Why all actors in the medical device supply chain should aim at improving compliance

Medical devices and in-vitro diagnostic devices (IVDs) are subject to stricter rules and controls in Europe under the EU MDR and IVDR, as the regulatory reaction to a series of scandals involving defective devices. In Switzerland, legislation and compliance requirements are analogous. The national competent authority, Swissmedic, actively monitors the Swiss market for conformity. All economic operators on the Swiss market are concerned and need to understand the implications.

Replaces the version of 29.08.2019

Key takeaways

• The MedTech industry considers compliance with the EU MDR and, particularly, the IVDR to be very expensive. Yet, many requirements were already there under the former regulatory framework but were overlooked mostly out of insufficient enforcement. Manufacturers, but also importers, distributors and healthcare institutions, must now undertake efforts to close the gaps.
• Inappropriate resources (mainly lack of current and sufficient regulatory knowledge), self-contempt, and ignoring the costs of poor quality, safety or performance, tend to be the main reasons why manufacturers still struggle with the requirements and scrutiny under the EU MDR and IVDR.
• In Switzerland, Swissmedic is deploying focus campaigns as part of its market surveillance activities to identify non-conformities and raise awareness on the obligations of economic operators. If you place devices on the Swiss market, you need to be ready for such inspections.
• Swissmedic can fine or prosecute companies for regulatory breaches. Penalties are higher in case of willful felonies or misdemeanors (up to 10-year imprisonment), and lower if they result from negligence. Also failure to abide by a Swissmedic’s ruling is punished, with up to CHF 50,000.

Content

Defective devices hit the headlines

Untoward effects caused by medical devices and IVDs are unavoidable, but a functioning regulatory system requires them to be outweighed by clinical benefits and that avoidable harm be prevented. The reality is not always so clearcut and the entire regulatory system is only questioned when extreme health scares make the headlines.

The responsibility of TÜV Rheinland, a Notified Body required by law to oversee the conformity assessment of high-risk medical devices, was questioned in the health scandal involving the breast implants by the French manufacturer Poly Implant Prothèse (PIP). The Notified Body should have uncovered the fraudulent use of non-medical silicone in the breast implants during the manufacturer’s inspection. The case was revealed in 2010 and taken to the EU Court of Justice (CJEU), which ruled in 2017 that the then in force Medical Device Directive (MDD) did not impose a general obligation on the Notified Body to proactively search for evidence (e.g. product testing, unannounced audits, and/or review of commercial records). According to the CJEU, a Notified Body could only be held responsible if it had indications of defective products or a malfunction on the part of the manufacturer and ignored them. Finally, in 2018, a French Court found TÜV Rheinland to be negligent and condemned it to pay 3,000 € in interim damages to each claimant, unfortunately just a handful out of the 30’000 affected women in France. Too little, too late. Furthermore, PIP’s founder had been jailed for just 4 years and fined 75,000 € in 2013. PIP’s general manager, quality control lead, and development lead were also tried but got lesser penalties.

At the end of 2018, the research under the title Implant Files was published by the International Consortium of Investigative Journalists, uncovering serious safety deficits in the certification process for implants and other medical devices. In this scandal, again, the Notified Bodies were the focus of criticism, as was the EU regulatory approach based on certification by private organizations, as opposed to a national or supra-national regulatory agency like for pharmaceuticals in the EU, or the FDA in the USA. 

Post-market surveillance did not work in many of these cases because hospitals did not report complications. This was further revealed by the case of rusty and faulty needles in Swiss hospitals, which was made public in January 2018. The Swiss competent authority, Swissmedic, opened criminal proceedings against hospitals that had not reported the incidents and fined the hospitals concerned.

The new EU Regulations, EU MDR and IVDR, which significantly raised the conformity bar for medical devices and IVDs, can partly be seen as the reaction from the EU legislators to such compliance scandals. In response to the PIP fraud, the EU initiated immediate measures and called on the national competent authorities to tighten controls on Notified Bodies and to strengthen market surveillance by random controls. These are now mandated by law.

Lack of investment in regulatory compliance may thwart the most promising project.

