Why Virtual Manufacturing Is Likely To Be Less Popular Under EU’s New Device Regulations

The scale of responsibilities for a virtual manufacturer under the EU’s new Medical Device and IVD Regulations may deter many companies from taking on this role. Elisabethann Wright, partner at Cooley law firm, explains why.

It is not necessary to physically produce a device to be a manufacturer. A company can source products from other manufacturers (often referred to as original equipment manufacturers ̶  OEMs) and thereby become a “virtual manufacturer”.

But in so doing, and in putting its own name on the product, the virtual manufacturer accepts legal responsibility for the device and is regarded as “the manufacturer.”

Elisabethann Wright 

This means that the regulatory requirements applying to a virtual manufacturer are the same as for a manufacturer. And those responsibilities and the resources needed to meet them have increased under the new EU Medical Device and IVD Regulations compared with the medical device directives.

Now, virtual manufacturers face increased requirements relating to technical file submissions, as well as an obligation to fulfil post-market surveillance and vigilance activities and, where relevant, the need for notified body oversight. There are liability considerations too.

Medtech Insight asked Elisabethann Wright, partner at law firm Cooley, about the current changing regulatory factors impacting virtual manufacturing.

Medtech Insight: What is the scale of virtual manufacturing in the EU?

Elisabethann Wright: Under the former Medical Device Directive (MDD), the Active Implantables Directive (AIMDD) and the IVD Directive (IVDD), virtual manufacturing was fairly common in the EU, in particular in relation to less complex medical devices such as home-use pregnancy tests, contact lenses or condoms. However, even before adoption of the MDR and the IVDR, the practice became less common following publication of the European Commission's 2013 Recommendation on the audits and assessments performed by notified bodies in the field of medical devices. The Recommendation introduced the requirement that virtual manufacturers, or own-brand labelers (OBLs) as they were known at that time, should be considered the legal manufacturers of the medical devices placed on the EU market under their name.

The principles of the Recommendation have now become a legal obligation imposed on the virtual manufacturer by the relevant provisions of the MDR and the IVDR. The practical requirements for fulfilment of these obligations, particularly the obligation to prepare and keep up to date relevant technical documentation, may result in a further decrease in the number of virtual manufacturers in the EU.

How have the rules for virtual manufacturing changed in the EU MDR and IVDR compared with the medical device directives?

Wright: In principle, the MDR and IVDR impose the same basic obligations on virtual manufacturers as did the medical device directives. In practice, however, the Regulations have introduced more stringent requirements. These include the requirement for ongoing access to the original equipment manufacturer’s (OEM’s) technical documentation related to the device and an obligation to prepare and keep up to date their own technical documentation, an obligation to fulfil post-market surveillance and vigilance activities and, where relevant, the need for notified body oversight.

In addition, unlike the equivalent provisions in the MDD and the IVDD, Article 10 of the MDR and IVDR now detail the general obligations that manufacturers, including virtual manufacturers, must fulfil.

Moreover, while notified bodies may previously have accepted submission by virtual manufacturers of an abbreviated technical file to support conformity assessment of medical devices, this practice will no longer be acceptable under the MDR and IVDR. It is anticipated that, as a result, many virtual manufacturers will face greater challenges when seeking to demonstrate compliance with the MDR or IVDR than they did under the MDD and the IVDR.

Are the same issues relevant when it comes to virtual manufacturing under the MDR and the IVDR?

Wright: Yes, the MDR and the IVDR impose the same general obligations on virtual manufacturers of both medical devices and in vitro diagnostic medical devices. This includes a similar approach to post-market surveillance and vigilance activities.

What distinguishes a virtual manufacturer/own-brand labeler from a distributor of a medical device?

Wright: The Medical Devices Regulation 2017/745 (MDR) and the In Vitro Diagnostic Medical Devices Regulation 2017/746 (IVDR) provide very different roles for virtual manufacturers and distributors.

Moreover, while the Regulations include a specific definition of a distributor as “any natural or legal person in the supply chain, other than the manufacturer or the importer” who makes a medical device available on the EU market, there is no specific definition of a virtual manufacturer.

In addition, while Article 14 of both the MDR and IVDR detail the specific responsibilities of the distributor, no equivalent details are provided for virtual manufacturers.

Virtual manufacturers are assimilated into the definition of manufacturers. In accordance with Article 10(4) of the MDR and the IVDR, this means that virtual manufacturers of medical devices must comply with the obligation imposed on “real” manufacturers, including the obligation to draw up and keep up to date technical documentation for the devices. Virtual manufacturers and distributors, therefore, have very different responsibilities and obligations regarding the medical devices they make available on the EU market.

Who needs to apply for conformity assessment from the notified body?  Will the OEM be required to CE mark a medical device for which there is also a virtual manufacturer?

Wright: Where both a virtual manufacturer and an OEM place a CE marked device on the EU market, both parties are considered to be legal manufacturers of the devices they place on the EU market in their own name. As a result, both the OEM and the virtual manufacturer must conduct required conformity assessment and affix the CE mark to the device. If the conformity assessment process requires the involvement of a notified body, both the OEM and the virtual manufacturer must individually engage with a notified body for the assessment of their device. In practice, there may be benefit in the OEM and virtual manufacturer choosing the same notified body.

