EU MDR & IVDR Consulting

EU MDR & IVDR Consulting

Our firm provides EU MDR & IVDR Consulting for medical devices of all types.

• Medical device classification
• Verification of applicable standards and testing requirements
• Writing MDR or IVDR Technical Documentation or review
• Review of Labeling & UDI
• Verification of compliance with General Safety and Performance Requirements (GSPR)
• Writing Post Market Surveillance (PMS) Plan & Reports (including PDUR)
• Writing Post Market Clinical Follow-up (PMCF) Plan & Report
• Writing Literature Search Plan (Protocol) & Report

• Writing Clinical Evaluation Plan & Report
• EUDAMED Actors and Products registration
• Building and maintenance of a Quality Management system (ISO 13485)
• Risk assessment and management (ISO 14971:2019) Plan & Report
• Development of Risk, Clinical Evaluation, Vigilance, and PMS procedures
• Evaluation of significant changes
• Devices without a medical purpose

See also our EU MDR & IVDR Certification

MDR & IVDR Brief History

• 2017, EP adopted Medical Devices Regulation (EU) 2017/745 (MDR) and In Vitro Diagnostic Dev. Reg. (EU) 2017/746 (IVDR)
• 26 May 2021 – MDR Date of Application (transition 26 May 2024)
• 26 May 2022 – IVDR DoA
• March 2023 MDR/IVDR Transitional Provision Amendment – Regulation (EU) 2023/607 – the MDR/IVDR transitional period and the validity of MDD/AIMDD certificates have been extended, provided that the conditions in the amended Art.120/ Art.110 MDR are met. Only legacy devices benefit from the transitional period.

Frequently Asked Questions

Question: What are MDR Legacy devices?

Answer: Devices placed on the market (due to the transition period) after 26 May 2021 (MDR DoA) if certain conditions are fulfilled.

Legacy devices include:

• Class I devices under MDD (EC DoC prior DoA) and for which the conformity assessment procedure under MDR requires a Notified Body
• Devices covered by a valid MDD/AIMDD EC certificate issued before 26 May 2021 (DoA)
• Legacy devices must continue to comply with AIMDD/MDD and no significant changes in device design and intended purpose (conditions – Article 120(3c)

Question: Since accessories are also referred to as devices (Article 1:4), they are not excluded from the definition of “clinical benefit” in the MDR, and therefore, we thought we should assess “clinical benefit” for each accessory in our product. Is our approach correct?

Answer: We understand your logic; however, if you follow it to its full potential, you will have to do GSPR, PMS, PMCF, Risk, etc., for each accessory of the product, which was not, in our opinion, the legislator’s intention.   Each accessory contributes to the final product’s overall “clinical benefit,” benefit-risk ratio, etc. of the product, and we can describe such contributions in TD. Still, we would reserve the term “clinical benefit” for the final product only. I think that your approach may apply to a greater extent to the products contained in the “Procedure pack” (MDR 2(10) or “System” (MDR 2(11)). Similarly, for devices incorporating a medicinal product (Rule 14), you need to justify (clinical benefit, etc.) the addition of medicinal substance(s).

Question: Do implantable and/or class III orphan devices (OD) require clinical investigation?

Answer: Yes, these group devices would require clinical investigations unless they are exempt under MDR (Article 61). Due to the complexity of OD clinical trials, new guidance advises involving clinical experts for the appropriate clinical design. In addition, engagement with patients, patient associations, parents, and/or caregivers of the target population may also be helpful in confirming whether the study includes patient-relevant clinical outcomes.

In Appendix A.2 of MDCG 2024-10 Clinical evaluation of orphan medical devices, you can find additional considerations for clinical investigation design (for all medical device classes), including:

• Defining the study population
• Selecting appropriate objectives and endpoints
• Choice of study design
• Choice of comparator
• Study monitoring

The company should also assess the possibility of using clinical data extrapolated from the use of the device in other, non-orphan populations (see Appendix A.3 of the guidance on extrapolation).

Question: What information should be included in the Clinical evaluation plan (CEP) for the orphan device (OD) according to EU-MDR and new guidance (MDCG 2024-10)?

Answer: In your CEP, you should relate to disease-specific factors, which include:

• Information on the relevant disease or condition – Epidemiology, including incidence supporting the OD status; Patient population in which the OD is intended to be used; Severity of the disease/condition, including details on its morbidity and mortality; Factors of the disease or condition that contribute to the challenges and difficulties to generate pre-market clinical data in this population, including (if applicable) legal or ethical challenges to conducting clinical investigations in relevant vulnerable populations.
• Current state of the art in management of the disease/condition in question: Identify and describe all relevant alternative diagnostic and/or therapeutic options (if any); Explain the relevant limitations (if any) in clinical management of the disease in the existing state of the art.

