Software As A Medical Device In Europe – New Regulatory Regime About To Enter Into Force – (Part 5 Of 6) - Life Sciences, Biotechnology & Nanotechnology

The preceding articles of this series laid out how the new EU Medical Device Regulation 2017/745 ("MDR") leads to a broader coverage of medical devices and an overall deeper level of regulation in areas already regulated before. This episode will put the spotlight on a feature introduced to the European market of medical devices for the first time: the Unique Device Identification ("UDI") system, also referred to as the bar-code system for medical devices.

INTRODUCTION

Following the lifecycle approach of the MDR, the identification system aims to enhance the effectiveness of the post-market safety-related activities. The system brings about two key obligations: device labeling and data submission requirements. If this does not sound at all novel, it might be for other medical device markets, such as the U.S., that have had similar rules in place for quite some time. The UDI is obtained through officially designated entities, some of which are entrusted by both EU and U.S. authorities. The data submissions will have to be made to the European Databank on Medical Devices ("EUDAMED"), which is in the process of being set up. Submissions of UDI data to EUDAMED will be mandatory beginning November 26, 2022. However, providers of medical device software ("MDSW") can start the process of obtaining a UDI immediately.

1. UDI FORMATS

The MDR requires a medical device to be labelled with a certain UDI, which allows for a clear and unambiguous identification of specific medical devices and facilitates their traceability on the market. What is visible, is called the "UDI-carrier," which can either be an automatic identification and data capture ("AIDC") (i.e., bar codes, smart cards, biometrics, etc.) or a human-readable interpretation ("HRI") (a series of numeric or alphanumeric characters). All of the issuing entities, currently GS1, HIBCC, ICCBBA, and IFA GmbH, have their own algorithm to create UDIs. The format is based on guidelines (here) but will be specific to the issuing entity. An example of a human-readable UDI assigned by IFA GmbH could be "(9N)1101234568(S)ABC123."

According to Article 27 of the MDR, the UDI comprises of a Device Identifier ("UDI-DI"), which is specific to a manufacturer and a device, and the Production Identifier ("UDI-PI"), which identifies the unit of device production.

The UDI-DI is linked to a so-called Basic UDI-DI that connects devices with the same intended purpose, risk class, and essential design and manufacturing characteristics, identifying a certain group of devices. The Basic UDI-DI itself will not be placed on the product but has to be provided to EUDAMED.

2. UDI FOR MDSW

Annex VI Part C Point 6.5 of the MDR addresses the UDI assignment on MDSW specifically. Some guidance on the UDI assignment to MDSW provided by the Medical Device Coordination Group is provided here, according to which UDI-DI shall be assigned to stand-alone MDSW (available on its own and software that constitutes a device in itself) at the system level of such MDSW. If MDSW is sold on a physical medium, every level of packaging needs to display UDI in AIDC format and HRI format. Software comprising a user interface must display the UDI easily accessible in plain-text format, while software without a user interface needs to be able to transfer the UDI by API.

Upon substantial changes to the MDSW, a new UDI-DI is required (Annex VI Part C Point 6.5.2 of the MDR). Guidance on changes can be found here. Such new UDI-DI requirements are also triggered upon a change to Basic UDI-DI that impacts the original performance, safety, or the interpretation of data or to the name or trade name, version or model number, critical warnings or contraindications, or user interface language. Minor software revisions, such as bug fixes, usability enhancements that are not for safety purposes, security patches, or operating efficiency, shall require a new UDI-PI and not a new UDI-DI.

3. CONCLUDING REMARKS

With the introduction of the UDI system, the MDR steps up the post-market transparency and levels with what seems to have become an international regulatory standard. For providers of MDSW, this means to plan for additional steps before placing their products on the market. From a regulatory perspective, it is necessary to obtain a UDI and provide data to EUDAMED, while practically a labeling concept has to be developed.

Against this background, manufacturers of medical devices should bear in mind the timeline regarding the obligation of UDI assignment, which depends on the device class. High-risk devices in Class III start on May 26, 2021, followed by Class IIa and IIb devices, which are due on May 26, 2023. The low-risk devices in Class I are due on May 26, 2025.

Originally Published by Morrison & Foerster, March 2021

Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.