Navigating EU MDR 2017/745: A Complete Guide for Medical Device Compliance

The Regulation (EU) 2017/745 constitutes a major overhaul of the medical device regulatory framework in the EU. It imposes strict requirements for manufacturers, importers, distributors, notified bodies, and others regarding patient/user safety, performance and traceability during the lifetime of the device. Below we present a breakdown of the relevant sections by the main regulatory topics with explanation of the implications for manufacturers (or "us" according to your preference).

Scope Of The EU MDR Regulations 2017/745

What the section covers

The MDR covers the application and definitions in Chapter I (Articles 1-4). It includes the regulation of medical devices and their accessories intended for human use, devices for diagnosis/monitoring/prevention/treatment/compensation of disease or disability, and also those non medical devices specified in Annex XVI. It specifies the definition of the term "manufacturer", "placing on the market", "making available on the market", "device", "accessory", etc.

What it means for manufacturers

• We first need to establish whether our product is within the scope of the MDR – if yes, the whole set of requirements will apply.

• If our device is for human use and meets the criteria of being a "medical device", the entire regulation applies.

• If the device is not medical but is listed in Annex XVI (such as aesthetic devices), the MDR may still apply.

• We need to comprehend the definition of various terms (such as "placing on the market"), as they determine the beginning of the compliance.

• Even if the device was subject to the old directive (93/42/EEC or 90/385/EEC), the transitional and exclusion provisions of the MDR (Chapter X) may apply.

Classification Of Devices

What the section covers

For the full classification index, click here: Medical Devices Classification.

Manufacturing implications

• We need to determine and justify the right risk class of the device based on the provisions of Annex VIII of the MDR.

• The higher the risk class (IIb, III) the more regulation it entails (e.g., notified body involvement, additional clinical and technical requirements).

• Incorrect class determination may lead to non compliance, product withdrawal from the market, etc.

• We need to evaluate whether any re classification is needed for the device currently on the market (based on previous regulations).

Unique Device Identification (UDI) & Traceability

Scope of the section

Chapter III of the MDR discusses device identification and traceability issues (e.g., the UDI system); Annex VI covers UDI and EUDAMED registration issues. The UDI system requires unique identifiers to be applied to every device or group of devices to facilitate device traceability and post market activities.

Manufacturing implications

• We need to allocate a unique device identifier (UDI-DI) and production identifier (UDI-PI) according to the MDR requirements.

• We need to register and keep our device information in the EU database for medical devices (EUDAMED).

• Our labelling and packaging shall contain the UDI.

• We will be better able to carry out product recalls/corrections and post-market activities.

• We need to consider UDI as early in the device life cycle as possible (during the design, manufacturing, and labeling process).

Technical Documentation & General Safety And Performance Requirements (GSPR)

Scope of the section

Chapter II (Articles 10-15) prescribes obligations for manufacturers; Annex I contains General Safety and Performance Requirements (GSPR) which should be satisfied by the device; Annex II describes the contents of technical documentation. The technical documentation demonstrates compliance with the GSPR and the relevant harmonized standards/common specifications.

Manufacturing implications

• We need to compile, maintain, and revise technical documentation (technical file) for each of our devices or device family. The documentation should contain device description, design and manufacturing details, risk management data (e.g., in accordance with ISO 14971), verification & validation results, clinical data, labeling, etc.

• We need to ensure that our device satisfies all the General Safety and Performance Requirements in Annex I (that is, safety requirements e.g., biological compatibility, mechanical safety, electrical safety, software reliability, and performance requirements i.e., the device performs its function properly).

• We should use harmonized standards (ISO/IEC, EN standards, etc.) or common specifications (where no standard is available) in order to ensure the conformity with GSPR. In such a case, compliance with harmonized standards provides presumption of conformity.

• The technical documentation should be ready for submission and must be stored for a certain period (e.g., 10 years after the last device is placed on the market, for implantables perhaps 15 years).

• Any change in the device design or manufacturing process, change of the manufacturing facility, major components should trigger updating the technical documentation and probably conformity assessment.

Clinical Evaluation & Clinical Investigations

What the section covers

Chapter VI (Articles 61 to 82) relates to clinical evaluation and clinical investigations. Under the MDR, manufacturers must undertake a clinical evaluation in order to verify the safety and performance of the medical device, based on clinical data, literature, post market experience or new clinical investigations if required. Further details on clinical investigations are provided in Annex XIV.

What it means for manufacturers

• We must conduct a clinical evaluation as required: collect the existing clinical data (literature, previous device experience), assess its adequacy and justification, and conduct clinical investigation where there are gaps.

• For high risk devices (Class III, implantables), generally clinical investigations are required unless the exception is justified.

