The EU Commission’s proposal aims to streamline and future-proof the regulatory framework for medical devices and IVDs in order to prevent supply shortages and products being taken from the EU market, while still maintaining a high level of public health protection.
Key aspects of the proposal are summarized below.
Measures to simplify regulatory requirements and reduce administrative burden
Validity of certificates
The current maximum validity of notified body certificates of conformity of five years would be removed so that certificates are generally not limited in time. Notified bodies would, however, still be entitled to define a maximum validity based on duly justified grounds and would carry out periodic reviews proportionate to the risk class of the respective device.
Classification rules
The proposal includes changes to the classification rules under the MDR. For example, the proposal suggests that all reusable surgical instruments are classified as Class I, regardless of the body part with which they come into contact. Furthermore, the classification rule for software would be amended, which could lead to significantly more software being classified as Class I.
PRRC
Requirements regarding the person responsible for regulatory compliance (PRRC) would be alleviated. In particular, the detailed qualification requirements for the PRRC would be removed and micro and small enterprises (less than 50 employees and less than EUR10 million in turnover or balance sheet) would not be required to have their external PRRC “permanently and continuously” available.
Post-market surveillance
The frequency with which the PSUR has to be updated would be decreased (for example for Class III or IIb devices from at least annually at present to once in the first year after certification and every two years thereafter). The reporting timeline for serious incidents that are not related to public health threats, death, or serious deterioration of health would be expanded from 15 days to 30 days.
Well-established technology devices
The proposal suggests more proportionate requirements for “well-established technology devices” (defined based on certain criteria such as having a simple, common and stable design and not being associated with safety issues in the past). Such devices would, inter alia, be exempted from the requirements to draw up a summary of safety and clinical performance, as well as to have the periodic safety update report (PSUR) reviewed by a notified body.
Measures to support innovation
In-house devices
The proposal suggests providing more flexible conditions for in-house devices (devices manufactured or modified by a health institution and used exclusively within that same facility). In particular, in-house IVDs would no longer be subject to the condition that no equivalent device is available on the market, certain documentation requirements would be removed and the transfer of in-house devices to another health institution would be possible in duly justified cases. Furthermore, the proposal intends to expand the scope of in-house devices to cover laboratory-developed tests of central laboratories exclusively used for clinical trials.
Breakthrough and orphan devices to be prioritized
The proposal introduces criteria for breakthrough devices (devices with a high degree of novelty and a significant clinical impact for a life-threatening or irreversibly debilitating disease) and orphan medical devices (intended for the treatment, diagnosis, or prevention of a disease or condition that affects not more than 12,000 individuals in the EU per year and for which either: (i) insufficient alternatives are available or (ii) the device provides a significant clinical benefit). Once designated by an expert panel, breakthrough devices and orphan devices could benefit from prioritized conformity assessment procedures and the option of a rolling review. Orphan devices CE marked under the previous directives would benefit from additional grandfathering provisions.
Derogations from conformity assessment procedures
In addition to the current possibility for national competent authorities to authorize the placing on the market of non-CE-marked devices in the interest of public health or patient safety or health, the proposal would entitle the EU Commission to authorize the placing on the market in the event of a public health emergency at EU level and the national competent authorities to authorize deviations from the requirements related to changes to manufacturing, design, or intended purpose in the event of serious cross-border health threats, disasters, or crises.
Regulatory sandboxes
The proposal suggests the introduction of regulatory sandboxes (controlled environments for the development, testing, validation, and use of innovative products or technologies under regulatory supervision). These sandboxes can be established by the EU Commission or the member states to address the needs of innovative and emerging health technologies.
Measures to ensure availability of devices
Critical devices
The proposal suggests establishing an IT tool for information exchange regarding the interruption or discontinuation of supply of critical devices. The European Medicines Agency (EMA) would create a list of critical devices that are subject to such an information obligation.
International cooperation
The proposal provides for increased international cooperation, for example through the EU Commission participating in international programs such as the Medical Device Single Audit Program (MDSAP) and in bilateral or multilateral reliance mechanisms or reliance programs, potentially providing significant benefits for medical device manufacturers.
Measures to increase predictability and cost-efficiency
Notified body timelines and fees
The proposal suggests notified body fee reductions for micro and small enterprises as well as for orphan devices. In addition, the EU Commission has recently published another draft implementing regulation to create uniform requirements for conformity assessment procedures, including cost transparency and maximum timelines.
Notified body involvement
Overall, the proposal intends to reduce notified body involvement in the conformity assessment procedures for medium-risk devices (e.g., by reducing the assessment of the technical documentation to one representative device of a category of devices/generic device group for Class IIa/IIb medical devices and Class B/C IVDs). Notified bodies would be entitled to carry out remote audits instead of on-site audits.
Measures to improve interplay with other EU legislation
AI Act
Under the proposal, most requirements for high-risk AI systems under Regulation (EU) 2024/1689 (AI Act) would become inapplicable for AI medical devices to avoid overlaps. The EU Commission would, however, be entitled to lay down specific requirements for AI-based devices via implementing or delegated acts, leaving some uncertainties.
Combined studies
The proposal provides for a single application and coordinated assessment for clinical studies involving medicinal products, medical devices, and/or IVDs.
Cybersecurity
The proposal clarifies the interplay with Regulation (EU) 2024/2847 (Cyber Resilience Act). Currently, cybersecurity-related incidents that do not concern public health or patient safety are not reported, as medical devices are exempted from the scope of the Cyber Resilience Act. According to the proposal, cybersecurity vulnerabilities and severe incidents would have to be reported to the computer security incident response teams (CSIRTs) and to the European Union Agency for Cybersecurity (ENISA). Cybersecurity requirements would become part of the general safety and performance requirements.
Conclusion
The long-awaited proposal by the EU Commission constitutes a crucial step towards a future-proof regulatory framework for medical devices in the EU that maintains the high level of public health protection introduced by MDR/IVDR but avoids an unnecessary regulatory burden for the medical device industry, which largely consists of small and medium-sized enterprises.
The proposal will have to pass the EU Parliament and the Council of the EU before it can enter into force. The forthcoming negotiations between the European Parliament and the Council might refine several aspects of the proposal, particularly those relating to classification rules or the interactions with the AI Act. However, since the EU Parliament had already asked the EU Commission to propose “a systematic revision” of MDR/IVDR in a resolution in October 2024, it can be expected that the proposed amendments to the regulatory framework will be generally aligned with the legislators’ expectations.
Manufacturers, notified bodies, and health institutions should begin assessing how the proposed amendments may affect their regulatory strategies, including device classification, pathways and timelines for conformity assessment as well as post-market surveillance systems. Currently, stakeholders have the opportunity to submit their feedback during the next eight weeks, which will contribute to the further legislative process.
The EU Commission currently expects the new regulatory framework to be adopted and to become applicable by Q2 2027.
