MHRA response to consultation on UK regulation of medical devices

On Sunday 26 June the Medicines and Healthcare products Regulatory Agency (MHRA) published the government response (Response) to the consultation on the future regulation of medical devices in the UK. In this article we look at some of the key points of the Response.

The consultation was issued in September 2021 and closed in November, and draft regulations will be published in the next few months. As the new regulations are secondary legislation, they will not be the subject of full parliamentary scrutiny, but instead, if they are laid before the UK parliament at all, they might only be accepted or rejected. 

Given that the key rationale for the new regulations is to enhance patient safety and the government is up against its own deadline of 30 June 2023, it is likely that they will be approved. We can therefore expect the new UK medical device laws to be on the statute book in relatively short order after their publication.

The Response to the consultation points to the use of guidance over regulation, so that we might expect to see regulations that are less detailed than the EU regulations are, but which will be supplemented by detailed guidance. This allows the MHRA more flexibility because guidance can be adapted and updated without resorting to legislation.

Below we have given our analysis of some of the key points, in our top 10 highlights.

Transitional provisions

During the transitional periods CE marked devices both under the directives and the regulations will continue to be accepted, as will UKCA marked devices under 'old' UK regulations. The shortest timelines are for UKCA marked devices and general medical devices whose certificate and/or declaration of conformity (DoC) is/are issued under the EU directives, where certificates and/or DoCs under the UKCA mark must be in place within three years for a device to continue to be marketed. 

Interestingly, the Response notes that these timelines will be flexible – perhaps a nod at the UK intending to act more flexibly to meet the needs of the industry, compared with the EU who have been fairly intransigent on timelines. 

Note however the transitional provisions relate only to product certificates/DoCs and not to all provisions. One should expect for other provisions, such as those relating to post-market surveillance, economic operators and the UK responsible person to be fully applicable from 1 July 2023. 

Unless any applicable certificate expires sooner, the transition times for obtaining a certificate and/or declaration of conformity under new UK regulations for the GB market are as follows:

Similarities to the EU Regulations

Unsurprisingly many of the proposals have a strong resemblance to concepts in the MDR and IVDR (EU Regulations). This allows manufacturers to reuse the approach already followed for the EU Regulations. Examples of approaches that are the same as the EU Regulations include:

• Although the UK will continue to use 'essential requirements' as a term, they will be aligned with the General Safety and Performance Requirements (GSPRs) of the EU Regulations (with an additional labelling requirement for allergens/sensitisers).
• Key definitions, including the definition of medical device and an IVD.
• The provisions on making claims (Article 7 MDR/IVDR), but which will be supplemented by guidance on meaning of a 'misleading claim' – something we have yet to see from the MDCG for the EU.
• Manufacturer, importer and distributor obligations (although the obligation for the importer to undertake the 'placing on the market' is not referenced in the Response).
• The requirement for the manufacturer to have coverage for legal liability arising from adverse incidents.
• The health institution exemption definitions and key provisions.
• UDI definitions will align with the EU ones.
• UK Approved Bodies (ABs) will be equivalent to notified bodies, as private entities essentially performing the same functions.
• IVDs will require evidence of scientific validity and analytical and clinical performance data to provide sufficient clinical evidence including from a performance evaluation. This will be part of the technical documentation, together with justifications for not providing clinical evidence.
• The requirement for a summary of safety and clinical performance (SSPC) for higher risk devices.
• An equivalent of Article 16 MDR, with a person modifying a device having manufacturer-like obligations.
• Most of the sections on clinical trials and performance evaluations are aligned.
• There will be an ethical review for all performance evaluations involving human samples.
• SaMD is to be regulated by essential requirements that are similar to those in the relevant GSPRs.
• The requirement for a post-market surveillance system and the definitions used within it.
• The requirement for implant cards and leaflets for patients.

Departures from the EU Regulations/Additional UK Requirements

There are some areas of significant departure from the EU regime, or where a UK equivalent means an additional regulatory burden for manufacturers already operating in the EU, most notably in relation to the following:

• Classification principles will align to best international practice, by which we presume they mean IMDRF classification rather than the EU Regulations. There is also a list of devices of special concern to the MHRA which are likely to be up-classified. This will mean that a small number of device types will be classified differently in the UK compared with the EU.
• Aspects of regulation of SaMD, with specificity on the meaning of 'placing on the market' of downloaded SaMD.
• GMDN is to be used where the EU uses EMDN.
• The Response states that importer details must be provided with the device, but this can be on an invoice. It is not clear though if those details need to be able to flow down the supply chain with each individual device, as a single invoice would not do so if the importer sells to a distributor.
• The UK Responsible Person (UKRP) will have legal liability similar to the EU Authorised Representative, which means an additional entity requiring insurance.
• Equivalence in clinical investigations will be permitted only where there is entire equivalence on a biological, technical and clinical basis.
• Clinical trials undertaken by non-UK based sponsors will require a UK-based legal representative.
• The requirement for an independent monitor to be appointed by the sponsor of a clinical trial in the UK, although if this person could be based in the EU for a multi-site trial, then this would not be an additional appointment – but this is not specified yet.
• The requirement to publish a clinical investigation report with specific details.
• While for IVDs the requirements for post-market surveillance are similar to those in the EU, they are tighter in requiring at least annual updating of the summary of safety and clinical performance and of the post-market performance follow-up.
• Requirements for a clinical performance study plan for clinical and performance evaluations with specific content to be provided.
• Performance studies for companion diagnostics involving only leftover samples are to be notified to the MHRA.
• There will be exemptions from some requirements for certain types of clinical investigations and performance studies where an academic institution is working with a health institution on proof of concept or early feasibility, without any input from industry, although this will still require MHRA notification.
• There is to be no additional scrutiny for implantable devices as there is in the EU – with the MHRA noting that some will be up-classified and will be subject to stronger evidence requirements.
• There will be more stringent post-market follow-up requirements for implantable medical devices.
• There are no exemptions to the requirements for clinical evidence for certain more standard implantable devices such as screws and wedges.
• The introduction of a quality management system for certain custom-made devices, and more stringent requirements for PMS for custom-made devices.
• Health institutions will be permitted to provide services to other health institutions, but not if provided commercially or for profit.

