This roadmap explains in 11 steps what should be done to obtain CE certification for a medical device.
A term relevant to certification is the Intended Purpose (or Intended Use) of the medical device. The intended purpose states what the medical device does (what the intended medical purpose is), and does not do. Thus, the scope is defined. Everything described in the intended purpose must be proven. Therefore, the intended purpose partly defines which validation tests must be carried out at a later stage.
Note: The intended purpose is described by the manufacturer on the label, in the instructions for use and/or the website and promotional material.
Medical devices are divided into four classes: I, IIa, IIb and III for devices covered by the MDR, and A to D for devices under the IVDR. This classification is based on risk: the higher the risk to the patient if the medical device fails, the higher the class. In addition to these four classes, a distinction is made within class I or A between devices that must be sterile (class Is or As), that have a measuring function (class Im) or are reusable surgical instruments (class 1r).
The quick scan Classification can help to make an initial estimation of the class. For a class I or A device, the manufacturers themselves assess whether the device complies with the regulation. For all other classes an external independent party has to make this assessment. This party is called the Notified Body. For class Is, As, Im, or Ir the sterilization process, the production process and accuracy of the measuring function, or the process surrounding the reusability are still being assessed by a Notified Body. Within Europe you are free to choose any Notified Body. Three Notified Bodies are located in the Netherlands: DARE, DEKRA and BSI.
The regulations contain a list of requirements that every medical device must meet. These requirements are referred to as the general safety and performance requirements. The requirements concern design, production, risk management and use of materials. This list describes requirements for all types of devices and is therefore very general. As a result, not all requirements might apply to your device or app.
The general safety and performance requirements are described in Annex I of the MDR and IVDR. In a "General Safety and Performance Requirements Checklist" you must indicate which requirements apply, which standards are used, in which document you describe how your device meets an applicable requirement and where this document can be found.
Standards are uniform agreements about a product or a process. Standards for a product (group) are often less vague and general than the requirements from the regulations and therefore much more useable. Harmonized standards are standards that are presumed to meet the general safety and performance requirements automatically when that standard is met. It is not mandatory to use standards, but it is strongly advised. The harmonized standards can be found on the website of the European Commission.
Each manufacturer must set up a quality management system. A quality management system describes the processes within an organization in areas such as design and development, production, testing, installation and service of the device. ISO 13485 is the harmonized standard for a quality management system for manufacturers of medical devices, and suppliers of a part or service for a medical device.
The notified body will audit the quality management systems of manufacturers of medical devices higher than class I or A.
An important requirement from the regulations is that the device does not pose an unacceptable risk to users and patients. In order to demonstrate this, all risks associated with the device must be identified. Of all the identified risks, the extent of that risk must be assessed and measures must be taken to reduce the risks as far as possible. The harmonized standard ISO 14971 describes this process in detail.
Testing is required to demonstrate that the device is safe, that the device performs according to the intended purpose, and that the risks are effectively mitigated. This can be done by means of technical tests, user tests, laboratory tests, simulation tests, and animal tests. With all these tests, the following items must be demonstrated:
- whether the user understands how to use the device and cannot accidentally make an error (ergonomic safety)
- whether the device does what it is supposed to do (performance testing and clinical safety)
- whether the device has no (serious) undesirable effects on the body (biological safety).
The clinical evaluation (MDR) and performance evaluation (IVDR) examines the safety, performance and side effects of the device. This can be done by conducting a literature study on the actual usage data of the device.
If there is insufficient data to establish the safety and performance of the medical device and the testing and risk assessment are not sufficient evidence, a clinical investigation should be performed.
The requirements for clinical evaluation are defined in Article 61 and Annex XIV of the MDR. The procedure for clinical investigations is described in Annex XV of the MDR. ISO 14155 is the harmonized standard for clinical investigation.
For performance evaluation of in vitro diagnostic medical devices, the requirements are set out in Article 56 of the IVDR and in AnnexXIII. Annex XIV describes specific requirements for interventional clinical trials. For IVDs, there is also a specific standard for clinical research, the ISO 20916.
The technical documentation is intended to allow for the inspection of conformity of the device to the requirements of the regulation. This audit can be done by a Notified Body, but, in case of problems, also by the Competent Authority. In the Netherlands, this is the IGJ (Healthcare and Youth Inspectorate). The technical documentation describes the device, details of the design and how it is made, such as the technical drawings and a list of all components.
In addition, this documentation also states:
- the general safety and performance requirements checklist,
- a description of packaging, label and instructions for use,
- results of the risk analysis,
- assessment of the risks with regard to the benefits (benefit-risk analysis),
- the tests and their results,
- the clinical/performance evaluation (and if applicable clinical investigation) and the plan for the post-market clinical follow-up or post-market performance follow-up,
- the plan for post-market surveillance.
Over time the EU declaration of conformity, certificates and the results of the post-market surveillance and post-market clinical follow-up/ post-market performance follow-up will be added to the technical documentation. The documentation must be preserved for at least 10 years after the production of the last device. In the case of implants, the documentation must be preserved for at least 15 years.
Once all eight steps are completed, conformity of the device to the requirements of the regulation must be assessed. How this is done depends on the conformity assessment procedure. This is a procedure that will be followed to assess the conformity of the device; whether it meets the requirements of the MDR or IVDR. The procedures differ based on who makes the assessment (Notified Body or manufacturer), and what is assessed (the device itself, the technical documentation and/or the quality management system).
In principle, the conformity assessment procedure is tougher for devices with a higher classification grade since these devices carry a greater risk. The different procedures are explained in Annexes IV, X and XI of the MDR and IVDR. Article 52 of the MDR and article 48 of the IVDR describe for each class which procedures may be followed. Ultimately, the manufacturer chooses which procedure they will follow. Once the procedure has been successfully completed, the EU declaration of conformity will be signed and attached to the technical documentation.
If a Class I or Class A device has been assessed and certified by the manufacturer, the device and the manufacturer must be registered at the Competent Authority (in the Netherlands, via Farmatec). Manufacturers of all other device classes do not have to register the device, this is done by the Notified Body. Class I devices that are sterile and have a measuring function, or are reusable surgical instruments must be registered by the manufacturer themselves, even though a Notified Body has been involved.
When EUDAMED becomes available, the device and the manufacturer must also be registered in EUDAMED. To be able to do so, the manufacturer must apply for an SRN (single registration number).
In addition to registering the device, the CE mark must be shown on the device. The mark must be legible and in the correct proportions. If a Notified Body has been involved in the certification, the CE mark is followed by the identification number of this Notified Body.
Once the device is placed on the market, it is the manufacturer's responsibility to proactively monitor the device. The manufacturer must proactively investigate experiences, complaints and/or problems with the device. Additionally, serious incidents must be reported to the Competent Authority (IGJ) and, if necessary, action must be taken. A serious incident is defined as an incident in which a problem with the device and/or the explanation of the device caused or could have caused the death of a patient or seriously impacted (or could have impacted) a patient’s health.
In the post-market surveillance plan it is described how the manufacturer will monitor the devices and which criteria are defined to take certain actions. This plan is also part of the technical documentation.
If design changes are made, the technical documentation must be updated. When the changes are significant, they must be reported to the Notified Body.