From our experience as regulatory consultants, the most common reasons why manufacturers do not comply are:

• Inappropriate resources: Outdated regulatory knowledge, insufficient qualified personnel, and/or no electronic solutions (e.g. for regulatory monitoring, for data management) result in serious gaps in regulatory expertise. If you do not know what you must do and how, you cannot get it right. Acquiring and keeping abreast of relevant regulatory requirements is labor-intensive and many companies are reluctant to spend more in a department that seems to be an obstacle to innovation. Yet, lack of investment in regulatory compliance may thwart the most promising project.
• Self-contempt: A record of successful Notified Body audits despite poor data and/or processes should not be considered enough. Even with the increased scrutiny under the EU MDR and IVDR, Notified Body audits are spot checks that rarely detect more than the tip of the iceberg. Many manufacturers know that skeletons lie in closets but are happy to get lulled by the sense of sufficient compliance that an EU certificate provides. When more extensive or specific scrutiny arises from other sources (e.g. inspections from competent authorities, product liability claims), the outcome may be unpleasant.
• No analysis of the cost of poor quality/safety/performance: The MedTech industry agrees that compliance with the EU MDR and, particularly, the IVDR has become very expensive due to the enhanced requirements and controls. Yet, many of those requirements were already there under the former regulatory framework, in the form of guidelines (e.g. MEDDEV), national legislation and positions from competent authorities but used to be overlooked mostly because they were insufficiently enforced. As a result, the gap to fill is now considerable for many devices and economic operators (e.g. importers). Clearly, penalties for compliance breaches are not deterrent enough. Now, bear in mind that companies like Dow Corning, Lipomatrix, and PIP, all dealing with breast implants, went bankrupt after the massive product recalls and legal actions that befell them. Less extreme but also shattering, in 2023, Philips had to lay 6000 people off due to significant financial losses after the recall of its sleep apnea device.

Medical device regulation: balancing safety and innovation

Medical devices and IVDs play an essential role in the healthcare system. Because the end user of a medical device or IVD is ultimately a patient suffering from a disease or disability, instead of a healthy consumer, these products are subject to a strictly regulated framework. All medical devices and IVDs placed on the market must have demonstrated safety and performance for their intended purpose, and the regulatory constraints increase with the inherent risk of the device.

In countries of the European Economic Area (EEA), Turkey, and Switzerland, demonstration of conformity is achieved through the CE-marking regulatory system. The approach is based on a conformity assessment process, which must involve a Notified Body for medium- to high-risk devices. This is different in other jurisdictions, where a national agency centralizes the pre-market review and authorization of medical devices (e.g. US FDA). For more details on the differences between EU and US approaches, see: Medical device regulatory strategy – US vs. EU.

Innovation in the MedTech industry relentlessly aims at incorporating the most promising technical and clinical developments and, thus, has always outpaced regulation. Transformative software solutions have found their way into medical technology, changing products and production processes and helping to improve patients’ quality of life and the efficiency of care. New technologies such as nanotechnology, 3D printing, and now artificial intelligence, open limitless opportunities, but also bring new risks and dangers. Government policies and laws must walk the thin line between preventing public health threats and fostering technological progress.

With the implementation of the new Regulations, the EU MDR in May 2021 and the IVDR in May 2022, the EU attempted, among other things, to adapt the rules to substantial technological and scientific progress, while maintaining a high level of patient safety. While raising the level of compliance required was necessary, especially in comparison with pharmaceutical law, the insufficient resources assigned to the implementation and enforcement of the new rules have not resulted in an improvement for either the industry or the patients. The EU MDR and IVDR have been the object of severe criticism, due to excessive bureaucracy and costs for manufacturers, particularly in their interactions with Notified Bodies, resulting in product discontinuation and disruption of innovation in the EU, with alarming consequences for public health. Yet again, a sizable portion of the problem stems from insufficient compliance with previous requirements that manufacturers chose to ignore for as long as they did not hinder certification under the former Directives.

The impact is even more striking in Switzerland, which has simultaneously suffered from the disruption of the Mutual Recognition Agreement (MRA) with the EU, thus being considered a third country to the effects of the EU MDR and IVDR. The Swiss legislation was immediately adapted to align with the EU MDR and IVDR but had to introduce Swiss-specific clauses, like the obligation to appoint a Swiss Authorized Representative that translated in additional burden for foreign manufacturers.

National legislation supplements the EU MDR and IVDR

Because they are EU Regulations, the EU MDR and IVDR must be adopted as such in all EU Member States and in the legislation of countries with bilateral agreements, like Iceland, Liechtenstein, and Norway (via EFTA agreements) or Turkey (via the Customs Union agreements). In addition, legislation at the national level governs, among others, the specific duties of the national authorities, local economic operators (e.g. distributors, retailers), healthcare professionals, penalties, labeling languages and advertising. 

The national competent authorities investigate reports of non-compliant products and serious incidents. In the event of non-compliance, the authority can enforce necessary corrective actions.

