Happy IVDR day!
Happy IVDR day my readers! My apologies for the low level of activity on this blog the last time. I’ve been very busy with MDR and IVDR work.
And of course I have been working hard on the second edition of the big book, the Enriched MDR and IVDR, which is nearing completion and will additionally cover regulation amendments, new guidance, amended guidance and other developments during the period of early April 2021 to the date of application of the IVDR. Hundreds of pages of additional content, outdated content revised, updated graphics, updated flowcharts, added flowcharts, added graphics, added tables – it was (and at the moment still is) a lot of work. When the content is ready we’ll do another InDesign pass for numbering and layout issues in the first edition, have it reviewed by the fabulous group of people that reviewed the first edition, and then we’ll have something interesting and worthwhile I hope. When, you ask? Well, soon. People that have bought the first edition have received a code for a reduction on the second edition. Competent authorities (not notified bodies) will get a free copy if they ask for it, just like with the first edition.
Something old, something new, something legacy
Happy IVDR day – the IVDR is now applicable and that means that the world will not be the same as before. As a result of the legislative change in January 2022 the IVDR has gone all out in legacy devices without an IVDD certificate during the staggered risk class determined grace periods, more so than the MDR. Given the relatively low number of IVDs that already had a CE certificate under the IVDD (and of course the low number of IVDR certified IVDs), becoming a legacy device has become sort of the rule under the IVDR.
As of now, the IVD world in the Union is devided in three IVD categories (see MDCG 2022-8 on legacy devices):
- Old devices (devices placed on the market under the IVDD before the date of application);
- New devices (devices placed on the market under the IVDR, regardless of the date of application); and
- Legacy devices (devices with an IVDD CE certifcate valid past the date of application and IVDD devices with a valid declaration of conformity issued before the date of application).
Note that the IVDR applies differently to each of these three categories! So it’s pretty important that you know in which category your device falls. MDCG 2022-8 describes in quite a lot of detail what parts of the IVDR apply for what group of devices. Essentially it comes down to this:
| Category | IVDR parts applying |
| Old devices | “IVDR provisions should generally apply if they do not directly impact the device, its documentation or the conditions for the placing or making available of devices on the market” (MDCG 2022—8) this means market surveillance (article 88-95 IVDR) as well as reporting and analysis of serious incidents and field safety corrective actions occurring after 26 May 2022 (article 82 and 84 IVDR) |
| Legacy devices | Article 110 (3) IVDR requirements: the relevant requirements set out in Chapter VII of the IVDR on post-market surveillance, market surveillance and vigilance (see for much more detail on what these are exactly in MDCG 2022-8 and specifically its table annex – you will see that there is a lot of IVDR QMS elements and economic operator requirements that already need to be implemented or apply) |
| New devices | The whole enchilada of the IVDR |
To determine if your device is an old device or a legacy device it is pretty important to get the details on placing on the market of the device right. Not a week goes by that I am not advising MDR and IVDR clients on placing on the market. It’s a complex and often misunderstood concept, as you can see in my discussion of it here.
A legacy device is not a walk in the park, as I’ve seen first hand being underestimated by manufacturers. Often the grace period was mistaken for a ‘delay’ in which the manufacturer did not do much, but this is mistaken. You should compare a legacy device to a large passenger airplane that is almost out of fuel: you want it on the ground safely as soon as you can, but landing a machine like that is a process that takes time. You do not continue flying at cruising altitude until the fuel gauge reaches zero and then hope you’ll magically find yourself safely on the ground.
Significant changes
Just before the date of application the MDCG released guidance on significant changes for IVDs specifically (MDCG 2022-6). Although on the rather late side, it was nevertheless useful to have this guidance for two reasons:
- Operationalisation of the concept of significant change specifically for IVDs;
- Some little steps of evolution in thinking on the part of the MDCG about formalities around significant changes.
In terms of evolution of MDCG thinking about signifiant changes there were two little gems in the MDCG 2022-8 document that stood out for me: one footnote and one little piece of text conspicuously left out.
