United States: Software As A Medical Device In Europe – New Regulatory Regime About To Enter Into Force – (Part 6 Of 6)

In Part 6 of our series of consecutive articles on the reformed regulatory framework under the EU Medical Device Regulation 2017/745 ("MDR"), which will govern medical devices software ("MDSW") in the EU, we turn to the transition periods certain MDSW can benefit from before being required to fully comply with the MDR.

Transitional periods are provided in Article 120 MDR. In part due to the COVID-19 pandemic, the original text of Article 120 MDR has been corrected by two corrigenda (I, II) and another Regulation to avoid additional burdens to stakeholders and impasses in the supply of medical devices. The changes introduced by these amendments are twofold: On the one hand, the scope of the existing transitional periods was substantially changed and now includes more devices. On the other hand, the MDR now reflects the pushed-back applicability dates of the MDR and their influence on the transitional periods.

Due to the many amendments, however, the European legislator missed its aim to lay down clear and legible transitional rules. Therefore, the following article will decipher Article 120 MDR and provide an overview, which rules have to be observed when, as well as the prerequisites MDSW has to meet in order to benefit from the grace periods.

1. INTRODUCTION: THE TERMINOLOGY OF ARTICLE 120 MDR

The various transitional periods granted by Article 120 MDR allow for extended "placing on the market," "making available on the market," and "putting into service" of certain legacy MDSW, i.e., MDSW that was in compliance with the provisions of the current EU Medical Device Directive 93/42/EEC (as amended by Directive 2007/47/EC – "MDD"). Other than with physical medical devices, it can be challenging to determine when these actions take place. It is thus worthwhile to take a closer look at their definitions under the MDR.

Placing on the market means the first making available of a device, other than an investigational device, on the EU market (Article 2 (28) MDR). It is subject to an ongoing debate whether MDSW is placed on the market as soon as it is offered for download through a website or an App Store or whether every license or access key to a MDSW granted to a user is placed on the market upon issuance. The latter option seems favorable due to the underlying rationale of the MDR. Most of the MDR provisions, including the transitional rules, were designed with physical medical devices in mind, and it is therefore common understanding that the placing on the market applies separately to each individual device. Translated to MDSW, this means that every license or access key will only be considered placed on the market once it is issued to the user.

Making available on the market means any supply of a device, other than an investigational device, for distribution, consumption, or use on the EU market in the course of a commercial activity, whether in return for payment or free of charge (Article 2 (27) MDR). Putting into service means the stage at which a device, other than an investigational device, has been made available to the final user as being ready for use on the EU market for the first time for its intended purpose (Article 2 (29) MDR). Following the placing on the market through issuance of a license or access key to MDSW, it is then made available through the download by a user and put into service through its installation. These modalities therefore cover the maintenance of licenses to MDSW that were already granted to the user.

It must be mentioned that while some notified bodies back these conclusions, they are not set in stone, as courts have not yet decided on these issues.

2. TRANSITIONAL PERIODS FOR UP-CLASSIFIED MDSW

In Part 3 of this series, we discussed that it is to be expected that many MDSW that are currently classified in Class I under the MDD will be up-classified to Class IIa or higher under the MDR regime ("Up-classified MDSW"). Such MDSW will benefit from the transitional periods of the MDR in two ways. First, new licenses and access keys to Up-classified MDSW may be granted until May 26, 2024 (Article 120 (3) MDR). Second, licenses and access keys granted until May 26, 2024, may be maintained until May 26, 2025 (Article 120 (4) MDR), i.e., users may use, download, and install Up-classified MDSW that they already purchased.

a. Requirements for granting new licenses to Up-classified MDSW

For the aforementioned transitional periods to apply, the following requirements have to be met (see MDCG 2020-2 Guidance for further instructions; please note that the dates mentioned therein do not reflect the dates of the current version of the MDR):

• The MDSW needs to continue to comply with the MDD.