Although CE-marking is achieved either by the manufacturer’s self-declaration (for lowest risk devices) or through certification by a Notified Body, national competent authorities in the EU/EEA, Turkey and Switzerland have a monitoring role within the framework of market surveillance set forth in the EU MDR and IVDR. This involves monitoring conformity of Notified Bodies, manufacturers, importers, authorized representatives, and healthcare institutions (including companies selling or using “Annex XVI products”, e.g. dermal fillers, now governed under the EU MDR). Market surveillance also includes collecting samples of medical devices and IVDs placed on the market for sporadic controls. In the event of non-compliance, the authority can enforce necessary corrective actions.

In Switzerland, the Therapeutic Products Act (SR 812.21, TPA), the Medical Devices Ordinance (SR 812.213, MedDO) and the In-vitro Diagnostic Devices Ordinance (812.219, IvDO) form the relevant regulatory basis. This legislation is largely based on the EU MDR and IVDR, with only a few Swiss specificities that were introduced after the disruption of the MRA with the EU. Relevant EU implementing and delegated acts can be adopted when the Swiss Federal Council declares them as directly applicable, and that only if they relate to technical or administrative details that are regulated on an ongoing basis and generally at short notice. Common Specifications become legally valid in Switzerland after they have been designated by Swissmedic and published in the Federal Gazette. Additional specific legislation for clinical investigations conducted in Switzerland encompass the Human Research Act (SR 810.30, HRA) and the Ordinance on Clinical Trials with Medical Devices (SR 810.306, ClinO-MD).

How does Swissmedic ensure compliance?

Unlike pharmaceuticals, Swissmedic does not approve medical devices and IVDs before they are allowed to be sold in Switzerland. Market clearance is based on the unilateral recognition of CE-marking under the EU MDR or IVDR. However, Swissmedic controls the market through a mix of mandatory notifications, Vigilance reporting assessment, and market surveillance activities.

Mandatory notifications

For economic operators, Swissmedic follows a similar approach to the EU. Swiss-based manufacturers, Swiss authorized representatives, and importers must register with Swissmedic via the database swissdamed to obtain a single Swiss registration number (CHRN), analogous to the EU’s Single Registration Number (SRN). In addition, economic operators based in Liechtenstein must also register with Swissmedic. This is due to the Customs Treaty between Switzerland and the Principality of Liechtenstein. The legislation that currently applies to medical devices in the context of the Customs Treaty is the Swiss MedDO (version: 18 October 2022; Annex I to the Customs Treaty) as well as the Swiss IvDO (version: 18 October 2022; Annex I to the Customs Treaty). The applicable legislation was revised on 18 October 2022. Under the present law, economic operators based in Liechtenstein may act as manufacturers, importers, authorized representatives and distributors in Switzerland. As such, manufacturers based in Liechtenstein are not obliged to appoint a Swiss authorized representative.

For products, there is no obligation to register device models in the Swiss database for medical devices, swissdamed, yet. The so-called UDI module is expected to become mandatory in 2026, like EUDAMED’s UDI module. The table below shows the only products that need notification to Swissmedic for the time being, which are basically those that are not subject to Notified Body’s oversight.

Vigilance reporting assessment

Vigilance reporting duties in Switzerland are analogous to those in the EU. Healthcare professionals and manufacturers (or their Swiss authorized representatives) must submit to Swissmedic any serious incidents occurring in Switzerland, Field Safety Corrective Actions (FSCA) undertaken in Switzerland, and Vigilance trend reports. 

Swissmedic assesses the information submitted, issues requests for additional information (RFAIs), and can require corrective actions. Vigilance data collected by Swissmedic is also used for market surveillance prioritization, i.e. companies that accumulate RFAIs or FSCAs that might reveal insufficient compliance for medium- to high-risk devices tend to be the object of further scrutiny.

Market surveillance activities

Swissmedic actively monitors the Swiss market through spot checks (focus campaigns) as well as suspicion reports from the market.

Focus campaigns are mostly intended to raise awareness of the duties of economic operators under the MedDO and IvDO. The topics are planned on an annual basis in consideration of national and international market feedback (e.g. Vigilance cases), suspicion reports, and major changes in the regulatory requirements. 

Since 2022, Swissmedic has conducted focus campaigns on the below topics. 

Detailed summaries of the outcomes are publicly available from Swissmedic’s focus campaigns webpage.

More targeted device controls can be conducted in the form of announced or unannounced inspections. In such cases, Swissmedic sends inspectors to the company site to gather information and verify that the devices conform to the legal requirements.