First: in footnote 5 there is a significant statement stating in relation to the requirement that legacy device certificates must remain valid during the grace period:
“This does not exclude the possibility that during the transition period an EC certificate for the manufacturer’s approved quality system issued in accordance with Annex IV or Annex VII IVDD, which has become invalid, is replaced by a EU QMS certificate issued in accordance with Annex IX, chapter 1, IVDR, provided that the EC design examination certificate issued under Annex IV, section 4, IVDD or EC type-examination certificate issued under Annex V IVDD remains valid.”
This is an important statement because it shows that the MDCG thinks that is is possible to exchange an expired QMS certificate for a legacy device with a new QMS certificate under the IVDR. This is not only relevant for the IVDR but also under the MDR, since footnote 6 of that same guidance mentions that the MDCG 2020-3 guidance should be aligned with MDCG 2022-6, where needed. This makes me somewhat optimistic that this will also be allowed under the MDR now, as I have seen more than one client get in trouble because the legacy QMS certificate supporting a legacy design examination certificate expired or otherwise became invalid. This would be an important development because I have experienced notified bodies categorically stating that this is not possible. Well, now it is.
The second interesting point is an omission of which I hope that it is significant, concerning administrative changes that are allowed, specifically in relation to M&A or corporate reorganization. MDCG 2020-3 under the MDR stated that permitted administrative change is:
“administrative changes of organisations are considered in principle as non-significant. This includes changes of the manufacturer’s name, address or legal form (legal entity remains) or changes of the authorised representative.”
MDCG 2022-6 phrases this as:
“changes of the manufacturer’s name, address or legal form, including a merger or acquisition involving the manufacturer;”
Why is this relevant? I have seen companies structure M&A projects wrong in the way that the legal entity of the manufacturer did not ‘remain’ and suffer the consequences: notified body did not want to cooperate with certification of new legal entity become manufacturer for a complete business unit that otherwise remained intact. It seems that the leaving out of the requirement that the legal entity remains could (might) be reason for optimism that this requirements has been dropped, thus making asset transactions that involve a new legal manufacturer possible without triggering a significant change (dear devices unit of the Commission, if I’m wrong on this point, would you kindly correct me please?)
Then there is the substance on what is considered a change to the intended purpose or design of the device, specifically operationalized for IVDs in MDCG 2022-6. The below table is a combination of MDCG 2020-3 extrapolation and MDCG 2022-8 added wisdom setting out a non-exhaustive overview of changes that are prima facie candidates for significant changes, conveniently put together for you:
| Change of what? | What makes it significant? | Example of significant change |
| Intended purpose | Extension of intended purpose (limitation of the scope of the intended purpose is not a significant change) | – See also Chart A in MDCG 2020-3 and MDCG 2022-6 concerning change of intended purpose – Change or extension of patient population – Addition regarding what is detected or measured – Additional functions of the device (screening, monitoring, diagnosis) – Addition of specimen type(s) – For companion diagnostics: extension of associated medicinal product, of target population or of the tissue type – Change in assay type (e.g. qualitative to quantitative assay) – Change of the intended user (e.g. professional to lay user) – Change of operation (e.g. automatic to manual) – Change of specimen type(s) |
| Design | Changes in design that alter device’s operating principle | – Change from immunofluorescence to enzyme-linked immunoasorbent assay (change from immunofluorescence to ELISA); – Change from immunochromatography with subjective visual detection to immunochromatography with detection by automated reader; – Change from high-performance liquid chromatography (HPLC) coupled with time-of-flight mass spectrometry to HPLC coupled with orbitrap mass spectrometry; – Change from photometric measurement into liquid chromatographic based or proton nuclear magnetic resonance spectroscopy (NMR) measurement; – Change from immunoturbidimetry measurement to colorimetric measurement. |
| Changes in design that affect the safety or performance and negatively affect the risk/benefit ratio of the device | – See also Chart B in MDCG 2020-3 and MDCG 2022-6 regarding changes of design or performance specification – Change of IFU to refer to reduced sensitivity of the device (based on PMS) | |
| Change of ingredient or material that affects the safety or performance and negatively affects the risk/benefit ratio of the device | – See also flowchart D in MDCG 2020-3 concerning change of a material – Substitution of a chemical substance in order to comply with the REACH regulation resulting in an adverse impact on performance of the device | |
