Designing and developing an innovative product is always a challenge. Bringing it into production smoothly and manufacturing it with high quality is a lot of work. Doing it in the medical space adds another dimension of complexity that might multiply the total cost and the timelines by a factor of 2 to 10 if you have to reach EU MDR compliance!
Why is that?
If you are developing a new medical device for sale in the EU, heavy regulations apply. (This is also true for selling in the USA, Canada, Australia, Japan, etc., but in this article, we will focus only on the European Union, Switzerland, Norway, and Turkey, which are all working on implementing the EU MDR (Medical Device Regulation) 2017/745.
(Note: If you have any doubts about if your product is actually a medical device, be sure to read: Are You Selling a Medical Device, and What Class Is It?)
What is the EU MDR?
This new regulation is effective since May 2021. It is now a must for all new products that fall under the definition of a “medical device” and are set to be imported into Europe.
The EU MDR states that any company that develops and/or manufactures a medical device for compliance with the EU MDR must follow the ISO 13485 quality management system. And one of the key requirements of ISO 13485 is to plan for the design & development process, including transfer to manufacturing and ongoing follow up. (Many companies call it the “New Product Introduction process”, or NPI process.)
Why is it particularly difficult if you work with a manufacturer in China?
Let’s tell things as they are. So far, many suppliers have been MDD-certified on the basis of fake documents. They, and their critical component suppliers, often have no concept about basic requirements of the EU MDR such as traceability, data collection and analysis, etc. And there is a pervasive concept that “there is always a way around all those requirements”. Why do all the hard work when a smart consultant can find loopholes?
The EU Commission has taken note of that situation and has taken adequate measures. The short list of notified bodies are now liable, a lot of information must now be shown on the product labelling, and the result of using fake documents is removal from the market!
The best Chinese manufacturers, of course, are doing all the hard work and following the process. Others are going through a phase of denial and resistance, and will eventually have to decide — do they step up to the challenge, or they stop selling in the EU?
What this guide aims to achieve
In this guide, we’re going to share the new product introduction (NPI) framework for medical devices that will allow you to achieve EU MDR compliance if followed.
We will provide an overview of the NPI process and go into each phase in detail…
The NPI Process for Design and Development of a Medical Device
Every company may develop their own NPI process, but here is a framework that has worked well for us:
- Phase 1: Specifications and Initial Plan
- Phase 2: Feasibility Study and Refined Plan
- Phase 3: Product Design Work
- Phase 4: Tooling, Testing, Clinical Evaluation
- Phase 5: Pre-Production Preparation
- Phase 6: Mass Production, Market Introduction, and Follow up
We represented these 6 phases in the graph below:
Let’s go through these 6 NPI phases in more detail, examining the activities in each that will lead to EU MDR compliance for medical devices.
Phase 1: Specifications and initial plan
Phase 1 takes place before any design or engineering work gets done.
A big risk at this stage is to jump too fast from “there is a need” to “let’s develop this product”. ISO 13485, as well as the EU MDR, require a very structured approach. Do not let R&D people start working before you have a plan!
A note of caution: if you mention ISO 13485 to a Chinese manufacturer and they mention that they are certified to Chinese standard YY/T 0287-2017, you need to know that it looks the same but it is nearly devoid of any requirement! It is actually quite different from the ISO standard.
Initial design plan; collection of user needs & intended use
By “design plan”, we mean a plan for the process of designing & developing the product.
A plan would typically list the steps in a logical order, such as:
- 1. Define the general space in which we want to be present
- 2. Pick a gap in the current products on offer; start to study it
- 3. Collect user needs, and organize them so that they can be used as inputs in the design process
- 4. Analyze how users would typically use the existing product(s) or an imaginary product you describe – that’s very important to start planning on the class (I, II, III) and the corresponding procedures to get authorized to put the product on the market.
- 5. Do the design, with intermediary steps and milestones (e.g. initial design, design review, first prototype, second prototype, user feedback, accelerated life testing, tooling fabrication, reliability testing, clinical trial…)
This is the list of regulatory and statutory requirements of the countries of manufacture and sale, as well as a thorough understanding of who the intended users are, what their needs and wants are, how the product could help them, etc.
