IVDR: The EU’s In Vitro Diagnostic Regulation for Medical Diagnostic Tests
Frequently asked questions about IVDR
What is IVDR?
IVDR defined
IVDR or the in vitro diagnostic regulation was created to assure conformity for all in vitro diagnostic (IVD) medical devices used in the EU. This applies to all new IVDs, but also to all IVDs currently conforming to the 1998 In Vitro Medical Devices Directive; no grandfathering has been allowed.
What is an in vitro diagnostic medical device?
The regulation applies to any device intended for a use that examines or monitors humans. The regulation has broad implications; it can refer to any part of a system used to test specimens, from reagents, apparatuses, and kits, up to the software used to look at the results. Think anything from blood grouping, COVID tests or genetic testing, to glucose monitors or pregnancy tests. Accessories for any such devices need to be classified separately, so the entire process to reach conformity applies separately for all components.
When was the IVDR created and by whom?
The European Commission undertook public consultations in 2008 and 2010, recognizing the 1998 IVDD (in vitro medical devices directive) and the medical devices directive (MDD) and active implantable medical devices directive (AIMDD) weren’t keeping up with new genetic testing and modern devices. They wanted to streamline these three medical device directives. Then in 2010, the deficiencies in the existing directives were brought into sharp relief when the PIP Scandal came to light.
In 2001, Poly Implant Prothèse (PIP) cut manufacturing costs of its silicone breast implants by switching from medical-grade to industrial-grade silicone. This silicone change introduced impurities and increased a risk of rupture by 500 percent. By 2010, when the scandal came to light, PIP implants were implicated in several deaths due to toxicity or breast cancer. Post-marketing surveillance was considered a failure resulting in the scandal and is one of the aspects improved upon with the new regulations.
What countries are affected by IVDR?
This regulation is in force in all 27 member states of the EU, as well as Iceland, Liechtenstein, Norway, and Switzerland (the European Free Trade Association States). With Brexit now a reality, it is not in force within the United Kingdom. If you want to sell your in vitro diagnostics, software, or accessories in these countries, you must have them approved by the date of application—May 26, 2022. If your business is not part of the EU, you will need to find an authorized representative to help you with the conformity process.
By use of a regulation for the new IVDR, instead of a directive, it means it is immediately binding. If the European Commission (EC) had left the regulation as a directive, it would have been necessary for every single country to transpose it into their own laws.
What does conformity look like?
Each IVD that has gone through the conformity process and meets the requirements of the regulation will be marked with the CE (Conformité Européenne) mark. The CE mark indicates to consumers that the product or device conforms to all EU standards for health and safety.
How long does IVDR certification last?
Once a certificate is issued for an IVD under the IVDR, it is valid for five years. CE certificates issued under the old IVDD, prior to IVDR entering into force in 2017, are still valid for their full five years. During the transition period (May 2017-May 2022), certificates can be issued under either the old IVDD or the new IVDR. IVDD certificates will no longer be issued after May 2022; CE certificates issued under the IVDD during the transition period may be valid for up to five years, depending on when in the transition period they were issued. All IVDD certificates expire two years after the IVDR Date of Application (May 2022), regardless of when they were issued.
IVDR vs MDR
To confuse matters, the IVDR isn’t the only regulation the EU is undertaking to ensure medical standards are upheld. The MDR (medical device regulation) impacts medical “devices” that are to be used on humans. This includes items from bandages, swabs, and needles to hospital beds and wheelchairs, but it also includes things like contraceptive devices. The MDR has a slightly different timeline, coming into effect sooner than the IVDR. This regulation will impact the implementation of the IVDR as the same bodies are involved in both.
What is the timeline for IVDR implementation?
Original timeline
The Commission released the first versions of the IVDR and MDR regulations in 2012, followed by formal publication of both regulations in the Official Journal of the European Union (OJEU) May 5, 2017. Both regulations came into force May 25, 2017. That date was the start of a three-year transition period for MDR and a five-year transition period for the IVDR before documentation needed to be updated to meet the new requirements for conformity.
Modified timeline
May 2020 was the original Date of Application for the new MDR, meaning all medical devices needed to meet the requirements of the regulation and have completed the conformity process. But on April 24, 2020, due to the COVID-19 pandemic interfering with all aspects of the process, the European Commission pushed off the compliance date for MDR to May 26, 2021. Although there are currently no changes to the IVDR compliance date of May 2022, there is industry pressure to push that off.
What changes does the IVDR make to diagnostic compliance?
One of the biggest changes in the IVDR is the adoption of a risk-based classification system. This replaces the list-based system of the predecessor IVDD. This also brings the EU in line with international standards being established by the Global Harmonization Task Force (GHTF) of the World Health Organization (WHO).
The new standards also tighten regulations, adopt standard nomenclature, improve post-market surveillance, and broaden the definitions of the devices, bringing things like software or other digital technologies under the regulation.
