Manufacturers of medical devices must monitor their products on the market. The European Medical Device Regulation (EU) 2017/745 (MDR) requires manufacturers to gather experiences systematically and proactively from product use after placing a product on the European Union market. Based on this, manufacturers must keep the technical documentation of their products up to date and cooperate with national authorities responsible for vigilance and market surveillance. The aim is to increase the safety and performance of medical devices.
What is Post-Market Surveillance and Vigilance?
Post-market surveillance (PMS) refers to the monitoring of a medical device after it has been placed on the market by the manufacturer. To this end, the manufacturer actively and systematically collects information on product use in the market. In this way, the manufacturer identifies incidents and trends. If corrective or preventive measures are necessary, the manufacturer informs the users, competent authorities or the notified body.
If the manufacturer detects a serious incident and initiates a safety corrective action in the field, he must report it immediately. The MDR refers to this separately regulated reporting procedure as vigilance.
The definitions of the terms are important in this context. For example, according to the MDR, a serious incident results in death, in a serious deterioration in health, or a serious risk to public health. If the manufacturer takes a countermeasure at this point, it is a field safety corrective action.
What is Post-Market Clinical Follow-Up?
Post-Market Clinical Follow-Up (PMCF) refers to the clinical follow-up of a product after it has been placed on the market. It is an ongoing process that keeps the mandatory clinical evaluation of the product current. Post-Market Clinical Follow-Up is part of Post-Market Surveillance and is described separately in the MDR in Annex XIV.
What is market surveillance?
Market surveillance is carried out by the competent authorities. These must check whether products on the market comply with the requirements of the MDR and do not pose a hazard. To this end, the competent authorities can inspect medical devices based on random samples. In the most extreme case, the authorities can cause a product to be withdrawn from the market. Details are regulated in the respective national laws. The guideline "MDCG 2023-3 Questions and Answers on vigilance terms and concepts as outlined in the Regulation (EU) 2017/745 on medical devices" explains important terms and concepts used in Section 2 of Chapter VII of the MDR in relation to vigilance.
What are the obligations of the manufacturer?
Manufacturers must establish a PMS process as part of their quality management system. This must be appropriate to the risk class and type of product and ensure that data on the quality, performance and safety of a product is actively collected and analyzed throughout the product's life.
The manufacturer must then use the collected data to
- update the risk management and benefit-risk assessment of its product,
- update the product manufacturing, instructions for use and labeling,
- update the clinical evaluation (PMCF)
- update the Summary of Safety and Clinical Performance (SSCP, for Class III devices and implants only),
- identify the need for preventive or corrective action and initiate as appropriate,
- inform the competent authorities or the Notified Body, as appropriate,
- identify any serious incidents, initiate safety corrective actions and report them,
- identify how to improve the usability, performance and safety of the product,
- identify and report trends,
- update the technical documentation.
How does a manufacturer implement a PMS process?
The basis for this is a PMS plan, which must be drawn up for every medical device regardless of the risk class. The MDR contains comparatively detailed information on what must be included in the PMS plan. In particular, the manufacturer must obtain the following information:
- indicators and thresholds for risk management and risk-benefit assessment,
- methods for reviewing product-related complaints and experiences,
- approach to trend reports with regard to occurrence, severity level and time period,
- method of communication with all stakeholders involved,
- plan for clinical follow-up (PMCF) or a rationale for why this is not applicable.
The Technical Report ISO TR 20416:2020 can be helpful in creating the PMS plan. The examples are particularly interesting: On the one hand, exemplary data and trend analyses are explained. On the other hand, the Technical Report contains 4 exemplary PMS plans, namely for a surgical instrument, a radiation therapy system, a drug-eluting stent and a blood glucose monitoring system.
For PMS documentation, manufacturers of Class I devices prepare a PMS report. This contains a summary of all results with corresponding conclusions. The report is updated as necessary and made available to the competent authority upon request.
Manufacturers of products in risk classes IIa, IIb and III have more extensive reporting obligations. They prepare a safety report (Periodic Safety Update Report, PSUR), the contents and structure of which are explained in detail in the guideline "MDCG 2022-21 - Guidance on Periodic Safety Update Report (PSUR) according to Regulation (EU) 2017/745". In addition to the summary with all results and conclusions, the safety report also contains a justification and description of any preventive and corrective measures taken.
Manufacturers of products in risk classes IIa, IIb, and III must track the following items in the safety report throughout the life of the product:
- the result of the benefit-risk assessment,
- the main findings of the clinical evaluation report,
- the total sales volume of the product,
- an estimate of the number of individuals in whom the product will be used; and
- An estimate of the frequency of product use.
The safety report is part of the technical documentation. The manufacturers of class IIa devices update the safety report as required, but at least every two years. The manufacturers of class IIb and III devices update the safety report at least once a year.
In principle, manufacturers submit the safety report to their Notified Body and - upon request - to the competent authorities. By way of derogation, manufacturers of class III devices or implantable devices submit their safety reports to the notified body via the European medical device database EUDAMED. The notified body then also makes the safety report available to the competent authorities via EUDAMED after it has been examined.
What do manufacturers need to consider when it comes to vigilance?
