Medical Device Link.

Originally Published IVD Technology April 2003

IVD Directive

The deadline for compliance with the IVD Directive is around the corner, and an efficient CE marking plan is essential.

Sue Spencer

With less than eight months to go before the European Union’s In Vitro Diagnostics (IVD) Directive becomes mandatory, many companies have a long way to go to achieve compliance. The clock is ticking loudly. The mandatory deadline for compliance is December 7, 2003, and companies must stock their European warehouse shelves with CE marked goods by the deadline to be in compliance with the directive. The logistics and time required to turn over all non–CE marked warehouse stock have not generally been considered. 

Additionally, many companies do not understand how the end of the transition period will affect their production schedules. After finalizing the European Union’s Medical Devices Directives, the Commission of the European Communities issued guidance stating that if non–CE marked devices were placed in the distribution chain before the compliance deadline, the distributors would have two additional years to put these devices into service. “Distribution chain” referred to the path of the medical device once it was sent outside the manufacturer’s premises and control, and before it was sold to the end-user. 

This supplementary period was a late concession intended to assist distributors with surplus stocks of high-cost equipment that they would have been unable to sell before the deadline. It was not intended to be a two-year extension to the mandatory compliance date. In light of this precedent, distributors will have until December 7, 2005, to put non–CE marked products into service, as long as the products are placed in the distribution chain before December 7, 2003. 

Customer expectation is also impacting companies. Manufacturers are finding that requests for CE-marked devices are increasing, especially when they apply for loans and grants that will still be in operation after the compliance deadline. From a regulatory perspective, CE marking is optional before December 7. However, it is increasingly becoming a customer requirement.

This article discusses some common pitfalls in the CE marking process. It will provide guidance for navigating through the CE marking maze and provide tools that companies can use to assess their current state of preparation. 

Fundamentals

Table I. High-risk in vitro diagnostics devices are divided into List A for highest-risk and List B for high-risk devices within Annex II of the directive (Click to Enlarge).

One of the biggest pitfalls in the CE marking process is that companies do not construct a compliance strategy ahead of time and plan accordingly. The first step in designing such a strategy is determining what must be CE marked. Many companies forget to include all of the accessories they manufacture. 

Under the IVD Directive, manufacturers are required to prepare a technical file for all IVDs and their associated accessories. All corresponding labels and instructions for use must comply with the essential requirements of the directive. Companies must determine which products are considered to be IVDs and IVD accessories, and will thus require the CE mark before being placed on the market. 

The first step in preparing a technical file is documenting the logic used to categorize a product as an IVD, IVD-related product, spare part, or product for general laboratory use. Spare parts should not bear the CE mark, but should be included in the technical documentation of the main device or accessory. 

Many companies sell general laboratory equipment to provide a one-stop shop for their customers. When selling these general laboratory items, companies must not make claims that could change the classification of the item to either an IVD or an accessory. Such a reclassification would require the CE marking of the product. Reclassification may result from attaching IVD-associated logos or brand names to a spare part or piece of general laboratory equipment (e.g., light bulbs or replacement dispensing units). 

A product should be classified as an accessory when it does not generate a diagnostic result in its own right, but is required for the IVD device to work as intended (e.g., a wash solution or sample tray that is sold separately from the main kit or system).

Deciding which items should be classified as “for research and development (R&D) use only,” and thus fall outside the scope of the directive, presents an additional quandary for manufacturers. If a company decides that an item is a true R&D-use-only product, it should document its reasoning and ensure that its marketing and sales force understands this reasoning. 

How a product is sold and marketed is an important determinant of whether the product is classified as an IVD, and is thus regulated by the directive. Products labeled “for research use only” cannot be marketed to hospitals with clinical claims (i.e., information providing clinical decision points for a product). Using a research-use-only claim to move products outside the regulatory framework may be an attractive option, but should be done with caution. Devices for R&D use only are restricted to marketing and sales for nonclinical markets, and such restrictions may make a product with clinical ties nonviable. 

