After having dealt with the issue when software may be considered a medical device according to its intended purpose (in part 2) and the implications of the new risk classification regime (in part 3), in this part 4 of our series on Software as a Medical Device in Europe, we will now explore key changes to the quality assurance and documentation requirements for stand-alone medical device software (“MDSW”) under the new EU Medical Device Regulation 2017/745 (“MDR”).
INTRODUCTION: A NEW LIFE CYCLE-FOCUSED APPROACH
While the current EU Medical Device Directive 93/42/EEC (as amended by Directive 2007/47/EC – “MDD”) primarily focusses on the pre-approval stage of a medical device and how the manufacturer can obtain the CE marking, the MDR deploys a product life cycle-focused approach, aiming to establish responsibilities of medical device companies throughout the life cycle of the product. While not all requirements are new, to ensure conformity of the MDSW with the MDR, detailed and partly enhanced requirements concerning quality management, risk management, clinical evaluation, and technical documentation must be complied with post-market for the time the MDSW is in service.
1. QUALITIY MANAGEMENTS SYSTEMS
Article 10(9) of the MDR has extended the scope of the Quality Management Systems (“QMS”) required to be in place for MDSW. Key changes include:
- Document Control. More so than the MDD, the MDR requires continuous alignment and updating of the documentation with regard to available data, records, and post-market surveillance (see, e.g., Article 83(3) and Annex IX, I 2.2 (c) MDR). This will require the manufacturer to maintain a seamless system of data and information, ensuring that documents are generated and updated in a coordinated and coherent way throughout the organization.
- Post-Market Surveillance: According to Articles 83 and 84 of the MDR, for each device, the manufacturer shall implement, maintain, document, and update a post-market surveillance system that shall be suited to actively and systematically gather, record, and analyze relevant data on the quality, performance, and safety of a device throughout its entire lifetime, and to draw the necessary conclusions and take preventive and corrective actions. This includes continuously updating the risk assessment and technical files of the MDSW. The post-market surveillance system shall be based on a post-market surveillance plan, the requirements for which are set out in Section 1.1 of Annex III.
- Periodic Safety Update Report. Manufacturers of class IIa, class IIb, and class III devices have to prepare a Periodic Safety Update Report (“PSUR”) for each device (or category or group of devices, as applicable), summarizing the results and conclusions based on the post-market surveillance data and any preventive and corrective actions taken (Article 86 of the MDR). For class IIb and class III devices, the PSUR shall be updated at least annually.
- General Safety and Performance Requirements. The “essential requirements” under the MDD have been replaced by the “General Safety and Performance Requirements” (GSPR). GSPR for software are included in the new Section 17.2 of Annex I. According to this provision, software shall be developed and manufactured in accordance with the state of the art, taking into account the principles of development life cycle and risk management, including information security, verification, and validation. According to Article 8 of the MDR, compliance with so-called harmonized standards creates the presumption of conformity with the GSPR of Annex I. While there are over 250 harmonized standards for the MDD, there are currently no relevant harmonized standards for the MDR. Manufacturers will need to adhere to existing relevant standards (e.g., IEC 62304:2006 – Medical device software – Software life-cycle processes) but should pay close attention to any upcoming harmonized standards.
- Supply Chain. Under the MDR, required scrutiny with regard to suppliers and outsourced processes is increased. The documentation requirements pertaining to the supply chain are stipulated in Article 25 of the MDR. While manufacturers already have responsibilities for stand-alone MDSW under the MDD, the MDR sets out specific new requirements for other economic operators like authorized representatives (Article 11 and 12), importers (Article 13), distributors (Article 14), and sterilizers and packaging (Article 22) in this regard. Manufactures have to ensure that everyone in the supply chain of its MDSW who is considered an “economic operator” under the MDR understands the key changes to quality management and has a plan in place for compliance with their specific responsibility under the MDR.
- Document Retention. The period during which manufacturers have to store technical documentation has extended from five to 10 years after the last device has been placed on the market (Annex IX Section 7 MDR). For implants it is, and has been, 15 years.
