When the Commission recently published the Notice on the application of Sections 2.3 and 3.3 of Annex IX to Regulation (EU) 2017/745 and Regulation (EU) 2017/746 with regard to notified bodies’ audits performed in the context of quality management system assessment on 11 January, there was much rejoicing in the medical devices community. Yay!

It looked like one of the big stumbling blocks of hold up of issuance of MDR certificates was finally cleared. But, this is actually not the case. Or, it depends how you look at it. More precisely, it depends how the member states authorities look at it.

What was the problem again?

What was the problem again? There is this COVID pandemic going on, which tends to cause a lot of restrictions in the movement of persons as a result of national measures to prevent it from spreading. At the same time the MDR and the IVDR require site visits as a condition for the notified body to grant an MDR or IVDR certificate (see sections 2.3 and 3.3 of Annex IX in either regulation). No travel is no site visit, and no site visit is no MDR or IVDR certificate. As the epidemic persists and the date of application of the MDR and IVDR creep closer, you don’t need to be a rocket scientist to see that this will create a big problem.

In 2020 the MDCG had already issued guidance on remote audits (discussed on this blog here about MDCG 2020-4 that was further clarified in MDCG 2020-17), but this did not (fully) cover the MDR and the IVDR and moreover it did not cover initial audits, which are the audits everybody needs for their first MDR and IVDR certificates. So, too bad so sad – no remote audit for you in case of an initial application until the auditors can physically travel again.

In the mean time in the medicines field

In the mean time the authorities for medicinal products were surprisingly more lenient and practical in allowing first GMP audits. The HMA notice of 20 April 2020 on the subject (see paragraph 2.2) is quite clear about that

“For new sites/facilities in the EEA that have never been inspected and authorised, a distant assessment may be conducted in order to evaluate if the site could be authorised without a pre-approval inspection. In such cases, it should be indicated that the certificate has been granted on the basis of a distant assessment. Moreover, an on-site inspection should be conducted when circumstances permit.”

and

“For new sites/facilities in third countries where an inspection is required, and where there is no operational mutual recognition agreement (MRA) or the scope is not covered by the MRA, a distant assessment by an EEA supervisory authority may be conducted. A GMP certificate may be granted depending on the outcome of the assessment. In such cases, it should be indicated that the certificate has been granted on the basis of a distant assessment. Moreover, an on-site inspection should be conducted when circumstances permit.”

And if circumstances do not permit to do a distant assessment, there is a clock stop until they do. The notice furthermore contains some good guidance on how to make the risk assessment to determine if the circumstances so permit, for example whether the manufacturer concerned has been naughty or nice in the past, and how to actually implement a remote audit in a practical way.

The EMA Guidance on remote GCP inspections during the COVID- 19 pandemic (dated 20 May 2020) even contains a complete template and roadmap for how to set up a functioning remote audit and also contains more detail on the risk assessment of the manufacturer audited.

So the Heads of Medicines Agencies in the EU and the EMA are very aligned on this, and had no issues in drafting a pretty clear notice that applies across the board. Enter the world of devices, in which things are completely different for no apparent reason.

The MDR and IVDR notice

The notice of the Commission is really kind of a non-notice. It turned out this way because it is very clear that the member states could not agree on this like they were able to do for medicines. Because, you know, medicines are really important. Ventilators, IC beds, COVID tests, who needs those in these times – right? Like in the Brexit agreement that fails to address devices but does address medicines also with respect to remote audits the lack of ambition on the part of member states is striking. It’s like member states still haven’t discovered devices as the crucial pillar underneath the healthcare system that they are. If the member states would have been aligned, we would have had MDCG guidance, which would apply across the board. But they are not, and here we are.

So what does the notice really say? You can see that the Commission had a difficult situation to work with, and tried to do the best it could under the circumstances. The notice reiterates legal requirements and the needs for remote audits under the circumstances, but then goes on to state that this is really a member state game, because

“the national authorities responsible for notified bodies shall monitor the notified bodies established on their territory and their subsidiaries and subcontractors, to ensure on-going compliance with the requirements and the fulfilment of obligations set out in the medical devices Regulations.”

which is legally completely correct. In other words, because the member states can’t align between themselves in the MDCG, it’s every member state for itself for as long as they cannot agree. This means that, as we are seeing, some member states are willing to allow remote audits, and others do not.

While the Commission does give outlines of a framework for determining if a remote audit can take place in the notice, this is a lot less practical than the HMA and EMA guidances discussed above for medicines. Personally, for the life of me I cannot see why this could not be harmonised better. In many member states the authority for medical devices and IVDs is even the same as the one for medicines. Not everywhere, I know that, but even then they can talk to each other you would think. So what the [beep] is the major malfunction here?

