Ever since the EU Medical Device Regulation (MDR) became fully applicable on May 26, 2021, it has introduced a stringent conformity assessment process to ensure device safety and performance, which can be particularly challenging for manufacturers, requiring rigorous review by Notified Bodies, often leading to delays, termination or refusal of the certification.

Submitted Applications in the Long Process

Although the entire MDR conformity assessment process is not consistently published as a single, straightforward statistic by official EU bodies, the extent of the issue can be examined through various reports and surveys that provide insights into the challenges, delays, and relative outcomes of conformity assessments by notified bodies.

One report worth noting is the MedTech Europe survey, which examines conformity assessment and certification figures up to June 2023. According to the study, 13,177 MDR applications and 3,899 MDR certificates have been issued to date, leaving the status of almost 10,000 MDR applications unanswered. If one were to oversimplify the odds, this would imply an issuance rate of approximately 29.6% of applications submitted to that date, leaving a whopping 70.4% of applications without certification.

Light on the matter sheds a Team-NB survey that gathered data from 35 Notified Bodies, showing an increase in MDR applications from 1,661 in 2020 to 14,539 in 2023. Despite the surge in applications, the number of issued certificates increased only from 180 for the same period in 2020 to 4,873 in 2023, demonstrating figures similar to those reported in the MedTech Europe survey.

For IVDR, the numbers are significantly lower. However, the trend is quite similar, as 1565 applications in 2023 resulted in 754 IVD certifications, highlighting an approximately 48.2% issuance rate for IVDR applications submitted to that date.

These numbers indicate that while applications are surging, a significant proportion of the MDR conformity assessments are either still ongoing, significantly delayed or result in termination. Regarding the reasons behind the relatively low rate of certificates issued compared to the total number of applications submitted, the process is complex and often requires multiple iterations and resubmissions.

Termination or Refusal of EU MDR Certification

Unknows to many, the conformity assessment process for medical devices under the EU MDR can also be terminated or result in a refusal of certification due to various, very repetitive but avoidable, common findings typically stemming from a manufacturer’s inability to demonstrate full compliance with the General Safety and Performance Requirements (GSPRs) and the stringent demands of the MDR/IVDR.

Delving into the details of critical areas where manufacturers frequently encounter challenges leading to non-compliance with the conformity assessment process under the Medical Device Regulation (MDR).

Insufficient or Non-Compliant Technical Documentation

The primary purpose of the technical documentation is to demonstrate that a device conforms to the General Safety and Performance Requirements (GSPRs) throughout its entire lifecycle, and its deficiencies, in particular, signal a fundamental lack of control or understanding of the device and its compliance with regulations.

Therefore, the technical documentation must be clear, organised, readily searchable, and unambiguous, and it must comprehensively reflect the device’s design, manufacturing, performance, and safety as stated in the EU MDR requirements.

Let’s break down some of the common findings that lead to non-compliance in technical documentation.

General Requirements and Structure of the Technical Documentation

• Lack of Clarity and Document Organisation:
  • Finding: The documentation is unstructured, lacking a logical flow and is challenging to navigate for the reviewer. The information may contain contradictory information across different sections of the technical documentation.
  • Impact: NBs are unable to efficiently review and verify compliance, which may result in significant delays or, in the worst-case scenario, the immediate termination of the application.
• Incomplete or Missing Information:
  • Finding: Entire sections mandated by Annexe II are absent, or critical details within sections are missing altogether.
  • Impact: Fundamental gaps in the technical documentation mean, in essence, that the manufacturer hasn’t provided the necessary evidence for assessment.

Device Description and Specification, including Variants and Accessories

• Inadequate Device Description:
  • Finding: The description remains too generic, lacks the necessary detail on the device’s specific mechanism of action, intended purpose, or even target patient population.
  • Impact: The NB cannot fully understand or review the device or its intended use, hindering subsequent assessments.
• Undefined Accessories/Variants:
  • Finding: Accessories or variants that are part of the device family are not clearly identified, their specific functions are not detailed, or their conformity is not adequately addressed within the primary device’s documentation.
  • Impact: Each component or variation must demonstrate compliance; a lack of specific documentation for these elements constitutes a significant deficiency.

Information to be Supplied by the Manufacturer

• Non-Compliant Labelling and Instructions for Use (IFU):
  • Finding: The labelling on the device, packaging, or IFU does not meet all the specific requirements of MDR Annexe I. Crucially, the IFU may lack sufficient detail for safe and effective use or fail to include all necessary safety information for users and patients.
  • Impact: Direct breach of GSPRs relating to user safety and information provision.