Figure 1. The routes to demonstrating conformity for devices in Annex II List A (Click to Enlarge).

Deciding what to CE mark can be difficult. Competent authorities have taken legal action against companies that have inappropriately CE marked their products (e.g., tooth whiteners CE marked as medical devices that should have been classified as cosmetics). Legal action can be taken both against the inappropriate CE marking of products and against the companies that have not CE marked products that fall under the scope of the directive. Guidance is needed for classifying products with applications falling under multiple directives, and will hopefully be made available soon.

Companies that have not yet begun to CE mark their products should plan to begin by CE marking the products that produce the greatest profit. CE marking is a time-consuming process, so all products may not be CE marked before the mandatory compliance deadline. Thus, ensuring that top-selling products remain marketable should be a priority. 
Companies can use this profit-assessment process as an opportunity to rationalize their product portfolio. Manufacturers should consider whether adding the cost of CE marking to producing and supporting a product would make its continued production unprofitable.

Product Families

Once a company has determined what products must be CE marked, it should examine the synergy of its products to determine whether they can be configured as product families. Products can be grouped into product families if they share technology, such as a system platform, or if they use a common analyte. Components of a product family should share a high proportion of common technical documentation and pose similar risks. The product family is a vehicle to enable manufacturers to reduce the bureaucratic burden of supplying excess documentation. Determining whether to use product families and how to construct them is left to the discretion of the manufacturer. 

One way in which the product family classification is applied is when a series of analytes run on the same analyzer. These analytes will share common risks in their processing. Such risks result from the capture and detection of each analyte by the IVD. Also, risks result from the establishing of appropriate parameters, such as carryover, which are primarily features of the analyzer but differ according to each analyte and its application. One technical file can therefore deal with common features of the product family, but should also address all variations among the components.

Project Plan

Figure 2. The routes to demonstrating conformity for devices in Annex II List B (Click to Enlarge).

A detailed project plan is essential to managing the CE marking process. Once a company has determined which products must be CE marked, the order in which they will be marked, and the number of technical files required, a project plan should be prepared. Input from many parts of the organization will be required to coordinate and properly pave the way for compliance with the directive. 

The vast majority of CE marking projects do not involve a wide and diverse enough portion of a company’s resources. Companies mistakenly expect the entire process to be carried out by their quality control or regulatory departments or by an external consultant, apart from the rest of the organization. Meeting CE marking requirements will affect all parts of a business and may change the way in which the organization functions. Decisions therefore have to be made through a coordinated effort by all parts of an organization. Planning ahead for how to accomplish this coordination is essential to staying focused and on track.

Conformity Assessment

European directives have been written to accommodate the needs of member states, whether they use testing or quality assurance systems to regulate production. Conformity assessment procedures are therefore a series of independent modules used to assess a manufacturer’s compliance with the directive. 

Companies hire independent third parties called notified bodies to conduct an external review that serves as a conformity assessment. Notified bodies must meet a series of requirements outlined in Annex IX of the directive, and are appointed by each member state. Article IX presents a series of rules that should ensure that the notified body conducts a fair assessment. 
These rules state that a notified body should be independent, impartial, and operate with integrity. Thus, notified bodies cannot be device manufacturers and must observe client confidentiality. Notified bodies must also be technically competent, as they are making technical judgments. They should also carry civil liability insurance. 

The competent authority, the government agency or department that has been designated to oversee the directive in each member state, is required to monitor the performance of notified bodies. In some countries, such as Germany, several organizations combine to fill the role of the competent authority.

The greater the risk posed by a device, the higher the level of external review required. The perceived risk of a device is determined by a classification system described in the directive. Annex II List A contains highest-risk devices, and Annex II List B contains high-risk devices. Self-test and all other IVD devices are subject to a different set of rules. Assays are classified by analyte, as List A and List B devices (Table I). All classified analytes have been assigned to one of the lists. For example, prostate specific antigen (PSA) is the only cancer marker in Annex II List B.