Even if the OEM has not placed the device on the EU market, or does not plan to do so, the virtual manufacturer entity may still contract with the OEM to manufacture the device on their behalf. In this case, however, the OEM would be a contract manufacturer for the virtual manufacturer. This would mean that the virtual manufacturer entity would be the sole legal manufacturer of the device in the EU.

The virtual manufacturers must hold the full technical documentation for any product they place on the market under their name. What obligations must virtual manufacturers fulfil to ensure that they have access to technical documentation held by the OEM and what related documentation must they possess?

Wright: For the virtual manufacturers to ensure continuous access to updated technical documentation it will be necessary for them to either acquire a duplicate of the OEM’s technical documentation and ensure ongoing updates to the documentation or, conclude an agreement with the OEM whereby the OEM agrees to give ongoing access by the virtual manufacturer to their technical documentation.

The technical documentation to which the virtual manufacturer has access must be appropriate and adequate to support the conformity assessment and CE mark of the devices marketed in the EU in their name. It must also include the information provided in Annexes II and III to the MDR and IVDR. This includes documentation relating to the design and manufacturing processes of the device, risk management processes, verification and validation data as well as technical documentation on post-market surveillance activities and plans.

One difficulty that virtual manufacturers may face in negotiating access to the OEM's technical documentation is that this documentation will commonly include OEM commercially-confidential information. As a result, the OEM may not be willing to share certain the information with the virtual manufacturer necessary to ensure fulfilment of the obligations imposed by the MDR and the IVDR.

Is it necessary to conclude a written agreement between the OEM and the virtual manufacturer concerning access to technical documentation?

Wright: There is nothing in either the MDR or the IVDR that imposes an obligation on the virtual manufacturer and the OEM to conclude a written agreement concerning access to the technical documentation. It is, however, inconceivable that a written agreement would not be concluded between the parties.

Access by the virtual manufacturer to the OEM’s technical documentation is likely to constitute access to the OEM’s commercially-confidential information.

Virtual manufacturers must demonstrate how their quality management system (QMS) enables them to ensure continuous compliance with the requirements of the applicable regulation. Any agreement concluded with the OEM would be part of the virtual manufacturer's QMS. The agreement may, therefore, be audited by the notified body, as applicable.

What factors should be covered in such an agreement?

Wright: The agreement between the virtual manufacturer and the OEM should clearly state the conditions under which the virtual manufacturer will have access to the OEM's technical documentation, including whether this will be in hard copy or by remote access, and how updated access is to be assured. The agreement should, moreover, set out the roles and responsibilities of each party and determine how the parties will cooperate throughout the lifetime of the device.

Cooperation between the parties will be particularly important for fulfilling post-market vigilance obligations. Virtual manufacturers and OEMs could consider including within the agreement provisions addressing among other things:

• Where both the virtual manufacturer and the OEM plan to CE mark and market a medical device in the EU;

•  How the parties plan to establish a clear link between the party and the medical devices placed on the EU market in their name;

• How the parties plan to cooperate in relation to post-market surveillance and vigilance activities such as the communication of incidents and post-market clinical follow-up;

• Communication between the parties regarding potential changes to the devices;

• Facility auditing by the parties and their notified bodies; and

• Fulfilment of registration requirements in the Eudamed database.

Who owns the rights for product design in the case of virtual manufacturing of OEM?

Wright: It is the OEM who commonly owns the rights for product design of medical devices provided to virtual manufacturers. Given that the OEM will take practical responsibility for manufacture of the device, modifications to the device by a virtual manufacturer that would constitute significant changes are, in our experience, uncommon.

Where does the virtual manufacturer stand regarding the OEM in terms of product liability?

Wright: The fact that the virtual manufacturer does not take practical responsibility for the manufacture, and commonly the design, of a medical device would not exclude it from liability for any injury or damage resulting from use of devices that it has placed on the EU market. This is because these devices are placed on the market at the discretion of, and consequently the liability of, the virtual manufacturer. Should the virtual manufacturer face an action in damages related to injury or damage caused by the device it could, however, either seek to join the OEM as a defendant in any action or sue the OEM to recover any subsequent losses.

The OEM would be independently responsible and liable for any injury or damage related to medical devices that they have placed on the EU market in their own name.

Does the potential income from virtual manufacturing outweigh the regulatory challenges, in your view, and is virtual manufacturing likely to be on the increase or decrease under the MDR/IVDR?

Wright: The obligations imposed on virtual manufacturers by the MDR and the IVDR may mean that they will face significantly higher related costs than was previously the case. In the past, given that the virtual manufacturer could rely on an abbreviated version of the OEM's technical file, related costs were largely supported by the OEM. Where, as is common, the medical devices that virtual manufacturers seek to market in the EU are low-value, high-volume, the additional costs that they will incur to comply with MDR and IVDR obligations may outweigh the benefits of virtual manufacturing.

In addition, some OEMs may consider that the risks that they may face in sharing their technical documentation and related commercially-confidential information with a virtual manufacturer outweigh the potential income generated in supplying medical devices to virtual manufacturers.

Consequently, unless OEMs and virtual manufacturers can agree on an individual basis how access to technical documentation will be shared, we would anticipate that virtual manufacturing will decrease under the MDR and IVDR.