Last, suspicion reports can be sent to Swissmedic via e-mail by anyone who harbors doubts about the conformity of a medical device or IVD placed on the market in Switzerland or Liechtenstein. This option can be used by patients or healthcare professionals but is also very frequently used by competitors who become aware of unfair commercial practices involving, for example, misleading advertising or products that are incorrectly not considered to be medical devices. Swissmedic prioritizes the reports according to health risks.

What are the consequences of placing non-compliant medical devices on the Swiss market?

When deviations from legal requirements (i.e. non-conformities) are revealed during an inspection, Swissmedic requests the company to submit a written corrective and preventive action (CAPA) plan. The plan must describe the root cause analysis conducted by the company as well as its binding strategies to rectify and preventively address each identified non-conformity. Swissmedic reviews the CAPA plan and oversees its implementation.

If Swissmedic deems the analyses, objectives and corrective actions described in the CAPA plan to be insufficient, the economic operator is requested to define and implement further actions, or Swissmedic may order measures as part of the administrative procedure, which can include safety warnings, mandatory product recalls, or restriction of device sales.

In addition, Swissmedic can fine or prosecute companies for regulatory breaches, according to the penalties for criminal provisions set forth in chapter 8 of the Therapeutic Products Act (SR 812.21, TPA). The severity of penalties is obviously higher in case of willful felonies or misdemeanors, and lower if they result from negligence. Moreover, any person who could assume that the violation specifically endangers human health or any person who achieves a high turnover or makes substantial profits through commercial activity could be liable to up to 10-year imprisonment.

Failing to comply with a Swissmedic’s ruling is also punished with a fine of up to CHF 50,000, according to Art. 87 §1(g) of the TPA.

Placing a non-compliant medical device on the market can have serious consequences not only for the manufacturer, but also for the importer and the authorised representative.

Any measure taken by Swissmedic as part of its market surveillance is done as an administrative procedure, governed by the Administrative Procedure Act (SR 172.021, APA). Swissmedic’s rulings under such procedures can be subject to appeal by the respondent. In practice, it is very unlikely that an appeal against Swissmedic’s ruling succeeds within a reasonable timeframe.

In addition, according to the Product Liability Act (SR 221.112.944, PLA), damage caused by a medical device can also have liability consequences. If this damage is caused by a medical device that has not been certified and manufactured in accordance with the legal provisions, it would be difficult for the manufacturer to prove that a product defect is not responsible for the damage.

Placing a medical device on the market that does not meet the legal requirements (e.g. is faulty or incorrectly labelled) can therefore have serious consequences for the manufacturer but also the Swiss authorized representative, who is jointly and severally liable, as well as for the Swiss importer. Healthcare professionals and institutions are also responsible for checking that the medical devices used have been duly certified, particularly when a Swiss importer is not involved, as it is the case for direct sales from a foreign manufacturer. Healthcare institutions who manufacture and use their own devices have additional requirements under Article 9 of the MedDO or IvDO. If they fail to do so, they are violating their duty of care and are liable to prosecution.

How Decomplix can help

Decomplix provides regulatory and quality assurance consultancy services in all matters relative to medical devices and IVDs.

We have extensive experience in compliance issues within device supply chains and can support your company identify an appropriate solution for your quality management system, as well as help you navigate importer’s requirements and ensure compliance in the most efficient manner.

Furthermore, we have hands-on experience with Swissmedic’s inspections and expectations. We offer readiness-checks for Swiss importers, and we can provide targeted training and ready-to-use templates for procedures, checklists and other tools for the compliant placing of medical devices and IVDs on the Swiss market.

Learn more about our offering here.

Further reading

• Is my product a medical device in Europe? How to determine if your product requires medical device CE marking
• EU Notified Bodies for medical devices and IVDs
• Medical device regulatory strategy – US vs. EU
• The intended purpose – or what does your medical device do?
• Swiss medical device importers – regulatory requirements
• Swiss authorised representatives for medical device manufacturers
• Class I medical device requirements for manufacturers under the EU MDR
• Medical device and IVD Vigilance in EU and Switzerland
• Post-market Surveillance for medical devices under the EU MDR and IVDR
• “Legacy” medical devices and IVDs under EU legislation
• Annex XVI and EU MDR – Guide to regulation of products without intended medical purpose

This article is a complete overhaul of the version dated 29 August 2019. The information has been expanded to describe in detail Swissmedic’s processes to verify compliance.