MedTech Intelligence – Read More

ASK THE EXPERT

Kevin is an experienced global level manager/director of design assurance and research & development in the bio medical field for hardware/software systems and associated disposable product lines. He believes strongly in innovation and superior design winning the day, and appreciates advancements in medicine on every front, from process improvement to design enhancement.

Notified bodies receive numerous questions from legal manufacturers during technical assessments. We cannot always answer them for individual legal manufacturers because this would constitute consultation. However, the same questions distilled to their basics and answered for everyone is permitted as guidance to the medical device community. With that in mind, below are answers to four of our top questions.

Do I need to present evidence of lifetime and transport for software only medical devices? It’s not physical after all. How would I even prove it?

Yes, compliance is required to demonstrate GSPR 6, 7 or 17.1 of Regulation (EU) 2017/745 and/or ER 4, 5 of the UK Medical Devices Regulations 2002 for UKCA marking. Software ages, like all other items, not just in the sense of hardware and bad sectors, which would be outside the SaMD scope, but in the sense of compatibility. What platforms can it run on? How often is software around it upgraded until it is no longer usable? These items contribute to software lifetime. When we consider transit, think of it as the question, “How can I demonstrate the software which was verified and validated, is the same as the software which reaches my user, not just now but in two, three, five or ten years?” Software can be obtained by download, a combination of physical media and snail mail, or even legal manufacturer installation. How does your configuration management and software maintenance plan guarantee that what you tested, and think is in their hands arrives and stays in working order the way you intended? These are the real answers to GSPRs 6, 7, 17.1 and ERs 4 and 5. A notified body will check for sufficient evidence that these are met for all devices, including Software as a medical device so lifetime must be declared, and evidence of meeting it such as projected lifetime of surrounding SW and related HW must be reasonably discussed. Similarly, how software is handled for transport or delivery to the end user must be sufficiently controlled that it is unchanged by the delivery method, with demonstrated evidence.

Do I need to declare AI trained SW? It’s just another internal developer, and I don’t declare those.

Yes, artificial intelligence which is present in the device, as SaMD or embedded, or software which was trained by AI and then locked (i.e. static AI), must be declared. Discovery of an AI trained module of software part way through an assessment will have negative impact on assessment time and may require a new quote to cover the relevant AI background. More importantly, Regulation (EU) 2024/1689, the EU AI act, enters into force for high-risk AI systems with obligations applying (e.g. for healthcare) on August 1 of 2026. What are the ramifications? At a minimum expect to be able to answer questions about training sets and validation sets and both their representations to real world. What bias may exist in these data sets? Were the data sets statistically sound across all indications and populations? What risks are associated with the artificial intelligence trained or derived software? Is the software able to grow and self-modify (i.e. dynamic or constrained AI)? If so, how often is it revalidated? What is the evidence that the device’s training and validation represents state of the art? All aspects of the artificial intelligence must be reviewed by the notified body. In addition to the preclinical aspects, be aware that clinical evaluation and assessment is impacted by the presence of AI. For example, AI trained or based software will, in the vast majority of cases, be unable to demonstrate equivalence.

My software as a medical device is used outside the normal live stream of the clinical workflow. Do I need clinical data?

Almost certainly, yes. Article 61(10) for preclinical data only, is rarely possible, requires robust justification, and is largely limited to devices lacking direct clinical benefit where clinical data is not possible or example unethical. Further, under MDR Annex XIV Part B, and MEDDEV 2.12/2, manufacturers are expected to continuously collect clinical safety and performance data after reaching the market, and as such, even for those devices that fall under Article 61(10), that is not a viable permanent clinical evaluation route. The ability to initially dismiss the requirement for clinical data depends on the clinical claims made by the device, and the related specific and measurable performance and safety which support these benefits. It is commonly thought that SaMD does not need clinical data, but this is not true. However, there are different kinds of clinical data which may be very useful to SaMD devices such as retrospective data sets, for devices which are used outside of the common workflow of the surgical procedure, in combination with robust usability in the clinical context verifying the device is not detrimental to the clinical workflow. Retrospective data collected during a procedure which sufficiently represents data which would be fed to the SaMD device during real use, may then be used to assess the performance of the SaMD device. These data must be clinical in nature, and the use of the device must be in alignment with the intended use statements and the intended purpose. If the device is used in between other clinical activity steps of a surgical procedure such retrospective data cannot cover all aspects of the device use, and additional clinical evidence would be required such as but not limited to clinical investigations, literature or possibly equivalence. Furthermore, the ethical collection and use of retrospective data is still required to be thoroughly supported and assessed in the clinical documentation.

How do you stay on top of MDCG changes, changes to standards, and new regulations? It seems like there is so much to know and stay on top of.

There is a lot for a legal manufacturer to stay aware of in the constantly moving space of MDR and UKCA compliance. CE marking a device caries a presumption of conformity with other relevant EU regulations and directives. This may include legislations covering such topics as AI, PPE, RED, Pressure, LI Batteries, toys, REACH, RoHS, radioactive waste, machinery, etc.

• List of MDCG endorsed guidance https://health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en Med-Tech Insights, or RAPS often issue newsletters about MDCG updates.
• You can create automatic alerts for selected MDCGs on the EU website as well: Predefined RSS alerts – EUR-Lex.

Standards are more complex, because standards are updated by international bodies (e.g., IEC, ISO), but adopted and harmonized at national or EU levels, and are not automatically binding unless cited in regulation. There are different places you can go to stay up to date on standards and depending on your device you may need to visit more than one of them:

• European standards are considered harmonized upon being published in the Official Journal of the European Union: https://single-market-economy.ec.europa.eu/single-market/goods/european-standards/harmonised-standards/medical-devices_en
• For UKCA go to their Guidance Designated standards medical devices for a full list of applied standards: Designated standards: medical devices – GOV.UK
• IEC Webstore Alert Service — set up free alerts for any IEC standard, being aware that unless the standards is harmonized, each specific country may have their own version and requirements to address. See MDCG 2021-5 guidelines for manufacturers to declare what standards, guidances, and legislations constitute state of the art.
• ISO Update Alerts — for tracking ISO standard revisions
• Subscription platforms like IHS Markit, Techstreet, SAI Global, and other similar products offer alerts and document management for relevant and changing standards, guidances, and legislations based on the territories into which you plan to sell
• CEN/CENELEC notification services for harmonized standards under EU MDR/IVDR
• FDA Recognized Consensus Standards Database for those targeting the U.S. market
• The EU “Blue Guide” gives a basic outline of the regulatory journey for placing products on the market in the EU. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.C_.2022.247.01.0001.01.ENG

The post 4 FAQs to Notified Bodies appeared first on MedTech Intelligence.