1.1.1. Each notified body shall be established under the national law of a Member State, or under the law of a third country with which the Union has concluded an agreement in this respect. Its legal personality and status shall be fully documented. Such documentation shall include information about ownership and the legal or natural persons exercising control over the notified body.
1.1.2. If the notified body is a legal entity that is part of a larger organisation, the activities of that organisation as well as its organisational structure and governance, and the relationship with the notified body shall be clearly documented. In such cases, the requirements of Section 1.2 are applicable to both the notified body and the organisation to which it belongs.
1.1.3. If a notified body wholly or partly owns legal entities established in a Member State or in a third country or is owned by another legal entity, the activities and responsibilities of those entities, as well as their legal and operational relationships with the notified body, shall be clearly defined and documented. Personnel of those entities performing conformity assessment activities under this Regulation shall be subject to the applicable requirements of this Regulation.
1.1.4. The organisational structure, allocation of responsibilities, reporting lines and operation of the notified body shall be such that they ensure that there is confidence in the performance by the notified body and in the results of the conformity assessment activities it conducts.
1.1.5 The notified body shall clearly document its organisational structure and the functions, responsibilities and authority of its top-level management and of other personnel who may have an influence upon the performance by the notified body and upon the results of its conformity assessment activities.
1.1.6 The notified body shall identify the persons in top-level management that have overall authority and responsibility for each of the following:
the provision of adequate resources for conformity assessment activities;
the development of procedures and policies for the operation of the notified body;
the supervision of implementation of the procedures, policies and quality management systems of the notified body;
the supervision of the notified body’s finances;
the activities and decisions taken by the notified body, including contractual agreements;
the delegation of authority to personnel and/or committees, where necessary, for the performance of defined activities;
the interaction with the authority responsible for notified bodies and the obligations regarding communications with other competent authorities, the Commission and other notified bodies.
1.2. Independence and impartiality
1.2.1. The notified body shall be a third-party body that is independent of the manufacturer of the device in relation to which it performs conformity assessment activities. The notified body shall also be independent of any other economic operator having an interest in the device as well as of any competitors of the manufacturer. This does not preclude the notified body from carrying out conformity assessment activities for competing manufacturers.
1.2.2. The notified body shall be organised and operated so as to safeguard the independence, objectivity and impartiality of its activities. The notified body shall document and implement a structure and procedures for safeguarding impartiality and for promoting and applying the principles of impartiality throughout its organisation, personnel and assessment activities. Such procedures shall provide for the identification, investigation and resolution of any case in which a conflict of interest may arise, including involvement in consultancy services in the field of devices prior to taking up employment with the notified body. The investigation, outcome and its resolution shall be documented.
1.2.3. The notified body, its top-level management and the personnel responsible for carrying out the conformity assessment tasks shall not:
be the designer, manufacturer, supplier, installer, purchaser, owneror maintainer of devices which they assess, nor the authorised representative of any of those parties. Such restriction shall not preclude the purchase and use of assessed devices that are necessary for the operations of the notified body and the conduct of the conformity assessment, or the use of such devices for personal purposes;
be involved in the design, manufacture or construction, marketing, installation and use, or maintenance of the devices for which they are designated, nor represent the parties engaged in those activities;
engage in any activity that may conflict with their independence of judgement or integrity in relation to conformity assessment activities for which they are designated;
offer or provide any service which may jeopardise the confidence in their independence, impartiality or objectivity. In particular, they shall not offer or provide consultancy services to the manufacturer, its authorised representative, a supplier or a commercial competitor asregards the design, construction, marketing or maintenance of devices or processes under assessment, and
be linked to any organisation which itself provides consultancy services as referred to in point (d). Such restriction does not preclude general training activities that are not client specific and that relate to regulation of devices or to related standards.
1.2.4. Involvement in consultancy services in the field of devices prior to taking up employment with a notified body shall be fully documented at the time of employment and potential conflicts of interest shall be monitored and resolved in accordance with this Annex. Personnel who were formerly employed by a specific client, or provided consultancy services in the field of devices to that specific client prior to taking up employment with a notified body, shall not be assigned for conformity assessment activities for that specific client or companies belonging to the same group for a period of three years.
1.2.5. The impartiality of notified bodies, of their top-level management and of the assessment personnel shall be guaranteed. The level of the remuneration of the top-level management and assessment personnel of a notified body and subcontractors, involved in assessment activities shall not depend on the results of the assessments. Notified bodies shall make publicly available the declarations of interest of their top-level management.
1.2.6. If a notified body is owned by a public entity or institution, independence and absence of any conflict of interest shall be ensured and documented between, on the one hand, the authority responsible for notified bodies and/or the competent authority and, on the other hand, the notified body.
1.2.7. The notified body shall ensure and document that the activities of its subsidiaries or subcontractors, or of any associated body, including the activities of its owners do not affect its independence, impartiality or the objectivity of its conformity assessment activities.
1.2.8. The notified body shall operate in accordance with a set of consistent, fair and reasonable terms and conditions, taking into account the interests of small and medium-sized enterprises as defined in Recommendation 2003/361/EC in relation to fees.
1.2.9. The requirements laid down in this Section in no way preclude exchanges of technical information and regulatory guidance between a notified body and a manufacturer applying for conformity assessment.
1.3.1. The notified body shall have documented procedures in place ensuring that its personnel, committees, subsidiaries, subcontractors, and any associated body or personnel of external bodies respect the confidentiality of the information which comes into its possession during the performance of conformity assessment activities, except when disclosure is required by law.
1.3.2. The personnel of a notified body shall observe professional secrecy in carrying out their tasks under this Regulation or any provision of national law giving effect to it, except in relation to the authorities responsible for notified bodies, competent authorities for medical devices in the Member States or the Commission. Proprietary rights shall be protected. The notified body shall have documented procedures in place in respect of the requirements of this Section.
1.4.1. The notified body shall take out appropriate liability insurance for its conformity assessment activities, unless liability is assumed by the Member State in question in accordance with national law or that Member State is directly responsible for the conformity assessment.
1.4.2. The scope and overall financial value of the liability insurance shall correspond to the level and geographic scope of activities of the notified body and be commensurate with the risk profile of the devices certified by the notified body. The liability insurance shall cover cases where the notified body may be obliged to withdraw, restrict or suspend certificates.
1.5. Financial requirements
The notified body shall have at its disposal the financial resources required to conduct its conformity assessment activities within its scope of designation and related business operations. It shall document and provide evidence of its financial capacity and its long-term economic viability, taking into account, where relevant, any specific circumstances during an initial start-up phase.
1.6. Participation in coordination activities
1.6.1. The notified body shall participate in, or ensure that its assessment personnel is informed of, any relevant standardisation activities and in the activities of the notified body coordination group referred to in Article 49 and that its assessment and decision-making personnel are informed of all relevant legislation, guidance and best practice documents adopted in the framework of this Regulation.
1.6.2. The notified body shall take into consideration guidance and best practice documents.
2. QUALITY MANAGEMENT REQUIREMENTS
2.1. The notified body shall establish, document, implement, maintain and operate a quality management system that is appropriate to the nature, area and scale of its conformity assessment activities and is capable of supporting and demonstrating the consistent fulfilment of the requirements of this Regulation.
2.2. The quality management system of the notified body shall address at least the following:
management system structure and documentation, including policies and objectives for its activities;
policies for assignment of activities and responsibilities to personnel;
assessment and decision-making processes in accordance with the tasks, responsibilities and role of the notified body’s personnel and top-level management;
the planning, conduct, evaluation and, if necessary, adaptation of its conformity assessment procedures;
control of documents;
control of records;
corrective and preventive actions;
complaints and appeals; and
Where documents are used in various languages, the notified body shall ensure and control that they have the same content.
2.3. The top-level management of the notified body shall ensure that the quality management system is fully understood, implemented and maintained throughout the notified body organisation including subsidiaries and subcontractors involved in conformity assessment activities pursuant to this Regulation.
2.4. The notified body shall require all personnel to formally commit themselves by a signature or equivalent to comply with the procedures defined by the notified body. That commitment shall cover aspects relating to confidentiality and to independence from commercial and other interests, and any existing or prior association with clients. The personnel shall be required to complete written statements indicating their compliance with confidentiality, independence and impartiality principles.
3. RESOURCE REQUIREMENTS
3.1.1. Notified bodies shall be capable of carrying out all the tasks falling to them under this Regulation with the highest degree of professional integrity and the requisite competence in the specific field, whether those tasks are carried out by notified bodies themselves or on their behalf and under their responsibility.
In particular, notified bodies shall have the necessary personnel and possess or have access to all equipment, facilities and competence needed to perform properly the technical, scientific and administrative tasks entailed in the conformity assessment activities in relation to which they have been designated.