The Commission ends the notice with a call on the member states to at least keep the Commission involved of what they are doing and how they implement this. That’s the best that could be achieved under the circumstances, apparently.

What to do now?

This weird situation means that the possibilities will differ from one notified body to the next, depending on how the notified body fills in the broad criteria, which in turn is based on what the notified body’s notifying member state is willing to allow. EU harmonisation at its finest! Team NB is working on at least seeing if it can align its own members in this respect, and aims to have this done by end January. Let’s see what this brings, but in the mean time the clock is relentlessly and mercilessly ticking towards the date of application.

So what can you do as manufacturer? You do what Brian Boytano’d do: you make and plan and you follow through. Be proactive, and engage with your notified body about how whether and how it will apply this because you cannot assume that there will be aligned standard practices across notified bodies (except maybe if they are notified by the same member state). If they are waiting for alignment via Team NB, indicate your willingness to receive a remote audit. Look at the criteria in the Commission notice and in the HMA GMP and EMA GCP inspections notices, think about how you can demonstrate why a remote audit would be justified and that your case passes the required risk assessment, and think about what you can offer the notified body to make the remote audit practical (what would they want to see in normal circumstances, and how can you show this remotely in a way that they can consider it audited sufficiently?).

In terms of legal recourse you could, in extreme cases, consider taking legal action against a member state that does not allow its notified body/ies to do remote audits or imposes disproportionate measures compared to other member states or compared to the medicines notices.

You might find yourself in a situation that the certificate really does not arrive in time and new products can no longer be placed on the market, under which you could be forced to consider a local exemption or article 59 MDR based exemption, although the criteria for the latter option are very strict.

Try to stay positive

Personally, I am not rejoicing very much in view of this development and have a hard time staying optimistic about it. I had a spike of enthusiasm when I saw that a notice about this had been published. And then the disappointment came. Now I’m just trying to stay positive and hope this sorts itself out for the best. Maybe there will be alignment after all in the last months before the date of application – oh, wait. Thats where we are already.

To me it seems we need a change of culture in the EU because this non-notice shows how the member states are failing the patients, failing them badly. This is low hanging fruit. There is a precedent in medicines. What more do you need?

If there is one thing that the COVID epidemic has shown that one the one hand member states are ill-equipped to deal with bigger healthcare challenges by themselves, but on the other hand are too stubborn to equip the Commission with the tools to at least create aligned policies. This goes back to article 168 TFEU, which provides that medicines and devices are basically to regulated as widgets in the internal market, with secondary healthcare aspects. But otherwise the EU should stay off of any real healthcare policy (this is a bit simplified, but essentially what it comes down to). Yes, there is some movement with joint vaccine procurement and a very general healthcare policy, but this is not very much and certainly not a revision of article 168 TFEU.

At the same time we see member states under-resource national competent authorities for medical devices because we have European laws and a system that sort of took care of itself historically, right? This leads to the terrible situation where the lame (the Commission with insufficient competences to make a difference) has to herd the blind running all over the place doing their own thing (the member states that don’t see the need for a coordinated healthcare policy and underresource national devices authorities) – which is not productive at all. And how can this be explained to patients? That’s quite a challenge if you ask me. The reality now is that for example German restrictions on their notified bodies may lead to Swedish patients not having access to certain essential devices. That is the reality of the internal market and the reason why this problem is bigger than any single member state. By necessity, this means that the solution must also be bigger than any single member state, and that, unfortunately, requires a culture change that I have been advocating for a long time.

The notice contains an almost cynical closing statement by the Commission in relation to a request for member states to at least inform the Commission:

“In particular, given the difficulties to fully quantify the extent of the problem in advance, namely the need to recourse to extraordinary temporary measures in order to ensure continuous availability of devices and prevent the potential risk of shortages, it is vital to carefully follow how these measures are applied in practice.”

So, member states, please show some ambition here and know your limitations. If the problem is bigger than you can handle yourself, enable action at EU level. Europe is supposed to have the best healthcare system in the world, but looking at this mess you would really not think that. Nothing to be proud of, especially since a proven solution is right in front of you.

But before I get too cynical (this epidemic takes its toll on everyone including me these days) let’s see how things develop. The best thing to hope for is quick alignment between member states after all, and a very clear and detailed MDCG guidance. If the member states can agree about this stuff for medicines, why not for devices?

Let see if we can make this work for the better, rather than have it disfunction for no apparent reason.