• Clinical evaluation is not a once off process: it must be continuously updated ("lifecycle") we must monitor ongoing safety and performance through post market (PMS) data and revise evaluations accordingly.

• Documentation of the clinical evaluation (clinical evaluation report) should be included in the technical documentation and be available to competent authorities.

• Investigational devices should comply with certain protocols, have ethical approval and patient protection in place and, upon completion, the data should contribute to the evaluation and risk benefit analysis.

• By ensuring compliance with regulatory requirements (as well as those by national competent authorities and Medical Device Coordination Group guidance) we will avoid delays or rework.

Conformity Assessment & Ce marking

What the section covers
Chapter V (Articles 52 to 60) includes information on the classification and conformity assessment procedures. Depending on the device class, different methods of conformity assessment can be used – starting with self certification (for low risk devices) and going all the way up to notified body audit, product verification, type examination, and others. After the conformity has been proven, Declaration of Conformity is issued and CE marking is applied. Detailed procedures are laid out in Annexes IX-XI.

What it means for manufacturers

• We must choose and follow the appropriate method of conformity assessment for our device class. For example, Class I (non sterile, non measuring) devices allow self certification (if not measuring function and not sterile packaging) but still must comply with GSPR and technical documentation.

• For higher risk devices, we must engage a notified body (NB), which will audit QMS, review technical documentation, may conduct audits of manufacturing and supply chain and issue a certificate.

• After successful conformity assessment, we prepare the EU Declaration of Conformity, apply CE mark and release the device on the market.

• We must ensure that any changes to the device, manufacturing process or its intended use are assessed in terms of their impact on conformity – substantial changes will require new conformity assessment.

• PMS and vigilance is relevant not only to the post market but also when preparing justifications of conformity at device lifecycle.

Post Market Surveillance (PMS), Vigilance & Market Surveillance

What the section covers

Chapter VII (Articles 83 to 100) concerns post market surveillance (PMS) by manufacturers, market surveillance by Member States, vigilance and reporting of serious incidents or safety corrective actions. Annex III provides details on PMS documentation while Annex XIII is for custom made devices.

What it means for manufacturers:

• We must set up a PMS system and prepare a PMS plan for each individual device or device family. The PMS system must collect and analyse the data on the device once it is placed on the market, identify trends and use these data in risk management and review activities.

• We must prepare Periodic Safety Update Report (PSUR) for Class IIa and above and other summary reports, if required.

• Upon occurrence of a serious incident or a need for field safety corrective action (FSCA), we must report to the competent authority without undue delay.

• We must implement the corrective or preventive actions (CAPA) when trends or data reveal increasing risks or decreasing performance. We must also document (PMS data, reports) and communicate externally (through EUDAMED, for instance).

• Market surveillance authorities may inspect the documents, access technical files, review PMS data, check UDI/traceability and enforce actions in case of non compliance or device unsafety.

• The PMS cycle is continuous – from design input data, clinical data, manufacturing to the market feedback.

Economic Operators And Roles (Manufacturer, Authorised Representative, Importer, Distributor)

Scope of the section

Obligations of economic operators (manufacturers, authorised representatives for non EU manufacturers, importers, distributors, etc.) are defined in Chapter II (particularly, Articles 10 to 15) and elsewhere.

Consequences for manufacturers (and us):

• In our capacity as manufacturers, we are primarily responsible for conformity of devices, technical documentation, QMS, PMS, vigilance, labelling, IFU, provision of necessary information to importers/distributors, registration with markets.

• Where we are a non EU manufacturer using an authorised representative in the EU to place devices, that representative will bear joint liability and should be appointed in writing.

• Importers and distributors should verify the CE marking, correct labelling, EUDAMED registration, UDI data and establish mechanisms for checking the compliance and traceability.

• We should ensure that the supply chain (distributors/importers) knows their roles and we have appropriate agreements and controls.

• We should ensure records of economic operators (traceability) for devices we put on the market.

Person Responsible For Regulatory Compliance (PRRC)

Scope of the section:

According to Article 15, each manufacturer (and authorised representative) is required to appoint at least one Person Responsible for Regulatory Compliance (PRRC) meeting some requirements.

Consequences for manufacturers:

• We should appoint a PRRC, having scientific/regulatory education or experience and ensuring the conformity obligations are met.

• The PRRC should be available to the organisation (or contractually) permanently and sign off on the device conformity, technical documentation and obligations.

• It will increase the organisational responsibility, as the PRRC will be an individual person to approach regarding compliance and documentation issues.

• We should ensure that the role of the PRRC, training and internal procedures supporting PRRC's activities (such as document management, CAPA, auditing, etc.) are established.