Such requirement presupposes at all times and for each conformity assessment procedure and each type of devices in relation to which they have been designated, that the notified body has permanent availability of sufficient administrative, technical and scientific personnel who possess experience and knowledge relating to the relevant devices and the corresponding technologies. Such personnel shall be in sufficient numbers to ensure that the notified body in question can perform the conformity assessment tasks, including the assessment of the medical functionality, clinical evaluations and the performance and safety of devices, for which it has been designated, having regard to the requirements of this Regulation, in particular, those set out in Annex I.
A notified body’s cumulative competences shall be such as to enable it to assess the types of devices for which it is designated. The notified body shall have sufficient internal competence to critically evaluate assessments conducted by external expertise. Tasks which a notified body is precluded from subcontracting are set out in Section 4.1.
Personnel involved in the management of the operation of a notified body’s conformity assessment activities for devices shall have appropriate knowledge to set up and operate a system for the selection of assessment and verification staff, for verification of their competence, for authorisation and allocation of their tasks, for organisation of their initial and ongoing training and for the assignment of their duties and the monitoring of those staff, in order to ensure that personnel who carry out and perform assessment and verification operations are competent to fulfil the tasks required of them.
The notified body shall identify at least one individual within its top-level management as having overall responsibility for all conformity assessment activities in relation to devices.
3.1.2. The notified body shall ensure that personnel involved in conformity assessment activities maintain their qualification and expertise by implementing a system for exchange of experience and a continuous training and education programme.
3.1.3. The notified body shall clearly document the extent and limits of duties and responsibilities and the level of authorisation of the personnel, including any subcontractors and external experts, involved in conformity assessment activities and inform those personnel accordingly.
3.2. Qualification criteria in relation to personnel
3.2.1. The Notified Body shall establish and document qualification criteria and procedures for selection and authorisation of persons involved in conformity assessment activities, including as regards knowledge, experience and other competence required, and the required initial and ongoing training. The qualification criteria shall address the various functions within the conformity assessment process, such as auditing, product evaluation or testing, technical documentation review and decision-making, as well as the devices, technologies and areas, such as biocompatibility, sterilisation, tissues and cells of human and animal origin and clinical evaluation, covered by the scope of designation.
3.2.2. The qualification criteria referred to in Section 3.2.1 shall refer to the scope of a notified body’s designation in accordance with the scope description used by the Member State for the notification referred to in Article 42(3), providing a sufficient level of detail for the required qualification within the subdivisions of the scope description.
Specific qualification criteria shall be defined at least for the assessment of:
the pre-clinical evaluation,
tissues and cells of human and animal origin,
devices that incorporate as an integral part a medicinal product,
devices that are composed of substances or of combinations of substances that are absorbed by or locally dispersed in the human body and
the different types of sterilisation processes.
3.2.3. The personnel responsible for establishing qualification criteria and for authorising other personnel to perform specific conformity assessment activities shall be employed by the notified body itself and shall not be external experts or subcontracted. They shall have proven knowledge and experience in all of the following:
Union devices legislation and relevant guidance documents;
the conformity assessment procedures provided for in this Regulation;
a broad base of knowledge of device technologies and the design and manufacture of devices;
the notified body’s quality management system, related procedures and the required qualification criteria;
training relevant to personnel involved in conformity assessment activities in relation to devices;
adequate experience in conformity assessments under this Regulation or previously applicable law within a notified body.
3.2.4. The notified body shall have permanent availability of personnel with relevant clinical expertise and where possible such personnel shall be employed by the notified body itself. Such personnel shall be integrated throughout the notified body’s assessment and decision-making process in order to:
identify when specialist input is required for the assessment of the clinical evaluation conducted by the manufacturer and identify appropriately qualified experts;
appropriately train external clinical experts in the relevant requirements of this Regulation, CS, guidance and harmonised standards and ensure that the external clinical experts are fully aware of the context and implications of their assessment and the advice they provide;
be able to review and scientifically challenge the clinical data contained within the clinical evaluation, and any associated clinical investigations, and appropriately guide external clinical experts in the assessment of the clinical evaluation presented by the manufacturer;
be able to scientifically evaluate and, if necessary, challenge the clinical evaluation presented, and the results of the external clinical experts’ assessment of the manufacturer’s clinical evaluation;
be able to ascertain the comparability and consistency of the assessments of clinical evaluations conducted by clinical experts;
be able to make an assessment of the manufacturer’s clinical evaluation and a clinical judgement of the opinion provided by any external expert and make a recommendation to the notified body’s decision maker; and
be able to draw up records and reports demonstrating that the relevant conformity assessment activities have been appropriately carried out.
3.2.5. The personnel responsible for carrying out product-related reviews (product reviewers), such as technical documentation reviews or type examination, including aspects such as clinical evaluation, biological safety, sterilisation and software validation, shall have all of the following proven qualifications:
successful completion of a university or a technical college degree orequivalent qualification in relevant studies, e.g. medicine, pharmacy,engineering or other relevant sciences;
four years’ professional experience in the field of healthcare products or related activities, such as in manufacturing, auditing or research, of which two years shall be in the design, manufacture, testing or use of the device or technology to be assessed or related to the scientific aspects to be assessed;
knowledge of device legislation, including the general safety and performance requirements set out in Annex I;
appropriate knowledge and experience of relevant harmonised standards, CS and guidance documents;
appropriate knowledge and experience of risk management and related device standards and guidance documents;
appropriate knowledge and experience of clinical evaluation;
appropriate knowledge of the devices which they are assessing;
appropriate knowledge and experience of the conformity assessment procedures laid down in Annexes IX to XI, in particular of the aspects of those procedures for which they are responsible, and adequate authorisation for carrying out those assessments;
the ability to draw up records and reports demonstrating that the relevant conformity assessment activities have been appropriately carried out.
3.2.6. The personnel responsible for carrying out audits of the manufacturer’s quality management system (site auditors) shall have all of the following proven qualifications:
successful completion of a university or a technical college degree orequivalent qualification in relevant studies, such as medicine, pharmacy, engineering or other relevant sciences;
four years’ professional experience in the field of healthcare products or related activities, such as in manufacturing, auditing or research, of which two years shall be in the area of quality management;
appropriate knowledge of devices legislation as well as related harmonised standards, CS and guidance documents;
appropriate knowledge and experience of risk management and related device standards and guidance documents;
appropriate knowledge of quality management systems and related standards and guidance documents;
appropriate knowledge and experience of the conformity assessment procedures laid down in Annexes IX to XI, in particular of the aspects of those procedures for which they are responsible, and adequate authorisation for carrying out those audits;
training in auditing techniques enabling them to challenge quality management systems;
the ability to draw up records and reports demonstrating that the relevant conformity assessment activities have been appropriately carried out.
3.2.7. The personnel with overall responsibility for final reviews and decision-making on certification shall be employed by the notified body itself and shall not be external experts or be subcontracted. Those personnel shall, as a group, have proven knowledge and comprehensive experience of all of the following:
devices legislation and relevant guidance documents;
the device conformity assessments relevant to this Regulation;
the types of qualifications, experience and expertise relevant to device conformity assessment;
a broad base of knowledge of device technologies, including sufficient experience of conformity assessment of devices being reviewed for certification, the device industry and the design and manufacture of devices;
the notified body’s quality management system, related procedures and the required qualifications for personnel involved;
the ability to draw up records and reports demonstrating that the conformity assessment activities have been appropriately carried out.
3.3. Documentation of qualification, training and authorisation of personnel
3.3.1. The notified body shall have a procedure in place to fully document the qualification of each member of personnel involved in conformity assessment activities and the satisfaction of the qualification criteria referred to in Section 3.2. Where in exceptional circumstances the fulfilment of the qualification criteria set out in Section 3.2. cannot be fully demonstrated, the notified body shall justify to the authority responsible for notified bodies the authorisation of those members of personnel to carry out specific conformity assessment activities.
3.3.2. For all of its personnel referred to in Sections 3.2.3 to 3.2.7, the notified body shall establish and maintain up to date:
a matrix detailing the authorisations and responsibilities of the personnel in respect of conformity assessment activities; and
records attesting to the required knowledge and experience for the conformity assessment activity for which they are authorised. The records shall contain a rationale for defining the scope of the responsibilities for each of the assessment personnel and records of the conformity assessment activities carried out by each of them.
3.4. Subcontractors and external experts
3.4.1. Notified bodies may, without prejudice to Section 3.2, subcontract certain clearly defined component parts of a conformity assessment activity.