Design and Manufacturing Information

• Insufficient Design Details:
  • Finding: Lack of comprehensive design specifications, drawings, calculations, or descriptions of the design phases. Design inputs, outputs, verification, and validation activities are not adequately documented.
  • Impact: Prevents the NB from assessing the safety and performance aspects designed into the device.
• Inadequate Manufacturing Process Documentation:
  • Finding: Manufacturing flowcharts are too high-level, critical manufacturing processes are not adequately validated, or the validation reports are incomplete or outdated. Information on essential suppliers and their control is missing.
  • Impact: The NB cannot verify that the device can be consistently manufactured to meet its specifications and GSPRs.

General Safety and Performance Requirements (GSPRs)

• Incomplete GSPR Checklist:
  • Finding: The manufacturer’s GSPR checklist is incomplete, lacks justification for “not applicable” sections, or provides generic statements without specific references to supporting evidence within the technical documentation.
  • Impact: The GSPR checklist is the roadmap to compliance; its inadequacy indicates a systemic failure to demonstrate how the device meets all relevant safety and performance requirements.
• Missing or Inadequate Justifications:
  • Finding: Where specific GSPRs are claimed as “not applicable,” the rationale provided is weak or unsubstantiated.
  • Impact: Notified Bodies cannot accept unsupported claims, demanding evidence for all relevant GSPRs.

Benefit-Risk Analysis and Risk Management

• Immature Risk Management System:
  • Finding: The risk management file is not a “living document” and has not been updated throughout the device’s lifecycle. Risk analysis is superficial, critical hazards are missed, or the effectiveness of risk control measures is not adequately demonstrated or verified.
  • Impact: A robust risk management system is fundamental to patient safety. Significant deficiencies in this area are often showstoppers.
• Unacceptable Benefit-Risk Ratio Justification:
  • Finding: Even after risk mitigation, the residual risks are deemed too high relative to the clinical benefits, and the justification provided by the manufacturer is not convincing or evidence-based.
  • Impact: Direct failure to meet a core GSPR, leading to refusal.

Product Verification and Validation

• Incomplete or Inadequate Test Reports:
  • Finding: Test reports are missing, outdated, or do not adhere to relevant harmonised standards. Test protocols are not sufficiently detailed, or results are not clearly presented and analysed.
  • Impact: The NB cannot verify that the device meets its specified performance criteria and safety requirements.
• Lack of Post-Market Surveillance (PMS) Plan:
  • Finding: The PMS plan is generic, lacks specific methods for data collection and analysis, or doesn’t include a Post-Market Clinical Follow-up (PMCF) plan when required. The Periodic Safety Update Report (PSUR) is missing or incomplete for higher-risk devices.
  • Impact: The manufacturer fails to demonstrate a proactive approach to monitoring the device’s safety and performance once on the market, a key MDR requirement.

In essence, an NB’s findings of “Insufficient or Non-Compliant Technical Documentation” mean that the manufacturer has failed to provide compelling, complete, and verifiable evidence that their medical device meets the stringent safety and performance standards of the MDR that often necessitates a complete resubmission or significant remediation, which, if not adequately addressed, will lead to the termination of the assessment process.

Deficiencies in Clinical Evaluation and Evidence

The clinical evaluation is a continuous process of collecting, appraising, and analysing clinical data pertaining to a device to verify its clinical safety and performance, including its clinical benefits, when used as intended by the manufacturer.

Clinical evaluation must demonstrate that the device achieves its intended purpose without compromising the safety and health of patients and users, and that any risks are acceptable when weighed against the benefits.

Inadequate Clinical Evaluation Plan (CEP)

• Finding: The CEP, which defines the scope and methodology of the clinical evaluation, is generic, lacks specific objectives, or does not clearly define the criteria for demonstrating safety and performance. It may fail to specify the relevant GSPRs to be addressed by clinical data.
• Impact: Inadequately defined CEP indicates a lack of a systematic approach to clinical evaluation, making it difficult for the Notified Body (NB) to ascertain the validity and sufficiency of the subsequent clinical data.