Manufacturers must report serious incidents to the competent authorities via EUDAMED and, if necessary, initiate safety corrective measures. The reporting deadline depends on the severity of the incident.
In principle, notifications must be made without delay. However, the MDR allows manufacturers a period of 15 days. This period is reduced to 10 days in the case of deaths or unforeseen serious deteriorations in health. If there is a serious risk to public health, the deadline is reduced to 2 days. Safety corrective actions also require notification before they are taken.
The guideline MEDDEV 2.12-1 rev. 8 contains additional requirements for the vigilance of medical devices. Thus, the roles of the actors are described, the link to national laws or the contents to be reported. The EU has published a supplement to MEDDEV 2.12-1 rev. 8 in 2019, which mainly contains updates with regard to the current requirements of the MDR. Equally worth reading in this context is the MDCG 2019-15 rev. 1 guideline, which is intended to help manufacturers of Class I medical devices with the transition to the MDR. Many of the aspects on PMS and vigilance listed there are generally also relevant for medical devices of higher risk classes.
Manufacturers who market their medical devices in Germany should take a look at the MPDG (“Medizinprodukterecht-Durchführungsgesetz”). Chapter 5 contains the regulations on vigilance. In particular, it regulates the responsibilities of the authorities, the manufacturer's obligations to cooperate and provide information, and cooperation with other EU member states. The Medical Devices User Notification and Information Ordinance (MPAMIV – Medizinprodukterecht-Durchführungsgesetz) regulates the notification obligations. Of particular interest here is the definition of "suspected serious incident" introduced as a supplement to the MDR.
What are the links to quality and risk management?
Manufacturers of medical devices must have a quality management system. The ISO 13485 standard describes the requirements for this. The MDR stipulates that post-market surveillance must be an integral part of the quality management system.
Thus, ISO 13485 requires systematic post-market surveillance of a product. Chapter 8 of the standard presents the requirements for a continuous feedback process, which describes a flow of information from manufacturing to marketing. The information obtained in this way is incorporated into the mandatory risk management system.
The ISO 14971 standard describes the requirements for risk management. With regard to the market phase, it does not focus on the manufacturer's reporting obligations. The requirements of the standard, on the other hand, ensure that PMS data are obtained and used for the continuous assessment of the risk-benefit ratio of the product in question. The Technical Report ISO/TR 20416:2020 already mentioned above also describes how ISO 14971 and ISO 13485 interrelate.
What are a manufacturer's responsibilities in post-market clinical follow-up?
During clinical follow-up, the manufacturer collects and evaluates clinical data of its product in the market. The product must bear a CE marking and be used in accordance with its intended purpose. The objectives of the PMCF are:
confirmation of safety and the performance of the product during its lifetime,
identification of side effects and contraindications,
identification of risks, and
ensuring an appropriate risk-benefit balance of the product.
The manufacturer must also use the PMCF to determine whether its product may be systematically misused, i.e., used incorrectly or in a manner that exceeds its approval. In this way, the manufacturer checks whether the intended purpose has been appropriately selected.
The manufacturer must formulate a PMCF plan. This shall include at least:
- a description of the specific PMCF objectives,
- a description and justification of the methods used, for example, to obtain clinical experience or user feedback, analyze scientific literature, or review other sources of clinical data, particularly from registries or clinical trials,
- a description of how reference to clinical evaluation and risk management will be made,
- a procedure for obtaining and evaluating clinical data on the same or similar products,
- references to all relevant common specifications, harmonized standards and guidelines; and
- a timeline.
The PMCF results are included in both the PMS report and the safety report (PSUR) and are also part of the clinical evaluation report. For both documents, the guidelines "MDCG 2020-7 Post-market clinical follow-up (PMCF) Plan Template. A guide for manufacturers and notified bodies" and "MDCG 2020-8 Post-market clinical follow-up (PMCF) Evaluation Report Template. A guide for manufacturers and notified bodies" provide comprehensive explanations of the scope and content.
Summary
The MDR significantly increases the requirements for medical device manufacturers in terms of market monitoring and surveillance. A further requirement arises from the responsible person to be appointed in accordance with Article 15 MDR. This person is explicitly responsible for ensuring that all obligations arising from post-market surveillance of medical devices are implemented. This includes all vigilance reporting requirements. Since all post-market surveillance, vigilance and market surveillance requirements are mandatory as of May 26, 2021, all manufacturers need to have corresponding processes implemented now, despite the ongoing transition period until May 2024.
One problem with this: EUDAMED. The database is still not fully functional and will remain so for a while. So PMS notifications cannot yet go through EUDAMED. Until then, notifications must be made through existing national notification systems. Manufacturers should always keep up to date with the current state of affairs regarding EUDAMED. The MDCG 2021-1 Rev. 1 "Guidance on harmonised administrative practices and alternative technical solutions until EUDAMED is fully functional", whose title at least refers transparently to the EUDAMED permanent construction site, can help here. Even more precise at this point is the current announcement of the German Federal Ministry of Health (BMG – Bundesgesundheitsministerium) on the regulation of the transition period until the European Database for Medical Devices is fully functional.
