MDR Amendment Regulation (EU) 2023/607

how this may (not) work for you

• Read about that crucial one-sentence elevator pitch for your management
• Understand what this amendment really means
• Find your devices live in parallel worlds
• Understand how to make the best of that
• Rethink that one-sentence elevator pitch I started with

Elevator pitch

The new amendment to the MDR is nicknamed the ‘MDR Extension Regulation’. This has some truth in it, but it does not cover the whole story. It may also create incorrect expectations with stakeholders. So here is the one-sentence elevator pitch I would recommend preparing, in case your CEO wants to know what this Regulation means for your organization:

“From 26 May 2024, this regulation changes the definition of a legacy device in such a way that we need to take actions now in order to avoid losing our legacy status.”

Below I will reflect on this amendment and its consequences and provide some suggestions for limiting your risk of unintentionally losing your legacy status.

The amendment has entered into force

On 20 March 2023 the text of the MDR amendment, Regulation (EU) 2023/507, was published in the Official Journal of the European Union and it became into effect immediately. In that way, devices with expired certificates can remain on the market for some time longer. This amendment mainly changes Article 120 of the MDR, and that is what I will focus on. Elsewhere on my website, you can find the ‘tracked changes’ version together with the consolidated version of Articles 120 and 122. You may observe that in particular Article 120(3) has changed.

The MDR is extended for notified bodies

When the MDR was introduced in 2017 it had a flaw. Smooth implementation depended on the assumption that the notified bodies would be able to transition all devices from the AIMDD and MDD to the MDR in three years, more or less in parallel with the normal recertification cycle. Obviously, it would have been a challenge to squeeze a four or five-year cycle into three years. But the main problem was that it took about two years before the first notified body became MDR designated, which happened to be BSI UK, a large organization that was about to leave the EU thanks to Brexit. Even now, almost six years later, there are still notified bodies in the process of becoming designated. In other words, there has been a gap in the certification capacity that can only be corrected by allowing the notified bodies more time.

So this amendment essentially does just that:

Manufacturers must be fully compliant with the MDR, while the notified bodies can take more time.

It means that the concept of legacy devices will remain with us a bit longer, although the nature of legacy devices will change.  In my view this small change is crucial for the access your legacy devices have to the European market (and others…).

The definition of legacy devices has been changed

MDCG Guidance 2021-25 defines legacy devices as:

• Devices that are class I devices under Directive 93/42/EEC (MDD), for which an EC declaration of conformity was drawn up prior to 26 May 2021 and for which the conformity assessment procedure under the MDR requires the involvement of a notified body;
• Devices covered by a valid EC certificate issued in accordance with Directive 90/385/EEC (AIMDD) or the MDD prior to 26 May 2021.

Both groups will remain legacy devices under the following conditions:

1. They will remain a legacy device until their AIMDD or MDD certificate expires, or until 26 May 2024, whichever comes first, and;
2. The devices continue to comply with their respective Directives, and;
3. There are no significant changes in the design and the intended purpose, and;
4. The manufacturer applies the requirements of the MDR relating to post-market surveillance, vigilance, and to the registration of economic operators and devices.

The amendment changes the definition of a legacy device. All of the above applies, except that the end date has moved to 31 December 2027 for Class III and Class llb implantable devices (with some exceptions) and to 31 December 2028 for all other devices. It also reintroduces legacy status to devices for which the certificate has expired while they were still covered by a valid certificate on 26 May 2021, the date of application of the MDR. On top of that, there are additional conditions:

1. The manufacturer has lodged an application for MDR certification at a notified not later than 26 May 2024 and there is a signed agreement with that notified body about this by 26 September 2024;
2. The surveillance audits are done by the notified body that does the MDR certification, which has been agreed upon no later than 26 September 2024.

You can only lodge an application for MDR certification if you are fully ready for that because the notified body will do a few checks to see if they can expect a minimal quality in the evidence presented to show the devices comply.

Losing your legacy status

So, manufacturers need to be fully ready for the MDR by 26 May 2024 and the notified body for the MDR certificate will be surveilling their devices. And here is the catch:

If you don’t have a notified body signed up, you will lose your legacy status.

