When Spreadsheets Stop Being Defensible for EU Medical Device Compliance

The landscape of medical device regulation in the European Union has become increasingly complex under Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR). Distributors and importers play a critical role in the supply chain, bearing specific legal obligations to ensure the safety and performance of devices placed on the EU market. Managing these responsibilities effectively requires robust systems, beyond what traditional, manual methods can reliably offer.

#Obligations for Distributors under the MDR and IVDR

Distributors of medical devices must act with due care in relation to the requirements of the MDR and IVDR. Before making a device available on the market, a distributor must verify several key aspects, as stipulated in Article 14(2) MDR and Article 12(2) IVDR. These checks are crucial for ensuring only compliant devices reach end-users.

Specifically, the distributor must verify:

• The device has been CE marked and that the EU declaration of conformity has been drawn up.
• The device is accompanied by the information to be supplied by the manufacturer in accordance with Article 10(11) MDR and Article 10(10) IVDR, which must be in an official language of the Member State where the device is made available.
• For imported devices, the importer has complied with the requirements laid down in Article 13(3) MDR and Article 11(3) IVDR.
• The manufacturer has assigned a UDI, where applicable.

If a distributor considers or has reason to believe that a device is not in conformity with the requirements of the MDR or IVDR, they must not make the device available on the market. They must inform the manufacturer and, where applicable, the manufacturer's authorised representative, and the importer. Additionally, they must inform the competent authority of the Member State in which they are established if they consider the device presents a serious risk or is a falsified device. This is detailed in Article 14(4) MDR and Article 12(4) IVDR.

Distributors also have an obligation to cooperate with competent authorities and provide all necessary information and documentation, as per Article 14(7) MDR and Article 12(7) IVDR.

#Obligations for Importers under the MDR and IVDR

Importers bear more extensive responsibilities than distributors, as they are the first point of contact for devices entering the EU market from third countries. Article 13 MDR and Article 11 IVDR delineate these obligations.

Before placing a device on the market, importers must ensure:

• The device has been CE marked and that the EU declaration of conformity has been drawn up.
• The manufacturer is identified and has designated an authorised representative.
• The manufacturer has complied with the requirements set out in Article 10(6) MDR and Article 10(6) IVDR (quality management system) and Article 10(11) MDR and Article 10(10) IVDR (information to be supplied).
• A UDI has been assigned by the manufacturer, where applicable.
• The importer's name, registered trade name or registered trade mark, and the address at which they can be contacted are indicated on the device, its packaging, or in a document accompanying the device, as per Article 13(6) MDR and Article 11(6) IVDR.

Importers must also verify that the device is registered in EUDAMED, as per Article 13(5) MDR and Article 11(5) IVDR. This includes verifying that the manufacturer has assigned a UDI and that the manufacturer has correctly uploaded the device data. For specific details on EUDAMED registration, refer to guidance documents from the Medical Device Coordination Group (MDCG). Please note: rules around EUDAMED modules have changed in stages. The reader should confirm the current status and scope with their national competent authority.

If an importer considers that a device is not in conformity or presents a serious risk, they must not place the device on the market and must inform the manufacturer and the competent authority, as specified in Article 13(7) MDR and Article 11(7) IVDR.

#Traceability and Documentation Requirements

Both distributors and importers must maintain a register of complaints, non-conforming devices, and recalls, and keep the manufacturer, authorised representative, and other relevant economic operators informed thereof. This is mandated by Article 14(5) MDR, Article 12(5) IVDR, Article 13(8) MDR, and Article 11(8) IVDR.

Furthermore, economic operators must be able to identify any economic operator to whom they have supplied a device, any economic operator who has supplied them with a device, and any health institution or healthcare professional to whom they have supplied a device. This traceability requirement, covering ten years after the last device has been supplied (or fifteen years for implantable devices), is outlined in Article 25 MDR and Article 22 IVDR.

Managing this volume of data and ensuring its accessibility for competent authorities requires robust record-keeping systems. Spreadsheets can become unwieldy, prone to errors, and lack the necessary audit trails for such critical information.

#EUDAMED Implications for Distributors and Importers

EUDAMED, the European Database on Medical Devices, is a central component of the EU regulatory framework. While manufacturers and authorised representatives bear primary responsibility for data submission, distributors and importers must interact with the system indirectly by verifying manufacturer compliance and ensuring data consistency.

As EUDAMED modules become fully functional, the ability to query device information, UDI data, and economic operator registrations will become an integral part of compliance verification for distributors and importers. Staying updated on the operational status of EUDAMED modules is essential. For further information, consider consulting the EUDAMED AI platform for medical device compliance.

#Common mistakes in practice

• Inadequate initial checks: Failing to thoroughly verify CE marks, declarations of conformity, and language requirements before making devices available, as per Article 14(2) MDR and Article 12(2) IVDR.
• Insufficient importer details: Not ensuring the importer's details are clearly indicated on the device or its packaging, as required by Article 13(6) MDR and Article 11(6) IVDR.
• Lack of traceability records: Inability to quickly identify suppliers or recipients of devices, failing the requirements of Article 25 MDR and Article 22 IVDR.
• Delayed incident reporting: Not promptly informing manufacturers, authorised representatives, or competent authorities about non-conforming devices or serious risks, as mandated by Article 14(4) MDR, Article 12(4) IVDR, Article 13(7) MDR, and Article 11(7) IVDR.
• Poor complaint handling: Absence of a structured system for recording and addressing complaints and device issues, contravening Article 14(5) MDR, Article 12(5) IVDR, Article 13(8) MDR, and Article 11(8) IVDR.
• Reliance on outdated information: Not staying current with EUDAMED operational status or updated guidance documents from the MDCG.
• Manual data management: Utilising spreadsheets or paper-based systems that are prone to human error, lack audit trails, and hinder efficient data retrieval during inspections.

#The Role of Compliance Software

Compliance software solutions offer a structured approach to managing the complex data and procedural requirements under the MDR and IVDR. These systems can:

Adopting specialised software can transform compliance from a reactive, labour-intensive task into a proactive, systematically managed process. It enhances data integrity, streamlines workflows, and significantly reduces the risk of non-compliance. This is particularly valuable given the scrutiny applied by national competent authorities during inspections.

Navigating the intricacies of medical device regulations requires robust and reliable systems. Digital platforms, such as the EUDAMED AI platform, offer tools to manage complex compliance data efficiently, helping economic operators meet their obligations under the MDR and IVDR. While such platforms assist in managing regulatory requirements, the ultimate responsibility for compliance remains with the individual economic operator and their designated personnel.

This material is for information only and is not legal advice. For binding interpretation consult your national competent authority.