European Commission proposes dramatic simplification overhaul of medical device and IVD rules

The European Commission has published its long-awaited proposal for a regulation to simplify the EU Medical Devices Regulation (“EU MDR”)[1] and the In Vitro Diagnostic Medical Devices Regulation (“IVDR”)[2]. The text of this proposal can be found here.

While some of the changes which it will introduce are innocuous, others could have far-reaching implications for how the EU medical devices framework will function for the next decade.

In the words of the Commission, this proposal is intended to achieve 8 objectives in relation to the EU MDR and IVDR:

1. Regulatory simplification and proportionality
2. Reduction of administrative burden
3. Promotion of innovation and availability of devices for special patient groups and unmet needs
4. Greater predictability and cost efficiency in conformity assessment
5. Coordination within the decentralised EU medical device and IVD regulatory system
6. Greater use of digitalisation
7. Promotion of international cooperation
8. Improved interplay with other EU legislation, including the AI Act

The number of individual changes proposed by the Commission pursuant to these objectives is far too great to explain exhaustively. However, we have set out below some of the noteworthy proposed changes under each of these headings. 

This proposal needs to be seen in the context of profound legislative changes in the EU, especially in technology and life sciences. In the last few weeks we have seen major developments in relation to the simplification of the AI Act, the political agreement on the revamped pharmaceutical law package, and a proposal for an EU Biotech Act which is scheduled for adoption in parallel with this medical device simplification proposal. 

Simplification and proportionality

The Commission touts a number of measures designed to simplify the EU MDR and IVDR and make them more proportionate. A few appear genuinely impactful, for instance: 

• Removing the 5-year validity cap on certificates of conformity, avoiding regular re-certification. Instead, Notified Bodies will “periodically review” certificates during their life time. Certificates will only be subject to a period of limited validity where the Notified Body considers this exceptionally necessary, for instance where the Notified Body has issued the certificate subject to conditions like conducting a Post-Market Clinical Follow-up (“PMCF”) study. This goes hand in hand with the earlier implementing regulation proposal to standardise aspects of Notified Bodies’ conformity assessment activities, which will curtail the extent of Notified Body review on a device re-certification.[3]
• Removing the minimum qualification requirements for a Person Responsible for Regulatory Compliance (“PRRC”) and the requirement for a small- to medium-sized enterprise (“SME”) to maintain a “permanently and continuously available” PRRC.
• Introducing a definition of “well-established technology devices” that are subject to more light-touch conformity assessment requirements, instead of relying on the old list of “sutures, staples, dental fillings, dental braces, tooth crowns, screws, wedges, plates, wires, pins, clips or connectors.”

In other cases, the Commission’s proposals seem underwhelming. For instance, the acceptable categories of clinical and non-clinical data for use in a conformity assessment submission will ostensibly be broader, allowing greater use of non-peer reviewed clinical data, clinical data relating to equivalent devices, and use of in vitro, ex vivo and in silico non-clinical data. 

However, it is not clear that the proposed text actually allows for greater use of non-peer reviewed data, or that in vitro, ex vivo and in silico non-clinical data add very much to the existing permitted categories of non-clinical data, being “laboratory testing, simulated use testing, computer modelling, [and] the use of animal models.”

It is also not clear that the Commission actually proposes to make it easier to demonstrate equivalence to an existing device and so rely on clinical data relating to it. It is true that the Commission proposes to remove the requirement for a medical device manufacturer to have a contract entitling it to access to the technical documentation of a device to which it wants to demonstrate equivalence. However, the Commission is not proposing to remove the requirement that a manufacturer demonstrate “sufficient levels of access to the data relating to devices with which they are claiming equivalence”, or the requirement to demonstrate technical, biological and clinical equivalence, which remains a very high threshold.

The Commission’s proposals on adjusting medical device classification rules are particularly underwhelming. No changes are proposed to IVD classification rules, so there will be no relief from the sweeping up-classification of IVDs that resulted from the IVDR. Changes are proposed to EU MDR classification rule 11 on standalone software. However, these changes only serve to reinforce the reality that almost no Class I medical device software exists in the EU, by clarifying that medical device software used for “diagnosis, treatment, prevention, monitoring, prediction, prognosis, compensation or alleviation of a disease or condition” (i.e. any software with a medical purpose) in a “non-serious situation” (the least serious situation under the IMDRF risk classification matrix) is classified as Class IIa.

