Maria E. Donawa

A Notified Body is a public or private organisation designated by a Competent Authority of a member state to carry out certain conformity assessment tasks specified in the European directives. To do this, it will need to assess compliance with specific aspects of the directives, including those related to risk management and the demonstration that the benefits of device use outweigh the risks. Medical device manufacturers should determine if they will need to contract the services of a Notified Body during the earliest phases of planning to market their products in Europe. To do this, the relevant medical device directive must be identified together with the regulatory risk category or classification of the device. This is followed by a decision on the conformity assessment procedure that will be followed to obtain the CE mark.

There is only one device risk category in the Active Implantable Medical Devices Directive (AIMDD; 90/385/EEC). Options for demonstrating conformity to the AIMDD are in Article 9; conformity assessment procedures are in Annexes 2 through 5. Manufacturers need to decide on the conformity assessment procedure they wish to follow to CE mark their devices. Notified Body intervention is required for all devices covered by the AIMDD.

The Medical Devices Directive (MDD; 93/42/EEC) specifies four risk-based classes of devices, which are Class I, IIa, IIb and III, with Class I the lowest risk category and Class III the highest. Annex IX of the MDD contains the classification rules that manufacturers must follow to determine the device class. Article 9 of the MDD describes the conformity assessment options available, depending upon the device class. The conformity assessment procedures are in Annexes II through VII. Notified Body intervention is required for Class I devices only if they are sold sterile or have a measuring function. Notified Body intervention is not needed for any other type of Class I device. For all other classes of devices, the MDD requires Notified Body intervention.

The In Vitro Diagnostic Medical Devices Directive (IVDD; 98/79/EC) places devices into the following risk-based groups: devices that are specified in Annex II, which consists of List A and List B; devices for self-testing that are not in Annex I; and all other devices. The conformity assessment options are described in Article 9 and the conformity assessment procedures are in Annexes III through VII. Notified Body intervention is not required for the vast majority of IVD devices, but only for those listed in Annex II and for self-test devices.

Notified Body regulatory requirements

Manufacturers should be aware of the requirements Notified Bodies must fulfill, how they are designated and the oversight to which they are subjected. For example, each medical device directive contains an annex that describes the criteria that Notified Bodies must meet in order to be designated (Annex 8 in the AIMDD, Annex XI in the MDD, and Annex IX in the IVDD). In addition, the European guidance document, “Designation and Monitoring of Notified Bodies within the Framework of EC Directives on Medical Devices” (MEDDEV 2.10-2 Rev. 1)¹ describes in more detail the criteria and conditions for the designation and operation of Notified Bodies. However, this 2001 document is in need of important updating so that it refers to current versions of the directives and standards and incorporates requirements for IVD Notified Bodies, which are excluded from the guidance.

One of the criteria that Notified Bodies must meet concerns subcontracting. In some cases, a Notified Body may not have specific in-house expertise and will require the services of a subcontractor. If so, the Notified Body must ensure that the subcontractor meets relevant criteria and has the requisite qualifications. In some cases, knowledge of the regulations is particularly critical.

For example, some Notified Bodies may need to subcontract certain types of clinical expertise, which is understandable given the vast range of clinical areas that medical devices cover. The subcontracted clinical expertise may be needed for assessing a manufacturer’s clinical data, including clinical evaluation reports and associated documentation. Manufacturers should be assured that the clinical experts contracted for these services not only have the clinical expertise needed, but also a basic understanding of the regulatory framework for which the assessment is being performed. Otherwise, inappropriate conclusions that are inconsistent with the regulations may result. This happened with one particular subcontracted clinical expert who was convinced that a manufacturer was required to conduct a clinical study in each member state where the device was to be marketed; in fact, this is not required by European medical device regulations. Another subcontracted clinical expert insisted that a literature search was required as the basis for demonstrating device safety and performance in a clinical evaluation report, even though the manufacturer had carried out multiple clinical studies, including a very large randomised controlled study with convincing results. This could have been avoided had these experts been properly trained on the European device regulations before being employed in the assessment process. This may not be a common problem, but a check on hiring and training policies of external experts is a worthwhile discussion to have with a potential Notified Body.

Notified Body Operations Group (NBOG)

The NBOG was established in July 2000 by member states and the European Commission in response to widespread concern over variability and inconsistency in the performance of Notified Bodies in the medical device sector and their individual designations for specific device types. NBOG’s terms of reference are to improve the overall performance of Notified Bodies in the medical device sector by primarily identifying and promulgating examples of best practices to be adopted by both Notified Bodies and organisations responsible for their designation and control. NBOG membership includes the European Commission and nominees from the member states’ Designating and Competent Authorities, and is open to EFTA/EEA Competent Authorities as well as candidate and accession countries.

