Notified Body Q&A: 3 NBs Talk EU MDR Enforcement, The IVDR 'Big Bomb,' 'Tough' Regulators – And More Insights

MEDCERT's Klaus-Dieter Ziel, TÜV SÜD Product Service's Bassil Akra and Qserve Group's Gert Bos answered questions about the EU's new Medical Device and In Vitro Diagnostic Regulations at MedCon 2019.

At MedCon 2019 in Cincinnati, OH, in May, three officials from big-name notified bodies took questions from the audience related to the EU's new Medical Device and In Vitro Diagnostic Regulations, to be implemented on 26 May 2020 and 26 May 2022, respectively.

The remarks from MEDCERT managing director Klaus-Dieter Ziel, TÜV SÜD Product Service VP Bassil Akra and Qserve Group executive director and partner Gert Bos were lightly edited for clarity.

Notified bodies have now gone through the certification process. Not to full certification, but I believe this is the first time you've actually been audited, to a significant degree, by the competent authorities, and I'd like to hear your insights on what you've learned from that process that might be applicable to manufacturers as we go forward.

Klaus-Dieter Ziel: Yeah, it's a very interesting time that we are spanning with regard to regulation and being audited from member states, from different countries and the European Commission on the Medical Device Regulation.

The first impression was those people were dealing with the regulation for the first time, so this is a very interesting time for them. If you have an auditor coming in for the first time, treating you according to new rules, then the way they are dealing with that, you see the uncertainty. You see also the question mark on their head, and this is how they were behaving, as well.

Those are regulators. They were very tough. They were from a point of view that they are coming in with the intention to write nonconformities. Because they didn't want to provide positive results at the end, saying you pass the audit; they wanted you to not pass.

"In the past when an audit happened for our organization, the authority came to us and they audited us. With the new regulation, they audit you before they come." – Klaus-Dieter Ziel

And this kind of audit we didn't see before. In the past when an audit happened for our organization, the authority came to us and they audited us. With the new regulation, they audit you before they come. They request your quality management documentation at the beginning with the application, and they come to you with a bag full of nonconformities. They just highlight where are the nonconformities, and if you changed them already because your continuous quality management process is requiring that you have continuous updates, they don't look to the change. They say, "We don't want to look what you have adopted. We want to tell you what we have previewed, and we don't have time to discuss the new thing. You have to submit that afterwards."

And this is showing you actually that they didn't want to spend time. I expect also a kind of similar experience between industry and notified bodies at the beginning of the process. Because none of us have done this before. Even notified bodies are doing this for the first time. Even manufacturers have prepared documentation for the first time. And believe me, from my experience at this moment of time, we are still discussing with industry the MDD, the Medical Device Directive.

So, we still discuss interpretation of a directive that was published in 1990 and 1993. Do you believe with the new regulation we will have a smooth process? It will be a very tough process because everyone is doing this for the first time, so everyone who tells you, "I'm an expert in MDR," you can ask them, "How did you get your expertise?" Because nobody has that expertise. You are currently in the development phase, and you are currently running toward the new MDR.

"The big fish is the European Commission, running after the authorities; the authorities are running after the notified bodies; and the notified body is going to be running after the manufacturer." – Klaus-Dieter Ziel

So, you're going to see a reflection of what notified bodies were experiencing in your auditing for sure, because the expectation on notified bodies was too high, and they are expected to reflect it down. It's a big fish-little fish approach in Europe. The big fish is the European Commission, running after the authorities; the authorities are running after the notified bodies; and the notified body is going to be running after the manufacturer. This is what you're going to see as the result of the whole process.

In general, the term "lifetime of the device" is used throughout the regulation. So, in the postmarket surveillance space, is the phrase "lifetime of the device" clearly understood and defined? Are there any guidances on quantifying that?

Bassil Akra: "Lifetime of the device" is actually not something new. You have been doing this for the multiple authorities worldwide. When you design a device, you have to define for which lifetime you are developing that device. You design a device with the intention to reflect the current state-of-the-art expectation.

So, if you are creating a new, say, heart valve, you will not design it for one-year lifetime. You design it for 20 years; that is at least time that it is expected to remain in the human body. So, you have to define "lifetime" as the medical device manufacturer.

And whatever you define, you have to justify when you convert to current state of the art. And this definition and what you have considered has to be assessed by [a notified body] to see if this is reasonable, and we look to the state of the art to see if this is reflecting what is the state of the art, and determine if it's reflecting also the patient population that you are targeting. You're going to have different patient populations that have different lifetime expectations, and based on that, you have to set up your postmarket surveillance system.

