Regulation (EU) 2017/745, the Medical Device Regulation (MDR), sent shockwaves through the industry with its stricter oversight and transparency demands. While the implementation challenges like delays, notified body capacity, and EUDAMED implementation have dominated discussions, a potentially bigger issue lurks for software as a medical device (SaMD) previously classified as Class I under the Medical Device Directive (MDD).
The structure of the MDD allowed for broad and varied interpretations of the Directive, and some SaMD manufacturers relied upon this leeway to self-classify devices as low-risk Class I. Now, with the MDR in effect, these devices are stuck in a loophole and face serious challenges in meeting the rigors of the MDR. This quiet crisis, buried by the noise rising from MDR’s administrative challenges, demands immediate attention.
The Loophole
Under MDD, manufacturers who classified a device as Class I enjoyed a flexibility that is now proving problematic. They could self-declare compliance with the Directive, draw up a Declaration of Conformity, and affix a CE mark without independent oversight from a notified body or formal CE certification. This means two crucial checks are missing:
- Independent Review of Technical Documentation: The manufacturer’s assessment of their product’s safety and performance remained unchecked, potentially leading to inadequate documentation.
- Scrutiny of Classification: Manufacturers determined their own device class, raising concerns that some digital medical devices landed in the lower-risk Class I when they should have faced stricter Class II or III requirements. Because these devices were Class I, they were able to evade rigorous reviews by notified bodies, which could have identified the misclassification.
In discussing the loophole, it’s important to clarify the difference between “CE marked” and “CE certified,” often misused interchangeably.
- CE Marking: A manufacturer’s self-declaration that their product meets essential safety and performance requirements. A CE mark alone is not a quality assurance declaration; it does not show evidence of third-party review, and it should not be confused with any independent certification mark that is issued by international or European notified test bodies.
- CE Certification: Confirmation by an independent notified body, involving audits, testing, and technical documentation review that a manufacturer’s quality system and product meets all appropriate EU requirements.
Both types of devices can display the CE mark, but only CE-certified devices can include the notified body’s four-digit identification number next to the “CE”.
The reasons for misclassification of digital devices under the MDD are varied:
- Lack of Scrutiny: Limited oversight by notified bodies and competent authorities of Class I devices under MDD allowed manufacturers to market a misclassified device without scrutiny.
- Ambiguous Guidance: MDD and MEDDEV guidance on software classification was murky, leaving room for misinterpretation, unintentionally or otherwise.
- Cost and Time Savings: Notified body reviews were expensive and time-consuming, making Class I self-certification a tempting shortcut.
While the loophole problem applies to many SaMD types, it is particularly endemic in radiology software devices. The text of MDD Rules 9, 10, and 11 and MEDDEV 2.4/1 Rev.9 ‘Classification of Medical Devices’ did not appear to explicitly cover software related to diagnostic imaging. Even the subsequent MEDDEV 2.1/6, ‘Classification of Standalone Software’ guidance left room for overly favorable interpretation by manufacturers seeking to classify into a lower risk class. By a process of elimination and taking the guidance text at face value, manufacturers could claim to have performed a diligent yet incorrect classification analysis.
Knock-on Effect: The Legacy of Misclassification has Severe Consequences
Because there is no grandfathering of Class I self-certified devices from MDD to MDR and no transition period for general Class I devices, any device on the market today with a Class I MDD-derived CE mark is in breach of the MDR.
The manufacturers of these devices are in potentially dire circumstances:
- Technical Documentation: Lack of notified body review means potentially incomplete technical files, jeopardizing compliance with the MDR and the General Safety and Performance Requirements (GSPR). In some instances, manufacturers compiled documentation to support an ISO 13485 certificate but failed to address the MDD and the Essential Principles.
- Unpreparedness for MDR: If technical documentation was not sufficient for MDD, manufacturers may struggle to demonstrate compliance with MDR’s stricter demands. These manufacturers face a serious challenge in generating a Clinical Evaluation Report (CER) that demonstrates the device’s intended clinical benefit and that the risk-benefit is acceptable.