Reduction of administrative burden

In a similar vein, the Commission also proposes changes to reduce the administrative burden associated with EU MDR and IVDR compliance. These includes changes to reduce the burden of post-market surveillance, by reducing the frequency with which Periodic Safety Update Reports (“PSURs”) need to be updated for each class of device and extending the vigilance reporting period for an incident to 30 days from 15 days.

Performance studies on IVDs only involving routine blood draws will be exempted from prior authorisation, and performance studies on companion diagnostics using leftover tissue samples will be exempted from prior notification.

More intriguingly, one proposed change would allow a Notified Body to agree a pre-determined change control plan with a manufacturer, allowing the manufacturer to make pre-approved changes to its device or quality management system without seeking fresh approval from the Notified Body. Pre-determined change control plans have been a topic in the field of AI-enabled medical devices for some time[4] and one wonders whether this proposal has one eye on the future adaptation of the EU MDR and IVDR to incorporate specific rules on AI (more on that later).

Innovation and availability of devices for special patient groups or situations

In the Commission’s explanation of the changes it is proposing, the first item that is referred to under this heading is the proposal to broaden the in-house manufacturing exemption for medical devices and IVDs. This is relatively exciting as it removes the prohibition on supply of in-house manufactured devices between health institutions and the condition that no equivalent device should exist on the market. It also removes the obligation for health institutions to draw up detailed documentation describing the manufacturing facility, manufacturing process, and the design and performance data for the device. Laboratories will also be permitted to rely on the exemption to use in-house manufactured IVDs in clinical trials.

However, the real story here is the proposed introduction of special categories of “breakthrough” and “orphan” medical devices and IVDs. 

A medical device or IVD would be designated as “breakthrough” if (in the opinion of an expert panel):

1. it is expected to introduce in the Union a high degree of novelty with respect to the device technology, related clinical procedure or the application of the device in clinical practice; and
2. it is expected to provide a significant positive clinical impact on patients or public health, for a life-threatening or irreversibly debilitating disease or condition, by either of the following:
   1. offering a significant positive clinical or health impact compared to available alternatives and the state of the art;
   2. fulfilling an unmet medical need where there is an absence or insufficiency of available alternative options for that purpose.

A medical device or IVD would be designated as “orphan” if (in the opinion of an expert panel):

1. it is intended for the treatment, diagnosis, or prevention of a disease or condition that presents in not more than 12 000 individuals in the Union per year; and
2. at least one of the following criteria is met:
   1. there are insufficient available alternatives;
   2. the device is expected to provide a clinical benefit compared to available alternatives or the state of the art, taking into account both device-specific factors and patient population-specific factors.

Designation as a “breakthrough” or “orphan” device would entitle the manufacturer to “priority rolling review” from a Notified Body. It would also entitle the manufacturer to request advice from an expert panel on clinical development strategy and appropriate pre-clinical or clinical data for the clinical evaluation of the device, which the Notified Body would be obliged to give “due consideration” to. This latter point appears important as the Notified Body would be obliged to issue a certificate of conformity for the device, even where based on limited clinical data, where the available clinical evidence is deemed “adequate” and the benefits of immediate availability of the device outweigh the risks. The proposals contemplate the issue of conditional certificates in such circumstances and the use of PMCF studies to generate further clinical evidence. 

Clearly a great deal of guidance is needed on how the various concepts used here are to be interpreted. However, these proposals could seriously accelerate the time to market for innovative medical technologies and technologies for underserved populations, especially if expert panels are able to put pressure on Notified Bodies to grant conditional certificates while clinical data is still limited.

Designated orphan devices which were authorised under the former medical devices directives will also benefit from an indefinite extension to the validity of their authorisations under the EU MDR and IVDR transitional periods, allowing such devices to remain on the market for so long as they do not undergo a significant change and retain their designated orphan status.

Finally, the Commission proposes to introduce regulatory sandboxes at national and EU level for medical devices and IVDs, in which certain requirements of the EU MDR and IVDR would be suspended to allow testing of medical devices and IVDs in accordance with a sandbox testing plan. 