It can also include information about the company, such as an initial estimate of the maximum length and budget for the project, the product/technology space in which the company’s competencies lie, what healthcare institution might be interested in running a clinical evaluation, and so on.
Risk & benefits analysis
That’s a central topic. The manufacturer will need to document, in detail, why and how the new device will:
- 1. Bring something new and beneficial to the users and/or patients, while
- 2. Keeping overall risks limited, with
- 3. Benefits (a) demonstrably superior to (b) risks.
And this analysis will need to be updated all along the design & development process and beyond (once the products are on the market).
The manufacturer must have a plan for risk management, as per ISO 14971. That plan must include:
- Scope (not just design and development and process validation, but also production, shipment, warehousing, distribution, activation, use, and disposal).
- The different roles involved, their responsibilities, and how authority is distributed
- A review of all applicable requirements that are related to risk, based on the geographic areas where the product will be sold (e.g. US FDA regulations, EU MDR, and so on).
- The criteria to be used to decide whether the level of risk is acceptable
- How risk will be verified
- What data will need to be collected and reviewed
Here are the relevant clauses of the ISO 14971 standard (Medical devices — Application of risk management to medical devices):
Evaluation of any design changes (ECR)
You need to work in a very systematic manner. The systems you put in place may have to be untouched for many years.
Why is that? Let’s say you have approved a final prototype and done a lot of testing. You might even be selling your medical device on the market. If a design change is evoked and analyzed, you need to go back to phase 1 of this whole development process.
One word about the very high risk…to your company!
If you are involved somewhere in the supply chain of a medical device, you are probably exposed to high liability, hence why EU MDR compliance is so critical.
The EU MDR gives a list of the “economic operators” and their obligations:
Listen: We discussed the topic of liability, and how hard it will be to escape from it, in a podcast episode (How The EU MDR Will Change The Medical Device Industry Forever) with an expert in medical product compliance, Clive Greenwood.
Phase 2: Feasibility Study and Refined Plan
Feasibility study (technical design, supply chain, regulatory requirements)
Like in the design process of any new hardware product (whether it includes electronic parts or not), you need to:
- Conduct feasibility study(ies), if there are unknowns to address first
- Start the engineering design work
- Start picking the key materials and components, and if that makes sense going deeper (e.g. collecting their reliability testing data, auditing their manufacturers, reviewing certifications, etc.)
- Use the output of the above-mentioned work to refine the product concept.
In addition, in the medical field, you need to keep paying a lot of attention to regulatory requirements, including of course the EU MDR if you intend to sell in Europe. You might do more targeted research into the rules you will need to comply with.
Refined design plan
As your product concept becomes clearer, you need to update your design & development plan.
What is the work to be done? What are all the requirements (from regulators, users, distributors…), in terms as specific as possible? What verification & validation will be needed to confirm all those requirements have been met?
At this stage, you should probably discuss your plan with the notified body (i.e. one of the few organizations officially accredited to certify devices to the EU MDR – for example the BSI, TUV Rheinland, SGS, and so on) of your choice. They might have requirements of their own. You will need to add them to your list of applicable requirements and to plan on how to satisfy them.
Risk & benefits analysis (updated)
In every phase, you will need to update this analysis. As the exact nature and function(s) of the product become clear, and as all applicable requirements are updated and made more specific, you will need to add to the analysis. You should consider doing a structured risk analysis in the form of a design FMEA, at the minimum.
And, if needed, this might lead you to add extra controls that were not considered in the design plan, and it might also call for more specific requirements.
Phase 3: Product Design Work
Design & prototyping process
You need to complete the design work. This may involve a number of prototypes, depending on the technical complexity of the product and on the extent of applicable requirements.
The output of the design work may include mechanical CAD files (for the product and its packaging), electronic CAD files, the bill of materials, the user guide, etc., and of course a final set of prototype/s.
Verification of design outputs vs. inputs
As we mentioned, the inputs include applicable requirements, documented in terms as specific as possible. A good list of requirements gives a list of criteria that can be inspected/tested.