The subcontracting of the auditing of quality management systems or of product related reviews as a whole shall not be permitted; nevertheless parts of those activities may be conducted by subcontractors and external auditors and experts working on behalf of the notified body. The notified body in question shall retain full responsibility for being able to produce appropriate evidence of the competence of subcontractors and experts to fulfil their specific tasks, for making a decision based on a subcontractor’s assessment and for the work conducted by subcontractors and experts on its behalf.
The following activities may not be subcontracted by notified bodies:
review of the qualifications and monitoring of the performance of external experts;
auditing and certification activities where the subcontracting in question is to auditing or certification organisations;
allocation of work to external experts for specific conformity assessment activities; and
final review and decision making functions.
3.4.2 Where a notified body subcontracts certain conformity assessment activities either to an organisation or an individual, it shall have a policy describing the conditions under which subcontracting may take place, and shall ensure that:
the subcontractor meets the relevant requirements of this Annex;
subcontractors and external experts do not further subcontract work to organisations or personnel; and
the natural or legal person that applied for conformity assessment has been informed of the requirements referred to in the first and second indent.
Any subcontracting or consultation of external personnel shall be properly documented, shall not involve any intermediaries and shall be subject to a written agreement covering, among other things, confidentiality and conflicts of interest. The notified body in question shall take full responsibility for the tasks performed by subcontractors.
3.4.3. Where subcontractors or external experts are used in the context of a conformity assessment, in particular regarding novel, invasive and implantable devices or technologies, the notified body in question shall have internal competence in each product area for which it is designated that is adequate for the purpose of leading the overall conformity assessment, verifying the appropriateness and validity of expert opinions and making decisions on certification.
3.5. Monitoring of competences, training and exchange of experience
3.5.1. The notified body shall establish procedures for the initial evaluation and on-going monitoring of the competence, conformity assessment activities and performance of all internal and external personnel, and subcontractors, involved in conformity assessment activities.
3.5.2. Notified bodies shall review at regular intervals, the competence of their personnel, identify training needs and draw up a training plan to maintain the required level of qualification and knowledge of individual personnel. That review shall at a minimum, verify that personnel:
are aware of Union and national law in force on devices, relevant harmonised standards, CS, guidance documents and the results of the coordination activities referred to in Section 1.6; and
take part in the internal exchange of experience and the continuous training and education programme referred to in Section 3.1.2.
4. PROCESS REQUIREMENTS
The notified body shall have in place documented processes and sufficiently detailed procedures for the conduct of each conformity assessment activity for which it is designated, comprising the individual steps from pre- application activities up to decision making and surveillance and taking into account, when necessary, the respective specificities of the devices.
The requirements laid down in Sections 4.3, 4.4, 4.7 and 4.8 shall be fulfilled as part of the internal activities of notified bodies and shall not be subcontracted.
4.2. Notified body quotations and pre-application activities
The notified body shall:
publish a publicly available description of the application procedure by which manufacturers can obtain certification from it. That description shall include which languages are acceptable for submission of documentation and for any related correspondence;
have documented procedures relating to, and documented details about, fees charged for specific conformity assessment activities and any other financial conditions relating to notified bodies’ assessment activities for devices;
have documented procedures in relation to advertising of their conformity assessment services. Those procedures shall ensure that advertising or promotional activities in no way imply or are capableof leading to an inference that their conformity assessment will offer manufacturers earlier market access or be quicker, easier or less stringent than that of other notified bodies;
have documented procedures requiring the review of pre-application information, including the preliminary verification thatthe product is covered by this Regulation and its classification, prior to issuing any quotation to the manufacturer relating to a specific conformity assessment; and
ensure that all contracts relating to the conformity assessment activities covered by this Regulation are concluded directly between the manufacturer and the notified body and not with any other organisation.
4.3. Application review and contract
The notified body shall require a formal application signed by a manufacturer or an authorised representative containing all of the information and the manufacturer’s declarations required by the relevant conformity assessment as referred to in Annexes IX to XI.
The contract between a notified body and a manufacturer shall take the form of a written agreement signed by both parties. It shall be kept by the notified body. This contract shall have clear terms and conditions and contain obligations that enable the notified body to act as required under this Regulation, including an obligation on the manufacturer to inform the notified body of vigilance reports, the right of the notified body to suspend, restrict or withdraw certificates issued and the duty of the notified body to fulfil its information obligations.
The notified body shall have documented procedures to review applications, addressing:
the completeness of those applications with respect to the requirements of the relevant conformity assessment procedure, as referred to in the corresponding Annex, under which approval has been sought,
the verification of the qualification of products covered by those applications as devices and their respective classifications,
whether the conformity assessment procedures chosen by the applicant are applicable to the device in question under this Regulation,
the ability of the notified body to assess the application based on its designation, and
the availability of sufficient and appropriate resources.
The outcome of each review of an application shall be documented. Refusals or withdrawals of applications shall be notified to the electronic system referred to in Article 57 and shall be accessible to other notified bodies.
4.4. Allocation of resources
The notified body shall have documented procedures to ensure that all conformity assessment activities are conducted by appropriately authorised and qualified personnel who are sufficiently experienced in the evaluation of the devices, systems and processes and related documentation that are subject to conformity assessment.
For each application, the notified body shall determine the resources needed and identify one individual responsible for ensuring that the assessment of that application is conducted in accordance with the relevant procedures and for ensuring that the appropriate resources including personnel are utilised for each of the tasks of the assessment. The allocation of tasks required to be carried out as part of the conformity assessment and any changes subsequently made to this allocation shall be documented.
4.5. Conformity assessment activities
The notified body and its personnel shall carry out the conformity assessment activities with the highest degree of professional integrity and the requisite technical and scientific competence in the specific fields.
The notified body shall have expertise, facilities and documented procedures that are sufficient to effectively conduct the conformity assessment activities for which the notified body in question is designated, taking account of the relevant requirements set out in Annexes IX to XI, and in particular all of the following requirements:
appropriately plan the conduct of each individual project,
ensure that the composition of the assessment teams is such that there is sufficient experience in relation to the technology concerned, and that there is continuous objectivity and independence, and to provide for rotation of the members of the assessment team at appropriate intervals,
specify the rationale for fixing time limits for completion of conformity assessment activities,
assess the manufacturer’s technical documentation and the solutions adopted to meet the requirements laid down in Annex I,
review the manufacturer’s procedures and documentation relating to the evaluation of pre-clinical aspects,
review the manufacturer’s procedures and documentation relating to clinical evaluation,
address the interface between the manufacturer’s risk management process and its appraisal and analysis of the pre-clinical and clinical evaluation and to evaluate their relevance for the demonstration of conformity with the relevant requirements in Annex I,
carry out the specific procedures referred to in Sections 5.2 to 5.4 of Annex IX,
in the case of class IIa or class IIb devices, assess the technical documentation of devices selected on a representative basis,
plan and periodically carry out appropriate surveillance audits and assessments, carry out or request certain tests to verify the proper functioning of the quality management system and to perform unannounced on site audits,
relating to the sampling of devices, verify that the manufactured device is in conformity with the technical documentation; such requirements shall define the relevant sampling criteria and testing procedure prior to sampling,
evaluate and verify a manufacturer’s compliance with relevant Annexes.
The notified body shall, where relevant, take into consideration available CS, guidance and best practice documents and harmonised standards, even if the manufacturer does not claim to be in compliance.
4.5.2. Quality management system auditing
As part of the assessment of the quality management system, a notified body shall prior to an audit and in accordance with its documented procedures: — assess the documentation submitted in accordance with the relevant conformity assessment Annex, and draw up an audit programme which clearly identifies the number and sequence of activities required to demonstrate complete coverage of a manufacturer’s qualitymanagement system and to determine whether it meets the requirements of this Regulation, — identify links between, and allocation of responsibilities among, the various manufacturing sites, and identify relevant suppliers and/or subcontractors of the manufacturer, and consider the need to specifically audit any of those suppliers or subcontractors or both, — clearly define, for each audit identified in the audit programme, the objectives, criteria and scope of the audit, and draw up an audit plan that adequately addresses and takes account of the specific requirements for the devices, technologies and processes involved, — draw up and keep up to date, for class IIa and class IIb devices, a sampling plan for the assessment of technical documentation as referred to in Annexes II and III covering the range of such devices covered by the manufacturer’s application. That plan shall ensure that all devices covered by the certificate are sampled over the period of validity of the certificate, and — select and assign appropriately qualified and authorised personnel for conducting the individual audits. The respective roles,responsibilities and authorities of the team members shall be clearly defined and documented.