So, if you have a device with 20 years' lifetime, then we expect you in a postmarket surveillance system so you can look to the last device that was implanted in a patient, that you have a follow up of 20 years. It doesn't mean you have to do a study forever. Your system has to collect data enabling you to actively seek data from the market, that you can catch any signal for any device that you place on the market throughout its lifetime. This is the requirement.

There was a question-and-answer document released by the European Medicines Agency [EMA] at the end of February on MDR Article 117 on combination drug-device products. Is there any matching or different document that is being made from the perspective of notified bodies or regulatory authorities on how notified bodies are going to approach combo products?

Akra: The EMA document was created with the support of notified bodies. We were behind the scenes. We were consulted on that document. So, if EMA is saying this is how we should be doing that assessment, we're going to be following that. But in Article 117 – which refers to medicinal subsets that include a medical device – there are multiple expectations.

"I will not give you a hope. Even the commission doesn't have hope." – Bassil Akra

For this kind of combination, in the past, if you have a device that is applied for multiple medicines or substance, it had to be CE-marked. If you have a device that is just specific toward the application of one medicine or substance, it was under the responsibility of the authorities that released the medicine or substance to approve it. Now, in the MDR regulation, it's saying that if you have a device included in that combination, then the manufacturer has to seek an opinion from the notified body on the medical device part if they don't have a CE-mark device.

So, the easy answer: No, there will be no other document than the EMA document because EMA is consulting notified bodies and involving notified bodies and other authorities in the whole process.

When we think about the capacities of notified bodies, there's only maybe seven that will be designated for the IVDR. At the moment, only about 20% of all IVDs require a notified body under the IVD directive – and those numbers will reverse for the IVDR; 80% will need a notified body. And yet, the number of notified bodies is greatly reduced. Is there any hope? Because the situation seems dire.

Akra: I will not give you a hope. Even the commission doesn't have hope. They started discussing Plan B at the commission. The Plan B was, if they don’t have a sufficient number of notified bodies, that the EMA or other authorities will give support by taking responsibilities for IVD. So, they will look on CE certification with notified bodies that will be designated, and if there will be a gap, they are discussing whether some authorities can take the activity, as well.

"We expect for IVD to be a big problem because there will not be enough notified bodies. IVD is going to be the biggest big bomb that we will see in the next two years." – Bassil Akra

Because we will not have enough notified bodies. We are hiring like crazy. As a notified body, we have been hiring for the MDR and IVDR for the past three, four years. But it will not be sufficient because we can't find all of these experts. They are not available out there. The market is getting really tough. And this is the point where we expect for IVD to be a big problem because there will not be enough notified bodies.

And this is where I believe that IVD is going to be the biggest big bomb that we will see in the next two years. A large number of manufacturers didn't even recognize the impact of the IVDR, which is actually much bigger than the MDR.

So, there's no available capacity. The number of notified bodies will never be sufficient. And the only possibility would be that authorities may step in, and we're going to see what will happen in the upcoming years.

With the implementation of the MDR regulation, will there be a change in the level of enforcement as a result of deficiencies that may be found in quality systems? And will we see more input and oversight from the competent authorities as a result of implementing the regulation?

Akra: Notified bodies will be in the enforcement of the regulation, looking to that regulation and in a very clear way avoiding that they miss any nonconformances. And they are also impacted by authorities because authorities are currently scrutinizing today notified bodies much more. You should be seeing already a change in the expectations on how and what kind of evidence you need to provide to notified bodies.

So, with the new regulation, you will for sure see a difference, and the difference is in the way the notified body is going to be assessing the time they're going to spend on the technical file and the number of nonconformities related to promotion materials, to communication, to your website, and things like that.

Gert Bos: I'll add a little bit from a different perspective. You're talking a lot from the notified body perspective and what you see, but of course the market and the question is broader than that. Also, markets can be different all around the world. If I look, for instance, at my country, the Netherlands, a small country, they have upgraded the amount of staff they have by a factor of five to supervise the market. The co-interactions – or the interaction – that authorities have between themselves – for instance, on vigilance, follow-up and other concerns they have – has dramatically increased the number of interactions.

"On hot investigations where multiple countries are working together, it is not unheard of that they have four, five, six teleconferences per day to align on what they have found out." – Gert Bos

On hot investigations where multiple countries are working together, it is not unheard of that they have four, five, six teleconferences per day to align on what they have found out, and work with the manufacturer to really solve key critical issues, and so on.

And this is just a small country – the Netherlands – and every country is building similar things. If you look at the recent medical law that has been published [in the Netherlands] in preparation for the MDR implementation, it has a huge system to allow the issuance of fines. And when there have been repeated offenses, it gets a little bit closer to willingly not fulfilling all of the details of the law. A fine can be handed out. And so as such, that is really changing from how that was before – much more supervision from authorities, but also much more details in the national laws to allow them to really hit hard.