EU Medical Devices Directive Guide: By Anssi Ilmari Tynjälä

Face masks, medical gloves, and other medical devices are regulated by the Medical Devices Directive in the European Union. The scope of the Medical Devices Directive covers safety standards, labeling, quality management systems, product registration, and documentation. Further, some medical devices are more strictly regulated than others.

In this guide, written by Anssi Ilmari Tynjälä from Innovapro, you will learn what it takes for importers and manufacturers to ensure compliance with the Medical Devices Directive.

What is the Medical Devices Directive?

Basically the Medical Device Directive is an EU applicable statement adopted by all member states that establishes for the manufacturer,  the good practices and requirements to comply with the standards of this classification products, in order to be placed on the EU market with safety.

‘Medical device’ means any instrument, apparatus, appliance, software, material or other product, whether used alone or in combination, including the software intended by its manufacturer to be used specifically for diagnostic and/or therapeutic purposes and necessary for its proper application, intended by the manufacturer to be used for human beings.

Beyond this existing Directive, we are facing a significant change in this field as EU is about to implement the new MDR 2017/745 Medical Device Regulation which has many changes on the existing directive (MDD 93/42/EEC) like upgrading of requirements, new classification rules, upgrading of responsibilities of the economic actors, the inclusion of non-medical purpose products (previously not regulated or considered as medical devices) and the fact that it is the directly applicable law in all member states.

There is a whole new bunch of products that are now considered Medical Devices that weren’t before, so be careful and take time to check your imported product list and talk with a Regulatory Consultant if you have doubts.

The new adhesion products can be found in Annex XVI of the MDR 2017/745.

How are Medical Devices classified?

Medical Devices (or Sanitary Products, as also called in some countries) are classified depending on the grade of risk for the human body, intended use or in terms of general safety in the following groups:

Class I

(with other 2 subdivisions:  Class Im (measurement) and Class Ist (sterile))

Class IIa

Class IIb

Class III

Note: Software or apps can also be considered as a Medical Device

Is the CE mark mandatory for all medical devices?

From the basis that every product that enters the EU has requirements, yes, especially this group needs a CE marking evaluated by a Notified Body. Except for Class I (not including subdivisions, which also needs it).

Class I products have the same basic requirements but the evaluation by a Notified Body is not mandatory.

What documentation is needed?

This depends on the medical device class.

a. Documents required for ALL classes (Class 1)

1. That there is a Technical Construction File issued by the manufacturer

2. Translated User Manual (in the official language of the country we will place it into the market), *Note there are rules on the minimum content for this.

3. Product labeling according to requirements of the Directive/Regulation requirements

4. Declaration of Conformity (issued by the legal manufacturer, according to the Directive/Regulation requirements

5.Designation of EC REP (European Representative) by the manufacturer (if from outside the EU)

6. EC Certificate of Conformity of the product with the applicable standards (lab tests)

*Import license of medical devices (Issued by national Competent Authority, although it’s not required in all member states, what is necessary is the product registration or communication to these authorities)

Documents required IF only notified body is mandatory? (Class 2 and 3)

1. That there is a Technical Construction File issued by the manufacturer

2. Translated User Manual (in the official language of the country we will place it into the market), *Note there are rules on the minimum content for this.

3. Product labeling according to requirements of the Directive/Regulation requirements

4. Declaration of Conformity (issued by the legal manufacturer, according to the Directive/Regulation requirements

5. Designation of EC REP(European Representative) by the manufacturer (if from outside the EU)

6. EC Certificate of Conformity of the product (issued by a Notified Body) with the correct product scope and according to the Directive/Regulation.

7. ISO 13485 obtained by the legal manufacturer covering the activity/product scope

*Import license of medical devices (Issued by national Competent Authority, although it’s not required in all member states, what is necessary is the product registration or communication to these authorities)

Note: main requirements are basically the same, the main difference is that class I do not have the obligation to validate all these documents via Notified Body (also the content of the label, DoC, Manual, will be slightly different because of this)

What is a Notified Body?

The Notified Body is an EU based certification body Authorized by the EU to evaluate, audit and issue Certificates of compliance.

They check everything: the technical file in its totality, all test reports, procedures, and documents like labels, manuals DoC, etc.

Then check the documentation and then onsite to verify the manufacturer really is doing things he states he is going to do before issuing the certificate. So it’s a good way for the importer (after checking its validity) to not go through tons of documentation that in most cases he will even not understand.

Is a Notified Body required?

Except class I, all others are required to be audited by a Notified Body (including the subdivision of class I).

Is a Designated EC Rep required for all medical device classes?

Yes, all medical device needs to have the EC REP figure.

How does one find or become an EC Rep?

By signed contract (with the manufacturer) validated by the Notified Body, and by the communication from the company to the registered address country of the contract holder in EU. Most manufacturers hire EcRep agencies for this. They are legally responsible for all the products the particular manufacturer delivers to the EU and I would never recommend any importer to assume this responsibility.

The EcRep is the holder of all the documentation that the manufacturer used to pass the certification process and is in charge to surveil that they keep all documents updated among the legal responsibility.

It is not the same to be the ECRep than the importer.

Do I also need to register the product?

Every EU country has a Competent Authority on Medical Devices. In Spain, it’s the AEMPS (Agencia Español del Medicamento y Producto Sanitario) its a government agency (Like the FDA).

Where you need to communicate, Hey I’m going to place in the market this Medical Device.