| Change of ingredient or material that is essential for device’s operating principle | – See also flowchart D in MDCG 2020-3 and MDCG 2022-6 concerning change of a material – Changes of an ingredient or material that is essential for the operating principle of the device (primers for PCR; capture antibodies / antigens for immunoassay; detection marker (e.g. fluorescent, chromogenic, chemiluminescent marker) for chromatography) – Changes of an ingredient or material that adversely affect the safety or performance and that negatively affect the risk/benefit ratio of the device (substitution of a chemical substance in order to comply with the REACH regulation with an adverse impact on performance of the device) | |
| Software changes | – See flowchart C in MDCG 2020-3 and MDCG 2022-6 concerning software – New or major change of operating system or any component · new or major modification of architecture or database structure, change of algorithm – Addition of a new database with new content that is used to compare genetic assay results with – Required user input replaced by closed loop algorithm – Presentation of medical data in a new format or by a new dimension or measuring unit | |
| Sterilization changes | – See flowchart E in MDCG 2020-3 and MDCG 2022-6 concerning sterilization – change of sterilisation method – changing a device from ‘nonsterile’ to changes in the design or packaging that adversely affect the sterility assurance or the effectiveness of the sterilisation (e.g. integrity of a seal). |
In-house produced devices
There is another group of actors that is sucked into the IVDR, in kicking and screaming denial: the health institutions for the in-house produced devices. Kicking and screaming, you say, it can’t be that bad? Yes it is, I’ve seen from personal experience that this new group of addresses of the IVDR is mostly stuck somewhere on the low end of the Kübler Ross curve of acceptance of a dramatic situation that they did not choose for themselves, but on the other hand allowed to happen to them in all the worse ways because they never saw it coming and subsequently denied that it existed or downplayed the effort needed.
Specifically I’ve seen very vocal arguments for example that ISO 15189 compliance basically covers most of the gaps (spoiler: it most certainly does not) and more specifically, that ISO 15189 is an appropriate production quality system for devices (as required in article 5 (5) (b) IVDR), which it is not. Any person advocating that position is very welcome to engage me in discussion and point out to me where in ISO 15189 manufacturing quality management system requirements are imposed. I have not come across them in this standard, because the standard is not concerned with manufacturing quality but with testing quality and competence, which is not manufacturing quality. Lab activities, not manufacturing activities. It specifies how to set up and run a test lab and procure outside materials used in the lab for testing, but not how to actually manufacture tests. Receipt and storage of tests, yes. Acceptance testing of tests, sure. But not actual manufacturing of the tests! Fortunately MDCG guidance on in-house produced tests is imminent now, and we’ll see who is right on this point.
Article 5 (5) IVDR applies to in-house produced devices, which were not in scope of the IVDD, and imposes a ‘CE marking light’ regime on them, basically regulating in-house produced devices roughly speaking somewhat like class A self certified devices under national competent authority supervision (with optional national exemptions). However, that does not mean that the requirements are a light regulatory touch. For example, each in-house produced device needs to have documentation showing compliance to Annex I General Safety and Performance Requirements of the IVDR, which is a substantial regulatory task to complete.
In the January 2022 amendment of the IVDR some, but not all, of the regulatory deadlines for in-house produced devices were moved. This means that some of the requirements (actually the ones causing the most work) apply already, and since the IVDR does not grandfather the installed base, must also be applied to in-house produced tests that were developed before the date of application but still produced and used after the date of application. See below for my handwritten overview of deadlines (you need to put 26 May before each year mentioned):
So, regardless of whether health institutions are happy with these rules or not, the regime already applies partially and health institutions not meeting the requirements that already apply can be enforced against for non-compliance. They will also need to inform their liability insurance that they are applying non-compliant tests (if they are) and any incidents with patients suffering damage as a result of non-compliant in-house devices will normally be outside the health institution’s insurance policy cover. Maybe that is sufficient for hospital management to make this more urgent agenda item.
