IVDR Conformity Assessment, Postmarket Surveillance, and Vigilance Requirements
The EU’s new In Vitro Diagnostic Regulation (2017/746) (IVDR) places a significant new regulatory burden on IVD manufacturers.
Not only will 80-90% of all manufacturers be subject to ongoing Notified Body scrutiny, they will also be required to produce reams of premarket technical data in order to gain CE Marking under the IVDR.
While a significant number of IVD manufacturers have a quality management system in place, many do not.
The European IVDR mandates that all manufacturers – even those who manufacture Class A products – have an operating QMS. While manufacturers of all Class A products need a modest QMS and may “self-declare” conformity with CE Marking, there is no free pass for manufacturers of Class B, C, and D products. Most companies currently in compliance with the FDA Quality System Regulation (21 CFR Part 820) will need to upgrade their systems to comply with ISO 13485:2016 if they have not already done so. Even though ISO 13485 is technically a voluntary standard for QMS compliance, in reality it is the de facto standard for QMS compliance and even FDA is moving in this direction.
Conformity Assessment Options for Manufacturers Under the IVDR
Manufacturers of Class C and D devices have options for conformity assessment in the IVDR as follows:
Article 46 mandates that all Notified Bodies must post their standard fees for performing conformity assessments, so it should be easy for you to compare prices as you prepare your compliance plan and budgets.
Vigilance and PMS Requirements in the IVDR
Chapter VII of the IVDR outlines which type of data, sources, and analysis methods manufacturers should collect as part of ongoing efforts related to postmarket activities. The purpose is to gather postmarket data as part of a manufacturer’s continuing review of risk versus clinical benefit associated with their products. The chapter is actually quite similar to what is required for medical devices under the MDR (EU 2017/745). This includes the need for manufacturers to:
- Establish a postmarket surveillance (PMS) system. (Article 78)
- Establish a PMS plan to guide the system. (Article 79)
- Prepare a Postmarket Surveillance Report (PMSR) outlining conclusions of data gathered from your PMS plan plus any corrective action. Updated as needed. (Article 80, Classes A and B only)
- Prepare a Periodic Safety Update Report (PSUR) that has the same information as a PMSR but also includes a risk analysis, sales volumes, user population characteristics, and use frequency. Update at least annually for Class D and every two years for Class C. (Article 81, Classes C and D only)
- Report serious incidents and Field Safety Corrective Actions (FSCA). (Article 82)
- Prepare trend reports on incidents. (Article 83)
- Analyze serious incidents and FSCAs and report them. (Article 84)
Annex III provides some additional detail on the technical documentation needed related to postmarket surveillance. Notable among the requirements is that you must maintain a “proactive and systematic process” of collecting information. Annex III also mandates that you prepare a Postmarket Performance Follow-Up Plan (PMPF) or provide a reason why it should not apply to your device.
An important thing to understand about postmarket surveillance under the IVDR is that your PMS process must be continuous and proactive (not static and reactive) and has a direct link to your risk management file. Gone are the days when you could market your IVD in Europe and assume all was well because no incidents were reported last year. Your Notified Body will be examining your efforts to proactively monitor the safety of your products on the EU market. Postmarket surveillance covers a wide variety of sources managed through a quality management system, so make sure this is integrated into your current processes or create new processes as required.
Save time and frustration. Download a fully linked IVDR Table of Contents that includes the original IVDR text.
Incident Reporting Under the IVDR
Article 82 details requirements for reporting incidents. As with medical devices, the IVDR mandates that your reporting take into account the severity of the incident. You are required to report an incident no later than 15 calendar days after you become aware of it. Incidents that might pose serious public health threats must be reported within 2 calendar days. Thus, if you learn about something on Friday you better report it by Sunday, even if it’s a preliminary report that will be appended later – no exceptions. If the incident caused a death or “serious deterioration in a person’s state of health,” the reporting timeframe is 10 days. There are many additional requirements in Article 82, so you’ll want to study this carefully.
EUDAMED: The New Centralized Database for Medical Devices and IVDs
Many companies have been performing PMS activities all along, especially if they’re marketing in other countries. However, this may seem like a bureaucratic overreach for companies that have not been required to do so and whose products have excellent safety records. Alas, there is a logical reason for it. With the implementation of the new Medical Device Regulation (EU 2017/745) in May 2020 will come the rollout of the long-planned EUDAMED database. EUDAMED, which will also be used for IVDs, will give European Competent Authorities in 27 countries a centralized reference to track serious incidents, field safety notices, corrective actions, and Periodic Safety Update Reports (PSUR) – all in the name of greater transparency and patient safety.
We Have More to Share About the IVDR
If you enjoy this post, read the last post in this series where we talk about what you can be doing right now to prepare for the IVDR. If you really want to “go deep” on the IVDR, consider our training class taking place in multiple cities. Oriel STAT A MATRIX is also available to assist with IVDD to IVDR transition strategy and gap assessments.