National sandboxes would be open to medical devices or IVDs addressing “unmet medical needs” where application of the requirements of the EU MDR or IVDR would seriously impede or delay development of and access to the device, and would appear to permit real world testing. It is not clear whether data generated from use of a medical device or IVD in a regulatory sandbox would constitute clinical data for use in a conformity assessment, and guidance on this would be valuable.

The EU level sandbox would be used to test whether existing regulatory requirements are appropriate for specific types of devices (particularly based on emerging technologies), where there is a risk that existing requirements would seriously impede or delay development and access or would inadequately protect health and safety. Real world testing of medical devices and IVDs would not be permitted as part of the EU-level sandbox.

Predictability and cost-efficiency of certification

Continuing in the related “simplification” and “reduction of burden” vein, the Commission proposes a number of measures to increase the predictability and cost-efficiency of medical device certifications. These proposals go together with the earlier implementing regulation proposal to standardise aspects of Notified Bodies’ conformity assessment activities.[5]

For one, the Commission proposes to introduce a legal basis for so-called “structured dialogue” between Notified Bodies and manufacturers, which will clarify the circumstances in which Notified Bodies can discuss their expectations for medical device approval submissions without crossing the line into prohibited consultation with manufacturers. 

Further, the Commission proposes to reduce the scope of Notified Body review of Class IIa, IIb, B and C devices, requiring Notified Bodies to review only one representative device per generic device group, category or for the whole portfolio. The possibility of remote audits will also be introduced, surveillance audits reduced to once every two years, and unannounced audits only permitted “for cause”. 

Finally, the Commission will be empowered to set lower Notified Body fees for SMEs and manufacturers of designated orphan devices.

Coordination within decentralised system

The big headline here is the much greater role that the Commission is proposing the EMA should play in supporting and coordinating the EU’s medical device regulatory ecosystem, which is currently highly decentralised. 

The Commission’s proposals lean very heavily on the use of expert panels to provide clinical, scientific, technical and regulatory advice to the Commission, the MDCG, Member States, Notified Bodies and in some instances manufacturers directly. In practice, such expert panels are constituted under the EMA, which provides the secretariat for them, and if the Commission’s proposals are adopted, the EMA will also be responsible for appointing experts to the panels (formerly this was the role of the Commission in consultation with the MDCG). Manufacturers will pay fees to the EMA for advice provided by expert panels. In practice, expert panels will be creatures of the EMA.

Furthermore, the EMA will provide scientific, technical and administrative support to coordinate the activities of member state competent authorities in areas such as borderline and classification, multi-country clinical studies, derogations, vigilance and market surveillance. 

For instance, part of the Commission’s proposal is the codification in law of the Helsinki Procedure, which produces decisions on borderline and classification of medical devices and IVDs to populate the EU’s Borderline Manual in response to a referral from a national competent authority. Formerly, the Helsinki Procedure made these decisions by consensus between competent authorities at meetings of the MDCG, which made decisions slow to reach where competent authorities could not agree. Under the new procedure, if competent authorities cannot agree on the qualification or classification of a product as a medical device or IVD, the matter will be referred to an expert panel, which will issue an opinion. The competent authority which initially referred the matter must then adopt a decision, giving “utmost consideration” to the opinion of the expert panel, although it may ask clarifying questions. 

The EMA’s role under these proposals does not stop there: it will also provide scientific, technical and administrative support to the Commission for the EU-level regulatory sandbox referred to earlier in this article, and will provide a support scheme to help SME manufacturers comply with the requirements of EU MDR and IVDR.

Aside from the EMA’s beefier role in the EU medical devices framework, the Commission’s proposal will also introduce a new dispute resolution mechanism for manufacturers and Notified Bodies, operated by the member state authorities responsible for Notified Bodies acting as “ombudspeople”. Member state authorities will be entitled to consult with the MDCG where guidance is needed.

Further digitalisation

The main thrust here is that the Commission proposes to allow manufacturers to draw up electronic Declarations of Conformity and technical documentation and reports for conformity assessment purposes, to permit digital labelling, and to allow the use of electronic Instructions for Use for near-patient testing (as well as all the other types of device for which this is already permitted). 