Figure 3. The routes to demonstrating conformity for self-testing devices, excluding those in Annex II (Click to Enlarge).

The vast majority of IVDs are not listed in Annex II, and are sometimes described as self-certification products. However, technical documentation is required for all devices, as described in Annex III. This documentation should prove that each device meets the essential requirements described in Annex I of the directive. The essential requirements are minimum safety requirements, and include rules for both technical aspects and labeling. The amount of technical documentation required is proportionate to the risk level assigned to the device. 

For each class of device, manufacturers may choose from a number of different routes to demonstrate compliance with the directive. The philosophy of European directives is that the overall level of external scrutiny involved in conformity assessment should be the same whether compliance is achieved by testing or quality assurance. The available routes to conformity are described in detail in Article IX of the directive (Figures 1-4).

The risks posed by Annex II List A devices are so great that external testing of individual batches or lots is required, regardless of whether a quality assurance or testing route had been chosen. This testing is referred to as the “verification of manufactured product,” and is described in Annex IV section 6 or Annex VII section 5, depending on the route selected. 
The most common conformity route selected is “full quality assurance,” described in Annex IV of the directive. Using this route, the quality system must conform to ISO 13485, which requires an approval by a notified body of the design control system used to develop the IVD. Receiving an Annex IV approval allows companies to introduce new products with reduced notified body involvement.

Technical Documentation

When a European directive is proposed, the Commission mandates a series of standards to support the directive. Either the European Committee for Standardization (CEN, Brussels) or the European Committee for Electrotechnical Standardization (CENELEC, Brussels) is then commissioned to write the standards. Once the standards have been written and agreed upon, according to CEN or CENELEC rules, the standards are harmonized. Harmonization entails publishing the details of the standard in the Official Journal of the European Union. 

All harmonized standards contain an Annex ZA that describes which clauses in the standard demonstrate compliance with each essential requirement. The essential requirements are only met when the standard is applied in full. Standards embody what the EU deems to be the best practice, and are used as a reference source for proving compliance with the directive. 
Companies normally demonstrate compliance with the directive by preparing an essential requirements checklist. This list is a matrix that pairs the essential requirements with the standards the manufacturer has applied. It describes the technical documentation used by the manufacturer to prove compliance with the directive. 

Alternatively, the manufacturer may refer to a location where supporting technical documentation or data can be found. Many companies may already be compliant with FDA regulations. In this case, the essential requirements checklist can help these companies avoid reinventing the wheel by enabling them to cross-reference documents generated as part of U.S. 510(k) or PMA applications.

In European directives, the use of standards is encouraged, but not mandatory. However, the risk posed by the devices in Annex II List A was so great that a new standard called a Common Technical Specification (CTS) was written for them. This standard was not written in the normal manner. Rather, it was undertaken by a group of experts under the supervision of the commission. As a result, the CTS does not resemble a standard in structure and lacks the refinement of language normally found in standards. A copy of the CTS has now been published in the Official Journal of the European Community. 
Unlike other standards for European directives, the CTS is quasi-mandatory and it will be difficult to get an Annex II List A product approved without meeting it. Compliance with the CTS is reviewed as part of the design dossier review described in Annex IV or the test method described in Annex V. The design dossier review is a detailed review of an individual technical file. When files for Annex II List B devices are reviewed, the sampling of technical files is permissible. 

Until recently, many companies have prepared retrospective technical files. However, from now on companies will generate new files for new products. These companies must not fall into the trap of preparing their new files in the same way as their retrospective files, i.e., by waiting until the end of a project to assemble all of the required information. This often occurs when the product has been developed for the U.S. market and the essential requirements are only considered when the product is ready to enter Europe. 