- Missed Opportunities: Manufacturers who self-certified devices under the MDD face a more complex transition to the MDR compared to those with certified MDD devices. While certified devices enjoyed smoother application processes and built relationships with notified bodies beforehand, self-certified manufacturers are now scrambling to update technical documents and secure the services of a notified body – a task complicated by the limited number of approved vendors.
As this hopefully demonstrates, these manufacturers are caught in a catch-22. If a manufacturer suspects that a device may not be properly classified, seeking guidance from a notified body about MDR compliance could inadvertently trigger discussions about the original MDD classification. Raising these questions risks potential censure for MDD noncompliance and even device recall. This creates a chilling effect, dissuading manufacturers from seeking clarity they desperately need. However, staying silent is not an option. Under the MDR, incorrectly classified devices lack grandfathering and cannot legally remain on the market.
The Urgency to Act
Those misclassified SaMD lacking proper MDR certification now operate illegally within the EU market. While correctly classified MDD devices can rest easier, these “outlawed” devices face the very real threat of recall and market withdrawal. This risk is amplified under the MDR’s stricter scrutiny, particularly for SaMD due to their potential impact on patient safety.
The same loophole appears to exist with MDR – it is possible for a manufacturer to misclassify under MDR’s Class I and self-certify, dodging notified body involvement. However, the regulatory framework has shifted dramatically with greater oversight established by the MDR:
- Nowhere to Hide: Pre-MDR, a device’s classification could only be inferred by searches of individual notified body databases or by searching national registration databases, if available – effectively a needle in a haystack. Now, EUDAMED and post-market surveillance (PMS) reporting shine a light on all medical devices, making concealment near impossible. Additionally, MDR’s stricter rules for software Class I devices intensify scrutiny, significantly boosting the chances of swift detection by regulators and competitors.
- Rule 11 Classification: The specificity of MDR Classification Rule 11 will limit the number of software device types that fall through to Class I. Rule 11 establishes four risk classes (III, IIb, IIa, and I) and specifies that software can be Class I only if the software does not provide “information which is used to take decisions with diagnosis or therapeutic purposes” or “monitor physiological processes”. That language classifies most SaMD and almost all radiology software devices to Class IIa, IIb, or III, depending on intended use.
A Closing Window of Opportunity
The transitional provisions for legacy Class I devices under MDD fundamentally depend on the Class I determination being correct. While the transition period for legacy devices has been extended by the European Commission, the window of opportunity is not indefinite. Rather, a narrow window remains to reclassify and certify medical devices accurately before the legacy of the MDD loophole casts its shadow on both intentional and unintentional misclassifications.
If you think you might be caught in the Class I SaMD loophole, don’t panic! There’s still time to reclassify your device properly, update technical documentation, and partner with a notified body. EVERSANA’s Regulatory Consulting experts have helped several companies in this situation, and we can guide you through this, too.
Here’s how we can help:
- Expert Evaluation: Our experienced regulatory professionals will assess your current device classification and documentation.
- Remediation Plan: We’ll create a concise roadmap outlining the steps you need to take to achieve compliance.
- Minimize Risks to Business: Our team can help you implement the remediation plan, engage with notified bodies, and complete registration on your behalf, saving you time and allowing you to focus on your business.
Don’t wait – take control of your device’s regulatory status. Contact us today to share your situation and identify next steps.
Author
Gwilym is a seasoned regulatory professional with 15+ years of experience in Software as a Medical Device (SaMD). His expertise spans startups to large corporations, covering manufacturers and distributors. Gwilym has contributed significantly to…
With over 25 years in business and technology operations, Kory brings a wealth of experience to the ever-evolving medical device field. He partners with companies developing medical devices, leveraging his deep understanding of global…
Alberta Spreafico, Ph.D, MBA
Managing Director, Digital Health & Innovation, Healthware Group, an EVERSANA INTOUCH Agency
Alberta is a health innovator, global health and digital health expert with 10+ years of experience as senior director, researcher and management consultant in the health and life sciences sector. She co-founded and directed…