Based on the audit programme it has drawn up, the notified body shall, in accordance with its documented procedures: — audit the manufacturer’s quality management system, in order toverify that the quality management system ensures that the devices covered conform to the relevant provisions of this Regulation whichapply to devices at every stage, from design through final quality control to ongoing surveillance, and shall determine whether the requirements of this Regulation are met, — based on relevant technical documentation and in order to determine whether the manufacturer meets the requirements referred to in the relevant conformity assessment Annex, review and audit the manufacturer’s processes and subsystems, in particular for: — design and development, — production and process controls, — product documentation, — purchasing controls including verification of purchased devices,— corrective and preventive actions, including for post-market surveillance, and — PMCF,
and review and audit requirements and provisions adopted by the manufacturer, including those in relation to fulfilling the general safety and performance requirements set out in Annex I.
The documentation shall be sampled in such a manner as to reflect the risks associated with the intended use of the device, the complexity of the manufacturing technologies, the range and classes of devices produced and any available post-market surveillance information,
if not already covered by the audit programme, audit the control of processes on the premises of the manufacturer’s suppliers, when the conformity of finished devices is significantly influenced by the activity of suppliers and, in particular when the manufacturer cannot demonstrate sufficient control over its suppliers,
conduct assessments of the technical documentation based on its sampling plan and taking account of Sections 4.5.4. and 4.5.5. for pre-clinical and clinical evaluations, and
the notified body shall ensure that audit findings are appropriately and consistently classified in accordance with the requirements of this Regulation and with relevant standards, or with best practice documents developed or adopted by the MDCG.
4.5.3. Product verification
Assessment of the technical documentation
For assessment of the technical documentation conducted in accordance with Chapter II of Annex IX, notified bodies shall have sufficient expertise, facilities and documented procedures for:
the allocation of appropriately qualified and authorised personnel for the examination of individual aspects such as use of the device, biocompatibility, clinical evaluation, risk management, and sterilisation, and
the assessment of conformity of the design with this Regulation, and for taking account of Sections 4.5.4. to 4.5.6. That assessment shall include examination of the implementation by manufacturers of incoming, in- process and final checks and the results thereof. If further tests or other evidence is required for the assessment of conformity with the requirements of this Regulation, the notified body in question shall carry out adequate physical or laboratory tests in relation to the device or request the manufacturer to carry out such tests.
The notified body shall have documented procedures, sufficient expertise and facilities for the type-examination of devices in accordance with Annex X including the capacity to:
examine and assess the technical documentation taking account of Sections 4.5.4. to 4.5.6., and verify that the type has been manufactured in conformity with that documentation;
establish a test plan identifying all relevant and critical parameters which need to be tested by the notified body or under its responsibility;
document its rationale for the selection of those parameters;
carry out the appropriate examinations and tests in order to verify that the solutions adopted by the manufacturer meet the general safety and performance requirements set out in Annex I. Such examinations and tests shall include all tests necessary to verify that the manufacturer has in fact applied the relevant standards it has opted to use;
agree with the applicant as to where the necessary tests will be performed if they are not to be carried out directly by the notified body; and
assume full responsibility for test results. Test reports submitted by the manufacturer shall only be taken into account if they have been issued by conformity assessment bodies which are competent and independent of the manufacturer.
Verification by examination and testing of every product
The notified body shall:
have documented procedures, sufficient expertise and facilities for the verification by examination and testing of every product in accordance with Part B of Annex XI;
establish a test plan identifying all relevant and critical parameters which need to be tested by the notified body or under its responsibility in order to: —verify, for class IIb devices, the conformity of the device with the type described in the EU type-examination certificate and with the requirements of this Regulation which apply to those devices, — confirm, for class IIa devices, the conformity with the technical documentation referred to in Annexes II and III and with the requirements of this Regulation which apply to those devices;
document its rationale for the selection of the parameters referred to in point (b);
have documented procedures to carry out the appropriate assessments and tests in order to verify the conformity of the device with the requirements of this Regulation by examining and testing every product as specified in Section 15 of Annex XI;
have documented procedures providing for the reaching of an agreement with the applicant concerning when and where necessary tests that are not to be carried out by the notified body itself are to be performed; and
assume full responsibility for test results in accordance with documented procedures; test reports submitted by the manufacturer shall only be taken into account if they have been issued by conformity assessment bodies which are competent and independent of the manufacturer.
4.5.4. Pre-clinical evaluation assessment
The notified body shall have documented procedures in place for the review of the manufacturer’s procedures and documentation relating to the evaluation of pre-clinical aspects. The notified body shall examine, validate and verify that the manufacturer’s procedures and documentation adequately address:
the planning, conduct, assessment, reporting and, where appropriate, updating of the pre-clinical evaluation, in particular of — the scientific pre-clinical literature search, and — the pre-clinical testing, for example laboratory testing, simulated use testing, computer modelling, the use of animal models,
the nature and duration of body contact and the specific associated biological risks,
the interface with the risk management process, and
the appraisal and analysis of the available pre-clinical data and its relevance with regard to demonstrating conformity with the relevant requirements in Annex I.
The notified body’s assessment of pre-clinical evaluation procedures and documentation shall address the results of literature searches and all validation, verification and testing performed and conclusions drawn, and shall typically include considering the use of alternative materials and substances and take account of the packaging, stability, including shelf life, of the finished device. Where no new testing has been undertaken by a manufacturer or where there are deviations from procedures, the notified body in question shall critically examine the justification presented by the manufacturer.
4.5.5. Clinical evaluation assessment
The notified body shall have documented procedures in place relating to the assessment of a manufacturer’s procedures and documentation relating to clinical evaluation both for initial conformity assessment and on an ongoing basis. The notified body shall examine, validate and verify that manufacturers’ procedures and documentation adequately address:
the planning, conduct, assessment, reporting and updating of the clinical evaluation as referred to in Annex XIV,
post-market surveillance and PMCF,
the interface with the risk management process,
the appraisal and analysis of the available data and its relevance with regard to demonstrating conformity with the relevant requirements in Annex I, and
the conclusions drawn with regard to the clinical evidence and drawing up of the clinical evaluation report.
These procedures referred to in the first paragraph shall take into consideration available CS, guidance and best practice documents.
The notified body’s assessment of clinical evaluations as referred to in Annex XIV shall cover:
the intended use specified by the manufacturer and claims for the device defined by it,
the planning of the clinical evaluation,
the methodology for the literature search,
relevant documentation from the literature search,
the clinical investigation,
validity of equivalence claimed in relation to other devices, the demonstration of equivalence, the suitability and conclusions data from equivalent and similar devices,
post-market surveillance and PMCF,
the clinical evaluation report, and
justifications in relation to non-performance of clinical investigations or PMCF.
In relation to clinical data from clinical investigations included within the clinical evaluation, the notified body in question shall ensure that the conclusions drawn by the manufacturer are valid in the light of the approved clinical investigation plan.
The notified body shall ensure that the clinical evaluation adequately addresses the relevant safety and performance requirements provided for in Annex I, that it is appropriately aligned with the risk management requirements, that it is conducted in accordance with Annex XIV and that it is appropriately reflected in the information provided relating to the device.
4.5.6. Specific Procedures
The notified body shall have documented procedures, sufficient expertise and facilities for the procedures referred to in Sections 5 and 6 of Annex IX, Section 6 of Annex X and Section 16 of Annex XI, for which they are designated.
In the case of devices manufactured utilising tissues or cells of animal origin or their derivatives, such as from TSE susceptible species, as referred to in Regulation (EU) No 722/2012, the notified body shall have documented procedures in place that fulfil the requirements laid down in that Regulation, including for the preparation of a summary evaluation report for the relevant competent authority.
The notified body shall:
ensure that all steps of the conformity assessment are documented so that the conclusions of the assessment are clear and demonstrate compliance with the requirements of this Regulation and can represent objective evidence of such compliance to persons that are not themselves involved in the assessment, for example personnel in designating authorities,
ensure that records that are sufficient to provide a discernible audit trail are available for quality management system audits,
clearly document the conclusions of its assessment of clinical evaluation in a clinical evaluation assessment report, and
for each specific project, provide a detailed report which shall be based on a standard format containing a minimum set of elements determined by the MDCG.
The report of the notified body shall:
clearly document the outcome of its assessment and draw clear conclusions from the verification of the manufacturer’s conformity with the requirements of this Regulation,
make a recommendation for a final review and for a final decision to be taken by the notified body; this recommendation shall be signed off by the member of personnel responsible in the notified body, and
be provided to the manufacturer in question.
4.7. Final review
The notified body shall prior to making a final decision:
ensure that the personnel assigned for the final review and decision-making on specific projects are appropriately authorised and are different from the personnel who have conducted the assessments,
verify that the report or reports and supporting documentation needed for decision making, including concerning resolution of non-conformities noted during assessment, are complete and sufficient with respect to the scope of the application, and
verify whether there are any unresolved non-conformities preventing issuance of a certificate.
