Learn details about the potential impact of the new European Medical Device Regulation (EMDR) for medical device manufacturers and suppliers of outsource manufacturing.

By Rob Packard

During the last two decades, there has been a steady increase in the outsourcing of medical device manufacturing to contract manufacturers, service providers, and component suppliers. However, over the past few years there has also been an increase in the frequency of recalls and increased scrutiny of the supply chain by regulators. The new European Medical Device Regulation (EMDR) places additional burden on manufacturers and their suppliers. Ultimately, this may hurt the profitability of contract manufacturers and the willingness of manufacturers to outsource manufacturing. Here are some examples of how the EMDR may impact outsourcing of medical device manufacturing:

Changes to Supplier Quality Agreements

In the fall of 2013, most manufacturers of Class III devices were informed by Notified Bodies that they should expect an unannounced audit in 2014. They were also told that if they outsourced manufacturing to critical subcontractors, or if there were crucial suppliers of unique components, then the Notified Body may also perform an unannounced audit of their suppliers. This information was in response to a recommendation published by the EU Commission on September 24, 2013.

Throughout 2014, especially during the second half of the year, Notified Bodies subjected high-risk Class III device manufacturers and a few contract manufacturers to unannounced audits. These unannounced audits are expected to continue throughout 2015, and gradually, these audits will be extended to Class IIb and Class IIa manufacturers and their suppliers. In order to ensure that Notified Bodies will be able to conduct these audits, supplier agreements will need to be updated to specifically allow unannounced audits.

Increased Scrutiny of Your Supplier’s Supply Chain

In the past, if a supplier outsourced operations like heat treatment, coatings, or laser marking to a third party, the manufacturer was seldom aware of who was conducting the work. The only “control” of a supplier’s supply chain was the requirement that any changes to suppliers be communicated to the manufacturer as a change notification.

One of the consequences of the fraudulent Poly Implant Prosthese (PIP) breast implant scandal is that Notified Bodies are asking manufacturers to disclose each of their crucial suppliers—including raw material suppliers. This is different from previous years when Notified Bodies only focused on significant subcontractors that perform contract sterilization or manufacture a finished device. Ultimately, this will result in more thorough incoming inspection by suppliers as well as auditing of raw materials and component suppliers.

Increased Frequency of Supplier Audits and More Suppliers to Audit

Under the current directive, there is no specific requirement for conducting supplier audits, and that is unlikely to change in the new EMDR. However, manufacturers are required to demonstrate control of suppliers and records of evaluating suppliers. The most common practice is to categorize suppliers as having either “critical” or “non-critical” status.

Only critical suppliers are being audited in most cases, approximately once every three years. The implementation of unannounced audits of critical subcontractors and crucial suppliers on an annual basis for Class III products (less frequently for Class IIb and Class IIa products) will result in more frequent audits of suppliers and more audits of suppliers that were once categorized as “non-critical.”

Increased frequency of audits and audits of more suppliers will stretch the human resources of suppliers and manufacturers alike. Ultimately, manufacturers will need to consider alternative solutions to on-site audits, such as remote auditing and sharing audit reports with other manufacturers.

We could also begin to see other changes in outsourcing behavior. Manufacturers may outsource to fewer suppliers (consolidation) or outsource less in general, supplier corrective action requests could become more frequent, and audit follow-ups on supplier corrective action requests by email and phone are likely to become more routine. We may also see increased monitoring and measurement of product received from suppliers as a way to provide quantitative justification for not auditing a supplier.

UDI Labeling Implementation

FDA began implementation of the new Unique Device Identification (UDI) rule on September 24, 2014, but the UDI rule will also be applicable to CE Marked medical devices. In fact, the proposed EMDR states in Annex III that UDIs need to be recorded in the Declaration of Conformity. If a manufacturer outsources the packaging and labeling of devices to a supplier, then the supplier will need to maintain the database of UDI information for each lot. Many companies are finding that software validation of UDI databases is a major project that requires substantial resources and planning.

On Demand Printing of Labeling and Packaging

Recalls due to labeling errors have increased recently, and in 2014, approximately 15 percent of recalls were due to labeling errors. Therefore, manufacturers are reevaluating traditional batch printing of labels and packaging. Many manufacturers are changing the process for printing to on demand processes using software tools for label lifecycle management.

If packaging and labeling is outsourced, then suppliers must invest in new equipment and software to implement on demand printing. Part of the transition to on demand printing involves printing of country-specific instructions for use instead of inserting a multi-lingual booklet purchased by the manufacturer. This change will force contract manufacturers to develop processes for verifying that the correct translation is being used for each product.

Implementation of Revised ISO Standards

In parallel with changes to the medical device regulations for Europe, the quality system standards (i.e., ISO 9001 and ISO 13485) will also be changing. ISO 9001:2015 is expected to be released in October 2015, and the DIS2 for ISO 13485:201x was just released for comment. If these revised standards are harmonized, then contract manufacturers will be forced to implement these changes in order to meet the CE Marking requirements. Since the implementation of the "New Directives" in Europe more than 20 years ago, harmonization of ISO Standards has been the norm. However, the seven deviations identified in EN ISO 14971:2012 suggests that the European Commission may not automatically find the revised ISO 13485 standard acceptable.

RoHS2, REACH and WEEE Compliance

In parallel with the release of the EMDR, there is also a new restriction of hazardous substances directive (RoHS) that is being implemented RoHS Directive 2011/65/EU (RoHS 2). RoHS 2 expands the list of hazardous materials and the list of affected products. The RoHS 2 Directive became effective on July 21, 2011. However, most medical devices were exempt until July 22, 2014. In vitro diagnostic devices continue to enjoy an exemption until July 22, 2016. A working group from the RoHS/WEEE Technical Adaptation Committee drafted a document to help economic operators interpret RoHS 2 correctly and to ensure compliance with the new Directive’s requirements.

The primary impact of the RoHS 2 Directive is two-fold:

A simple certificate of conformity is not sufficient for demonstrating compliance in most cases. Subcontractors will need to provide a detailed certificate of analysis for component materials, by showing the actual levels of hazardous materials that are subject to the RoHS 2 Directive.

Conclusions

If contract manufacturers want to survive during this period of tougher European regulation, contract manufacturers and component suppliers need to be proactive and get additional training. Training needs to include general quality system requirements, EMDR, UDI regulations, and RoHS.

Suppliers should also consider developing new quality agreements to address the new regulations. Finally, suppliers may want to offer training to their customers on the new regulations as a way of building stronger relationships with those customers.

Rob Packard is a regulatory consultant and president of Medical Device Academy Inc. The consulting firm specializes in global regulatory submissions of medical devices, regulatory compliance, and continuing education for medical device companies. Reach him at [email protected].

[Image courtesy of: VENTRILOCK/FREEDIGITALPHOTOS.NET]