In addition, CEP for OP should include device-specific factors, including:

• Summary of supporting information to justify that the device meets the criteria for orphan device status;
• Summary of pre-clinical evaluation, including relevant non-clinical data;
• Justification for acceptability of limitations in pre-market clinical data.

Question: Which content should be included in the Clinical Evaluation Report (CER) for Orphan Device (OD)

Answer:  CER for OD should include summary descriptions of the orphan device-specific considerations laid out in MDCG 2024-10  device, including:

• Summary of how the device meets the criteria for orphan device status;
• summary of any identified limitations in clinical data and residual risks, including a description of how these were identified;
• acceptability of these limitations in clinical data and residual risks, with particular justification that:
  • all available non-clinical and clinical data relevant to the OD have been evaluated, and any limitations in clinical data have been identified;
  • the existing non-clinical and limited clinical data is sufficient to demonstrate that the relevant GSPRs in Annex I MDR are met, that the benefit-risk ratio is acceptable, and that it is expected that the device will provide a clinical benefit considering the clinical condition, the state of the art, and the safety of patients;
  • it is not feasible or proportionate to generate further clinical data within an acceptable time frame in the pre-market setting;
  • the manufacturer has an adequate PMCF plan that, once executed, will generate clinical data in an appropriate timeframe that will fully address the remaining limitations in clinical data.
  • users of the device will be adequately informed (e.g. by provision of information in the IFU, SSCP (for implantable and class III devices), and/or other accompanying documentation) of the orphan status of the device, the limitations in pre-market clinical data, and instructions to users on how to report incidents, complaints, and other clinical experience to the manufacturer.
• summary of the applicable non-clinical data that was evaluated as part of clinical evaluation planning;
• summary of pre-market clinical data that have been identified and evaluated, including any clinical investigations;
• a clear, stringent, and detailed PMCF plan with due regard to section, including:
  • summary of the risk management plan;
  • description of the type and quality of data that needs to be generated in the post-market phase in order to further evaluate the clinical performance and clinical safety of the device and address identified limitations in clinical data;
  • description on how the manufacturer plans to generate these data in an appropriate, timely manner;
  • projections on the number of patients that will be managed with the device per year in the EU;
  • a summary of planned PMCF activities including, as applicable, PMCF investigations and registries in the EU and globally for this device;
  • for orphan devices that carry significant risks (i.e. significant residual risks and/or high risk of causing serious adverse events), confirmation that the manufacturer will prospectively enroll a representative majority (e.g. greater than 90% if feasible) of patients into PMCF activities including PMCF investigations and/or registries;

• summary of any interactions with expert panels;
• a plan to update the clinical evaluation report at pre-defined intervals as appropriate, based on the PMCF plan, and whenever new information becomes available that may change the device’s benefit-risk profile.

Question: According to EU-MDR, what is considered a non-significant change for medical devices?

Answer: This should be assessed for each concrete case, but generally, we can say that non-significant changes include (assuming risk/benefit ratio of the device is not negatively affected) the following:

• Change that doesn’t alter built-in control mechanism, operating principle
• Replacement of a component with the same specifications
• New supplier/producer of a material within the defined specifications
• Security updates (e.g. cyber-security enhancements)
• Updates/upgrades of operating systems, e.g., Microsoft Windows, iOS, and others

Question: Does a company need to designate a person or persons responsible for cybersecurity within the company?

Response: According to IEC 81001-5-1: 2021-12 Health software and health IT systems safety, effectiveness and security — Part 5-1: Security — Activities in the product life cycle (see clause 4.1.2) – the Company needs to designate a person (personnel) responsible for the cybersecurity, same as for other organizational roles. Likewise, a Company should define and document all cybersecurity activities and processes in the Company.

Question: Does the personnel carrying out cybersecurity tasks need to have appropriate education, experience and/or training?

Answer: Certainly, like for all other job positions in the Company. This is ISO 13485 (6.2 Human Resources) requirement: “Personnel performing work affecting product quality shall be competent with appropriate education, training, skills, and experience. The organization shall document the process(es) for establishing competence, providing needed training, and ensuring awareness of personnel.”

Question: Do penetration testing laboratories (suppliers), must be accredited?

Answer: The recommendation is to use Penetration testing laboratories which are accredited, if possible.  The company is usually not requested to audit these suppliers. Instead, for the criteria for evaluation and selection of suppliers (as per ISO 13485 cl. 7.4.1), the company could use other means for rating performance and ability of penetration-testing suppliers, such as penetration test report reviews and questionnaires.