4.8 Decisions and Certifications
The notified body shall have documented procedures for decision-making including as regards the allocation of responsibilities for the issuance, suspension, restriction and withdrawal of certificates. Those procedures shall include the notification requirements laid down in Chapter V of this Regulation. The procedures shall allow the notified body in question to:
decide, based on the assessment documentation and additional information available, whether the requirements of this Regulation are fulfilled,
decide, based on the results of its assessment of the clinical evaluation and risk management, whether the post-market surveillance plan, including the PMCF plan, is adequate,
decide on specific milestones for further review by the notified body of the up to date clinical evaluation,
decide whether specific conditions or provisions need to be defined for the certification,
decide, based on the novelty, risk classification, clinical evaluation and conclusions from the risk analysis of the device, on a period of certification not exceeding five years,
clearly document decision making and approval steps including approval by signature of the members of personnel responsible,
clearly document responsibilities and mechanisms for communication of decisions, in particular, where the final signatory of a certificate differs from the decision maker or decision makers or does not fulfil the requirements laid down in Section 3.2.7,
issue a certificate or certificates in accordance with the minimum requirements laid down in Annex XII for a period of validity not exceeding five years and shall indicate whether there are specific conditions or limitations associated with the certification,
issue a certificate or certificates for the applicant alone and shall not issue certificates covering multiple entities, and
ensure that the manufacturer is notified of the outcome of the assessment and the resultant decision and that they are entered into the electronic system referred to in Article 57.
4.9. Changes and modifications
The notified body shall have documented procedures and contractual arrangements with manufacturers in place relating to the manufacturers’ information obligations and the assessment of changes to:
the approved quality management system or systems or to the product-range covered,
the approved design of a device,
the intended use of or claims made for the device,
the approved type of a device, and
any substance incorporated in or utilised for the manufacturing of a device and being subject to the specific procedures in accordance with Section 4.5.6.
The procedures and contractual arrangements referred to in the first paragraph shall include measures for checking the significance of the changes referred to in the first paragraph.
In accordance with its documented procedures, the notified body in question shall:
ensure that manufacturers submit for prior approval plans for changes as referred to in the first paragraph and relevant information relating to such changes,
assess the changes proposed and verify whether, after these changes, the quality management system, or the design of a device or type of a device, still meets the requirements of this Regulation, and
notify the manufacturer of its decision and provide a report or as applicable a supplementary report, which shall contain the justified conclusions of its assessment.
4.10. Surveillance activities and post-certification monitoring
The notified body shall have documented procedures:
defining how and when surveillance activities of manufacturers are to be conducted. Those procedures shall include arrangements for unannounced on-site audits of manufacturers and, where applicable, subcontractors and suppliers carrying out product tests and the monitoring of compliance with any conditions binding manufacturers and associated with certification decisions, such as updates to clinical data at defined intervals,
for screening relevant sources of scientific and clinical data and post-market information relating to the scope of their designation. Such information shall be taken into account in the planning and conduct of surveillance activities, and
to review vigilance data to which they have access under Article 92(2) in order to estimate its impact, if any, on the validity of existing certificates. The results of the evaluation and any decisions taken shall be thoroughly documented.
The notified body in question shall, upon receipt of information about vigilance cases from a manufacturer or competent authorities, decide which of the following options to apply:
not to take action on the basis that the vigilance case is clearly not related to the certification granted,
observe the manufacturer’s and competent authority’s activities and the results of the manufacturer’s investigation so as to determine whether the certification granted is at risk or whether adequate corrective action has been taken,
perform extraordinary surveillance measures, such as document reviews, short-notice or unannounced audits and product testing, where it is likely that the certification granted is at risk,
increase the frequency of surveillance audits,
review specific products or processes on the occasion of the next audit of the manufacturer, or
take any other relevant measure.
In relation to surveillance audits of manufacturers, the notified body shall have documented procedures to:
conduct surveillance audits of the manufacturer on at least an annual basis which shall be planned and conducted in line with the relevant requirements in Section 4.5,
ensure adequate assessment of the manufacturer’s documentation on, and application of the provisions on, vigilance, the post-market surveillance, and PMCF,
sample and test devices and technical documentation, during audits, according to pre-defined sampling criteria and testing procedures to ensure that the manufacturer continuously applies the approved quality management system,
ensure that the manufacturer complies with the documentation and information obligations laid down in the relevant Annexes and that its procedures take into account best practices in the implementation of quality management systems,
ensure that the manufacturer does not use quality management system or device approvals in a misleading manner,
gather sufficient information to determine if the quality management system continues to comply with the requirements of this Regulation,
ask the manufacturer, if non-conformities are detected, for corrections, corrective actions and, where applicable, preventive actions, and
where necessary, impose specific restrictions on the relevant certificate, or suspend or withdraw it.
The notified body shall, if listed as part of the conditions for certification:
conduct an in-depth review of the clinical evaluation as most recently updated by the manufacturer based on the manufacturer’s post-market surveillance, on its PMCF and on clinical literature relevant to the condition being treated with the device or on clinical literature relevant to similar devices,
clearly document the outcome of the in-depth review and address any specific concerns to the manufacturer or impose any specific conditions on it, and
ensure that the clinical evaluation as most recently updated, is appropriately reflected in the instructions for use and, where applicable, the summary of safety and performance.
The notified body shall have documented procedures in place relating to the re-certification reviews and the renewal of certificates. Re-certification of approved quality management systems or EU technical documentation assessment certificates or EU type-examination certificates shall occur at least every five years.
The notified body shall have documented procedures relating to renewals of EU technical documentation assessment certificates and EU type-examination certificates and those procedures shall require the manufacturer in question to submit a summary of changes and scientific findings for the device, including:
all changes to the originally approved device, including changes not yet notified,
experience gained from post-market surveillance,
experience from risk management,
experience from updating the proof of compliance with the general safety and performance requirements set out in Annex I,
experience from reviews of the clinical evaluation, including the results of any clinical investigations and PMCF,
changes to the requirements, to components of the device or to the scientific or regulatory environment,
changes to applied or new harmonised standards, CS or equivalent documents, and
changes in medical, scientific and technical knowledge, such as: — new treatments, — changes in test methods, — new scientific findings on materials and components, including findings on their biocompatibility, — experience from studies on comparable devices, — data from registers and registries, — experience from clinical investigations with comparable devices.
The notified body shall have documented procedures to assess the information referred to in the second paragraph and shall pay particular attention to clinical data from post-market surveillance and PMCF activities undertaken since the previous certification or re-certification, including appropriate updates to manufacturers’ clinical evaluation reports.
For the decision on re-certification, the notified body in question shall use the same methods and principles as for the initial certification decision. If necessary, separate forms shall be established for re-certification taking into account the steps taken for certification such as application and application review.
5.9. Internationally-accepted standards for data submission and updates shall, wherever possible, be used by the UDI database.
5.10. The user interface of the UDI database shall be available in all official languages of the Union. The use of free- text fields shall, however, be minimized in order to reduce translations.
5.11. Data relating to devices that are no longer available on the market shall be retained in the UDI database.
6. Rules for specific device types
6.1. Implantable devices:
6.1.1. Implantable devices shall, at their lowest level of packaging (‘unit packs’), be identified, or marked using AIDC, with a UDI (UDI-DI + UDI-PI);
6.1.2. The UDI-PI shall have at least the following characteristics:
the serial number for active implantable devices,
the serial number or lot number for other implantable devices.
6.1.3. The UDI of the implantable device shall be identifiable prior to implantation.
6.2. Reusable devices requiring cleaning, disinfection, sterilisation or refurbishing between uses
6.2.1. The UDI of such devices shall be placed on the device and be readable after each procedure to make the device ready for the next use.
6.2.2. The UDI-PI characteristics such as the lot or serial number shall be defined by the manufacturer.
6.3. Systems and procedure packs as referred to in Article 22
6.3.1. The natural or legal person referred to in Article 22 shall be responsible for identifying the system or procedure pack with a UDI including both UDI-DI and UDI-PI.
6.3.2. Device contents of system or procedure packs shall bear a UDI carrier on their packaging or on the device itself.
individual single-use disposable devices, the uses of which are generally known to the persons by whom they are intended to be used, which are contained within a system or procedure pack, and which are not intended for individual use outside the context of the system or procedure pack, shall not be required to bear their own UDI carrier;
devices that are exempted from bearing a UDI carrier on the relevant level of packaging shall not be required to bear a UDI carrier when included within a system or procedure pack.
6.3.3. Placement of the UDI carrier on systems or procedure packs
The system or procedure pack UDI carrier shall as a general rule be affixed to the outside of the packaging.
The UDI carrier shall be readable, or, in the case of AIDC, scannable,whether placed on the outside of the packaging of the system or procedure pack or inside transparent packaging.