The NBOG website (www.nbog.eu) indicates the current chair and vice chair, work programme and methods, reports and news items, and, most importantly, a link to NBOG documents, including a detailed Designating Authorities Handbook, designed as a best practices guide for authorities responsible for the designation of Notified Bodies. Other documents that may be of interest to readers are the NBOG’s Best Practice Guides, which are shown in Table I. They provide guidance on specific aspects related to the activities of Notified Bodies. For example, the change of a Notified Body, either voluntarily by the manufacturer or if the Notified Body is no longer able to operate or provide a required service, is an important event that should be managed carefully and in an organised manner. The NBOG guide on this subject contains helpful information on how to do this.

Another useful document is the “Checklist for audit of Notified Body’s review of Clinical Data/Clinical Evaluation” (NBOG CL 2010-1, March 2010). The document is intended to be used by Designating Authorities to determine a Notified Body’s capability for assessing clinical evaluation documents and specific clinical data to support compliance with clinical data and clinical evaluation requirements. The document is divided into two main sections: resource requirements and process requirements. The section on process requirements contains a detailed set of questions concerning the clinical data procedures and documentation that is expected to be checked during a quality system audit and technical file evaluation. A manufacturer reviewing these questions will know what is expected of a Notified Body and will be better prepared to respond to the questions that Notified Bodies will ask if they follow this best practice guide. Although not the subject of this article, it should be pointed out that the “Clinical Evaluation Guidelines” (MEDDEV 2.7.1 Rev 3, December 2009), also contain a checklist that Notified Bodies are expected to use for the assessment of clinical data; although, the questions are not identical to those contained in the NBOG guide, there is some overlap.

NBOG also makes available on its website reports of work, including the current activities of the Designating Authorities to effectively monitor and control their Notified Bodies. They are found on the Reports and News webpage, www.nbog.eu/5.html. For example, the report of 14/15 January 2013 on the outcome of three meetings held in 2012, discusses key aspects of the meetings, which included measures to improve audits in light of the Pip breast implant scandal and the status of work to revise several NBOG guides.

Longstanding concerns

A report from the European Medical Devices Expert Group, “Report on the Functioning of the Medical Devices Directive” (2002),² describes generally accepted concerns regarding the competence of Notified Bodies to perform the tasks for which they are designated, differences in interpretation between Notified Bodies and lack of transparency in the performance and control of their activities. Directive 2007/47/EC that revised the MDD and AIMDD addressed these concerns. From the time that those revisions became mandatory in March 2010, efforts to improve the functioning of Notified Bodies continued at a relatively steady pace. More recently, the Pip breast implant scandal has led to additional measures being considered for the designation and control of Notified Bodies.

In consideration of the critical role that Notified Bodies play in the European regulatory system, manufacturers need to understand how they are monitored and controlled and how that could change. 

Important criteria

A critical criterion when identifying potential Notified Bodies is whether the Notified Body has been designated for the services required by the manufacturer. Not all Notified Bodies can certify compliance with all conformity assessment procedures in all medical device directives, nor are all device types necessarily covered. For example, relatively few Notified Bodies are designated to cover in vitro diagnostic medical devices. Not all Notified Bodies can certify conformity with quality system standards used to provide a presumption of conformity with the quality system requirements of the directives. Some Notified Bodies can provide services related to European requirements only, while others can provide quality system certification or audits useful in covering other regions of the world. In some cases, the location of Notified Bodies and their affiliate offices also may be an important consideration. The cost of services should never be the sole criterion for selection of a Notified Body; however, this can vary widely. Some Notified Bodies provide a high quality of service, including the conduct of effective quality system and technical file audits, while others leave much to be desired. These and other factors, tailored to the specific needs of the manufacturer, should be considered. 

