FDA, EU MDR Updated Guidance Coming in 2023

The U.S. Food and Drug Administration’s (FDA) Center for Devices and Radiological Health (CDRH) recently published new guidance for medical device priorities in 2023. The guidance aims to evolve away from the COVID-19 pandemic and transition toward digital health, medical device software, and regulated software as a medical device (SaMD).

The guidance is chock full of new measures for medtech manufacturers. A closer examination of the new regulations for various subject areas follows.

Cybersecurity: Among topics the FDA guidance considers “A-List” priorities is medical device cybersecurity. Two initial priorities of the FDA guidance will include a deeper study of quality system (QMS) considerations and premarket submission (PMA) content. Additional FDA software guidance published last September described the ways in which software functions meet the definition of a medical device and public risks. The change industry should monitor is FDA product-specific guidance regulating software development that impacts patient safety risks.

Quality Management System: QMS regulation currently falls under 21 CFR 820, so it will be interesting to see how new updates are developed based on industry discussion. All medical device manufacturers must have a compliant QMS system that includes the necessary QMS documentation for regulatory approval. As digital healthcare integrates the physician-patient relationship, FDA continues to scrutinize device software functions and healthcare mobile apps. Lastly, these insights may provide additional feedback on software functions not subject to FDA regulatory requirements relevant to a QMS audit.

Medical device remanufacturing: FDA is taking a deeper look at reusable medical devices and how preventive maintenance increases the medical device lifecycle. Currently, there are separate regulations for both industry manufacturers and third-party service companies. FDA will likely clarify the differences between “servicing” and “remanufacturing,” and the impact on medical device safety for both. This is liable to impact the regulatory responsibilities of companies that perform these activities for healthcare providers.

Premarket authorization: Software as a medical device continues to grow across the healthcare industry. Updated premarket authorization guidance focuses on software products and specifically, the way(s) in which the software is delivered to end users. This can include factory-installed healthcare software or platforms installed by a third-party vendor. Equally important, new information is anticipated for different types of firmware and software-based control of medical devices. Manufacturers should anticipate greater clarity for stand-alone software applications and general-purpose computers. Leadership at FDA has hinted that medical device accessories that include software may also be included in future FDA guidance.

COVID-19 Emergency Use Authorization: There has been much discussion surrounding the proposed 180-day timeline for ending a COVID-19-related medical device EUA. Final guidance should be available this year that provides more detail on the appropriate transition period, as FDA is considering industry recommendations that avoid product shortages and supply chain disruptions. Moreover, the agency is also considering giving medical device manufacturers and healthcare providers an adjustment period to transition from policies adopted during the public health emergency (PHE). For example, an EUA issued under section 564 of the FD&C Act will remain in effect, but primary changes will be based on whether the FDA chooses to revoke the EUA because the issuance criterion is no longer met. 

Voluntary improvement program: FDA and the Medical Device Innovation Consortium (MDIC) continue to advance their pilot program, launched in 2018. Select medical device manufacturing sites were chosen to review key business processes using a series of integrated best practices. The Capability Maturity Model Integration Institute team will conduct and review quality system maturity at each of these sites.

More data and insights about the MDIC program are likely this year, including public information about continuous improvement through quarterly check-ins with participating companies. The program is designed to report industry baseline metrics after the check-in and monitor operational excellence.

Breakthrough Devices program: Early updates suggest guidance will clarify how the Breakthrough Devices program may be more applicable to certain products than others. FDA breakthrough designation often benefits populations that are more likely to be impacted by healthcare disparities. New clarity may include breakthrough therapy designations and how device companies can educate sponsors to submit for proposed indications of use. Finally, an important facet of the breakthrough devices program is the type of evidence needed for FDA approval. Clarity should help determine whether a device is reasonably expected to improve treatment or diagnosis efficacy. Early indications also suggest that intended use, technology and features, and available standard of care alternatives will all play a role.

Proposed EU MDR Update

The Employment, Social Policy, Health and Consumer Affairs (EPSCO) Council recently announced a proposed extension to MDR regulation, including an extended timeline for medical device regulatory submission. Additionally, the timeline includes new dates for both Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR).