6.4. Configurable devices:
6.4.1. A UDI shall be assigned to the configurable device in its entirety and shall be called the configurable device UDI.
6.4.2. The configurable device UDI-DI shall be assigned to groups of configurations, not per configuration within the group. A group of configurations is defined as the collection of possible configurations for a given device as described in the technical documentation.
6.4.3. A configurable device UDI-PI shall be assigned to each individual configurable device.
6.4.4. The carrier of the configurable device UDI shall be placed on the assembly that is most unlikely to be exchanged during the lifetime of the system and shall be identified as the configurable device UDI.
6.4.5. Each component that is considered a device and is commercially available on its own shall be assigned a separate UDI.
6.5. Device Software
6.5.1. UDI assignment Criteria
The UDI shall be assigned at the system level of the software. Only software which is commercially available on its own and software which constitutes a device in itself shall be subject to that requirement.
The software identification shall be considered to be the manufacturing control mechanism and shall be displayed in the UDI-PI.
6.5.2. A new UDI-DI shall be required whenever there is a modification that changes:
the original performance;
the safety or the intended use of the software;
interpretation of data.
Such modifications include new or modified algorithms, database structures, operating platform, architecture or new user interfaces or new channels for interoperability.
6.5.3. Minor software revisions shall require a new UDI-PI and not a new UDI-DI.
Minor software revisions are generally associated with bug fixes, usability enhancements that are not for safety purposes, security patches or operating efficiency.
Minor software revisions shall be identified by a manufacturer-specific form of identification.
6.5.4. Minor software revisions shall be identified by a manufacturer-specific form of identification.
where the software is delivered on a physical medium, e.g. CD or DVD, each packaging level shall bear the human readable and AIDC representation of the complete UDI. The UDI that is applied to the physical medium containing the software and its packaging shall be identical to the UDI assigned to the system level software;
the UDI shall be provided on a readily accessible screen for the user in an easily-readable plain-text format, such as an ‘about’ file, or included on the start-up screen;
software lacking a user interface such as middleware for image conversion, shall be capable of transmitting the UDI through an application programming interface (API);
only the human readable portion of the UDI shall be required in electronic displays of the software. The marking of UDI using AIDC shall not be required in the electronic displays, such as ‘about’ menu, splash screen etc.;
the human readable format of the UDI for the software shall includethe Application Identifiers (AI) for the standard used by the issuing entities, so as to assist the user in identifying the UDI and determining which standard is being used to create the UDI.
Automatic identification and data capture (‘AIDC’)
AIDC is a technology used to automatically capture data. AIDC technologies include bar codes, smart cards, biometrics and RFID.
The Basic UDI-DI is the primary identifier of a device model. It is the DI assigned at the level of the device unit of use. It is the main key for records in the UDI database and is referenced in relevant certificates and EU declarations of conformity.
Unit of Use DI
The Unit of Use DI serves to associate the use of a device with a patient in instances in which a UDI is not labelled on the individual device at the level of its unit of use, for example in the event of several units of the same device being packaged together.
A configurable device is a device that consists of several components which can be assembled by the manufacturer in multiple configurations. Those individual components may be devices in themselves.
Configurable devices include computed tomography (CT) systems, ultrasound systems, anaesthesia systems, physiological Monitoring systems, radiology information systems (RIS).
Configuration is a combination of items of equipment, as specified by the manufacturer, that operate together as a device to achieve an intended purpose. The combination of items may be modified, adjusted or customized to meet specific needs.
Configurations include inter alia:
gantries, tubes, tables, consoles and other items of equipment that can be configured/combined to deliver an intended function in computed tomography.
ventilators, breathing circuits, vaporizers combined to deliver an intended function in anaesthesia.
The UDI-DI is a unique numeric or alphanumeric code specific to a model of device and that is also used as the ‘access key’ to information stored in a UDI database.
Human Readable Interpretation (‘HRI’)
HRI is a legible interpretation of the data characters encoded in the UDI carrier.
Packaging levels means the various levels of device packaging that contain a defined quantity of devices, such as a carton or case.
The UDI-PI is a numeric or alphanumeric code that identifies the unit of device production.
The different types of UDI-PIs include serial number, lot number, software identification and manufacturing or expiry date or both types of date.
Radio Frequency Identification RFID
RFID is a technology that uses communication through the use of radio waves to exchange data between a reader and an electronic tag attached to an object, for the purpose of identification.
A shipping container is a container in relation to which traceability is controlled by a process specific to logistics systems.
Unique Device Identifier (‘UDI’)
The UDI is a series of numeric or alphanumeric characters that is created through a globally accepted device identification and coding standard. It allows the unambiguous identification of a specific device on the market. The UDI is comprised of the UDI-DI and the UDI-PI.
The word ‘Unique’ does not imply serialisation of individual production units.
The UDI carrier is the means of conveying the UDI by using AIDC and, if applicable, its HRI.
UDI carriers include, inter alia, ID/linear bar code, 2D/Matrix bar code, RFID.
2. General requirements
2.1 The affixing of the UDI is an additional requirement — it does not replace any other marking or labelling requirements laid down in Annex I to this Regulation.
2.2 The manufacturer shall assign and maintain unique UDIs for its devices.
2.3 Only the manufacturer may place the UDI on the device or its packaging.
2.4 Only coding standards provided by issuing entities designated by the Commission pursuant to Article 27(2) may be used.
3. The UDI
3.1 A UDI shall be assigned to the device itself or its packaging. Higher levels of packaging shall have their own UDI.
3.2 Shipping containers shall be exempted from the requirement in Section 3.1. By way of example, a UDI shall not be required on a logistics unit; where a healthcare provider orders multiple devices using the UDI or model number of individual devices and the manufacturer places those devices in a container for shipping or to protect the individually packaged devices, the container (logistics unit) shall not be subject to UDI requirements.
3.3 The UDI shall contain two parts: a UDI-DI and a UDI-PI.
3.4 The UDI-DI shall be unique at each level of device packaging.
3.5 If a lot number, serial number, software identification or expiry date appears on the label, it shall be part of the UDI-PI. If there is also a manufacturing date on the label, it does not need to be included in the UDI-PI. If there is only a manufacturing date on the label, this shall be used as the UDI-PI.
3.6 Each component that is considered to be a device and is commercially available on its own shall be assigned a separate UDI unless the components are part of a configurable device that is marked with its own UDI.
3.7 Systems and procedure packs as referred to in Article 22 shall be assigned and bear their own UDI.
3.8 The manufacturer shall assign the UDI to a device following the relevant coding standard.
3.9 A new UDI-DI shall be required whenever there is a change that could lead to misidentification of the device and/or ambiguity in its traceability; in particular, any change of one of the following UDI database data elements shall require a new UDI-DI:
name or trade name,
device version or model,
labelled as single use,
need for sterilization before use,
quantity of devices provided in a package,
critical warnings or contra-indications: e.g. containing latex or DEHP.
3.10 Manufacturers that repackage and/or relabel devices, with their own label shall retain a record of the original device manufacturer’s UDI.
4. UDI carrier
4.1 The UDI carrier (AIDC and HRI representation of the UDI) shall be placed on the label or on the device itself and on all higher levels of device packaging. Higher levels do not include shipping containers.
4.2 In the event of there being significant space constraints on the unit of use packaging, the UDI carrier may be placed on the next higher packaging level.
4.3 For single-use devices of classes I and IIa packaged and labelled individually, the UDI carrier shall not be required to appear on the packaging but it shall appear on a higher level of packaging, e.g. a carton containing several individually packaged devices. However, when the healthcare provider is not expected to have access, in cases such as in home healthcare settings, to the higher level of device packaging, the UDI shall be placed on the packaging of the individual device.
4.4 For devices exclusively intended for retail point of sale the UDI-PIs in AIDC shall not be required to appear on the point of sale packaging.
4.5 When AIDC carriers other than the UDI carrier are part of the product labelling, the UDI carrier shall be readily identifiable.
4.6 If linear bar codes are used, the UDI-DI and UDI-PI may be concatenated or non-concatenated in two or more bar codes. All parts and elements of the linear bar code shall be distinguishable and identifiable.
4.7 If there are significant constraints limiting the use of both AIDC and HRI on the label, only the AIDC format shall be required to appear on the label. For devices intended to be used outside healthcare facilities, such as devices for home care, the HRI shall however appear on the label even if this results in there being no space for the AIDC.
4.8 The HRI format shall follow the rules of the UDI code-issuing entity.
4.9 If the manufacturer is using RFID technology, a linear or 2D bar code in line with the standard provided by the issuing entities shall also be provided on the label.
