Article 16 inconsistencies
As you can read in another tip of the week, MDR Article 16 allows for a third party to repackage or relabel a device or to translate the instructions for use and add them to a device already placed on the market. Packaging, labelling and providing user information are typical manufacturer’s responsibilities and therefore Article 16 sets out they can either be done under the responsibility of the manufacturer by a third party (outsourcing), or they should be covered by the certificate listed in Article 16(4).
From a conceptual point of view, parties that make these changes to the packaging and/or the user information could be considered as taking over some responsibilities of the manufacturer. However, in the Servopax case the European Court of Justice thought that these responsibilities can be taken by a third party, in parallel with the original manufacturer, while trusting the Member States where these devices are made available will oversee if this is done sufficiently safe. It appears that regulators have been inspired by the Servopax case when Article 16 was created.
But there is a catch. Part of the conclusions of the Court was based other cases, which were about medicinal products. As all should know, medical devices and medicinal products are both medical products, but they live in parallel universes. They share some of the same terminology, but not the same meaning of those terms. The issue here is about ‘parallel import’. The pharmaceutical market is highly regulated, with national Member States regulating which products are allowed on their market, in what package size and how they are unambiguously identified. Medical devices are distributed on the Single Market and it is quite a challenge if a Member State wants to create a barrier for a specific device. With that in mind there are two interpretations for the concept of ‘parallel import’:
- ‘Parallel import of a medicinal product’ is seen as distribution of a medicinal product that has been placed on the market in a Member State on the territory of another Member State.
- ‘Parallel import of a medical device’ is seen as placing a medical device on the Union Market by a party in parallel with another importer, who is recognized as the official importer by the manufacturer.
Were the European Court in the Servopax case managed to navigate these different concepts, the rule makers of the MDR may have missed this difference. This leads to inconsistencies in the MDR. So far I found issues that are related to the role of the importer, UDI, legacy devices, risk management and brand name protection. Below you can see those issues, and some suggestions of how to handle this.
Importers – Article 16 as a Catch 22
In the MDR the importer is defined as a (legal) person, based in the EU, who places a device from a third country on the market. Article 16(2) describes certain changes made to a device that is already placed on the market. Therefore, Article 16 appears not to be about importers of medical devices. This article would work in a situation where a device is placed on the market in one Member State and a local distributor wants to make it available in another, in the case of medicinal products this would be considered a parallel importer. That distributor (MDR definition) is allowed to make changes to the packaging or the user information according to Article 16.
However, if a CE-marked device is made available by an importer via importation from a third country, which is what Article 16 suggests it is supporting, the importer would have to make changes to a device of a character that would more or less put them in the role of the manufacturer. This means that Article 16 is intended to allow for placing on the Union Market of medical devices from outside the Union Market, under the condition the device is already placed on the Union Market.
This looks like a Catch 22. The Article 16(4) certificate does not resolve this issue, because this only applies – I do repeat this condition of Article 16(2) – in case a device is already placed on the market. It would help if Article 16 were to be changed to mend this issue, or at least if the MDCG would issue guidance that would help to interpret this conflict in Article 16 in such a way that importers can actually perform these activities.
UDI – bending the rules, Brussel’s style
If a company puts a device into a new packaging, there must be a UDI on the new outer packaging to ensure identification and traceability during distribution. However, there is Annex VI, Part C, Section 2.3, that says: ‘Only the manufacturer may place the UDI on the device or its packaging’. Note that this is not about assigning the UDI to the device, which would make perfect sense to be a manufacturer’s responsibility. This would make repackaging by others than the manufacturer, or outsourced by the manufacturer, impossible. This too is related to the different universes of medical devices and medicinal products, because a medicinal product importer can make changes to the packaging, including adding identification codes required in a particular Member State.
When asked, a European Commission representative explained that the UDI can be added to the packaging or the label by a third party and outside the responsibility of the manufacturer, if certified by a notified body according to Article 16(4). This would indeed make sense, as the certification ensures a minimal level of compliance and scrutiny on this process. However, it is not in compliance with the MDR, Annex VI. Obviously, it would be great if the MDCG would at least issue guidance supporting this practical approach. It would of course be better if application of the UDI would explicitly be addressed in Article 16.
Legacy devices – the ‘no rules land’ between jurisdictions
MDCG guidance 2021-25 on legacy devices sets out that Article 16 does not apply for legacy devices. Under the MDD Article 16 was covered more or less by the definition of the manufacturer, where someone changing the intended purpose, packaging and/or user information would become the legal manufacturer, unless this was done under the responsibility of the original manufacturer. As can be seen from the Servopax case, this was not perfect and not what the authorities wanted, but at least there was a rule about it. MDR Article 16 says about the same, but it is stricter on its definitions and it adds the certificate. In general the MDD solution already worked quite well. As a consequence of MDCG Guidance 2021-25 on legacy medical devices Article 16 does not apply for legacy devices.