Following is that they will ask you to supply all the relative documents described in the article before they allow you to place it in the market.

Medical Devices have the PMS (Post Market surveillance) which is only effective if these statements are made and there is correct traceability for the product.

If something happens, someone gets injured, dies, etc..and the product has not been communicated…guess who is legally responsible for it? (clue, it´s not the manufacturer)

Is lab testing required?

Especially in Medical Devices, the EN, ISO and other harmonized standards that apply to the product, maybe several different ones in most cases, so yes, lab tests by accredited testing laboratories are mandatory to prove compliance. This evidence can be required by the Notified Body and/or customs and/or National Competent Authority.

For a product, there is normally an applicable standard list. Sometimes it can be difficult (especially if you have a lack of experience) to know which standards apply to your product. In this case always turn to a dedicated expert or Regulatory Consultant to have this knowledge for your specific case, as every product has its specific requirements and they can not be generalized.

Is it mandatory for the original manufacturer to comply with Quality management systems such as ISO 13485?

It is not stated as mandatory to comply with ISO 13485 specifically, but yes they must assure a Quality Management System and the one that is specific for this product range is the ISO 13485, so it’s far more than logical that the Notified Body or other authority requests this ISO fulfillment before emitting the EC Certificate to a manufacturer or as evidence of compliance.

We have to remember that ISO standards are not mandatory, but the requirements involving the Directive/Regulation focus on major points covered by this ISO so if a manufacturer wants an accepted and easy way to prove compliance, this is the way.

How can I check if my supplier is capable of supplying correctly certified products?

Here are the key questions that must be answered:

Is my supplier ISO 13485 certified?

Has my supplier existing products complied with 93/42/EEC Directive or MDR 2017/745 Regulation already?

These are good signs that my possible supplier has gone through the process and understands the requirements to comply with this kind of Directive/Regulation.

In this case, you can check the certificate issuer, as most Notified Bodies have a so-called Certificate Finder on their websites and a company that certifies a product normally uses (because of convenience) the same Notified Body to obtain their ISO13485.

My recommendation is always turning to the Notified Body to verify the Certificate a supplier sends, and check it is valid. We have to remember that certificates issued with these standards, that are not issued by a Notified Body, or that have been photoshopped are unfortunately quite common practices by some suppliers in order to sell.

Therefore we also have to understand what a Notified Body is and the role it plays in compliance assurance.

A Notified Body is an EU based certification organization with an assigned identification number of 4 numerical digits that follows the CE marking which is also related to the certification they issue. With this number, you can know which Notified Body is responsible for the certificate and you can check the authenticity of the documents sent by a supplier on this page.

How do I know if an existing ODM medical device is certified and compliant?

1. Firstly we need to check that the documents listed before are supplied.

2. Secondly, we need to match these documents to the model/description of the product we intend to import.

Example: Let’s suppose I have a supplier that provides me a certificate of Product Z, model X, but the supplier offers me a cheaper version of the same product Z with model Y. If this model is not in the scope of the certificate, we cannot consider importing this item legally. However, the certificates can scope a family ( in general), in which case it is legitimate if all the rest of the documents are in place and in force for this reference.

But as a recommendation, I always ask for enough evidence to be sure my product and model are covered. (if my certificate covers sliced bread, it doesn’t automatically mean cover baguettes)

It’s not the first time a supplier that has the correct paperwork for “X product family” tries to sell you ”Y product family” trying to make you believe “Y product family” is ok to buy also, it doesn’t work like that. (If my certificate cover bread, I cannot sell cheese)

Do I know the applicable standard list for my product?

When a solicit proof of compliance and I receive all the documents stated earlier, am I capable to know they are correct?

Example: A Declaration of Conformity issued by a manufacturer has to have the applied standard list,

And when I see that EN 60601-1-2: 2012 was applied, do I know this is the correct one for my product?

Which others does it need to have?

Therefore, especially if you are novel you should turn to expert guidance.

How does the process differ between OEM and ODM products?

If we import a finished product we have to take care of all what has been mentioned previously, but if we subcontract manufacturing according to our specific requirements and/or with our brand/logo on the product we need to be aware that legally we become the manufacturer,

Therefore we are the only legally responsible to ensure compliance and be the holder of all the mentioned compliance documents. (And we have to apply for manufacturing license from our Competent Authority)

1. We force our supplier to handle the whole Regulatory part so that our supplier certifies our product the same way he did others for himself.

2. We implant the whole process ourselves so that we manage all the documental, testing and auditory processes in our name.

3. We subcontract our supplier as a critical supplier and together with their existing certificates-documents, we make ours.

We need to be aware that certifying a Medical Device with the involvement of a Notified Body is not done in one day or for no cost.

Normally the complete process for a product family or reference is timed in 6-12 months with costs up to 100.000 USD in some cases (being roughly -30% in case 1, and -50% in case 3) but this is just an orientation based on my experience and type of product.

About Anssi Ilmari Tynjälä

Born in Finland in 1980, and living in Spain since 1987, Nowadays Associate Director, Purchase Manager, Quality Manager of ISO13485, Regulatory Affairs Director and Technical Department Director in Innovapro company (Spain) importer and manufacturer, focused on medical aesthetic devices.

Working in the company since 2001, and taking hold of importing processes since 2007 mainly from China, Korea, and other EU countries.

My main functions are production development, auditory of suppliers, quality and regulatory assurance and compliance, international relations and management of the complete import/export processes for our organization.