The best technical files are assembled as the design of the device progresses and as the pertinent documents are generated. To generate technical documentation in this manner, the quality system must be reconfigured to prompt the company to perform the appropriate reviews and generate documents at the appropriate times. For example, the way in which the device’s design meets the essential requirements should be reviewed and documented at each stage of the design process, as should the risk analysis. 

Technical files are not dead documents and must be kept up to date. Therefore, files should be configured in such a way that they are as easy as possible to update. Documentation control nightmares result when a company chooses inappropriate ways to generate a file and cross-reference supporting documentation. References should be specific, but manufacturers should also consider how the technical file will be updated if the document is changed. Companies should include within their internal audit program an assessment of the current status of their technical files to ensure that they remain up to date. 

Risk Analysis

European directives are based around the management of risk. Therefore, the risk analysis is the most important document within the technical documentation. Europe puts more emphasis on risk analysis than do other regulated markets, and a simple hazard analysis tends to be too narrow in scope to meet the requirements of the directive. A risk analysis should examine the risks to the end-user; the patient; all third parties, including delivery and service personnel; and the environment. All of these stakeholders would not generally be considered in a traditional hazard analysis conducted for a quality system regulation (QSR). 

When conducting risk analyses, the directive requires that companies extend their scope to a breadth that is proportionate to the risk posed by the device itself. Paradoxically, the directive does not explicitly state that the manufacturer must conduct a risk analysis and manage the risks identified. The only reference made to a risk analysis is that it should be included in the technical documentation. However, the risk analysis is really what the first two essential requirements are designed to accomplish and is a requirement of the directive. 

Risk analysis should be performed and reviewed at each step of the design process. Not only is this sound practice, but it is also good business sense. It enables companies to identify problems and address them early on in the design process. To conduct an effective risk analysis, procedures should be in place from the start to describe how to prepare a technical file, what documents should be generated, and when and by whom they should be reviewed.

Risk analysis is generally one of the weakest areas of technical files. Companies, especially those that are not accustomed to applying a risk analysis technique, do not step back and look at how the product is really used. U.S. companies should consider whether the product would be used in the same setting in Europe. If it would be used in a different manner, would the product generate any additional risks? 

Clinical and laboratory practice can be significantly different in different parts of the world, and companies often consider only their home market, especially when their product is sold through European distributors. Both end-users and company representatives who interact with end-users are often excluded from the risk analysis exercise, as is the company’s marketing department. Input from all of these parties is important to include. 

Marketing and sales claims have increased significance in a regulated environment. Therefore, marketing and sales departments that make the product claims must understand the significance and limitations of the claims they are making, as well as their regulatory implications. European sales and marketing departments that are unfamiliar with operating in a regulated environment should learn to work more closely with their regulatory colleagues. 

Traceability

Figure The route to demonstrating conformity for “self-certifying” devices, namely all devices that are not used for self-testing or listed in Annex II (Click to Enlarge).

The directive requires that the traceability of values assigned to calibrators and control materials be established through the use of reference measurement procedures or reference materials of a higher order. However, in many cases no reference materials or methods have been established.

Under these circumstances, the manufacturer must clearly define its rationale for traceability and why it considers each material and method employed to be appropriate. Companies should also periodically revalidate the traceability of in-house materials used to determine control and calibrator values.

Labeling and Packaging

Labeling requirements are laid out in the essential requirements of the directive and appear to be straightforward. However, once a company attempts to design multilingual labels to be globally compliant, difficulties become apparent. The directives require too much information and that the information be translated into too many languages for the space available on labels and packaging. Solutions to these problems take time and money and sometimes require changes in operations, equipment, and logistics. It is important to start planning for labeling and packaging early on in the CE marking preparation process to allow for the significant lead times that will be required.