The PIP scandal highlighted the problems with self-certification, so another big change is the requirement for the use of notified bodies (NBs) for classification and oversight of compliance for far more devices/diagnostics. NBs assess conformity of products before they are placed on the market. Operators requiring use of an NB are free to choose any of those registered in the database. Only the lowest-risk classification (Class A) will not require NB intervention. These same NBs are also busy bringing medical devices into compliance with the new MDR, adding strain to the system and industry fears about meeting deadlines.
The certification in the new IVDR also adopts a life-cycle approach. Manufacturers will be required to implement systems to ensure transparency with living documentation and post-market performance analyses.
Finally, to rise to the challenge of keeping track of all the MDs and IVDs, the European Commission is requiring these devices to be input into EUDAMED (European Databank on Medical Devices). The Commission will create the structure and maintain the technical aspects of EUDAMED, but users are required to add and update the content.
EUDAMED, The European Databank on Medical Devices?
EUDAMED is an IT system of several interacting databases. There are six interconnected modules that will work together to create EUDAMED. They are the Actors Registration, UDI/Devices Registration, the Notified Bodies and Certificates, Clinical Investigations and Performance Studies, Vigilance and Post-Market Surveillance, and Market Surveillance modules.
Actors registration and upcoming modules
The first EUDAMED module available, the actors registration, came online in December 2020. Economic operators (manufacturers, authorized representatives, producers, and importers) from the EU 27, Iceland, Liechtenstein, and Norway can register with this module. Non-EU manufacturers will also be able to register, but only if they have an authorized representative within the union. Operators in the UK, Switzerland, and Turkey currently cannot register, although the Commission says they will be able to submit registration later.
The other five modules are expected to be brought online in stages. May 2021 will see the UDI/Devices Registration and the Notified Bodies and Certificates modules brought online. The remaining three modules will follow, although with no given timeline—Clinical Investigations and Performance Studies, Vigilance and Post-Market Surveillance, and Market Surveillance modules.
What is a UDI?
As part of the global harmonization of medical devices, many countries, including the US and EU, are adopting a standardized Unique Device Identification (UDI) system. All medical devices affected by the IVDR and MDR will require a UDI.
What are the categories of IVDs?
Under the IVDR, in vitro medical devices are classified based on seven rules identifying their risk profile. Each IVD will fall into four risk categories based on the application of those rules. Each intended use requires its own classification and the highest classification always applies. Class B (as defined by rule 6) is the catch-all; all IVDs fall under the scope of the regulation, even if the other rules don’t seem to apply.
Full listing of the IVDR classification rules can be found in Annex VIII of the REGULATION (EU) 2017/746 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
What is the process for establishing conformity of IVDs?
Each risk class requires its own path to conformity, but they all start with the determination of the risk class. Given that class A is the only one not requiring an NB’s intervention, the notified body you choose will help work through the process. Authorized representatives, for those outside the EU, should also be able to help with this process. In general, here are some of the steps that may be necessary:
Risk assessment
Classification of IVDs is based upon their risk profile, which is determined by seven rules laid out in the regulation. Risk assessment will be the first thing done when considering conformity for an IVD and it must be done for every IVD, even individual components of a larger diagnostic.
Technical documentation
All IVDs must have all technical documentation in place. Some of the requirements for documentation includes the device description and specifications, how it is manufactured, safety, performance, and risk management. Ongoing documentation will also be required to stay in compliance, such as post-market surveillance.
QMS (Quality Management Systems)
All IVDs will require QMS (Quality Management Systems) audits to demonstrate that the structures and procedures of the manufacturing process will allow for the maintenance of the IVD effectiveness throughout its life cycle.
CA (Competent Authority) or EMA (European Medicines Agency) consultation
Competent Authority (CA) or European Medicines Agency (EMA) consultations may be required for class C or D IVDs. The EMA is responsible for evaluating the safety and performance of medical devices in the EU. National Competent Authorities (CAs) are partners for the EMA. The CA of each member state can authorize medicines that have not been passed through a centralized, EU-wide application.
Verification by an EU reference lab
The conformity procedures for class D IVDs will require the involvement of an EU Reference Lab. These labs will verify the manufacturer’s performance claims for the IVD and ensure their compliance with the EU’s Common Specifications.
Declaration of conformity
Following the rest of the conformity procedures, the manufacturer must complete a Declaration of Conformity. The details of this declaration are laid out in Annex IV of the regulation. It will include information such as the name, trademark, the manufacturer, any authorized representatives, a statement declaring that the conformity is issued under the manufacturer’s responsibility, the UDI (unique device identification) number, and more.
What happens after conformity is established?
One of the goals of the regulation was to create a process emphasizing the life cycle of IVDs. Part of this is the requirement to show QMS (quality management systems) are in place. Another part is post-market surveillance. The plans for post-market surveillance require monitoring for safety, clinical performance, and risk-benefit analyses. Regular updates must be submitted for the highest risk IVDs to EUDAMED and have them reviewed by the manufacturer’s notified body. Any serious incidents or fixes must also be reported through EUDAMED, following investigations by the manufacturer. Finally, if the incident is serious enough, it must be reported directly to any EU member states involved in the incident.
The regulation also requires regular updating of the certification for IVDs. A conformity certification will be valid for five years, so the process will start again for each IVD every five years.
