From FDA Quality System Regulation to CE MarkingFrom FDA Quality System Regulation to CE Marking

Medical Device & Diagnostic Industry Magazine
MDDI Article Index

An MD&DI May 1999 Column

Awareness of the similarities and differences between U.S. and EU regulatory systems can help manufacturers satisfy both regimens and meet CE marking requirements.

The critical question facing many medical device manufacturers today is how to bridge the gaps between U.S. FDA's quality system regulation (QSR) covering good manufacturing practices and the European Union's (EU) "new approach" Medical Devices Directive (MDD). Ongoing developments in these two systems—along with the recently signed mutual recognition agreement (MRA)—are part of a trend toward harmonization of regulatory processes and requirements designed to eliminate trade barriers.

Underlying the complexities and the differences between the two systems are fundamental similarities. Most significantly, both have the same goals: to ensure that a medical device company produces a safe product and that the company can do so consistently. Both regimens stress good manufacturing and design control processes. Only companies that meet the MDD requirements receive a CE mark, which allows their products to be sold in the EU market. CE marking has also been adopted by non-European countries, such as Australia and Canada, through an MRA with the EU. The Mercusor countries in the southern cone of South America have a standards agreement with the EU, which is a step toward CE marking.

Even for companies that have satisfied FDA premarket approval requirements, the MDD requirements can be complex. Conformity assessment—the processes and procedures by which companies demonstrate that their products meet CE marking requirements—varies depending on the class of product; therefore, closing the gaps between the U.S. and the EU requirements can also vary according to product type. To add to the potential confusion, the EU has four classes (Class I, Class IIa, Class IIb, and Class III), while FDA has three (Class I, Class II, and Class III). Furthermore, in the United States, submissions for products in the same class have historically had different requirements for premarket notification (510(k)) as opposed to premarket approval (PMA), whereas EU product approval submissions are based solely on class, and each submission must meet exactly the same requirements. Thus, legacy products with superficial 510(k)s that lack technical documentation will be at a disadvantage compared with products that have recent, comprehensive 510(k)s or PMA applications.

CLOSING THE GAP BETWEEN THE 510(k) AND THE TECHNICAL FILE

In many cases, closing the gap between the 510(k) and the technical file is the biggest task companies face. Both the United States and the EU require sufficient technical documentation for regulators to review and determine whether the conception and design of the product or product family is safe. In the EU, the term technical file is used to describe how this documentation is compiled for Class I, Class IIa, and Class IIb products. The technical file documentation for Class III devices is known as the design dossier. The equivalent of the technical file in the United States is either the 510(k) for established products that are similar to others already on the market, or the PMA application, which is generally required for Class III and high-risk Class II devices.

In the technical file, the EU requires documentation organized in a more detailed, structured, and specific way than required by FDA. In Annex I, the MDD sets forth essential requirements that establish minimum safety considerations. These essential requirements are a checklist of factors that could affect the safety of a medical device, such as design, construction, packaging, and labeling. Not all essential requirements apply to every device. For example, requirements for protecting someone from electrical risk apply only to devices with an electrical component or to devices that can be connected to an electrical component.

For each applicable essential requirement, the technical file must also include the European norm (EN) harmonized standards and other standards used to demonstrate conformity to the EN standards. Harmonized safety standards have been written specifically to provide a path for demonstrating conformity to the relevant directives. There are hundreds of EN harmonized standards applicable to medical devices; some of these apply to broadly defined factors affecting a wide range of devices (e.g., risk assessment, packaging, labeling, and instructions), while others apply to more-specific areas (e.g., gamma or ethylene oxide sterilization). If there are no applicable European standards, other standards—such as national or international standards—may be invoked.

The technical file must also include evidence for claiming compliance with the standards or applicable clauses in the standards—for example, results of a risk analysis, results of bench testing, biological safety reports, clinical trial data, equivalence to other products, sales or complaint history, and so on. In addition, the technical file should reference relevant documents from the device master file, the design file, and quality records, as well as records from the postmarket surveillance system and vigilance system.

Because FDA has increased the range of information it requires to include technical and safety standards, risk analysis, and design control, the scope of a comprehensive 510(k) is similar to that of a technical file. In a document published in May 1998, Design Control Report and Guidance, FDA deals with many of the same questions as the essential requirements and covers the same ground regarding inspections. As a result, companies that have recently developed comprehensive 510(k)s and PMA applications should meet most EU requirements. Many of the ISO or other standards required by FDA are either the same as or equivalent to EU harmonized standards; therefore, if a company can meet FDA requirements, it is often well on its way to satisfying the dictates of EU standards.

The situation for older 510(k)s, however, is different. When 510(k)s were initially created, they typically lacked the kind of technical documentation that the EU now requires. As a result, legacy devices and established devices with a superficial 510(k) will need to create an acceptable technical file to receive CE marking. This is also true for devices that were marketed in the EU prior to full implementation of the MDD on June 14, 1998.

QUALITY ASSURANCE

Both the EU regulatory system and FDA have been moving toward harmonization in their approach to quality assurance. Both FDA (in the QSR) and the EU have adopted ISO 9001 and ISO 13485 as the cornerstone of their regimens. Referred to as EN ISO 9001 in the EU, ISO 9001 is the international quality management system standard for both design control and manufacturing; ISO 13485, referred to as EN 46001 in the EU, applies ISO 9001 to medical devices.