And now is the time to check the outputs vs. the inputs. For example, if a product made of steel has to possess a certain tensile strength and a certain strength at 25 deg. C, this can be tested in a laboratory. The prototype(s) have to be tested based on all such requirements.
Initial validation of working prototypes vs. user needs
Documenting user needs, putting together a corresponding checklist, and applying that checklist is not sufficient.
You will also need to put prototypes in the hands of your intended users and validate the fact that the product seems to be well suited to their needs.
You will then need to go much deeper in that direction in the following phase, in the clinical trial.
Risk & benefits analysis (updated)
As explained before, update your risk & benefit analysis.
You will have to set up a traceability system for your products. The device will need to be registered in the EU’s UDI system, so you have to plan for it from the start.
It is a compulsory way of ensuring traceability in order to enhance user safety. It will allow more accurate reports of adverse events, a reduction in medical errors, and more effective management of recalls.
The “basic UDI-DI” is the identification number for a group of products with the same intended use and classification. (“DI” stands for “Device Identifier”.) It does not appear on the product, but it will be on many other documents (certification form, declaration of conformity. It is created by the manufacturer or the EU representative.
A UDI number is composed of 2 numbers:
- The UDI-DI. That’s the group, or family, of relatively similar devices, as explained above. It won’t change over time.
- The UDI-PI (“PI” stands for “Production Identifier”.) It may include the batch number and the serial number, the manufacturing date, the expiration date…
The UDI carrier includes a human-readable interpretation, as well as a barcode, QR code, or another format for automatic identification and data capture.
Only a few accredited organizations can create UDI carriers. Each one has its own standards. You will need to pick one.
As you can see, starting in phase 3 there are many requirements that are typically not fulfilled by Chinese manufacturers of protective equipment. And yet, their products (such as surgical masks, N95 respirators, gowns and drapes, gloves…) to be used in a medical setting definitely fall under the scope of the EU MDR.
Phase 4: Tooling, Testing, Clinical Evaluation
Process validation (part 1, to be continued in phase 5)
In phase 3, you validated that the medical device does respond to the users’ needs. With the clinical evaluation, you are about to spend far more time & money in order to demonstrate that the product presents an acceptable benefit/risk profile.
Before the effective transfer to manufacturing, you also need to validate that the manufacturing & testing processes are suitable for making the product as required in a very consistent manner.
The main regulation for medical devices sold in the USA, US FDA regulation 21 CFR 820.75, requires the following 3 stages:
- Installation Qualification (IQ) — when new manufacturing/testing equipment needs to be installed at the manufacturing site, there needs to be a “factory acceptance test” at the supplier’s site and a “site acceptance test” in the final manufacturing facility.
- Operational Qualification (OQ) — this is testing the elements of the process one by one. Can the processes make the right product? Do they display too much variation?
- Performance Qualification (PQ) — this is testing of all elements together. In other words, this is what we usually mean by ‘pilot run’, in the same conditions (same people, same equipment, same testing stations, same components…) as mass production. Again, variation on critical-to-quality criteria is monitored. The Cpk index must be at least 1.33.
(This is not exactly the set of requirements that apply to medical products sold in the EU, but those 3 stages are a good framework to follow. At the same time, they allow you to cover some of the requirements of ISO 13485.)
Tooling fabrication (part of IQ and OQ)
We have worked primarily on the development of electro-mechanical products, and many of them require a custom plastic enclosure, some custom internal parts, etc. These parts require an investment in tooling (e.g. plastic injection molds, casting molds, extrusion molds…) before anybody can say “these samples are made in the same conditions and with the same processes as mass production”.
In other words, when tooling is needed, its fabrication is part of process validation.
Whenever it’s practical, batches of test units must be made before mass production is authorized to start. Those test units must come from the same components, same equipment, same operation methods, same testing stations, as will be used for mass production. And those test units can then be used for various tests and clinical evaluations.
Further lab testing (performance, reliability, compliance)
The type of testing needed depends heavily on the type of product. It typically includes reliability testing and compliance testing in an effort to ensure the level of safety for users & patients is relatively high.