EUDAMED & Public Transparency

Scope of the section

Chapter III (Traceability) and other chapters refer to the EU database of medical devices (EUDAMED) which enables registration, UDI/traceability, vigilance, clinical investigations, certificates of notified bodies, etc.

Consequences for manufacturers:

• We should register our devices and economic operators' data in EUDAMED, when the modules will be ready for full operation.

• We should provide the data in EUDAMED (registration of devices, UDI-DI/PI, vigilance reports, certificates, performance studies, etc.) for transparency and traceability.

• The public transparency aspect requires certain device data to become publicly available (to patients, clinicians, authorities, etc.) – we should ensure the data are accurate and current.

• We should ensure that the data is updated and controlled in EUDAMED modules.

Transitional Provisions & Legacy Devices

What the section covers:

Chapter X (Articles 97 to 105) includes provisions concerning legacy devices previously subject to the older directives and on market devices, as well as on dates of the full application of the MDR.

What it means for manufacturers:

• In case we have any devices on the market in the context of the older directive (MDD/AIMDD), we need to evaluate the possibility of their transition to the MDR or re certification under MDR for continuing marketing.

• We need to keep in mind official corrigenda, amendments, and extensions of the transitional periods (e.g., those implemented in March 2023) to avoid missing compliance deadlines.

• We need to prepare for any issues related to expiry or re issue of certificates for our devices, gaps in supply, or changes in the availability of notified bodies due to MDR implementation.

Custom Made Devices & Devices Without Intended Medical Purpose

What the section covers:

Annex XIII describes the rules for custom made devices, and Annex XVI covers the list of devices without intended medical purpose. The MDR introduces special rules for both cases.

What it means for manufacturers:

• Even in the case of producing custom made devices (specific patient, produced on the basis of prescription), we should be aware of the obligations (technical documentation, PMS, labeling) despite simplified conformity assessment procedure.

• If we produce devices without intended medical purpose (listed in Annex XVI), we need to decide whether the MDR is applicable for us and treat these devices according to the special rules (classification, documentation, performance requirements) of the medical devices.

• We must clearly identify the device category, justify any exemptions, and ensure full traceability and documentation even for these special categories.

Market Surveillance, Enforcement, Penalties

What the section covers

Chapter IX (Articles 102 to 105) describes confidentiality, data protection, penalties, cooperation and coordination between competent authorities and the Medical Device Coordination Group (MDCG).

What it means for manufacturers

• We need to be prepared for the audits of the market surveillance conducted by the competent national authority. This includes technical documentation, QMS records, PMS, UDI/tracing, etc.

• Non-compliance may result in penalties, withdrawal of the device, recall of the device, suspension of CE marking, prohibition order, etc.

• It means that we need to have proper documentation, retain the required information for the required period of time, and respond quickly and transparently to the competent authorities.

• We need to monitor the regulatory landscape (MDCG, corrigenda, updates, etc.) and adapt to it.

Quality Management System (QMS) & Risk Management

What the section covers

While this is not a separate heading in the regulation, Chapter II and Annexes contain information about the obligation of the manufacturer to implement the QMS (for design, manufacture, distribution) and risk management for the entire life cycle of the device.

What it means for manufacturers

• We need to establish and maintain the QMS (usually based on ISO 13485) for design and manufacturing of our medical devices in the scope of the MDR (with exception of certain Class I devices where the manufacturer may implement simplified QMS). The QMS needs to include procedures for design control, production, services, post market activities, CAPA, internal audits, management review, etc.

• We need to conduct risk management per ISO 14971 for the entire life cycle of the device (design, manufacturing, distribution, post market activities, use, disposal). We need to ensure that the benefits of our products outweigh the residual risks. And we need to monitor and review the risks in case any new data becomes available.

• The QMS and risk management documentation will be audited by the notified bodies (and competent authorities) as part of the conformity assessment procedure. So we need to make sure that the documentation is robust and up to date.

Conclusion

The MDR fundamentally transforms the regulation of medical devices within the EU with the emphasis on the full life cycle control from design and manufacturing through clinical evaluation and post market surveillance and tracing. For us as manufacturers (or service providers working on behalf of the manufacturer), compliance with the MDR requires more than just check boxes – it means implementing the regulatory strategy, having strong documentation, tracing, risk and post market feedback management, etc.

How Morulaa Can Help

Morulaa simplifies your MDR 2017/745 compliance process by being your regulatory partner. From classification of your medical devices, preparation of the robust technical documentation, conducting clinical evaluation and PMS planning to serving as an EU Authorized Representative if necessary Morulaa helps to comply with all the critical aspects of the MDR effectively.