However, one interesting tweak is the Commission’s proposal that some of the functionality which Eudamed is supposed to deliver could actually be delivered by other electronic systems. The Commission has already given notice that the Actor, UDI/Devices, Notified Body & Certificates and Market Surveillance Eudamed modules will be mandatory to use from 28 May 2026. However, the Post-Market Surveillance & Vigilance and Clinical Investigation & Performance Studies modules remain outstanding (there is not even an estimated “go live” date for the latter module at this time), so perhaps one or both of those modules will be delivered using another IT system.

International cooperation

The Commission’s proposals contain two major new provisions for the EU MDR on international cooperation.

First, a new provision requiring the Commission to “pursue international regulatory cooperation” (including participating in IMDRF, MDSAP and ISO) and empowering it to sign agreements with third country authorities and international organisations on matters include “joint or coordinated inspections and assessments”. 

Second, a new provision empowers the Commission to participate in bilateral and multilateral international reliance schemes under which regulatory decisions issued in third countries can be relied on to expedite the grant of a regulatory decision (such as an approval) in the EU.

At minimum, these provisions raise the possibility of the EU finally fully recognising quality management system reports issued by MDSAP auditing organisations, instead of just allowing Notified Bodies to take their findings into account during routine surveillance audits. Taking a more expansive view, these provisions open the door to the EU entering into mutual reliance arrangements with third-country partners such as the UK and Australia, whereby device approvals issued in one jurisdiction would expedite the issue of an equivalent approval in all participating jurisdictions. Australia already incorporates some degree of international reliance in its medical devices framework and the UK plans to introduce a unilateral medical device reliance procedure as part of its revamp of its medical devices legislation. 

Unfortunately for some, the new provision requires the EU’s participation in reliance mechanisms to be reciprocal, which would appear to exclude the possibility of relying on an approval from the U.S. FDA to obtain an approval in the EU.

Interplay with other Union legislation

Talk about saving the best for last (or perhaps just burying the lede): the biggest news in all of this is the proposal to effectively exempt medical devices and IVDs from the scope of regulation as “high-risk AI systems” under the AI Act. Instead, AI-enabled medical devices and IVDs will be treated in the same way as AI systems used in sectors such as civil aviation, railways and automotive: subject to sector-specific regulation only, which may be updated by the Commission in a manner which is consistent with the general approach adopted by the AI Act.

Notified Bodies will not need to seek a separate designation to conduct AI Act conformity assessments (although they will need the expertise to assess AI-based devices). Manufacturers will not have to struggle to reconcile overlapping quality management system requirements or deal with the uncertainty wrought by the delays in the delivery of AI Act technical standards and guidance. After industry’s recent experience with the prohibition on real world testing of high risk AI systems introduced by the AI Act, this feels like a very good thing. Presumably, that prohibition had the commendable aim of excluding real world testing of insidious AI-enabled toys on children, or AI-enabled lifts on unsuspecting office workers, but in reality it very nearly killed all interventional clinical research using AI-enabled medical devices and IVDs in the EU.

There are some other interesting points to note under this heading too, including a pathway for obtaining a single approval for a combined clinical trial involving an investigational medicinal product and an investigational medical device and/or an investigational IVD, in line with the amendments to the EU Clinical Trial Regulation which will be introduced by the proposed EU Biotech Act. In light of this blurring of the lines between a clinical trial, a clinical investigation and a performance study, perhaps the Commission’s proposal not to deliver all of the Eudamed functionality through Eudamed has one eye on turning its Clinical Trials Information System (CTIS) into a single register for all clinical research into investigational products in the EU? 

Cybersecurity will also be formally introduced as a general safety and performance requirement for digital medical devices and IVDs and cybersecurity incidents (which are not safety incidents) will be reportable to EU cybersecurity authorities through the Eudamed Vigilance module.

All in all, the Commission’s proposal to simplify the rules on medical devices and IVDs is welcome news. As the proposed regulation follows the EU’s ordinary legislative procedure (with the European Parliament and the Council acting as co-legislators), there is a long legislative train ahead of us before the final regulation is enacted. We expect (and very much hope) that the final text will apply before entry into application of the obligations related to high-risk AI systems under the AI Act. This is of course a moving target, with the proposal to delay the application of the provisions applicable to high-risk AI systems in the Digital Omnibus on AI Regulation Proposal.