One note of caution: at the time of the MDD (Medical Device Directive), many companies produced fake evidence in lieu of proper test results. Often with the active complicity of their manufacturer (which was, in many instances, located in China). That is much harder now with the EU MDR, as notified bodies are exposed to liability and will look at data much more closely. In addition, in case falsified data are found, the consequences from that fact alone are now very heavy.
Formal clinical evaluation, as product validation
You will probably need to work closely with a healthcare institution that will help you run a clinical evaluation.
Prepare it very carefully. It will take a lot of time and money. You will need a lot of data in order to demonstrate that the benefit-to-risk profile is favorable.
“Clinical evaluation is a set of ongoing activities that use scientifically sound methods for the assessment and analysis of clinical data to verify the safety, clinical performance and/or effectiveness of the medical device when used as intended by the manufacturer.”
The clinical evaluation will help answer questions such as:
- Is the device safe to use?
- Does the device meet its intended purpose?
- Are the claims (about safety, clinical performance, and effectiveness) supported by evidence?
- What are the residual risks?
- Any side effects?
Note: if equivalence to another device can be demonstrated, that other device’s clinical data can be used. It all has to be documented.
Risk & benefits analysis (updated)
Like in the other phases, you need to update your analysis. This phase will provide you with a lot of data. Here are two examples:
- Based on the manufacturing pilot run, you will know what the critical process steps will be, how to control them, how to test the products, what controls may be missing, etc.
- The clinical trial will surface a lot of feedback from users and/or patients. It might indicate some counter-indications, some new types of risks you did not consider, as well as some unintended and/or unforeseen benefits.
Phase 5: Pre-Production Preparation
Process validation (part 2) and transfer to manufacturing
In phase 4, you went through operational qualification (OQ) and performance qualification (PQ). You actually need to keep going through it. A good rule of thumb is usually to do 3 small-scale manufacturing pilot runs, each time collecting critical-to-quality data for statistical analysis, in order to confirm process capability.
You should try and perform those pilot runs in the worst conditions (for instance, with process inputs at the lowest and highest control limits), as this will provide valuable information about the ‘process window’ that will allow the final products to be acceptable.
Based on those data, you will need to confirm what attributes are critical-to-quality and how you will keep them under control during mass production. Plan for everything that will help maintain the process under control – for example, equipment maintenance and staff training. And make sure this is done well at the level of your component suppliers.
Submission to the notified body
This is going to be a lot of work. Once you have submitted all the required documents your organization is going to be audited in depth.
If you have been exchanging information with your intended notified body, and if you have already got their confirmation that you are going in the right direction and that your quality management system seems to be acceptable, it may not be stressful. Otherwise, prepare for a gruelling process.
There are often several possible paths available. Pick the one that makes sense for you. For example, for a class II b device, there are 4 possible paths, as shown below:
(See How To Get a New Medical Device Certified? for more details.)
You will also need to register with the EUDAMED system, which is an EU database. You will have to keep inputting data in that system over the life cycle of your product.
Note: the European Commission has been releasing the various modules gradually. The first module made available was the Actor registration module, in Dec. 2020, with others planned to follow over time. Even if there are delays, economic operators must adhere to EU MDR compliance.
Risk & benefits analysis (updated)
An important review of the risk management process has to take place prior to mass production and release to the market. The reviewers have to produce a report that demonstrates the following:
- The risk management plan has been followed
- The residual risk, as a whole, is at an acceptable level
- There is a plan, and there are systems in place, to collect information in production and after production
As always, this report becomes part of the risk management file.
Phase 6: Mass Production, Market Introduction, and Follow up
Your notified body certified your product and your quality management system. You are ready to start making the product. You have worked hard in phases 4 and 5 on a plan for making consistently good products. Now you need to apply that plan and keep verifying that products are within specifications in order to assure EU MDR compliance.
Many companies do regular inspections of products out of the lines, and they forget about ongoing reliability testing (ORT). It is a good way of catching issues that come from batch-to-batch variation and that are not easy to detect by quality control technicians.
And, as the product becomes mature, use your experience to make small improvements to the manufacturing & testing processes. If you are not working on your processes, they are probably degrading!
Keep in mind, though, that any substantial change might necessitate an in-depth risk analysis and possibly a new clinical evaluation. Make sure the manufacturing teams are aware of what should never be changed.