Not only that:

If the notified body finds major non-compliances during their surveillance audit, you may also lose your legacy status.

Expect detailed scrutiny of your post-market surveillance activities. But the risk of losing the legacy status does not end here. If your MDR certification is refused by the notified body, you have to apply again for certification.

Without that ongoing application, you lose your legacy status.

Even your MDR-certified device is not safe. You have to keep complying with the MDR, which must be demonstrated in the surveillance audits by your notified body. In summary, this is what you need to manage if you want to keep your legacy status:

1. Meet MDR requirements for your devices as soon as possible (see below);
2. Sign up with a notified body as soon as possible, but no later than 26 May 2024;
3. Prepare for in-depth surveillance audits by your notified body, especially when it comes to PMS and vigilance;
4. Prepare for MDR certification as if you will not get a second chance, because you will not get that second chance until 2029 at the earliest.

Parallel worlds

Obviously, we all know that the MDR is coming and that you need to prepare for that. But there are some essentials that you need to have in place well before the notified body starts its assessment. Basically, you need to comply with everything, except for Articles 54 and 55 (if they apply for you), items that depend on a EUDAMED being fully operational, and some other minor details.

This means you have to arrange essentials like:

• The implant card;
• The Summary of Safety and Clinical Performance;
• UDI;
• And some other details…

Mind you, I am not saying that you need to make these items publicly available already. I am only saying they need to be ready and up for scrutiny by the notified body on 26 May 2024. And all the time you are in legacy status you need to keep updating them and in alignment with your PSUR and updated CER and/or risk management report.

You will have your devices living in two parallel worlds.

In one world, they are called ‘legacy devices’ and you keep them in compliance with the AIMDD or MDD. In the other world, they are already in compliance with the MDR and you are keeping them compliant. And of course, you must appoint a PRRC to ensure compliance of that parallel world. Expect the notified body to check the availability of a PRRC at the moment you lodge your application. Be aware that in the case your certificate has expired already, or it will expire before 26 May 2024, the new definition of a legacy device already applies.

Having to handle devices in parallel worlds starts at the moment you lodge your application for notified body certification, or when your certificate expires – that may have happened months ago

Losing legacy status is now irreversible

If you lose your legacy status, your device can no longer be placed on the market. For most devices that risk only applies after 26 May 2024. But if your MDD or AIMDD certificate has already expired, or will expire soon, this may happen earlier. Once you are out of the ‘legacy world’ you cannot go back. You can only place your devices on the market after you have become MDR certified, which may take until 2029 or later. Article 59 and 97 will not be very likely ways out, because in deciding about their applicability the authorities will apply more or less the same criteria as for the legacy status.

Five ways of losing legacy status:

1. If your certificate expired or was not valid on the date of application of the MDR, your device did not have legacy status. You can’t go back now.
2. If your certificate was valid on the date of application but expired after that, your device can still be treated as a legacy device. You must have an agreement with a notified body by 26 May 2024 and you must be MDR certified before 31 December 2027/2028.
3. If your certificate expires between 20 March 2023 and 26 May 2024 you must have an agreement with a notified body and you must be MDR certified before 31 December 2027/2028.
4. If have an agreement with a notified body, but you don’t meet the PMS requirements (and some others) and/or your documentation fails the assessment, you lose legacy status.
5. If you are in legacy status now, manage to have an agreement with a notified body, manage to keep your device compliant, you still need to have an MDR certificate by 31 December 2027/2028.

Elevator pitch v2.0

Having to maintain full compliance with both the Directives and the MDR, with one set of documents as ‘official’ and the other as ‘draft’, may be complex. In most situations compliance with the MDR also implies compliance with the Directives. From that perspective, it would make life easier if you just go full MDR compliance as soon as possible. The only problem is that you cannot demonstrate that with a certificate. The good news is that this recent MDR amendment has taken care of that.

With that in mind, you may want to change the elevator pitch to your management:

‘From 26 may 2024 we must comply in full with the MDR. Period!’

Reach out if:

• You want to know if you have done everything to ensure the continued legacy status of your devices
• You just want to have a top expert only one email away…

Just reach out to: Ronald@boumansconsulting.com