• A valid Declaration of Conformity ("DoC") complying with Annex VII of the MDD must be drawn before May 26, 2021. With the DoC, the manufacturer of the MDSW declares that it meets the relevant requirements of the MDD. Comprehensive instructions on the form, content, and handling of the DoC can be found in the MDCG 2020-2 Guidance, the Blue Guide on the implementation of EU products rules 2016 (2016/C272/01), the standard EN ISO/IEC 17050-1/2, and the model declaration in Annex III of Decision No 768/2008/EC.

• The MDSW must not undergo significant changes to its design or intended purpose after May 26, 2021. It cannot be emphasized enough that this provision can have far‑reaching implications for the manufacturer's ability to benefit from the transitional period, as it covers a lot of changes that could be considered desirable or, in the worst case, even mandatory changes. While the MDR does not define when a change is 'significant,' some meaningful guidance can be drawn from the MDCG 2020-3 Guidance on Significant Changes that leads the determination process through a series of flow charts. Additionally, the NB-MED Coordination on Council Directives 90/385/EEC, 93/42/EEC, and 98/79/EC as well as the NBOG's Best Practice Guide should be considered. Following these guidelines, bug-fixes, security patches, and minor changes to non-critical parts of the user interface, such as spelling mistakes, will likely not be seen as significant. Vice-versa, changes to the intended user groups or changed indications, corrections of errors to minimize risks, changes to the user interface (like changing warning messages), or the use of a different runtime environment will likely be deemed significant (these examples are only for illustrative purposes and are not comprehensive).

Any manufacturers of MDSW going this route are well advised to make themselves familiar with the guidance documents on significant changes. They should be aware that as MDSW by their very nature undergo a high volume of changes during their life cycle, it is likely that some of these changes could ultimately jeopardize the applicability of the transitional period.

This risk is accelerated by the new EU Directive on Digital Content and Services 2019/770, which contains a mandatory obligation to update digital products in order to keep them in conformity with the underlying contract (Article 8 (2)). These obligations also apply to products, for which the consumer "pays" for with personal data (Article 3 (1)). Depending on the nature of the MDSW and the respective contract, changes required in this context can be of a kind that would be seen as significant under the MDR. As the Member States of the EU have to transpose these rules into national laws until July 1, 2021, these obligations will be applicable to manufacturers of MDSW very soon.

b. Maintaining existing licenses until May 26, 2025 (Article 120 (4) MDR)

Designed as a sell-off provision for physical medical devices, Article 120 (4) MDR allows for the continued making available on the market and putting into service until May 26, 2025, of legacy medical devices that were placed on the market prior to May 26, 2024. For MDSW, this means that licenses and access keys that were already issued before May 26, 2024, can be maintained for another year. In this timeframe, the manufacturer can give users who have already obtained a license or access key further access to the MDSW, allow the respective installations, and use and offer technical support.

3. TRANSITIONAL PERIODS FOR SAME-CLASS MDSW

Legacy MDSW that is classified as Class I under the MDD and which will remain in Class I under the MDR regime ("Same-class MDSW") will have limited transitional options. Only licenses or access keys to Same-class MDSW granted before May 26, 2021, may be maintained until May 26, 2025 (Article 120 (4) MDR), i.e., users may use, download, and install already obtained Same-class MDSW. This makes sense, as the main purpose for transitional periods must be found in the legislatures aim to avoid congestion of the bottleneck of certification, the notified bodies, and full compliance of Same-class MDSW with the MDR can be achieved by way of the continued possibility of self-certification of Class I devices, as we have shown in Part 2 of this series.

To be on the safe side, manufacturers of Same-class MDSW should also consider not changing their product as long as use of already-issued licenses and access keys are required before full compliance with the MDR.

4. TRANSITIONAL PERIODS FOR HIGHER-CLASS MDSW

Even though most MDSW under the MDD was classified in Class I, some software for high-risk medical scenarios was already in Classes IIa to III ("Higher-class MDSW"). For example, MDSW intended to image in vivo distribution of radiopharmaceuticals was in Class IIa and MDSW controlling emitters of ionizing radiation for therapeutic interventional radiology was in Class IIb (MEDDEV 2.1/6 Guidance of July 2016, p. 16).

