• Financial sponsors considering an investment in an IVD manufacturer should carefully assess the manufacturer’s IVDR readiness, the impact of the IVDR on the marketability of products, whether grandfathered IVDD products can be commercialized as planned and what the envisaged transaction may mean for these grandfathered products.