Insufficient or Non-Compliant Clinical Evaluation Report (CER)

• Finding: The CER, which documents the results of the clinical evaluation, is incomplete, lacks a critical appraisal of the data, or fails to draw clear conclusions regarding the device’s safety and performance in relation to its intended purpose and target population.
• Impact: The CER is the primary output of the clinical evaluation process. Its deficiencies mean the manufacturer has not adequately demonstrated the clinical safety and performance of the device based on collected data.

Insufficient Clinical Data

• Finding:
  • Quantity: There isn’t enough clinical data (from clinical investigations, literature, or post-market experience) to adequately address all GSPRs or cover the entire intended use and target population.
  • Quality: The collected data is not robust, reliable, or statistically sound (e.g., studies with poor methodology, high risk of bias, or inadequate statistical power).
  • Relevance: The clinical data does not directly pertain to the specific device in question, its intended use, or the claimed clinical benefits, which is particularly an issue when relying on literature data for similar devices.
• Impact: The core claim of clinical safety and performance cannot be substantiated, as the underlying evidence is too weak or incomplete.

Inappropriate or Undocumented Literature Search and Appraisal

• Finding: The literature search strategy for the clinical evaluation lacks systematicness, comprehensiveness, and reproducibility. Relevant scientific databases may be omitted, or the search terms may be too narrow. The appraisal of identified literature is superficial, biased, or lacks a critical assessment of the methodology, results, and limitations of the studies.
• Impact: The NB cannot verify that the manufacturer has considered all available scientific evidence, leading to doubts about the completeness and objectivity of the clinical evaluation.

Flawed Equivalence Claims for Devices Without Their Own Clinical Data

• Finding: Manufacturers often try to demonstrate conformity by claiming equivalence to a legally marketed device for which sufficient clinical data exists. However, the MDR sets out stringent criteria for demonstrating equivalence in terms of:
  • Clinical characteristics: (e.g., same intended purpose, similar clinical effects, same target population).
  • Technical characteristics: (e.g., similar design, materials, processing methods).
  • Biological characteristics: (e.g., similar biocompatibility).
  • Scientific justification for differences: Any differences must be thoroughly documented and demonstrated not to affect clinical safety and performance adversely.
  • Inadequate access to data for equivalent devices: Manufacturers often struggle to obtain sufficient technical and clinical data for their claimed equivalent devices, particularly for competitor products.
• Impact: Failure to demonstrate robust equivalence means the manufacturer must generate clinical data for their own device, often through clinical investigations, which is a costly and time-consuming process, and frequently leads to termination or withdrawal if the manufacturer is not prepared for this.

Lack of a Robust Post-Market Clinical Follow-up (PMCF) Plan and Report

• Finding: The PMCF plan is generic, lacks specific objectives to proactively collect and evaluate clinical data after the device is placed on the market, or fails to define adequate methods (e.g., PMCF studies, registries, user feedback analysis). The PMCF Evaluation Report (which assesses the results of PMCF activities) is missing or insufficient.
• Impact: PMCF is a continuous process linked to clinical evaluation. A weak PMCF indicates that the manufacturer is not adequately monitoring the device’s long-term safety and performance in real-world use, which is a mandatory element of the MDR’s lifecycle approach.

Failure to Address Residual Risks in Clinical Evaluation

• Finding: While the risk management process identifies and mitigates risks, the clinical evaluation must confirm that the identified clinical benefits outweigh the residual risks and that these risks are acceptable. A common finding is that the CER does not adequately address the clinical implications of residual risks or justify the acceptability of the benefit-to-risk ratio based on clinical data.
• Impact: Clinical safety cannot be definitively established if the critical balance between benefits and risks is not clearly and robustly demonstrated through clinical evidence.

In summary, deficiencies in clinical evaluation and evidence often stem from an underestimation of the MDR’s strict requirements for clinical data. Manufacturers must move beyond simply compiling existing data to actively planning, collecting, and critically appraising clinical evidence that directly supports all claims of safety, performance, and clinical benefit for their specific device. Failures in this area represent a fundamental barrier to market access under the MDR.

Non-Compliance of the Quality Management System (QMS)

A robust and MDR-compliant Quality Management System (QMS) is foundational for all medical device manufacturers. Annexe IX of the MDR outlines the requirements for a QMS, emphasising a lifecycle approach to product quality and safety. A Notified Body (NB) will meticulously audit the manufacturer’s QMS to ensure it meets these stringent requirements.