Ongoing follow up of performance & safety data
As part of your QMS, you need to have a way to collect data from distributors, users, and patients. You must log those data and analyze them regularly. In certain cases, you will have to inform your notified body and/or the regulator through the EUDAMED database.
Annex XIV part B of the EU MDR calls for continuing to collect data when the device is on the market. That’s the Post Market Clinical Follow up (PMCF). It collects data (through surveys, hospital databases…) and then feeds those data to the risk management file that is in the technical documentation.
The PMCF aims at confirming the safety and performance of the device throughout its expected lifetime (in other words, this is related to product reliability), at monitoring the contra-indications and any side effects, identifying and analyzing emergent risks, and confirming that the benefit-to-risk profile still makes sense.
The PMCF must be scheduled, conducted over time, and its findings must be documented and analyzed. The resulting report becomes part of the technical documentation.
The manufacturer needs to react in a certain way to issues when they come up. For details, refer to:
- EU MDR chapter VII section 2, and article 87 for details
- Guidance document https://ec.europa.eu/docsroom/documents/32305/attachments/1/translations
- Guidance document http://www.imdrf.org/docs/ghtf/final/sg2/technical-docs/ghtf-sg2-n54r8-guidance-adverse-events-061130.pdf
Risk & benefits analysis (updated)
As we wrote above, you keep getting a lot of data in this phase, both from production (including by component suppliers) and from the market. This analysis never stops!
EU MDR compliance is critical for importers of medical devices into Europe and now differs quite a lot from the 25-year-old former regulation, the Medical Device Directive (MDD). Everyone in the supply chain is identified and has liability for issues, the authorities will pursue wrongdoers with gusto, and cutting corners is now no longer an option (such as we saw with the importation of sub-standard PPE at the start of the coronavirus pandemic).
Key changes in the EU MDR to be wary of
If you’re a medical device manufacturer or importer, you’ll need to look out for the following changes in particular that we’ve covered throughout the guide during our explanation of the suggested NPI process for medical devices that will later reach EU MDR compliance:
- The roles and responsibilities of the ‘economic operators’ (everyone involved in the medical device supply chain) are clearly outlined. This includes the manufacturer, importer, EU authorized representative, and distributor. All may be liable for punishment if medical devices are found to breach compliance regulations and cause harm.
- Notified Bodies are duty-bound to put far more time and effort into supervising medical device manufacturers’ post market surveillance systems because they too are liable for any issues that occur that escape their notice.
- Manufacturers must produce a post market surveillance report periodic safety update (for some devices). This is a standard part of EN ISO 14971, but is now mandatory for all.
- Unique Device Identification (UDI) will be used on devices in order for them to achieve EU MDR compliance.
- A person responsible for regulation compliance (PRRC) must be assigned and bears the responsibility for ensuring that the company and its devices reach EU MDR compliance.
- The EU MDR’s scope now includes non-medical devices that are similar to those that are specifically used for medical applications. A good example are certain cosmetic devices that come into close contact with the wearer’s body and could pose a health risk, such as colored contact lenses, hair removal lasers, and equipment for performing facial fillers (more examples here in Annex XVI of the Regulation).
These changes represent a lot of work, but if you’re already familiar with preparing and testing to comply with the older MDD then many of the MDD’s requirements are retained by the EU MDR, such as the devices classes (I, IIa, IIb, and III), technical documentation requirements, the need to register the device (including with EUDAMED), notified bodies, and more.
Don’t forget to read and listen to the following resources to help you with EU MDR compliance
- New EU Medical Device Regulation: No More Traders?
- How The EU MDR Will Change The Medical Device Industry Forever [Podcast]
- New EU MDR: Who Are The “Economic Operators” For Imported Devices?
- EU MDR Changes: Are You Selling a Medical Device, and What Class Is It?
- EU MDR Update: How To Get a New Medical Device Certified? [Flow Charts]
We at Sofeast are not lawyers. What we wrote above is based only on our understanding of the regulatory requirements. We do not present this information as a basis for you to make decisions, and we do not accept any liability if you do so. Please consult a lawyer before taking action.