How to prepare for the MHRA's new medical devices enforcement rules

The Medicines and Medical Devices Bill 2020-21 is more than just another piece of Brexit legislation – especially if you're a medical devices manufacturer.

Expected to become law in the UK by the end of 2020, it contains significant new enforcement provisions that apply solely to the sale of medical devices.

Some of the new rules resemble the Serious Fraud Office's powers under the Bribery Act 2010, which allows us to draw on strategies we've developed to deal with the anti-bribery regime.

With this in mind, we outline the key changes and actions you can take to prepare for the new enforcement rules.

Take note: New enforcement tools

When the Medicines and Medical Devices Bill 2020-21 (MMD Bill) becomes law, the MHRA will have several new enforcement tools at their disposal, including enforcement undertakings and civil monetary penalties. Offences can be committed by individuals, directors and by corporations.

The MHRA will have the right to issue four different types of notice, and breaching any of them will be a criminal offence. Recourse against the MHRA for any person who disagrees with the imposition of a notice will mean taking the MHRA to court in an application to set-aside or vary the notice. You will want to ensure that in your interactions with the MHRA your company avoids being issued with any of these notices in the first place.

The ability to impose notices gives the MHRA extra leverage in those interactions and means you will have to consider complying with directions of the MHRA more promptly than was previously the case.

Undertakings: "Promise to be good"

Undertakings are (broadly) promises to take specific agreed action to bring your business into compliance. The MHRA can accept undertakings if they have reasonable grounds to suspect that an offence under medical devices regulations has been committed.

They might choose to use this route to achieve compliance mainly because it is quicker and less time consuming but also where the MHRA is less sure of meeting the standard for criminal liability, which requires proof of the offence "beyond reasonable doubt". This option has already proven popular for financial crimes (tax evasion and failure to prevent bribery) and we expect it will similarly be a well-used enforcement tool by the MHRA for breaches of the medical devices regulations.

Just like with the Deferred Prosecution Agreements (DPAs) under the Bribery Act, agreeing on undertakings with the MHRA means you can avoid criminal prosecution. However, under the MMD Bill, the enforcement undertakings do not just defer prosecution, they effectively prevent it, on condition that you do of course comply with the undertakings given.

What makes undertakings even better for businesses is that the MHRA cannot couple them with a monetary penalty – unlike the DPAs, which usually involve both a financial penalty and undertakings.

If you receive a notice from the MHRA, a crucial consideration will be whether to offer/accept enforcement undertakings or rely on the due diligence defence (more on this below). Since the enforcement undertakings are not tied to financial penalties, they are likely to be your preference, especially if the process is not public (as appears to be the case).

As such, it might be a better strategy to propose the undertakings at the outset. In practice, agreeing on the content of the undertakings is likely to turn into a negotiation. This negotiation is likely to resemble current processes with the MHRA, but now with the formality of a legally binding outcome.

The MHRA will accept money

If the MHRA is a bit more confident that an offence has been committed, the MMD Bill will allow them to impose a civil monetary penalty instead of prosecuting you (or your business). If this happens, the undertakings ship has probably sailed – the MMD Bill requires the MHRA to have enough evidence to launch a criminal prosecution before imposing a fine.

However, if the MHRA use this option, this means you will be able to "buy your way out" of that potential criminal liability. The MHRA will communicate these monetary penalties by notice, and you will be allowed some time to make representations and objections.

We expect the MHRA to use this new option. If you pay the fine, the criminal charges not be laid, but the MHRA can still claim a successful enforcement action and which they can achieve with greater certainty, at less cost and in a much shorter timeframe than would be the case for a criminal prosecution.

For your business, the advantage of paying the fine is likely to be that the imposition of monetary penalties under the MMD Bill is not a public process (unlike with DPAs or criminal prosecution). This offers a way to resolve regulatory problems in private, particularly where the prospects of establishing a defence seem uncertain or low, or simply to allow your business to move forwards.

Have your say

When the MMD Bill becomes law, the MHRA will be obliged to publish guidance on how exactly the undertakings and monetary penalties will work.

They will hold a public consultation before this guidance is finalised, so make sure you keep an eye out for it – and submit your views.

Two points to focus on when reviewing the MHRA's proposals:

• How the monetary penalty is calculated and the extent to which self-reporting will factor into this calculation. Discounts may incentivise you to self-report early and pay, rather than risk prosecution.
• Will the MHRA guidance include any pointers on the management of the self-reporting process? Our experience under the Bribery Act shows that the practicalities of cooperation/self-reporting can be challenging when criminal prosecution is on the horizon. In this scenario, you need to avoid "trampling on the crime scene" and you have to decide what you need to disclose to demonstrate cooperation, bearing in mind that – once revealed to the authorities – otherwise privileged documentation might become disclosable in related civil proceedings.

"I did everything I can" – OK, but can you prove it?