- Incident Reporting. The deadline for reporting serious incidents involving medical devices made available on the EU market to the competent authorities has been shortened from 30 days (for incidents not amounting to serious public health threats, death, or serious deterioration in health) under the MDD (MEDDEV 2 12-1, Section 5.1.7) to 15 days under the MDR (Article 87(3) MDR).
Manufacturers of MDSW find a framework for QMS in ISO 13485, which provides a safe and easy way to prove conformity. While certification under this already-established standard will be the main path to establish QMS compliance under the MDR, manufacturers of MDSW with an existing QMS must ensure that the new and amended requirements under the MDR are covered by their existing QMS. Manufacturers should note that all QMS requirements must be met as of May 26, 2021, even if certain medical devices offered by them fall under a transition period.
2. CLINICAL EVALUATIONS
All manufacturers of medical devices are obligated to conduct a clinical evaluation. The MDR provides for requirements that are more precise as compared to the MDD regime, particularly regarding the post-market obligations. Clinical evaluation means a systematic and planned process to continuously generate, collect, analyze, and assess the clinical data pertaining to a device in order to verify the safety and performance, including clinical benefits, of the device when used as intended by the manufacturer. A sufficient amount and quality of clinical data have to underpin scientific validity, technical, and clinical performance. The Post-Market Clinical Follow-up (“PMCF”) that already existed under the MDD is now specified in more detail in Annex XIV Part B. A newly introduced requirement is the PMCF evaluation report, which shall provide analyzed findings of the PMCF. A template for the PMCF evaluation report can be found here. The Medical Device Coordination Group provides guidance on relevant aspects regarding MDSW, focused on international standards (MDCG 2020-1). The MDCG 2020-1 identifies three key components that need to be taken into account when compiling clinical evidence for every MDSW:
- Scientific Validity (Valid Clinical Association). There needs to be a valid scientific association between the output of the MDSW (calculations, recommendations, etc.) based on the input and algorithms selected on the one hand and the targeted physiological state or clinical condition on the other hand. For example, if the MDSW is designed to detect a certain disease by analyzing abnormal measurement values, there needs to be a valid clinical association between the analyzed measurement values and the disease in question. The association must be well founded or clinically accepted. This component seeks to establish that the use of the MDSW is based on sound scientific principles.
- Technical Performance (Analytical Performance). The MDSW must be able to accurately, reliably, and precisely generate the intended output from the input data. Evidence of this can be generated through verification and validation activities.
- Clinical Performance. For those features of the MDSW that claim a specific clinical benefit, the manufacturer must demonstrate that the MDSW can achieve clinically relevant output in accordance with the intended purpose. For the validation of an MDSW’s clinical performance, the MDSW must have been tested (i) for the intended use(s) on the target population(s), (ii) under the use condition(s) and operating and use environment(s), and (iii) with all intended user group(s).
3. TECHNICAL DOCUMENTATION
Requirements for the technical documentation of the MDSW are now explicitly addressed in Article 10(4) and Annexes II and III of the MDR. With regard to the technical documentation, the MDR brings about increased requirements, along with more details on how technical documentation has to be carried out and structured. The technical documentation has to be drawn up in a “clear, organized, readily searchable and unambiguous manner.” Annexes II and III of the regulation list elements to be contained, which in the pre-market phase include (i) information on device description and specification, including variants and accessories; (ii) information to be supplied by the manufacturer; (iii) design and manufacturing information; (iv) general safety and performance requirements; (v) risk-benefit analysis and risk management; and (vi) product verification and validation. As outlined above, any MDSW that is available on the market must be covered by a post-market surveillance plan according to Article 84, a post-market surveillance report according to Article 85, and a periodic safety update report according to Article 86 (PSUR) if class IIa or higher. The newly introduced PMCF evaluation report shall form part of the PSUR.
CONCLUDING REMARKS
The new life cycle-oriented approach under the MDR requires manufacturers of stand-alone MDSW to reassess their current quality management and documentation strategy and to set up a comprehensive process that encompasses, among other things, QMS and technical documentation post-market surveillance procedures. As it might take months to have a complying QMS in place, suppliers of MDSW need to be working on this now if they have not already done so.