Notified Body notification scope and location

Once a manufacturer has identified the applicable medical device directive and chosen a CE marking conformity assessment route, the scope of services of potential Notified Bodies can be used to begin the Notified Body selection process. The Nando website, which is published and maintained by the European Commission, is an electronic register that allows users to search lists of Notified Bodies, including their location, the directives under which they may operate, the tasks for which they have been notified and other information. The Nando website’s left-hand menu includes the following items: Country, Legislation, Body, Mutual recognition agreements, Notifying authority – Notification procedures, and Accreditation Body, among other categories. For example, a manufacturer interested in locating potential Notified Bodies in a particular country would click on Country, which opens a list of European countries where Notified Bodies operate. Clicking on a particular country opens a list of Notified Bodies operating under all legislation within that country. It is therefore necessary to filter for the desired medical device legislation, such as 93/42/EEC – medical device, which results in a list of Notified Bodies operating under that specific legislation. Clicking on the name of a Notified Body opens a page with its address and contact information, together with a list of the various legislations under which it has been designated to operate. Each legislation links to information on the Notified Body scope, including the products covered (described as product family, product intended use or product range), the directive conformity assessment procedures covered, and the corresponding annexes of the directives listed. It is also possible to begin a search for Notified Bodies by clicking on Legislation in the left-hand menu of the Nando site. This opens a list of European legislation, including the three medical device directives. Clicking on a particular directive opens a page with a list of the Notified Bodies operating in various countries that provide services related to that directive. Regardless of the information obtained on the Nando website, it is important to confirm the information found with the particular Notified Body of interest.

Quality system certification services

Under the European medical device directives, a manufacturer is provided with a presumption of conformity with the quality system requirements of the directives by complying with and being certified to harmonised standard EN ISO 13485:2012, Medical devices — Quality management systems — Requirements for regulatory purposes (ISO 13485:2003). Although quality system certification is not mandatory, most manufacturers use this method for demonstrating quality system compliance.

Some Notified Bodies, notably governmental Notified Bodies, are not accredited to certify quality systems to this standard and are only able to certify compliance to the quality system–related annexes of the directives. This means that a manufacturer choosing to use one of these particular Notified Bodies and also wishing to certify its quality system to the standard will need the services of two organisations, one for certifying compliance with the conformity assessment annex and the other for certifying the quality system to the standard. For this reason, companies should carefully consider whether or not the benefits of contracting the services of a Notified Body that can only certify compliance with the directives’ annexes is beneficial.

Service coverage of other regions

The capability of a Notified Body to provide services that apply to regulatory jurisdictions outside Europe is another important consideration for some manufacturers.

For example, in Canada, medical devices are grouped into four risk-based classes with Class I devices presenting the lowest potential risk and Class IV devices presenting the highest potential risk. Before selling a device in Canada, manufacturers of Class II, III and IV devices must obtain a Medical Device Licence. 

Health Canada requires medical device manufacturers to use a quality system certificate as evidence of compliance with the quality system requirements under Canadian law. Health Canada will only accept quality system certificates that have been issued by third-party certification organisations, called Canadian Medical Devices Conformity Assessment System (CMDCAS) recognised registrars. The Canadian Medical Devices Regulations require Class II, III and IV medical devices to be manufactured (Class II) or designed and manufactured (Class III and IV) under a quality system certified to CAN/CSA ISO 13485:2003. Manufacturers wanting to market their devices in Canada, therefore, may wish to select a Notified Body that is also a CMDCAS-recognised registrar.

In addition, some Notified Bodies have been designated by US FDA to be conformity assessment bodies (CABs), able to provide selected services, such as third-party regulatory review, under US regulations. Manufacturers considering the use of such services may wish to select a CAB-designated Notified Body.

Audit method and stringency

Unfortunately, some Notified Bodies have been known to conduct quality system audits that consist of little more than checking the existence of selected standard operating procedures, without adequately assessing whether the quality system requirements are being appropriately met or if the procedures have been properly implemented. The failure to provide effective quality system auditing services can have far-reaching effects for manufacturers, ranging from increased risks to patients and users of medical devices not adequately meeting quality requirements to increased risks to manufacturers with regard to product liability, reputation or the cost of product recalls. Ineffective quality system audits against European requirements also can affect a company’s ability to meet quality system requirements of other regulatory jurisdictions. For example, manufacturers certified by a Notified Body for many years may have serious problems in meeting US quality system requirements, not primarily because of differences in the requirements, but because of differences in the depth of some Notified Body audits compared with US FDA inspections. It is recognised that a Notified Body’s audit effectiveness is difficult to assess during the selection process; however, manufacturers should attempt to gain an understanding of how a Notified Body performs this critical task. At a minimum, manufacturers should discuss the Notified Body’s audit methods to determine how they are conducted. 

Team-NB and code of conduct

The European Association of Notified Bodies for Medical devices (Team-NB) is a not-for-profit association consisting of Notified Bodies operating under any of the three medical device directives: 90/385/EEC, 93/42/EEC or 98/79/EC. The stated purpose of the organisation is to improve communications with the European Commission, industry, Competent Authorities and user groups by acting as a focal point and the single voice of Notified Bodies; to promote high technical and ethical standards in the functioning of Notified Bodies; and to protect the legal and commercial interests of Notified Bodies. According to the Team-NB website (www.team-nb.org), the organisation has 32 members. Although, manufacturers may not consider Team-NB membership to be a criterion for selecting a Notified Body, it does indicate that the Notified Body has the opportunity to share and exchange views with other Notified Bodies and that it endeavours to adhere to the Team-NB Code of Conduct, which currently applies to Notified Bodies operating under Directives 90/385/EEC and 93/42/EEC.