The MMD Bill also introduces a new defence of due diligence to the two important corporate criminal offences:

• for breach of any of the notices served by the MHRA, and
• for breach of any of the major requirements of the medical devices' regulations.

To successfully use this defence, you'll need to show that you took "all reasonable steps and exercised all due diligence to avoid commission of the offence."

This wording is similar to s.7 of the Bribery Act defence, which allows companies to avoid prosecution for failure to prevent bribery if you prove that you had "adequate procedures" in place designed to prevent people associated with your business from giving or receiving bribes.

The "adequate procedures" defence effectively inhibits enforcement authorities from pursuing large corporates for the offence of failure to prevent bribery. Because it's unclear when this defence might be available, the SFO doesn't take on many prosecutions, fearing public failure.

However, it may play out differently under the MMD Bill, given the requirement that all reasonable steps be taken, which suggests that the MMD Bill will impose a higher standard than the Bribery Act. Whether the actions taken by your company were all reasonable ones will be a critical issue in prosecutions.

In further contrast to the Bribery Act, under the MMD Bill, the MHRA isn't obliged to issue guidance on what steps are relevant to establishing this defence, which may make it difficult for both you and the MHRA to assess what's required to prove it. This lack of certainty gives another reason for the MHRA to prefer fines over prosecutions.

It's vital that if not already in place, you map out what steps, policies, training and procedures you need to have in place now so that you're ready with the defence should it ever be needed. Engage with industry bodies to see if they could help with some of this homework. 

Clear lines of responsibility will help if things get personal

Under the MMB Bill, company officers will be liable for a criminal offence of their own if the corporate offence was committed with their "consent or connivance" or even if the offence is attributable to neglect on their part.

This wording goes further than a similar provision in the Bribery Act because it includes negligence (indicated by the word "neglect") as a ground for prosecution. You should take this seriously because negligence doesn't require any deliberate conduct, merely a lack of reasonable care – a rare basis under English law for imposing criminal responsibility. 

Note how the liability of officers ties in with the due diligence defence: if your company has relevant procedures in place and that have been properly followed, you stand a stronger chance of being able to establish the defence to the corporate offence charges. Without the company offence, there is no officer liability.

The policies and procedures you put in place to establish the defence of due diligence should go some way to protect your company officers. Make sure your business also has clear lines of responsibility to ensure that compliance is firmly embedded in its culture from the top down.

Brace yourself for civil actions…or use them

A broadly drafted provision in the MMD Bill grants a right of action for breach of statutory duty to anyone "affected" by a breach of a medical device regulations-imposed obligation. 

The legislators have not made clear who is intended to benefit from this provision. Various remedies are already available to patients, distributors, and other actors in the supply chain. 

We wonder whether this provision would allow companies to bring unfair competition claims against their competitors (civil law-style) to police regulatory breaches. This would allow the MHRA to reduce enforcement costs: in the world of pharmaceuticals, competitors have proven to be far more zealous enforcers than the regulators, especially in more nuanced cases.

Looking at it from another angle, if you're fed up with a competitor cutting regulatory corners and leveraging this to get ahead of you in the marketplace, this new cause of action may be your chance to put some pressure on them to comply with the law and level the playing field. 

Regardless of the MHRA's intentions here, one thing seems obvious: this provision will increase your potential exposure to civil actions. It may be time to review your insurance and litigation budgets. 

Be prepared for things to get expensive

Speaking of budgets: like the UK anti-bribery regime, the MMD Bill provides ample opportunity for the regulator to charge you for their regulatory efforts: 

• the MHRA may seek a court order for reimbursement of their enforcement costs if you had a forfeiture order made against you or have been convicted of breaching one of the four MHRA notices or the medical device regulations, or
• the MHRA may also require those accepting a fine to pay for the costs of the investigation, administration, and of obtaining expert and legal advice. These costs could be substantial, as they appear to encompass more than "enforcement costs" applicable following a criminal conviction – another reason to try to agree on achievable undertakings with the MHRA and avoid fines altogether.

These provisions may be an attempt by the government to bolster the MHRA's budget. The MHRA will need to take on more functions previously carried out by the European Commission or other European authorities after Brexit but without the income generated from reviewing European dossiers.

As non-compliance is about to become more expensive, you may want to bolster your regulatory teams to ensure compliance with medical devices regulations.

Find out more

There is plenty to digest in this bill – risks but also opportunities, like the new right of action that may work as a stick for competitors. The next step is to analyse the impact on your business and identify the actions you need to take both to ensure compliance with the law and to establish a defence of due diligence.

Additionally, your regulatory and legal teams need to be ready to negotiate with the MHRA in a potentially different manner from previously because the MHRA will be better and more formidably armed. If you'd like to discuss these next steps in greater detail, please contact a member of our Life Sciences and Healthcare team.