Quality management systems (QMS) and regulatory authority oversight

Every manufacturer and health institution will be required to have a QMS. While health institutions will not require a certificated QMS, manufacturers will have several options for proving that their QMS meets the required standards as part of the certification process.

• A 'CE plus UKCA' regime that will apply if a manufacturer uses a notified body and an AB from the same corporate group: avoiding duplication – hopefully the fees charged will reflect this and this should encourage EU notified bodies to establish in the UK to gain competitive edge.
• A Domestic Assurance route provides for an 'abridged assessment' by UK AB. This applies if there is an authorisation of another regulatory authority that is recognised, although these are not yet named.
• A MDSAP certificate will be recognised, with the intention that UK AB's will be able to give such certificates and if granted by a certifying body in another country, then the UK AB will review and grant a certain amount of recognition and thus a shorter route to certification.
• The MHRA is itself to have 'additional powers to grant initial market approval'…in 'specific, defined, circumstances' (innovative/game changers and SME manufacturers) – this is similar to a conditional authorisation for pharmaceuticals.

Note also that the MHRA will have the ability to step in in the event of AB failure (for which there must be one year's notice), and certificates will remain valid for a specified period to allow the manufacturer to obtain certification with another AB.

More regulatory burden for UKRPs

The MHRA is taking steps to address 'virtual' UKRPs by requiring a physical presence in the UK as they do not accept 'letterbox' UKRPs. The UKRP is also to be liable for defective products. This will mean that the UKRP will have to carry more expensive insurance provision. The UKRP will be required to have a Qualified Person (QP). It is not yet known if the QP will be required to be physically in the UK, or if an EU PRRC based elsewhere might perform this role.

Performance evaluation pre and post market requirements

Per the EU IVDR, there must be clinical evidence to support the intended use. Guidance is to be provided on what would count as justification for reliance on other sources of clinical performance data. The government recognises the need for 'international alignment', which could be EU, global or a mix. The SSCP and Post-Market Performance Follow-up (PMPF) is to be updated at least annually with a requirement to regularly review state of the art.

Health institution exemption

Health institutions will be required to have a QMS, although it will not need to be a certified QMS, and they will need to produce technical documentation and adhere to provisions of adverse incident reporting. The exemption is also to apply only where there are no alternatives available in the market, which is likely to limit its application compared with today's usage, even if health institutions can step up to the higher regulatory burdens imposed.

Special provisions for software

While the definition of 'software' will be the same as in the EU (where it is defined in guidance rather than law), there are new provisions, such as a specific definition of 'placing on the market' as applicable to SaMD deployed on websites or app stores. It will be clear that SaMD provided via distance sales is subject to UK medical device regulations. 

The UK will be following the IMDRF SaMD classification for general medical devices (not IVDs). SaMD will have specific essential requirements, although the essential requirements will closely mirror the applicable EU MDR GSPR. There will also be specific provisions on cyber security and data protection. AI will be regulated via guidance not law. There will be provision for predetermined change control plans (PCCPs) that will help manage changes for software and will be set down in law, although on a voluntary basis at least initially.

Device shortages

Despite responses being equivocal on the point, the MHRA intends to require economic operators to inform the MHRA of issues that will interrupt supply or cause shortages. It will also be a requirement to notify the MHRA of the market status of the device – whether it is premarket, on the market or withdrawn from the market.

The MHRA has reserved some areas for further consideration...

particularly where the regulation will affect other government departments. Reserved areas where we might expect some new, as yet undefined, legislation include:

• provisions on distance sales
• whether it will be an obligation to register (and therefore be publicly available) that a device contains human or animal tissue
• ABs entering information about conformity certificates into the MHRA database
• how to deal with bias and diversity in clinical evaluations
• whether to have an airlock classification rule for SaMD – allowing for classification to change once more data is obtained
• whether implantable devices will be limited to use in centres that are specialists in such devices
• how obsolete implantable devices are regulated
• mandating the logging of outputs of AI-enabled devices to allow auditing
• whether PCCPs will be mandated in the future.

Interested in hearing more about the Medicines and Healthcare products Regulatory Agency (MHRA) Response? Watch our recent webinars:

Session 1

A breakdown of the key proposals for all devices and their likely implications, including the UK's "new way" for regulating software medical devices.

Watch now

Session 2

The impact of the new provisions applicable solely to in vitro diagnostic medical devices.

Watch now