14 • ARTICLES WHO’S WHO LEGAL: LIFE SCIENCES LESSONS IN COMPLIANCE – WHAT MEDICAL DEVICES MANUFACTURERS CAN LEARN FROM RECENT EU ENFORCEMENT LANDSCAPE Josefine Sommer and Maurits Lugard, Sidley Austin Medical devices manufacturers are braced for the overhaul of the EU Medical Devices Directives. New Regulations, which are closer to final adoption than ever (although not quite there yet), are expected to clarify the regulation of medical devices in Europe – at least once the delegated and implementing acts have been put in place. As the closing of the first round of trialogue meetings in December did not see a common position between the Council of the European Union (Council) and the European Parliament (Parliament), adoption of the new Regulations is (optimistically) anticipated in mid-2016. The Regulations are expected to apply three years (for medical devices and implantable medical devices) and five years (for in vitro diagnostics medical devices) after adoption. In the meantime, manufacturers can already draw some conclusions from the two interim measures published by the European Commission (Commission) in September 2013: Commission Recommendation 2013/473/EC (Recommendation), which concerns assessments and audits performed on medical devices manufacturers by notified bodies; and Commission Implementing Regulation 920/2013/ EC (Implementing Regulation), which concerns the designation and supervision of notified bodies.

These measures are designed to bridge the gap between the new Regulations and the current Medical Devices Directives, which will continue apply to all medical devices in the EU for some years. Many of the (temporary) requirements and expectations in the interim measures will be carried over into the new Regulations, and manufactures should ensure that these are fully implemented. The interim measures clarify procedures for assessments by notified bodies, placing greater emphasis on unannounced audits, and placing notified bodies under stricter supervision by national competent authorities. The interim measures also confirm a growing demand for more vigilance reporting. Overall, medical devices manufacturers will have to change how they interact with notified bodies and commit more resources to compliance.

It is already fair to say that “business as usual” no longer applies. THE OBJECTIVE OF THE INTERIM MEASURES The interim measures are aimed at bridging a regulatory gap partly uncovered by two events, which contributed to making this objective a priority: the fraud committed by the French company Poly Implant Prothèse in 2010, and the subsequent metal-on-metal hip replacement scandal. These scandals caused patient groups across Europe to demand stricter rules and better oversight of medical devices manufacturers. In an attempt to address the scandals, Commissioner for Health John Dalli, called on EU member states to take “immediate action” in February 2012. The Commission adopted a Joint Action Plan proposing joint actions to EU member states and notified bodies. The Joint Action Plan aimed at ensuring clearer rules, making improvements at national level concerning tightened controls, guaranteeing safety of medical devices and restoring confidence.

The Plan was reinforced by a resolution adopted by Parliament in June 2012. This resolution required the Commission and EU member states to strengthen their cooperation. It also called on the Commission to: take immediate measures aimed at stricter controls on medical devices currently on the market; increase focus on the designation of notified bodies and their activities; and reinforce market surveillance. These developments encouraged the Commission to propose the new Regulations mentioned above, which had already been in the works for several years; and also resulted in the Commission publishing the two interim measures. THE CONTENTS OF THE INTERIM MEASURES The interim measures supplement the currently applicable rules under the Medical Devices Directives, thus covering measures considered necessary to ensure safety for medical devices until the intended changes to EU medical devices legislation brought by the new Regulations are adopted (and apply). The first measure, the Recommendation, clarifies the assessments and audits that notified bodies should perform on medical devices manufacturers. It outlines the “suggested” procedures for conducting product assessments and quality system assessments and sets out the “proposed” requirements for both manufacturers and notified bodies in the performance of unannounced audits.

The second measure, the Implementing Regulation, concerns the designation and supervision of notified bodies. The measure is addressed to EU member states and supplements the designation criteria set out in the current Medical Devices Directives and in the guidance documents intended to assist stakeholders in their implementation (MEDDEVs). The Recommendation is presented as “providing general guidelines” on assessments and audits, and makes it clear that it “does not create any new rights or EDITORIAL POLICY AND SELECTION CRITERIA: NOMINEES HAVE BEEN SELECTED BASED UPON COMPREHENSIVE, INDEPENDENT SURVEY WORK WITH BOTH GENERAL COUNSEL AND LIFE SCIENCES LAWYERS IN PRIVATE PRACTICE WORLDWIDE. ONLY SPECIALISTS WHO HAVE MET INDEPENDENT INTERNATIONAL RESEARCH CRITERIA ARE LISTED .