QMS Not Fully Aligned with MDR/IVDR Requirements

• Finding: The QMS procedures and documentation are still primarily based on the old Medical Device Directives (MDD) or lack integration of new MDR requirements, which include, for instance, insufficient procedures for post-market surveillance (PMS), UDI management, clinical evaluation updates, or the person responsible for regulatory compliance (PRRC) duties.
• Impact: A QMS that doesn’t fully reflect the MDR’s scope and requirements suggests a systemic failure to manage all aspects of compliance, indicating that the device’s conformity cannot be consistently assured.

Inadequate Process and Software Validations

• Finding: Critical manufacturing processes are not adequately validated, or the validation reports are outdated, incomplete, or do not demonstrate repeatable and reproducible results. Similarly, software used in the QMS or as a component of the medical device itself (e.g., embedded software, standalone software) is not properly validated according to relevant standards.
• Impact: Unvalidated processes or software pose direct risks to product quality, safety, and performance, raising serious concerns for the NB.

Deficiencies in Supplier and Subcontractor Control

• Finding: The QMS lacks robust procedures for evaluating, selecting, monitoring, and controlling suppliers of critical components, materials, or services. There might be insufficient documented evidence of supplier qualifications or performance reviews.
• Impact: Poor supplier control means the manufacturer cannot guarantee the quality of incoming materials or outsourced processes, which directly impacts the conformity of the final device.

Ineffective Internal Audits and Management Reviews

• Finding: Internal audits are not conducted regularly, do not cover all relevant QMS processes, or fail to identify significant non-conformities. Management reviews are often superficial, lack measurable objectives, or fail to lead to effective corrective actions.
• Impact: Insufficient internal audit mechanisms signify that the manufacturer’s QMS is not effectively identifying and addressing its shortcomings, undermining confidence in its continuous improvement.

Insufficient Resources and Competence

• Finding: The manufacturer fails to demonstrate that it has sufficiently qualified personnel with the necessary expertise for all QMS processes, design activities, clinical evaluation, and regulatory compliance.
• Impact: A lack of competent personnel directly impacts the ability to design, manufacture, and ensure the conformity of devices.

Risk Management File Deficiencies

Risk management is a continuous process that must be integrated throughout the entire lifecycle of a medical device, from conception to post-market activities.

Annexe I (General Safety and Performance Requirements – GSPRs), Sections 1-8 of the MDR, places a strong emphasis on risk management. The manufacturer must establish, implement, document, and maintain a risk management system.

Non-Compliance with ISO 14971

• Finding: While not directly cited in the MDR as a mandatory standard, ISO 14971 is the globally recognised standard for risk management for medical devices. One of the recurring findings is that the manufacturer’s risk management process deviates significantly from the principles outlined in ISO 14971, resulting in inadequate risk identification, estimation, evaluation, control, and post-market monitoring.
• Impact: Failure to adhere to a recognised and robust risk management standard means the device’s risks may not be systematically identified, assessed, or controlled, compromising patient and user safety.

Inadequate Scope of Risk Analysis

• Finding: The risk management process does not cover all relevant aspects, such as risks arising from transport, storage, installation, intended use, foreseeable misuse, interaction with other devices, or cybersecurity threats (for devices with software).
• Impact: Undiscovered or unassessed risks can lead to patient harm and compromise the device’s safety profile.

Insufficient Risk Control Measures and Verification

• Finding: Identified risks are not mitigated according to the hierarchy of control (inherent safety by design, protective measures, information for safety). The effectiveness of implemented risk control measures is not adequately verified or documented.
• Impact: Risks are identified but not effectively managed, leaving residual risks that may be unacceptable.

Unacceptable Benefit-Risk Ratio Justification

• Finding: Even after all reasonable risk control measures are applied, the manufacturer fails to demonstrate that the clinical benefits of the device outweigh the residual risks, or that the residual risks are acceptable based on the state of the art, which requires a strong connection to clinical evaluation data.
• Impact: If the benefit-risk ratio is deemed unfavourable or insufficiently justified, the device cannot be considered safe for its intended purpose.

Risk Management File Not “Living”

• Finding: The risk management file is treated as a static document, not continuously updated with information from design changes, production non-conformities, PMS data (e.g., complaints, vigilance reports), or new scientific knowledge.
• Impact: A risk management file that lacks continuous iteration, as per R&D, fails to adequately address the actual risk profile of the device, posing ongoing safety concerns.