Timing and the right decision

 Manufacturers should not wait until the last minute to select a Notified Body. If a clinical investigation is being planned, potential Notified Bodies should be identified, where possible, before initiation of the study. The Notified Body’s procedures for reviewing clinical data and its expertise should be discussed. Early involvement of the selected Notified Body in the clinical investigation strategy should help avoid costly problems that could occur if the Notified Body does not agree with the strategy for generating clinical data for the CE mark. Early contact is equally important if the medical device is complex or if its regulatory status is not straightforward, which can occur with drug-device combination or borderline products.

Careful contract review

Although discussion of all the steps in the Notified Body selection process is beyond the scope of this article, one of the most important activities is a careful review of the contract between the Notified Body and the manufacturer. Some Notified Bodies may interpret their roles in the conformity assessment process in a way that exceeds the requirements of the directives. For example, how the Notified Body approaches design changes may prove to be of critical importance once a device is available on the European market. Contracts that appear to overreach the requirements of the directives in this and other respects should be questioned and either amended or avoided.

Critical criteria

A critical criterion when identifying potential Notified Bodies is whether the Notified Body has been designated for the services required by the manufacturer. Not all Notified Bodies can certify compliance with all conformity assessment procedures in all medical device directives, nor are all device types necessarily covered. For example, relatively few Notified Bodies are designated to cover in vitro diagnostic medical devices. Not all Notified Bodies can certify conformity with quality system standards used to provide a presumption of conformity with the quality system requirements of the directives. Some Notified Bodies can provide services related to European requirements only, while others can provide quality system certification or audits useful in covering other regions of the world. In some cases, the location of Notified Bodies and their affiliate offices also may be an important consideration. The cost of services should never be the sole criterion for selection of a Notified Body; however, this can vary widely. Some Notified Bodies provide a high quality of service, including the conduct of effective quality system and technical file audits, while others leave much to be desired. These and other factors, tailored to the specific needs of the manufacturer, should be considered.

Notified Body notification scope and location

Once a manufacturer has identified the applicable medical device directive and chosen a CE marking conformity assessment route, the scope of services of potential Notified Bodies can be used to begin the Notified Body selection process. The Nando website, which is published and maintained by the European Commission, is an electronic register that allows users to search lists of Notified Bodies, including their location, the directives under which they may operate, the tasks for which they have been notified and other information. The Nando website’s left-hand menu includes the following items: Country, Legislation, Body, Mutual recognition agreements, Notifying authority – Notification procedures, and Accreditation Body, among other categories. For example, a manufacturer interested in locating potential Notified Bodies in a particular country would click on Country, which opens a list of European countries where Notified Bodies operate. Clicking on a particular country opens a list of Notified Bodies operating under all legislation within that country. It is therefore necessary to filter for the desired medical device legislation, such as 93/42/EEC – medical device, which results in a list of Notified Bodies operating under that specific legislation. Clicking on the name of a Notified Body opens a page with its address and contact information, together with a list of the various legislations under which it has been designated to operate. Each legislation links to information on the Notified Body scope, including the products covered (described as product family, product intended use or product range), the directive conformity assessment procedures covered, and the corresponding annexes of the directives listed. It is also possible to begin a search for Notified Bodies by clicking on Legislation in the left-hand menu of the Nando site. This opens a list of European legislation, including the three medical device directives. Clicking on a particular directive opens a page with a list of the Notified Bodies operating in various countries that provide services related to that directive. Regardless of the information obtained on the Nando website, it is important to confirm the information found with the particular Notified Body of interest.

Quality system certification services

Under the European medical device directives, a manufacturer is provided with a presumption of conformity with the quality system requirements of the directives by complying with and being certified to harmonised standard EN ISO 13485:2012, Medical devices — Quality management systems — Requirements for regulatory purposes (ISO 13485:2003). Although quality system certification is not mandatory, most manufacturers use this method for demonstrating quality system compliance.

Some Notified Bodies, notably governmental Notified Bodies, are not accredited to certify quality systems to this standard and are only able to certify compliance to the quality system–related annexes of the directives. This means that a manufacturer choosing to use one of these particular Notified Bodies and also wishing to certify its quality system to the standard will need the services of two organisations, one for certifying compliance with the conformity assessment annex and the other for certifying the quality system to the standard. For this reason, companies should carefully consider whether or not the benefits of contracting the services of a Notified Body that can only certify compliance with the directives’ annexes is beneficial.

