Annex II (EC Declaration of Conformity – full quality assurance system) of Council Directive 93/42/EEC, a.k.a., the Medical Device Directive (MDD) delineates the regulatory requirements necessary for compliance with the Directive employing an acceptable quality assurance system. Additionally, applications required by notified bodies for the quality management system (QMS) and device review and approval are included as part of Annex II.

The good news is that for device manufacturers that already comply with EN ISO 13485:2003, compliance with Annex II, from a quality system standpoint, is a proverbial “cake walk.” For device manufacturers not achieving compliance with the EN ISO 13485:2003, compliance with Annex II is going to be problematic. In fact, you might as well commence looking for another device market to enter because product entry in to the European Union (EU) is not going to happen. Why – because device manufacturers need a QMS approved by a notified body prior to making any application for a device approval. Frankly speaking, entry into most markets will be problematic until compliance is achieved.

The bottom line for device manufacturers is in reality quite simple. Having a documented and functional QMS is the price of admission into the medical device market. As you read this edition of DG, please keep in mind that Dr. D is trying to do more than just adumbrate (look-it-up) the information delineated within the MDD. The doctor’s goal is to provide insight into the interpretation and practical application of the requirements. 

Full text of MDD – 93/42/EEC ANNEX II – EC DECLARATION OF CONFORMITY can be viewed here (see pages 33-37).

What you need to know
The obvious “no-brainer” here is that a fully-functional QMS is a salient requirement for device manufacturers, period. Not unlike FDA’s Quality System Regulation (21 CFR, Part 820), Annex II requires that the QMS encompass more than just the routinely perceived elements associated with quality; such as inspection, measurement, CAPA, audits, nonconforming product, etc. In accordance with Annex II, QMS requirements begin with the design, continue with manufacturing, all the way through to final acceptance and distribution. In the last edition of DG, Dr. D explained the importance of devices meeting their essential requirements. Annex II supports the salient requirements associated with Annex I, by ensuring device manufacturers have an effective QMS, which in turn, supports the ability of a device to meet essential requirements.

The next point that needs to be made is that device manufacturers, as part of the application and approval process, are required to sign a declaration of conformity (DoC) that contains, as a minimum:

• Product name;
• Product code;
• First batch number manufacturer; and
• Other relevant information deemed important by the manufacturer.

Once the DoC has been prepared, do not forget to have the organization’s Chief Jailable Office (CJO) sign and date the declaration. Make sure the CJO is aware of the consequences associated with signing a fraudulent document; and the lack of a fashion statement wearing an orange jump suit in the Netherlands makes. Once signed, now would be a good time to ensure that the CE marking of conformity, containing your notified body’s registration number, is affixed to the product packaging.

QMS always comes first
So where does this entire process begin, a.k.a. what came first, “the chicken or the egg?” In the case of the Directive, the QMS should always come first. The process commences with the device manufacturer making application to a notified body requesting the assessment of the quality system. As a minimum, the application shall include:

1. The name and address of the manufacturer and the manufacturing sites covered by the QMS;
2. Relevant product information;
3. A declaration that no other application exists (extremely important point as device manufacturers are permitted just one application per device in the EU – for additional clarification, a device manufacturer can have multiple notified bodies but cannot have the same device application with multiple notified bodies);
4. QMS documentation;
5. The ongoing sustainment of the QMS by the device manufacturer; and
6. A post-market surveillance system to evaluate ongoing device performance characteristics.

Another salient point that device manufacturers need to know and understand reinforces #5 listed above. The QMS really does need to be fully functional from design to final acceptance inspection. Not so minor details such as procedures, written work instructions, quality plans, the quality manual, and all of the records collected are extremely important. In fact, one of the doctor’s favorite mantras continues to be; “If it isn’t documented in writing, it did not happen.” That being said, a few of the key elements expected to be developed, in accordance with Annex II compliance and the application process, are:

1. Quality objectives;
2. Organizational structure, including roles and responsibilities of management;
3. Methods employed for QMS monitoring;
4. Procedures for monitoring and verifying design effectiveness;
5. Device interactions, when connected to other devices;
6. Statements delineating if human blood derivatives or tissues of animal origin have been used as part of the manufacturing process;
7. Clinical evaluation data;
8. A copy of the draft label and the instructions for use (IFU);
9. The application of inspection and quality assurance methodologies; and
10. Sterilization.

Once application has been made, the notified body will assess the QMS to ascertain if all of the requirements of the Directive have been fulfilled. If this is a device manufacturer’s first time through the application and assessment process, Dr. D can safely state; “Expect to receive some minor deviations.” Minor deviations will not prevent a device manufacturer from entering into the European device market, provided corrections to the QMS are expedited. However, if a major deviation is received, all bets are off. The major deviation will need to be corrected and effectiveness verified by the notified body prior to device entering into the EU.