At the same time, the MDD, with its particular definition of a manufacturer, is no longer applicable and there is no transitional arrangement in Article 120(3) or anywhere else to ensure this section of the MDD would still apply. Article 120(3) sets out that legacy devices must either comply with the ‘old’ MDD certification requirements or the ‘new’ MDR. But what if an actor applies Article 16 on legacy devices? Or worse, if they just repackage a legacy device? This does not affect the certification of the device. If they make these changes the authorities can only act if they can demonstrate these changes have negative impact on the safety or compliance of the device.
In the case a company ensures their repackaging is done with sufficient care and the translate the instructions for use and labels adequately, the Servopax case makes clear that would not establish a non-conformity. This may therefore result in situations that explore some grey areas in compliance, where the authorities cannot act against. They may however decide that their guidance document is only guidance, and enforce market surveillance on companies that do repackaging, relabeling and other activities to legacy devices, that fall in this scope. Again, this may be difficult to bring to court, so the MDCG should update that guidance to address this issue.
In the meanwhile, would this result in a free for all situation? Not necessarily. Each legacy device may change into an MDR certified device overnight, and for the repackaging companies it may be difficult to spot the difference without EUDAMED fully operational. The authorities may have lists of ‘difficult’ situations, where they want to march in at the moment they know the devices in question have become MDR certified. Acting in line with the intentions of the MDR will probably make life easier for a company. Therefore, I would recommend in the situation of legacy devices to ignore MDCG 2021-25 and apply Article 16 in full to legacy devices anyway, including the actual certificate. This may also prevent suffering a gap in supplies between the moment a device becomes MDR certified and the company is certified according to Article 16.
Risk management – out of scope of ISO 14971
One of the subjects a notified body will look at for their Article 16(4) certification is how the company manages their risks. Obviously ISO 14971 jumps out as the appropriate standard. However, this standard is supporting the full process of medical device manufacturing, including the use of clinical data to improve the device. Packaging and labeling are steps in the production process, repackaging and relabeling should be seen in the same way. This implies that risk management related to Article 16 should focus on the process.
The question is if ISO 14971 would work best in this situation. For example, the post-market surveillance data may be replaced by ‘post-distribution data’, which should reflect the quality of the repackaging, relabeling and/or translating. But the post distribution data should not be confused by the PMS data generated in relation to the role of importer or distributor; that is data collected for the compliance of the device. Here we see again confusion about the exact role of the repackaging company. It appears that there is an Article 13 importer and a different importer role related to Article 16(4).
Where a manufacturer has a wider interest in fully understanding ISO 14971, it may be quite a burden for an importer or distributor to fully digest this standard. This becomes quite obvious, when you look at the scope of this standard: it is for manufacturers. We all know that application of a standard outside their scope can be quite risky…
There is another point. ISO 14971 is about preventing or reducing risks. The safety of a device should not depend on a user ‘just noticing a fault condition‘, which means that detectability of a fault condition is not relevant in ISO 14971. In the case of a repackaging or relabeling process, it would increase safety if a simple error could easily be detected at the end of the process, before product release. A company may develop for example their procedures in such a way that a specific fault reveals itself easily. Therefore, process design should facilitate detectability, which is not so obvious if ISO 14971 is applied in full.
If I look at the risks and how they should be managed, a much simpler FMEA would be adequate. We all know that keeping processes simple helps in improving the quality of their output. But we may see the notified bodies insisting on ISO 14971. Until there is guidance that sets out that other standards may be more useful, I suggest companies involved to still refer to ISO 14971, but only focus on the process related FMEA while using typical ISO 14971 templates for creating the documents for the notified body. My best guess is that, provided that FMEA is robust enough, this will pass the audit.
Brand name protection – does this make Article 16 futile?
Under European law it is not allowed to change, repackage, relabel etc. trade mark protected goods, unless of course, when this is done in agreement with the brand owner. Article 16(4) now makes it mandatory for anybody repacking a device without prior consent by the manufacturer, to share their intentions with that manufacturer at least 28 days before they do that. Manufacturers will now receive all the data, including a full confession, of anybody infringing their trade mark.
This looks too good to be true, and that is exactly the case. Any manufacturer claiming a breach of their brand name may find a parallel importer or distributor who claims they were able to obtain their device cheaper elsewhere or under other commercially interesting conditions, or to be able to make them available to other users than the official distribution chain. Europe does not like to see such differences as part of the ambition to create a competitive market, see Article 101 of the Treaty on the Functioning of the European Union (“TFEU”), which imposes a general ban on cartels, or Article 102 TFEU, intended to prohibit the abuse of a dominant position. Judges have been found in favor of those articles, so companies should be warned to be too strict on companies repackaging their devices.
These conflicting interests create uncertainty for both manufacturers, willing to invest in their devices and their marketing, and for companies that want to perform parallel imports or distribution. For medicinal products this is already set out in case law of the European Court. But, as already mentioned, that is law that applies in another universe. It would help if guidance would set out where repackaging and relabeling of devices is a necessity supported by the MDR ends, and where trade mark protection begins. Until that time, I can only recommend any party to carefully consider the pros and cons of any action taken when it comes to repackaging of devices.
Just reach out if you are making changes to devices and you want to fully understand how that relates to Article 16, or if you have another question related to repackaging, relabeling or translating.