Service coverage of other regions

The capability of a Notified Body to provide services that apply to regulatory jurisdictions outside Europe is another important consideration for some manufacturers.

For example, in Canada, medical devices are grouped into four risk-based classes with Class I devices presenting the lowest potential risk and Class IV devices presenting the highest potential risk. Before selling a device in Canada, manufacturers of Class II, III and IV devices must obtain a Medical Device Licence.

Health Canada requires medical device manufacturers to use a quality system certificate as evidence of compliance with the quality system requirements under Canadian law. Health Canada will only accept quality system certificates that have been issued by third-party certification organisations, called Canadian Medical Devices Conformity Assessment System (CMDCAS) recognised registrars. The Canadian Medical Devices Regulations require Class II, III and IV medical devices to be manufactured (Class II) or designed and manufactured (Class III and IV) under a quality system certified to CAN/CSA ISO 13485:2003. Manufacturers wanting to market their devices in Canada, therefore, may wish to select a Notified Body that is also a CMDCAS-recognised registrar.

In addition, some Notified Bodies have been designated by US FDA to be conformity assessment bodies (CABs), able to provide selected services, such as third-party regulatory review, under US regulations. Manufacturers considering the use of such services may wish to select a CAB-designated Notified Body.

Audit method and stringency

Unfortunately, some Notified Bodies have been known to conduct quality system audits that consist of little more than checking the existence of selected standard operating procedures, without adequately assessing whether the quality system requirements are being appropriately met or if the procedures have been properly implemented. The failure to provide effective quality system auditing services can have far-reaching effects for manufacturers, ranging from increased risks to patients and users of medical devices not adequately meeting quality requirements to increased risks to manufacturers with regard to product liability, reputation or the cost of product recalls. Ineffective quality system audits against European requirements also can affect a company’s ability to meet quality system requirements of other regulatory jurisdictions. For example, manufacturers certified by a Notified Body for many years may have serious problems in meeting US quality system requirements, not primarily because of differences in the requirements, but because of differences in the depth of some Notified Body audits compared with US FDA inspections. It is recognised that a Notified Body’s audit effectiveness is difficult to assess during the selection process; however, manufacturers should attempt to gain an understanding of how a Notified Body performs this critical task. At a minimum, manufacturers should discuss the Notified Body’s audit methods to determine how they are conducted.

Team-NB and code of conduct

The European Association of Notified Bodies for Medical devices (Team-NB) is a not-for-profit association consisting of Notified Bodies operating under any of the three medical device directives: 90/385/EEC, 93/42/EEC or 98/79/EC. The stated purpose of the organisation is to improve communications with the European Commission, industry, Competent Authorities and user groups by acting as a focal point and the single voice of Notified Bodies; to promote high technical and ethical standards in the functioning of Notified Bodies; and to protect the legal and commercial interests of Notified Bodies. According to the Team-NB website (www.team-nb.org), the organisation has 32 members. Although, manufacturers may not consider Team-NB membership to be a criterion for selecting a Notified Body, it does indicate that the Notified Body has the opportunity to share and exchange views with other Notified Bodies and that it endeavours to adhere to the Team-NB Code of Conduct, which currently applies to Notified Bodies operating under Directives 90/385/EEC and 93/42/EEC.

Timing and the right decision

Manufacturers should not wait until the last minute to select a Notified Body. If a clinical investigation is being planned, potential Notified Bodies should be identified, where possible, before initiation of the study. The Notified Body’s procedures for reviewing clinical data and its expertise should be discussed. Early involvement of the selected Notified Body in the clinical investigation strategy should help avoid costly problems that could occur if the Notified Body does not agree with the strategy for generating clinical data for the CE mark. Early contact is equally important if the medical device is complex or if its regulatory status is not straightforward, which can occur with drug-device combination or borderline products.

Careful contract review

Although discussion of all the steps in the Notified Body selection process is beyond the scope of this article, one of the most important activities is a careful review of the contract between the Notified Body and the manufacturer. Some Notified Bodies may interpret their roles in the conformity assessment process in a way that exceeds the requirements of the directives. For example, how the Notified Body approaches design changes may prove to be of critical importance once a device is available on the European market. Contracts that appear to overreach the requirements of the directives in this and other respects should be questioned and either amended or avoided.

Maria E. Donawa is president of Donawa Lifescience Consulting.

References
1. http://ec.europa.eu/health/medical-devices/files/meddev/2_10_2date04_2001_en.pdf.
2. www.team-nb.org/documents/2008/finalreport5-6-02cor1_3-july02.pdf.