It’s funny with these things how stakeholders like to shoot the messenger rather than fix non-compliance in their own situation. I’ve actually been accused of raising these issues just to make money. How rude – it just shows powerless frustration about the situation.
Bye bye Switzerland – yet another Swixit, this time for IVDR
Completely as expected and right on schedule we received the Commission’s Notice to Stakeholders that Switzerland is out of the Union for yet another MRA (the one concerning the IVDD) and will not be part of the Union for the IVDR as of the date of application, which is quite unfortunate. Would you like to know the back story? Check out my analysis of the Swixit for the MDR. It’s a pity that Swiss politicians have sold the advantages of being part of the internal market to badly at home. But then again, this is something you can say about a lot of EEA and Turkish politicians too unfortunately.
The Swiss will fix their legislation to mimic the IVDR as closely as possible just like they did for the MDR, and hope for the best.
But no Turkxit
Just like with the MDR, there is no Turkxit for the IVDR – meaning that Turkey is also part of the Union for the purpose of IVDR just like it is for the purpose of the MDR, as was confirmed in another Notice to Stakeholders. Mind you, Turkey is not a member state of the European Union, but it is part of the Union for the purpose of the MDR.
It shows that people that refer to the MDR’s and IVDR’s geographic scope as EU have mistaken conception of the scope of the geographic scope of the Union: the EEA member states (which includes all EU member states plus non-EU member states Iceland, Norway and Liechtenstein) plus Turkey, which is four more countries than the EU. So next time someone refers to the EU as place where the MDR and the IVDR apply you can ask them why they ignore Icelanders, Norwegians, Liechtensteiners and Turks.
So don’t sell the Union short please, people, and please stop using the actually pretty offensive term ‘rest of world’ to denote that you can’t be bothered to understand what is going on internationally. It is really not that complicated.
The capacity elephant
Whenever there is something to celebrate on a party there is also an elephant in the room, like an uncle that always gets just a little too drunk and ruins the party for everyone. In this case it is the notified body capacity elephant, which stands to put a serious dent in the IVDR project, regardless of the measures taken with the recent amendment. If you want to read and weep, you can read the updated (post amendment) Joint Implementation Plan for the IVDR. If you want your hair to stand up, read the recently published 2021 member survey of Team NB. It basically contains all the data that the MDCG says in the Joint Implementation Plan that they do not have. What do we learn from the Team NB document?
Well, first of all IVD manufacturers have not at all started to apply under the IVDR en masse. The IVD sector seems very much bent on making the same mistakes as MDR manufacturers, although the low number of applications may also be caused by the low availability of slots at notified bodies.
Another worrying development is that at least half of the submissions to notified bodies are incomplete. Apparently either notified bodies explain badly what they need, or manufacturers are bad at making complete applications. Either way, there is a serious disconnect that is costing everybody time.
Capacity, capacity, capacity is the theme. The notified bodies indicate that it will not be possible to issue a number of certificates under the MDR that is even close the number of still to expire in 2024. Team NB states ominously:
“There is a risk to the continuous availability of some device with expiring certificates in 2024. To avoid this risk, solutions have to be found as it will not be feasible to issue 14 063 certificates in a year.” [estimated capacity for 2024 is 6 300 per year]
Press release Team-NB sector survey 2021, p. 8
Regardless of the recent change to the IVDR, the IVDR will be in the same boat by 26 May 2025, when the first grace period under the IVDR expires. With the number of notified bodies notified for the IVDR, and the speed at which this happens, I predict the exact same issues with the IVDR. At some point MedTech Europe had calculated that we needed a 780% increase in notified body capacity for the IVDR, while at this point we are still working to have the same notified bodies notified again under the IVDR, of which not all actually applied, and not even half of the applicants have been notified at this point. As we can see from the most recent overview of notified body notification process for IVDR, it will take quite a while before the next IVDR notified body will be notified. As you can see in the overview the next two notified bodies are stuck in the JAT CAPA review phase, which can easily take a year, and the others are not even at that stage. Not a good sign.
So
Happy IVDR day – there is a lot to do for industry, notified bodies, competent authorities and the Commission. Let’s not disappoint the health system and the patients!