Lack of Notified Body Agreement or Timeliness

While not a “finding” directly related to product quality or QMS, the administrative and procedural aspects of engaging with a Notified Body (NB) are crucial. Failure in this area can unilaterally terminate the conformity assessment process before detailed technical review even begins.

Failure to Secure a Contract with a Designated Notified Body

• Finding: For most moderate to high-risk medical devices (Class Im sterile, Is, Ir, IIa, IIb, III) and all IVDs beyond Class A (for IVDs, Class B, C, D), manufacturers are legally required to involve a Notified Body for their conformity assessment. A manufacturer may fail to secure a contract with an NB due to:
  • Limited NB Capacity: There is a limited number of designated NBs under the MDR, leading to long waiting lists and NBs prioritising existing clients or specific device types.
  • NB Reluctance: An NB may decline to offer a contract if the manufacturer’s initial documentation or QMS maturity indicates a very high risk of non-compliance, requiring extensive unforeseen work.
  • Scope Mismatch: The manufacturer’s device type falls outside the specific scope for which an NB is designated.
• Impact: Without a valid contract with a designated NB, the manufacturer cannot proceed with the mandatory conformity assessment and therefore cannot place their device on the EU market (unless it’s a legacy device under specific transitional provisions).

Failure to Provide Documentation Within Agreed Timelines

• Finding: The NB always sets deadlines for the submission of technical documentation, responses to non-conformity reports, and requests for additional information once it begins the conformity assessment. Manufacturers sometimes fail to meet these deadlines due to their resource constraints, unexpected technical hurdles, or insufficient project management.
• Impact: NBs follow strict internal timelines and external oversight requirements set by the MDR. Repeated missed deadlines can lead to the NB putting the assessment on hold indefinitely or terminating the contract, forcing the manufacturer to restart the process (potentially with another NB), which may result in significant delays and additional costs.

“Significant Changes” to Legacy Devices

The MDR includes transitional provisions to allow devices certified under the old MDD/AIMDD to remain on the market for a limited period, provided they meet certain conditions. A critical condition is that these “legacy devices” must not undergo “significant changes” to their design or intended purpose.

Unidentified or Incorrectly Assessed Significant Changes

• Finding: Manufacturers may implement changes to their legacy devices (e.g., minor design tweaks, material substitutions, manufacturing process changes, updates to software, or expansions of the intended purpose) without correctly assessing whether these constitute “significant changes” under MDR guidance. If a change is deemed “significant” by an NB or a national competent authority:
  • The device immediately loses its legacy status.
  • It must then fully comply with the MDR, including a new conformity assessment, before it can be placed on the market.
• Impact: Many manufacturers, especially SMEs, are not adequately prepared for immediate and complete MDR conformity assessment, notorious for its high complexity and resource-intensiveness, often leading to the decision to withdraw the device from the market rather than pursue full MDR certification on short notice, effectively terminating its market presence.

The Economic Considerations

While not a direct “finding” of non-compliance, economic viability is a crucial underlying factor that often drives a manufacturer’s decision to terminate or withdraw from the conformity assessment process, which has become particularly relevant with the increased costs and complexities introduced by the MDR.

Cost of Compliance Outweighs Product Profitability

• Finding: Manufacturers (especially SMEs with a broad portfolio of older, lower-revenue products) analyse the projected costs of achieving and maintaining MDR compliance versus the expected revenue or profit margin for a specific device. These costs include:
  • Notified Body fees (initial certification, surveillance audits, annual fees).
  • Internal resource allocation (personnel, training, QMS upgrades).
  • External consultancy fees (for documentation, clinical evaluation, and regulatory strategy).
  • Costs of clinical investigations, if required.
  • Costs associated with UDI implementation and EUDAMED data entry.
• Impact: If the cost-benefit analysis is unfavourable, the manufacturer may strategically decide to discontinue the product, terminate its conformity assessment, or not seek MDR certification, which in fact is a business decision driven by the regulatory burden rather than a technical non-conformity, but it results in the device’s unavailability in the market.

Market Prioritisation and Portfolio Rationalisation

• Finding: Manufacturers may choose to prioritise their core, high-revenue, or strategically important products for MDR certification when faced with limited resources and the high demands of the MDR.
• Impact: Devices that are deemed less critical to the company’s long-term strategy, have low sales volumes, or serve niche markets may be deprioritised and ultimately withdrawn from the market. A rationalisation that leads to the termination of their conformity assessment processes.