4.10 Devices that are reusable shall bear a UDI carrier on the device itself. The UDI carrier for reusable devices that require cleaning, disinfection, sterilisation or refurbishing between patient uses shall be permanent and readable after each process performed to make the device ready for the subsequent use throughout the intended lifetime of the device. The requirement of this Section shall not apply to devices in the following circumstances:
any type of direct marking would interfere with the safety or performance of the device;
the device cannot be directly marked because it is not technologically feasible.
4.11 The UDI carrier shall be readable during normal use and throughout the intended lifetime of the device.
4.12 If the UDI carrier is readily readable or, in the case of AIDC, scannable, through the device’s packaging, the placing of the UDI carrier on the packaging shall not be required.
4.13 In the case of single finished devices made up of multiple parts that must be assembled before their first use, it shall be sufficient to place the UDI carrier on only one part of each device.
4.14 The UDI carrier shall be placed in a manner such that the AIDC can be accessed during normal operation or storage.
4.15 Bar code carriers that include both a UDI-DI and a UDI-PI may also include essential data for the device to operate or other data.
5. General principles of the UDI database
5.1 The UDI database shall support the use of all core UDI database data elements referred to in Part B of this Annex.
5.2 Manufacturers shall be responsible for the initial submission and updates of the identifying information and other device data elements in the UDI database.
5.3 Appropriate methods/procedures for validation of the data provided shall be implemented.
5.4 Manufacturers shall periodically verify the correctness of all of the data relevant to devices they have placed on the market, except for devices that are no longer available on the market.
5.5 The presence of the device UDI-DI in the UDI database shall not be assumed to mean that the device is in conformity with this Regulation.
5.6 The database shall allow for the linking of all the packaging levels of the device.
5.7 The data for new UDI-DIs shall be available at the time the device is placed on the market.
5.8 Manufacturers shall update the relevant UDI database record within 30 days of a change being made to an element, which does not require a new UDI-DI.
Core data elements to be provided to the UDI database together with the UDI-DI in accordance with articles 28 and 29
The manufacturer shall provide to the UDI database the UDI-DI and all of the following information relating to the manufacturer and the device:
1. quantity per package configuration,
2. the Basic UDI-DI as referred to in Article 29 and any additional UDI-DIs,
3. the manner in which production of the device is controlled (expiry date or manufacturing date, lot number, serial number),
4. if applicable, the unit of use UDI-DI (where a UDI is not labelled on the device at the level of its unit of use, a ‘unit of use’ DI shall be assigned so as to associate the use of a device with a patient),
5. name and address of the manufacturer (as indicated on the label),
6. the SRN issued in accordance with Article 31(2),
7. if applicable, name and address of the authorised representative (as indicated on the label),
8. the medical device nomenclature code as provided for in Article 26,
9. risk class of the device,
10. if applicable, name or trade name,
11. if applicable, device model, reference, or catalogue number,
12. if applicable, clinical size (including volume, length, gauge, diameter),
13. additional product description (optional),
14. if applicable, storage and/or handling conditions (as indicated on the label or in the instructions for use),
15. if applicable, additional trade names of the device,
16. labelled as a single-use device (y/n),
17. if applicable, the maximum number of reuses,
18. device labelled sterile (y/n),
19. need for sterilisation before use (y/n),
20. containing latex (y/n),
21. where applicable, information labelled in accordance with Section 10.4.5 of Annex I,
22. URL for additional information, such as electronic instructions for use (optional),
23. if applicable, critical warnings or contra-indications,
24. status of the device (on the market, no longer placed on the market, recalled, field safety corrective action initiated).
Information to be submitted upon the registration of devices and economic operators in accordance with articles 29(4) and 31
Manufacturers or, when applicable, authorised representatives, and, when applicable, importers shall submit the information referred to in Section 1 and shall ensure that the information on their devices referred to in Section 2 is complete, correct and updated by the relevant party.
1. Information relating to the economic operator
1.1 type of economic operator(manufacturer, authorised representative, or importer),
1.2 name, address and contact details of the economic operator,
1.3 where submission of information is carried out by another person on behalf of any of the economic operators mentioned under Section 1.1, the name, address and contact details of that person,
1.4 name address and contact details of the person or persons responsible for regulatory compliance referred to in Article 15.
2. Information relating to the device
2.1 Basic UDI-DI,
2.2 type, number and expiry date of the certificate issued by the notified body and the name or identification number of that notified body and the link to the information that appears on the certificate and was entered by the notified body in the electronic system on notified bodies and certificates,
2.3 Member State in which the device is to or has been placed on the market in the Union,
2.4 in the case of class IIa, class IIb or class III devices: Member States where the device is or is to be made available,
2.5 risk class of the device,
2.6 reprocessed single-use device (y/n),
2.7 presence of a substance which, if used separately, may be considered to be a medicinal product and name of that substance,
2.8 presence of a substance which, if used separately, may be considered to be a medicinal product derived from human blood or human plasma and name of this substance,
2.9 presence of tissues or cells of human origin, or their derivatives (y/n),
2.10 presence of tissues or cells of animal origin, or their derivatives, as referred to in Regulation (EU) No 722/2012 (y/n),
2.11 where applicable, the single identification number of the clinical investigation or investigations conducted in relation to the device or a link to the clinical investigation registration in the electronic system on clinical investigations,
2.12 in the case of devices listed in Annex XVI, specification as to whether the intended purpose of the device is other than a medical purpose,
2.13 in the case of devices designed and manufactured by another legal or natural person as referred in Article 10(15), the name, address and contact details of that legal or natural person,
2.14 in the case of class III or implantable devices, the summary of safety and clinical performance,
2.15 status of the device (on the market, no longer placed on the market, recalled, field safety corrective action initiated).
The EU declaration of conformity shall contain all of the following information:
1. Name, registered trade name or registered trade mark and, if already issued, SRN as referred to in Article 31 of the manufacturer, and, if applicable, its authorised representative, and the address of their registered place of business where they can be contacted and their location be established;
2. A statement that the EU declaration of conformity is issued under the sole responsibility of the manufacturer;
3. The Basic UDI-DI as referred to in Part C of Annex VI;
4. Product and trade name, product code, catalogue number or other unambiguous reference allowing identification and traceability of the device covered by the EU declaration of conformity, such as a photograph, where appropriate, as well as its intended purpose. Except for the product or trade name, the information allowing identification and traceability may be provided by the Basic UDI-DI referred to in point 3;
5. Risk class of the device in accordance with the rules set out in Annex VIII;
6. A statement that the device that is covered by the present declaration is in conformity with this Regulation and, if applicable, with any other relevant Union legislation that provides for the issuing of an EU declaration of conformity;
7. References to any CS used and in relation to which conformity is declared;
8. Where applicable, the name and identification number of the notified body, a description of the conformity assessment procedure performed and identification of the certificate or certificates issued;
9. Where applicable, additional information;
10. Place and date of issue of the declaration, name and function of the person who signed it as well as an indication for, and on behalf of whom, that person signed, signature.
Technical documentation on post-market surveillance
The technical documentation on post-market surveillance to be drawn up by the manufacturer in accordance with Articles 83 to 86 shall be presented in a clear, organised, readily searchable and unambiguous manner and shall include in particular the elements described in this Annex.
1.1. The post-market surveillance plan drawn up in accordance with Article 84.
The manufacturer shall prove in a post-market surveillance plan that it complies with the obligation referred to in Article 83.
The post-market surveillance plan shall address the collection and utilization of available information, in particular: — information concerning serious incidents, including information from PSURs, and field safety corrective actions; — records referring to non-serious incidents and data on any undesirable side-effects; — information from trend reporting; — relevant specialist or technical literature, databases and/or registers; — information, including feedbacks and complaints, provided by users, distributors and importers; and — publicly available information about similar medical devices.
The post-market surveillance plan shall cover at least: — a proactive and systematic process to collect any information referred to in point (a). The process shall allow a correct characterisation of the performance of the devices and shall also allow a comparison to be made between the device and similar products available on the market; — effective and appropriate methods and processes to assess the collected data; — suitable indicators and threshold values that shall be used in the continuous reassessment of the benefit- risk analysis and of the riskmanagement as referred to in Section 3 of Annex I; — effective and appropriate methods and tools to investigate complaints and analyse market-related experience collected in the field; — methods and protocols to manage the events subject to the trend report as provided for in Article 88, including the methods and protocols to be used to establish any statistically significant increase in the frequency or severity of incidents as well as the observation period; — methods and protocols to communicate effectively with competent authorities, notified bodies, economic operators and users; — reference to procedures to fulfil the manufacturers obligations laid down in Articles 83, 84 and 86; — systematic procedures to identify and initiate appropriate measures including corrective actions; — effective tools to trace and identify devices for which corrective actions might be necessary; and — a PMCF plan as referred to in Part B of Annex XIV, or a justification as to why a PMCF is not applicable.