Meeting translation requirements is an increasing problem. The number of languages required has increased and is set to increase further with the expansion of the European Union. Companies should establish viable mechanisms for conducting translations and then verifying them. The directive allows individual member states to decide whether they will require the labeling and instruction for use to be in their own languages. The IVD Directive is a European directive, but there is no such thing as European law. The directive becomes law by being transposed into the national legislation of each member state. 
Companies should monitor and examine each national transposition, because they contain distinct details, such as what language to use. National transpositions may also include minor national variations in the requirements or may include additional requirements that are beyond the scope of the directive, such as requirements for the approval of advertising materials. 

The Packaging and Packaging Waste Directive has seen little enforcement. However, many member states have increased their interest in environmental issues. Environmental impact must be considered to be within the scope of the directive. If packaging will be reviewed as part of a company’s CE marking process, then the Packaging and Packaging Waste Directive should be considered in tandem.

Performance Evaluation

Some companies have been accustomed to sending early-stage prototypes to other laboratories within Europe for evaluation. This process is now called the “performance evaluation.” All trials of pre-CE-marked IVDs conducted in Europe must be conducted as performance evaluations, according to the requirements of Annex VIII of the directive. 
One requirement of the evaluation is that companies must demonstrate that they have met all the essential requirements they can, other than those which are under investigation as part of the trial. To accomplish this, companies must generate a technical file and essential requirements checklist early in the product’s life cycle. 

According to the directive, as soon as the device is removed from a manufacturer’s premises for evaluation, the device should either be CE marked or labeled as a device for performance evaluation. The device must also be registered with the competent authority, as described in Article X of the directive. Regardless of the class of the device, notified body approval is not required for devices subject to a performance evaluation.

Vigilance

Vigilance is another area that is not well addressed by many manufacturers. Many companies wrongly assume that only high-risk devices pose the risk of adverse incidents. Adverse incidents that lead to or had the potential to lead to a death or serious deterioration in health must be reported. If death or serious injury did not actually occur, but could have occurred if the incident happened again, the incident must still be reported. 

The reporting requirements and time frames are similar to those for FDA medical device reporting, but are more complex because the report must be made to the country in which the incident took place; it must be made within 10 days for an adverse incident or 30 days for a “near incident.” The report may require that technical information be translated into the country’s national language as part of an adverse-incident investigation.

Companies are not required to hold multilingual technical documentation, but should have a strategy in place preparing them to translate and verify the translation, within a reasonable time, in case the need arises. The directive also states that failures in labeling can give rise to an adverse-incident report. 

If an incident occurs in multiple member states, one will normally act on behalf of the others. The competent authority of the member state will undertake the investigation. The notified body that approved the device should be kept informed, but does not usually become involved in the investigation unless it is requested to do so by the competent authority.

The commission guidance on vigilance is very helpful. However, companies should interpret how the guidance should be applied to their own products and technologies and then communicate this throughout their organization with specific examples. Employees handling complaints should be able to recognise an adverse incident and know what action to take to meet the deadlines for reporting times.

OEMs and Acquisitions 

Sue Spencer is director of Cascade Consulting Ltd. (Aldershot, Hampshire, UK). She can be reached at sue@cascade-consulting.com.

Though companies take a lot of care CE marking their own devices, they can run into difficulties when they purchase either OEM products or acquire other companies with CE marked devices. A regulatory due-diligence audit is essential, even for companies with notified body approvals. Such approvals are based on sampling and are not foolproof. When a company places a product on the market under its name, the company accepts liability for that product. Therefore, the company should verify that the product fully meets the requirements of the directive and that sufficient, appropriate documentation is available to prove compliance.

Conclusion

The CE marking process is an undertaking that will affect the entire organization of a company. It cannot be implemented overnight. If a company has not yet begun CE marking its products, then it may face market exclusion in December. If it has begun, but has not completed the process, then it is important that the company review its project plans to ensure that they are complete. If a company has completed its CE marking, it should remember that CE marking is an ongoing process and technical files must be maintained. 

Copyright ©2003 IVD Technology