U.S. manufacturers of Class II (both IIa and IIb) and Class III devices who have satisfied FDA's QSR will, for the most part, have met the conformity assessment requirements for the EU's quality assessment, known as full quality assurance (described in Annex II of the MDD). The same holds true for makers of Class I devices, with some modifications. FDA exempts most Class I devices from its design control requirements and allows manufacturers to satisfy the QSR by meeting the requirements of ISO 9002 and ISO 13488 (EN 46002 in the EU), the international standards that apply to production systems and exclude design control. For Class I sterile and measuring devices, the EU also accepts EN ISO 9002 and EN ISO 13488—which are spelled out in Annex V of the MDD as "Production Quality Assurance"—when they are combined with the manufacturer's declaration that the product conforms to the design specifications in its technical file (Annex VII, declaration of conformity). For Class I nonsterile, nonmeasuring devices, the EU requires self- declaration only (Annex VII).

As part of its modular approach to conformity assessment for quality assurance, the EU also offers other options to manufacturers of Class II and Class III devices to separate design control from manufacturing or production control. However, these options (as spelled out in Annexes III, IV, V, and VI) are irrelevant because U.S. manufacturers must meet the QSR requirements for ISO 9001 and ISO 13485. They might be useful in the short term for European firms that do not sell their products in the United States and do not have to comply with the QSR.

STERILE AND NONSTERILE DEVICES

Differences in the substantive regulatory requirements of the European Union and the United States can also pose challenges for U.S. device manufacturers. Simple Class I nonsterile devices that have passed through the current FDA system should be able to meet up to 85% of EU requirements. The primary differences between the EU and U.S. requirements occur as a result of multiple translations for labeling and use in the EU. Although the differences in use are likely to be minor, translation could be a significant issue. If a company wants to sell a device in all 15 EU countries, it may need labeling translations in 12 languages.

Quality system requirements for sterile devices can pose a greater challenge for U.S. manufacturers than the requirements for nonsterile devices. The EU requires companies to control the manufacturing and packaging environment to achieve a sterilization assurance level (SAL) of 10^—6 without overdosing with chemical sterilant. FDA has taken a more relaxed view of sterilization, allowing higher levels of sterilant, and, for some products, accepting an SAL of 10^—3. Some companies have already spent a lot of money to meet these requirements, while others may still need to do so. Another concern is expiration dating for sterile products. The EU requires such dates for CE marking; however, FDA does not. As a result, many U.S. companies do not have any packaging-validation data showing the shelf life of their products.

MAINTAINING THE CE MARK

After manufacturers obtain a CE mark, the EU requires them to use a medical device vigilance system and a postmarket surveillance system to monitor and service the product once it is on the market. The vigilance requirements create a formal system for complaints and recalls, which includes the presence of a designated representative in the EU. Generally referred to as an authorized representative, this person or company represents a manufacturer who does not have an official business location in the EU but sells in the EU market. The authorized representative is the "responsible person" required by article 14 of the MDD to act on behalf of the manufacturer when contacted by customers who have inquiries or complaints about products.

The vigilance system is largely equivalent to FDA's medical device reporting and recall requirements, with sufficient similarities between the two programs for them to be covered by the same complaint procedure.

Postmarket surveillance requires a manufacturer to actively survey device users to determine if there are quality problems and suggest preventive or corrective action. Although this does not yet exist in the United States, FDA is laying the groundwork for a similar system. The QSR's section on corrective and preventive action defines the requirements for analyzing all quality data, including trends from customer feedback and service reports. All of these are postmarket surveillance issues.

APPROVAL AUTHORITY

In the EU, notified bodies (i.e., private third-party testing laboratories and certification firms) conduct conformity-assessment procedures for all medical devices except MDD Class I nonsterile devices and certain IVD devices. These organizations are appointed by a competent authority (i.e., a national board of health similar to FDA) within an EU member state that notifies the EU commission of the firms it has appointed for a given directive. A notified body from one EU member state must be accepted by all member states.

Most EU notified bodies have U.S.-based operations that can readily provide conformity-assessment services and CE marking for U.S. manufacturers. Many notified bodies are also quality management systems registrars, but the two functions are separate. Certification of a manufacturer to ISO 9001 is irrelevant to conformity assessment for CE marking, although the two processes can intertwine. A notified body that is also an ISO 9001 registrar can assess a quality management system for ISO 9001 while simultaneously assessing it for CE marking.

With the signing of the MRA between the United States and the EU, FDA will designate selected U.S. firms as conformance-assessment bodies (CABs) for the EU. These firms would have the authority to approve some products for the EU market using the appropriate EU conformity assessment.

CONCLUSION

The CE mark is too important to be left to regulatory specialists alone. Regulatory matters cannot be separated from marketing, sales, design, and production, and manufacturers are well advised to involve parts of their organizations that historically have not been included in the regulatory or quality arena. If manufacturers do not clearly understand their intended market or neglect to define its constraints, they may be setting themselves up for disaster.

In Europe, for example, medical devices that are designed to be reused and resterilized may need to undergo a process called flash sterilization, which is standard in the EU but hardly ever used in the United States. A manufacturer who plans worldwide distribution of a product that has not been designed and manufactured for flash sterilization or has not considered the implications of practices such as flash sterilization is in for an unpleasant surprise when the EU marketplace rejects the device. The only way to avoid such surprises is to conduct thorough market research before designing, manufacturing, or marketing a product.

When developing new devices for international markets, there is a useful rule of thumb that manufacturers should follow: Conform your device to the MDD's essential guidelines. If manufacturers meet the requirements for CE marking, they will also largely satisfy FDA, which readily accepts EU harmonized standards and European national standards to demonstrate compliance with its requirements. By following this course of action, medical device companies can satisfy both EU and U.S. regulatory regimens at the same time.

Ron Belmont is director of food, drug, and healthcare support activities at Excel Partnership Inc. (Sandy Hook, CT). Carrie Hartill and James W. Kolka, JD, PhD, are senior consultants at Excel.

Photo courtesy of TNO Prevention and Health.

Copyright ©1999 Medical Device & Diagnostic Industry