Industry executives have suspected the EU MDR submission backlog would lead to this scenario. Equally important, many European health ministers voiced their opinion during the December 2022 session that medical device shortages would occur without a MDR timeline extension.

The updated EPSCO proposal includes new dates for high and low risk medical device products: 

• The deadline for high-risk Class II B and Class III devices is now 2027.
• The deadline for low-risk Class I and Class II A devices is now 2028 (when involving a notified body).

Many industry leaders have said that extending the deadline will provide additional time for legacy device regulatory approvals. Life science media outlets have reported extensively on the change since it was proposed at the meeting.

European Health Commissioner Stella Kyriakides first proposed extending the current MDR deadline during the EPSCO council meeting in Brussels. She estimated roughly 23,000 devices and 1,500 IVDs are currently approved and certified under MDD, but have not yet transitioned to the new MDR regulation. These medical devices are likely to expire in 2024 and 2025. “The transition to the new rules has been slower than we anticipated,” Kyriakides said. “The pandemic, shortages of raw materials caused by the Russian invasion against Ukraine, and low notified body capacity has put a strain on market readiness.”

Additionally, many unique viewpoints have emerged about the current landscape and impact of recertification.

“If the three-year deadline is truly unattainable, these extensions could prevent devices that are perfectly safe for use from being taken off the market because they were unable to get recertified in time,” said Alexandra Murdoch, a medical analyst at GlobalData. Murdoch highlighted that both medical device manufacturers and suppliers must deliver MDR regulatory documentation in a submission for approval. This often includes additional data about materials used in manufacturing.

Eduardo Nogueira Pinto and Ricardo Rocha, partner and senior associate, respectively, at Portugal law firm PLMJ, are concerned that “only medical devices considered safe will benefit from the extension.” This includes medical device manufacturers that have begun regulatory submission and certification under the existing MDR process.

The Commission has now initiated a 2023 pilot project for medical device manufacturers, which could support the ongoing need for patient safety data that experts can use. In the future, for example, expert panels may advise manufacturers through qualified scientific advice that treats different disease types.

Ireland Health Minister Stephen Donnelly supports the proposed timeline changes based on COVID-19 procurement and the potential to avoid medical device shortages. “Participation in the EU COVID-19 vaccine strategy has allowed us to conduct the largest immunisation programme in our country’s history, saving countless lives and enabling the resumption of normal social and economic life,”” he said. “This measure needs to be adopted and take effect without delay to ensure the devices our citizens and health systems rely on remain available.”

It is still unknown, though, how different types of EU legislation will impact connected medical devices. There has been growing discussion across the software as a medical device category about the type of legislation that may take precedence, and the increasing level of postmarket surveillance data needed.

The European Commission (EC) has since published a proposal for a Cyber Resilience Act to strengthen cybersecurity across medical device interoperability. Elizabeth Anne Wright and Alexander Wenzel of Cooley LLP contend this legislation lead to many MDR-related obligations on device manufacturers. The pair also suggests the EU may not require as much documentation about unknown vulnerabilities not currently present for medical devices.

Meanwhile, the EU Commission has previously recommended extending the IVDR implementation date due to the EU’s notified body bottleneck.

However, general MDR Class 1 low-risk devices that are non-measuring, non-sterile, non-reusable, non-surgical, and do not require review from a notified body are still in effect. Their dates remain as:

• Non-sterile Class A and B Devices (low risk) – May 26, 2022
• Class D (highest risk) – May 26, 2025
• Class C (medium risk) – May 26, 2026
• Sterile Class A and B Devices (low risk) – May 26, 2027 

---

Rod Mell is Executive Head – Medical Device Consulting at Regulatory Compliance Associates. Regulatory Compliance Associates provides healthcare consulting services for resolution of compliance and regulatory challenges. The firm understands the complexities of running a life science business and possesses areas of expertise that include every facet of R&D, operations, regulatory affairs, quality, and manufacturing. More information is available at www.rcainc.com.