www.whoswholegal.com obligations”. Nevertheless, it carries strong undertones of clearly expected practices to be followed by notified bodies – if not mandatory requirements. The Recommendation reinforces the surveillance and audit mandates that notified bodies already enjoy under the current Medical Devices Directives. For example, notified bodies are required to audit – and approve – the quality system of a manufacturer to ensure it meets the requirements set out in the directives. Moreover, the directives allow notified bodies – in duly substantiated cases – to inspect the premises of the manufacturer’s supplier and/or subcontractor when assessing the quality systems of the manufacturer. As part of their surveillance responsibility, the Directives also require notified bodies to periodically carry out appropriate inspections and evaluations to ensure that a manufacturer complies with the approved quality system. Notified bodies are also empowered – not required – to conduct unannounced visits to the manufacturer to verify that the quality system is applied correctly. In this regard, the Recommendation emphasises the mandate to conduct unannounced audits (see the detailed guidelines in Annex III of the Recommendation).

Interestingly, whereas notified bodies “may” perform unannounced visits according to the current directives, they “should” perform such audits according to the Recommendation. And unlike the directives, which do not specify a rate for (voluntary) unannounced audits, the Recommendation states that these audits should take place “at least once every third year” (with increased frequency for high-risk devices and device types with a high frequency of non-compliance, and if non-conformities are suspected). The Parliament had actually gone even further in its Resolution of 14 June 2012, requesting unannounced audits by notified bodies of the whole supply chain and of the operations of certain suppliers “at least once per year”. In surveying that the manufacturer complies with its obligations, the Recommendation also “advises” notified bodies – under certain conditions – to conduct unannounced audits of the ARTICLES • 15 manufacturer’s critical subcontractors or crucial suppliers. This is the first time the Commission has published such an instruction related to vigilance surveillance. The second measure, the Implementing Regulation, implements rules and requirements other than those set out in the Directives related to the designation and supervision of notified bodies.

For example, it requires EU member states to carry out surveillance and monitoring of notified bodies at certain intervals to ensure that they continuously comply with applicable requirements (if not, the designation of the notified bodies must be withdrawn). The Implementing Regulation also requires EU member states to (re-) designate a notified body only after a joint assessment conducted with experts from the Commission and other EU member states. LESSONS LEARNED FROM THE INTERIM MEASURES The interim measures, and their implementation by both notified bodies and EU member states, have already had noticeable effects on the medical devices landscape in Europe. First, manufacturers are seeing more unannounced audits – which may even become routine. Moreover, they are coming under increased pressure to step up their vigilance reporting. Third, notified bodies are now more strictly supervised by national competent authorities, which leads to additional pressure on manufacturers.

Finally, the Commission and EU member states have in recent years been cooperating more closely. Unannounced audits Since the publication of the Commission’s Recommendation in 2013, the rate of unannounced audits has been increasing significantly. For example, according to its own records, the notified body TÜV SÜD carried out roughly 400 unannounced audits worldwide between March 2014 and September 2015. This is a significant increase from previous practices by many notified bodies who, prior to the Commission’s interim measure, did not conduct unannounced audits across all CE certified manufacturers on a routine basis. Pressure on manufacturers for increased vigilance reporting Manufacturers are increasingly subject to pressure from national competent authorities with respect to specific issues, particularly vigilance reporting.

One reason appears to be a general concern that the medical device industry has been under-reporting for many years. With some exceptions, the general trend of late seems to be that national competent authorities have been requesting increased incident and trend reporting – in both large and small EU member states. In other words, national competent authorities often expect to see a significant increase in incidentreporting, and also expect this change to be implemented swiftly. These types of requirements will frequently come as an unexpected surprise for manufacturers, as previous interactions and communications with notified bodies very often have not revealed any significant issues. Another focus has been on certificates. In the past few years, there have been several cases of notified bodies requesting additional clinical evidence for already certified devices, or challenging the classification of a device already on the market. Super vision of notified bodies Notified bodies are now under stricter supervision by national competent authorities, particularly due to the mandatory joint audits for (re-)designations required by the Implementing Regulation.

This has resulted in a drop in the number of designated notified bodies. By the end of 2015, the number of notified bodies accredited to work under the Medical Devices Directive had decreased from 73 to 62 in one year. The number of notified bodies accredited to work under the Active Implantable Medical Devices Directive decreased from 18 in 2014 to 17 in 2015, and the number of notified bodies accredited to work on in vitro diagnostics medical devices decreased from 26 in 2014 to 23 in 2015.