As Higher-class MDSW had to be certified by a notified body already under the MDD, the question whether new licenses and access keys may be granted depends on the continued validity of the certificate. Certificates to Higher-class MDSW certified prior to May 25, 2017, remain valid until the date indicated on the certificate.[1] Certificates to Higher-class MDSW certified after May 25, 2017, also remain valid until the indicated date but no longer than five years or until May 27, 2024, whichever is earlier. Accordingly, new licenses and access keys can be granted to customers as long as the MDSW certificate is valid but no longer than May 26, 2024 (Article 120 (2), (3) MDR).

As with Up-classified MDSW, the following requirements have to be met for the transitional periods to apply.

• The MDSW needs to continue to comply with the MDD.

• The MDSW must not undergo significant changes to its design or intended purpose after May 26, 2021.

Any licenses and access keys granted in the described timeframe may be maintained until May 26, 2025 (Article 120 (4) MDR).

5. MDR REQUIREMENTS TO BE MET DURING THE TRANSITIONAL PERIOD

The transitional period must not be understood as a delay of application of the MDR. The following MDR provisions have to be complied with from May 26, 2021, in any scenario (Article 120 (3) MDR):

• Post-market surveillance (Article 83 et seq, "PMS"): as we have shown in part 4 of this series, manufacturers of MDSW need to establish a PMS system that systematically gathers records and analyzes relevant data on the quality performance of MDSW for its entire lifetime. As a result, the manufacturer needs to draw the necessary conclusions from the findings and implement preventive and corrective actions. Additionally, manufacturers of MDSW in Classes IIa to III have to prepare a Periodic Safety Update Report summarizing the results and conclusions out of the abovementioned aspects.

• Vigilance (Article 87 et seq): Manufacturers of MDSW are required to investigate and report serious incidents and take and report field safety corrective actions with regard to their products. Furthermore, they have to report on trends concerning the frequency or severity of side effects that are documented in the MDSW informational material and the technical documentation. For further information on incident reporting, please refer to part 4 of this series.

• Registration of economic operators and of devices (Article 29 et seq): manufacturers will have to register their MDSW in accordance with the Unique Device Identifier ("UDI") system that we have covered extensively in Part 5 of our series. In addition, they need to register themselves with a unique Single Registration Number ("SRN") and, where applicable, the authorized representative and the importer. SRNs are assigned by the competent authorities in the EU member states. The registration will be carried out through the European Databank on Medical Devices ("EUDAMED"), which is in the process of being set up.

• Market surveillance (Article 93): the provisions on market surveillance cover the duties and activities carried out by the competent authorities to ensure that medical devices do not pose significant risks to the health and safety of patients. It therefore does not directly apply to manufacturers of MDSW.

6. CONCLUDING REMARKS

As it is to be expected that many Class I MDSW will be up-classified under the MDR, developers should be duly prepared to qualify for the transitional periods and put the delay to good use. First, they should assess any upcoming necessary changes to their products and plan on pushing back any of them that could be deemed significant, as they could lead to abrupt applicability of all relevant MDR requirements (although there may be cases where they are forced to implement changes under PMS). Second, manufacturers should familiarize themselves with their obligations regarding PMS, vigilance, and registration and be ready for full compliance from May 21, 2021. Third, they should start preparing for MDR certification as additional pressure on the Competent Authorities at the end of the transitional periods are predictable. Manufacturers should begin to, inter alia, collect clinical data on their MDSW, set up a Quality Management System, and draft Clinical Evaluation plans.

Timely preparation is of the essence as only an on-time certification can ensure a smooth transition into the new (delayed) framework.

Footnote

1 In the rare case that a device has an EC-verification as set out in Annex IV to the MDD, it can only be placed on the market until May 27, 2022 (Article 120 (2) MDR).

Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Morrison & Foerster LLP. All rights reserved