Question: What is the difference between an Incident and a Serious Incident according to MDR & IVDR?

Answer: The distinction between an incident and a serious incident under the Medical Devices Regulation (MDR) and In Vitro Diagnostic Medical Devices Regulation (IVDR) is primarily based on the severity of the health or public health outcome associated with the issue.

According to MDCG-2023-3, an Incident is defined as:
• Any malfunction or deterioration in the characteristics or performance of a device, including:
o Use errors due to ergonomic features.
o Inadequacy in the information supplied by the manufacturer.
o Undesirable side effects.
Incidents not classified as serious are not reportable to competent authorities but must be documented and included in the manufacturer’s quality management system for post-market surveillance purposes.

A serious incident is a subset of incidents and involves events with significant consequences. It is defined under MDR (Article 2(65)) and IVDR (Article 2(68)) as an incident that:
• Directly or indirectly leads to one of the following outcomes:
1. Death of a patient, user, or another person.
2. Temporary or permanent serious deterioration in health (e.g., requiring surgical intervention, hospitalization, or causing chronic disease).
3. A serious public health threat (e.g., widespread distribution of defective blood test kits leading to incorrect diagnoses).

There is a mandatory reporting requirement for this kind of incident; manufacturers must report to competent authorities within specific timelines:

• 2 days for a public health threat
• 10 days for incidents causing death or unanticipated serious deterioration.
• 15 days for other serious incidents.

Question: Does the Importer of MDR medical device need to handle the payables and other accounting in order to be compliant?

Answer: No, the Importer of device under MDR is not required to handle financial payables or accounting to be compliant. The MDR defines the importer role strictly in terms of regulatory responsibilities, not commercial functions like payments. Financial transactions (e.g., payments to suppliers) can be managed by distributors, agents, or the manufacturer without impacting MDR compliance.

Question: Can the manufacturer have more than one Importer of the medical device within the EU?

Answer: Yes, a manufacturer can designate multiple Importers within the EU. This is common for companies with complex distribution networks across different EU countries. Each importer must fulfill the full MDR obligations for the products they import. It’s advisable to have Manufacturer – Importer Agreement to clearly define responsibilities and avoid gaps in compliance.

Question: Can manufacturer use a sticker label on the product to add importer information?

Answer: Yes, MDR allows the use of sticker labels to indicate importer information (unless this is Class III/High-Risk device). The sticker should be permanently affixed to the product packaging or accompanying documentation. In addition, the sticker should be legible, durable, and compliant with MDR labeling rules.

News:

• Heads up for manufacturers of contact lenses!

In November 2024, the EU issued MDCG 2024-14 Guidance on implementing the Master UDI-DI solution for contact lenses. The purpose of this guidance is to enhance traceability and identification of contact lenses by using the Master UDI-DI system and simplify compliance with MDR requirements.
A new Master UDI-DI will replace multiple UDI-DIs for lens variations and it will be mandatory from 9 November 2025. Master UDI-DI will also be required for device registration in Eudamed, replacing multiple UDI-DIs. If you need any assistance with Master UDI-DI, contact us now!

• In January 2025, MDCG published the 2nd version of MDCG 2023-3 (with minor changes from the 1st revision), a guidance document initially published in February 2023, and clarifies vigilance terms and concepts outlined in MDR and IVDR.
  This guidance targets manufacturers, competent authorities, and economic operators involved in the medical device lifecycle. Manufacturers are advised to adopt robust quality management practices to ensure compliance with vigilance requirements.
  Key Clarifications:
  Incident vs. Serious Incident
  • Definitions and criteria for classification based on health impact, ranging from minor device issues to events causing death or serious health deterioration.
  Reporting Requirements
  • Timelines and obligations for manufacturers to report serious incidents, including guidance on immediate, 2-day, 10-day, or 15-day reporting periods depending on severity.
  • Emphasis on documenting all incidents, even those deemed non-reportable.
  Field Safety Corrective Actions (FSCAs)
  • Description of corrective measures, such as device recalls or modifications, to reduce risks associated with serious incidents.
  Use Errors
  • Differentiates between “use errors” due to ergonomic design flaws and “abnormal use” involving deliberate misuse.
  • Manufacturers must document and address use errors in their quality management systems.
  Indirect Harm
  • Outlines scenarios where device inaccuracies lead to misdiagnosis or inappropriate treatment, which may indirectly harm patients.
  Expected and Unexpected Results
  • Guidance on managing and reporting expected side effects or erroneous results documented in product technical information.
  Call us if you need assistance!

Contact us if you need EU MDR & IVDR Consulting.