Examination of the design of the product
Believe it or not, the application and approval of the QMS is, in Dr. D’s humble opinion, the easy part of the equation. Device application and approval becomes the greater challenge. Once the QMS has been approved and the appropriate certificate issued by the notified body, application for the device can be made. In the good-ol’-days, notified bodies only reviewed Class III device applications in great detail. Class IIa and IIb (exempt from Section 4 of Article II), were for the most part self-certified by the manufacturer, with the manufacturer claiming conformance to the essential requirements.

This approach was clearly a two-edged sword with some manufacturers abusing the process by taking great liberties in claiming compliance to harmonized standards, where actual compliance was questionable. Regardless, as part of the application and examination process, the manufacturers must submit the design dossier (Class III devices) to their notified body for review and approval. The dossier shall contain sufficient granularity in regards to the device design, manufacturing, and performance characteristics. If the notified body, premised on their examination of the application and supporting data, believes the manufacturer and the device meet the required elements of the Directive, approval to market within the EU will be granted. Device manufacturers should not be surprised if this process takes several months, with multiple rounds of questions. Finally, once approval is granted, any changes impacting device conformity will need to be routed back to the notified body for review and approval.

Surveillance
Assuming a device manufacturer has obtained approval of their QMS, and their device application has been approved, now what? Is that the end of the process forever? Unfortunately, the answer would be a resounding no. The notified bodies are not very trusting, and by the way, they make significant coin through the performance of audits. That being said, surveillance audits now come into focus. Notified bodies perform surveillance audits with the aim of ensuring their clients (the device manufacturers) remain in compliance with the Directive. By the way, did the doctor mention they get paid for these activities? Device manufacturers can expect to host these surveillance visits annually, in between the actual full recertification audit. If the manufacturer is racking up a significant number of vigilance reports in the EU, they should expect more frequent visits.

A device manufacturer cannot expect to play in the European medical device sandbox without administrative provisions. For example, a key provision of Annex II is the requirement that the device manufacturer or their European authorized representative must retain certain pieces of data for at least five years for medical devices and 15 years for implantable devices, including:

• The EU DoC;
• The design dossier or technical file;
• Device changes;
• Other relevant documentation; and
• Decisions and reports from their notified bodies.

At minimum, these must be retained and be made available upon request from the notified body or Competent Authority.

Application to device in Classes IIa and IIb
I have presented, for the most part, examples supporting the applicability of Annex II for Class III devices. However, the Annex does apply to Class IIa and Class IIb as well. As stated earlier, Section 4 of Annex II does not apply for Class IIa and Class IIb devices.

Keep in mind, notified bodies are now requesting technical files for review prior to granting approval for device entry into the EU. Additionally, notified bodies are required to assess conformity of these products as part of their audits. During their friendly visits, your notified bodies are required to pull at least once representative sample from each device category. If a device manufacturer has a whole bunch of device categories, they better be prepared to review a whole bunch of technical files with their notified body. By the way, did Dr. D mention that the notified bodies get paid for these activities?

Application of the devices referred to Article 1(4a)
Article 1(4a) is the clause that delineates requirements for medical devices that incorporate, as an integral part, a medicinal product derived from human blood. When a device falls into this category, Directive 2001/83/EC is applicable. The salient requirement associated with Annex II is the need for testing and certification issued by a State laboratory or an approved facility designated by a Member State.

What you need to do
So let us see if the doctor can break down Annex II into even smaller sound-bites for device manufacturers to know and apply. For starters, device manufacturers need to make application to a notified body and have their QMS certified. The next step is for device manufacturers to make application with their notified body for their device(s) and seek review and approval (design dossier examination) for Class III devices. Device manufacturers can expect to pay for and receive surveillance audits. Device records shall be retained for a period of five or 15 years. Your notified body will assess conformance of Class IIa and IIb products as part of their audits. Finally, devices that incorporate human blood derivatives require additional testing and certification. Pretty simple stuff, right?

Takeaways
The takeaways from this edition of DG are eloquent in their simplicity. Annex II is really a straightforward document with requirements relatively easy to comprehend. In the gospel according to Dr. D, there are three major components: (a) application and approval of a QMS by a notified body; (b) application and approval of the actual device application by a notified body; and (c) retention of data for either five or 15 years, after the last device is placed onto the market, available upon request, by the notified body. If you can remember these three points, give yourselves an A. You just passed the Annex II test.

Until the next installment of DG, when Dr. D will begin providing guidance for complying with Annex III (EC Type-Examination) of Council Directive 93/42/EEC, the MDD – cheers from Dr. D and best wishes for continued professional success.

References:

1. Council Directive 93/42/EEC. (1993, June). Council Directive 93/42/EEC concerning medical devices. Retrieved December 21, 2010, from http://eur-lex.europa.eu
2. Devine, C. (2009, July). Exploring the effectiveness of defensive-receiving inspection for medical device manufacturers: a mixed method study. Published doctoral dissertation. Northcentral University. Prescott Valley, AZ.
3. Directive 2001/83/EC. (2001, November). Directive 2001/83/EC of the European Parliament and of the Council of 6 November 2001 on the community code relating to medicinal products for human use. Retrieved January 7, 2011, from http://www.edctp.org