1.2. The PSUR referred to in Article 86 and the post-market surveillance report referred to in Article 85.
The documentation shall contain the results and critical analyses of all verifications and validation tests and/or studies undertaken to demonstrate conformity of the device with the requirements of this Regulation and in particular the applicable general safety and performance requirements.
6.1. Pre-clinical and clinical data
results of tests, such as engineering, laboratory, simulated use and animal tests, and evaluation of published literature applicable to the device, taking into account its intended purpose, or to similar devices, regarding the pre-clinical safety of the device and its conformity with the specifications;
detailed information regarding test design, complete test or study protocols, methods of data analysis, in addition to data summaries and test conclusions regarding in particular: — the biocompatibility of the device including the identification of all materials in direct or indirect contact with the patient or user; — physical, chemical and microbiological characterisation; — electrical safety and electromagnetic compatibility; — software verification and validation (describing the software design and development process and evidence of the validation of the software, as used in the finished device. This information shall typically include the summary results of all verification, validation and testing performed both in-house and in a simulated or actual user environment prior to final release. It shall also address all of the different hardware configurations and, where applicable, operating systems identified in the information supplied by the manufacturer); — stability, including shelf life; and — performance and safety.
Where applicable, conformity with the provisions of Directive 2004/10/EC of the European Parliament and of the Council (1) shall be demonstrated.
Where no new testing has been undertaken, the documentation shall incorporate a rationale for that decision. An example of such a rationale would be that biocompatibility testing on identical materials was conducted when those materials were incorporated in a previous version of the device that has been legally placed on the market or put into service;
the clinical evaluation report and its updates and the clinical evaluation plan referred to in Article 61(12) and Part A of Annex XIV;
the PMCF plan and PMCF evaluation report referred to in Part B of Annex XIV or a justification why a PMCF is not applicable.
6.2. Additional information required in specific cases
Where a device incorporates, as an integral part, a substance which,if used separately, may be considered to be a medicinal product within the meaning of point 2 of Article 1 of Directive 2001/83/EC, including a medicinal product derived from human blood or human plasma, as referred to in the first subparagraph of Article 1(8), a statement indicating this fact. In this case, the documentation shall identify the source of that substance and contain the data of the tests conducted to assess its safety, quality and usefulness, taking accountof the intended purpose of the device.
Where a device is manufactured utilising tissues or cells of human or animal origin, or their derivatives, and is covered by this Regulation in accordance with points (f) and (g) of Article 1(6, and where a device incorporates, as an integral part, tissues or cells of human origin or their derivatives that have an action ancillary to that of the device and is covered by this Regulation in accordance with the first subparagraph of Article 1(10), a statement indicating this fact. In such a case, the documentation shall identify all materials of human or animal origin used and provide detailed information concerning the conformity with Sections 13.1. or 13.2., respectively, of Annex I.
In the case of devices that are composed of substances or combinations of substances that are intended to be introduced into the human body and that are absorbed by or locally dispersed in thehuman body, detailed information, including test design, complete test or study protocols, methods of data analysis, and data summaries and test conclusions, regarding studies in relation to: — absorption, distribution, metabolism and excretion; — possible interactions of those substances, or of their products of metabolism in the human body, with other devices, medicinal products or other substances, considering the target population, andits associated medical conditions; — local tolerance; and — toxicity, including single-dose toxicity, repeat-dose toxicity, genotoxicity, carcinogenicity and reproductive and developmental toxicity, as applicable depending on the level and nature of exposure to the device.
In the absence of such studies, a justification shall be provided.
In the case of devices containing CMR or endocrine-disrupting substances referred to in Section 10.4.1 of Annex I, the justification referred to in Section 10.4.2 of that Annex.
In the case of devices placed on the market in a sterile or defined microbiological condition, a description of the environmental conditions for the relevant manufacturing steps. In the case of devices placed on the market in a sterile condition, a description of the methods used, including the validation reports, with respect to packaging, sterilisation and maintenance of sterility. The validation report shall address bioburden testing, pyrogen testing and, if applicable, testing for sterilant residues.
In the case of devices placed on the market with a measuring function, a description of the methods used in order to ensure the accuracy as given in the specifications.
If the device is to be connected to other device(s) in order to operate as intended, a description of this combination/configuration including proof that it conforms to the general safety and performance requirements when connected to any such device(s) having regard to the characteristics specified by the manufacturer.
(1) Directive 2004/10/EC of the European Parliament and of the Council of 11 February 2004 on the harmonisation of laws, regulations and administrative provisions relating to the application of the principles of good laboratory practice and the verification of their applications for tests on chemical substances (OJ L 50, 20.2.2004, p. 44).
The technical documentation and, if applicable, the summary thereof to be drawn up by the manufacturer shall be presented in a clear, organised, readily searchable and unambiguous manner and shall include in particular the elements listed in this Annex.
1. DEVICE DESCRIPTION AND SPECIFICATION, INCLUDING VARIANTS AND ACCESSORIES
1.1. Device description and specification
product or trade name and a general description of the device including its intended purpose and intended users;
the Basic UDI-DI as referred to in Part C of Annex VI assigned by the manufacturer to the device in question, as soon as identificationof this device becomes based on a UDI system, or otherwise a clear identification by means of product code, catalogue number or otherunambiguous reference allowing traceability;
the intended patient population and medical conditions to be diagnosed, treated and/or monitored and other considerations such as patient selection criteria, indications, contra-indications, warnings;
principles of operation of the device and its mode of action, scientifically demonstrated if necessary;
the rationale for the qualification of the product as a device;
the risk class of the device and the justification for the classification rule(s) applied in accordance with Annex VIII;
an explanation of any novel features;
a description of the accessories for a device, other devices and otherproducts that are not devices, which are intended to be used in combination with it;
a description or complete list of the various configurations/variants of the device that are intended to be made available on the market;
a general description of the key functional elements, e.g. its parts/ components (including software if appropriate), its formulation, its composition, its functionality and, where relevant, its qualitative and quantitative composition. Where appropriate, this shall include labelled pictorial representations (e.g. diagrams, photographs, and drawings), clearly indicating key parts/components, including sufficient explanation to understand the drawings and diagrams;
a description of the raw materials incorporated into key functional elements and those making either direct contact with the human body or indirect contact with the body, e.g., during extracorporeal circulation of body fluids;
technical specifications, such as features, dimensions and performance attributes, of the device and any variants/ configurations and accessories that would typically appear in the product specification made available to the user, for example in brochures, catalogues and similar publications.
1.2. Reference to previous and similar generations of the device
an overview of the previous generation or generations of the deviceproduced by the manufacturer, where such devices exist;
an overview of identified similar devices available on the Union or international markets, where such devices exist.
2. INFORMATION TO BE SUPPLIED BY THE MANUFACTURER
A complete set of:
the label or labels on the device and on its packaging, such as single unit packaging, sales packaging, transport packaging in case of specific management conditions, in the languages accepted in the Member States where the device is envisaged to be sold; and
the instructions for use in the languages accepted in the Member States where the device is envisaged to be sold.
3. DESIGN AND MANUFACTURING INFORMATION
information to allow the design stages applied to the device to be understood;
complete information and specifications, including the manufacturing processes and their validation, their adjuvants, the continuous monitoring and the final product testing. Data shall be fully included in the technical documentation;
identification of all sites, including suppliers and sub-contractors, where design and manufacturing activities are performed.
4. GENERAL SAFETY AND PERFORMANCE REQUIREMENTS
The documentation shall contain information for the demonstration of conformity with the general safety and performance requirements set out in Annex I that are applicable to the device taking into account its intended purpose, and shall include a justification, validation and verification of the solutions adopted to meet those requirements. The demonstration of conformity shall include:
the general safety and performance requirements that apply to the device and an explanation as to why others do not apply;
the method or methods used to demonstrate conformity with each applicable general safety and performance requirement;
the harmonised standards, CS or other solutions applied; and
the precise identity of the controlled documents offering evidence of conformity with each harmonised standard, CS or other method applied to demonstrate conformity with the general safety and performance requirements. The information referred to under this point shall incorporate a cross-reference to the location of such evidence within the full technical documentation and, if applicable, the summary technical documentation.
5. BENEFIT-RISK ANALYSIS AND RISK MANAGEMENT
The documentation shall contain information on:
the benefit-risk analysis referred to in Sections 1 and 8 of Annex I, and
the solutions adopted and the results of the risk management referred to in Section 3 of Annex I.
Powered by TS Q&E - ISO 13485:2016 Medical Device Consulting Services
Manage Cookie Consent
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.