Most recently, the low number of notified bodies, combined with additional requirements, has resulted in a significant increase in the workload for notified bodies. Team NB, the European EDITORIAL POLICY AND SELECTION CRITERIA: NOMINEES HAVE BEEN SELECTED BASED UPON COMPREHENSIVE, INDEPENDENT SURVEY WORK WITH BOTH GENERAL COUNSEL AND LIFE SCIENCES LAWYERS IN PRIVATE PRACTICE WORLDWIDE. ONLY SPECIALISTS WHO HAVE MET INDEPENDENT INTERNATIONAL RESEARCH CRITERIA ARE LISTED .

16 • ARTICLES WHO’S WHO LEGAL: LIFE SCIENCES Association for Medical Devices of Notified Bodies, has therefore requested that legislators grant the industry a fiveyear transition period before requirements relating to notified bodies under the new Regulations will apply. More cooperation between EU member states and the Commission At EU member state level, increased focus on surveillance has resulted in more cooperation and sharing of information. For example, the frequency with which information has been disseminated in the form of national competent authority reports (on incidents evaluated) increased significantly in 2013 and 2014, compared to previous years. It is expected that 2015 will have seen similar, if not higher, levels of action. Moreover, monthly telephone conferences between the Commission and EU member states are taking place to coordinate vigilance matters. These teleconferences also aim at identifying trends and safety signals of concern. The increased coordination and communication between EU member states has significantly increased the number of matters in which national competent authorities can be involved. In some cases, and especially in vigilance reporting, certain manufacturers have been “selected” for special reviews by a so-called task force formed by EU member states.

Such a task force is composed of several national competent authorities with specific interests in a single manufacturer – for example, based on the location of the manufacturer or its main markets. One lead member of the task force coordinates questions and collects information – for example, on the manufacturer’s complaint-handling approach, risk assessment and justification for keeping certain products on the market. Information is provided to the other members of the task force.

This practice has to some extent lessened the burden for manufacturers, who primarily communicate with the lead member rather than with several EU member states concurrently. However, the pressure on manufacturers interacting with a task force is intense and requires the allocation of significant resources. HOW MEDICAL DEVICES MANUFACTURERS SHOULD REACT TO THE NEW ENFORCEMENT LANDSCAPE The most important lesson to learn from recent events is that the current regulatory enforcement landscape requires a different approach towards both national competent authorities (which have become significantly more interested in vigilance reporting) and notified bodies (which are eager to show that they are up to their task). Companies should adopt a communication approach towards notified bodies that largely resembles how they interact with national competent authorities. Previously, manufacturers might have considered notified bodies as a sophisticated type of “service provider”. This is no longer the case, with notified bodies increasingly taking the de facto role of a regulator, and the “practical arrangements” that were common between manufacturers and notified bodies for many years are no longer acceptable.

This is partly a result of national competent authorities being sceptical that the industry generally does not comply with applicable vigilance requirements, and thus leaning on notified bodies. This also means that an otherwise (somewhat) valid complaint from an individual company that it was just following general industry practices is no longer compelling – if it ever was. Therefore, manufacturers should consider changing their previous approach both to general interaction with notified bodies and to how quickly they respond to specific requests. Going forward, manufacturers will need to build more trust, practice more diplomacy, and commit more resources to compliance. Moreover, communication with notified bodies now requires diligence and a healthy level of transparency.

A matter may otherwise unnecessarily escalate to a level it is difficult to come back from (eg, the withdrawal of certificates). In particular, it may often help a manufacturer to place information in an appropriate context, eg, to contextualise vigilance reporting for high-volume products, or to highlight the benefit-risk assessment of a particular product. In vigilance-reporting, companies that have recently engaged with either national competent authorities or notified bodies will know that building trust is key to ensuring a successful outcome from any interaction. However, it takes time to build such trust, and it requires the company to honour any commitments made (however small). Being ahead of the curve, and ensuring that potential gaps are identified and addressed proactively, will often help to gain that crucial trust. Companies may need to commit more resources to compliance in order to address the concerns mentioned above. Staff may need additional training and support to avoid mistakes when under short-term (intense) pressure to answer questions requiring input from multiple departments, or ongoing pressure to increase reporting results and respond to additional questions.

Finally, external advice may help ensure an appropriate balance between providing relevant information and protecting the company’s interests. EDITORIAL POLICY AND SELECTION CRITERIA: NOMINEES HAVE BEEN SELECTED BASED UPON COMPREHENSIVE, INDEPENDENT SURVEY WORK WITH BOTH GENERAL COUNSEL AND LIFE SCIENCES LAWYERS IN PRIVATE PRACTICE WORLDWIDE. ONLY SPECIALISTS WHO HAVE MET INDEPENDENT INTERNATIONAL RESEARCH CRITERIA ARE LISTED .