Software as a Medical Device - Demystifying EU MDR

Thomas ET, senior associate, medical devices, Freyr, explains how EU MDR will apply to companies with Software as a Medical Device (SaMD).

SaMD is a result of evolving high-end technologies, which integrate software, medical devices and connectivity and have different jargon used by various regulatory bodies such as SaMD by the International Medical Device Regulators Forum (IMDRF) and Medical Device Software (MDSW) by European Commission’s Medical Device Coordination Group (MDCG). The SaMD market is expected to reach $86.45 billion in 2027 from $18.49 billion in 2019, with an estimated Compound Annual Growth Rate (CAGR) of 21.9%.  

As per the European Commission’s Medical Device Coordination Group (MDCG), Medical Device Software (MDSW) is a software intended to be used, alone or in combination, for a purpose specified in the definition of a “medical device” in Article 2(1) of Medical Device Regulation (EU) 2017/745, regardless of whether the software is independent or driving or influencing the use of a device. The software must have a medical purpose on its own to qualify as a MDSW. The MDSW must fulfil the definition of a “medical device”, “software”, or “in vitro diagnostic medical device”.  The keynote while determining a MDSW as per EU MDR include:

• MDSW may be independent, by having its own intended medical purpose and thus meeting the definition of a medical device on its own
• If the software drives or influences a (hardware) medical device and also has a medical purpose, then it is qualified as a MDSW
• Software may be qualified as MDSW regardless of its location (e.g. operating in the cloud, on a computer, mobile phone, or as an additional functionality on a hardware medical device)
• MDSW may be intended to be used by healthcare professionals or laypersons (e.g. patients or other users)
• When a software is not a MDSW, but is intended by the manufacturer to be an accessory for a medical device or in vitro diagnostic medical device, they fall under the scope of the MDR.

Software that directly controls a medical device (hardware); provides immediate decision-triggering information (e.g. blood glucose meter software); provides support for healthcare professionals (e.g. ECG interpretation software); is intended to process, analyse, create, or modify medical information when the software is governed by a medical intended purpose (e.g. searching image for findings that support a clinical hypothesis as to the diagnosis or evolution of therapy); independent software, by having its intended medical purpose; runs on different operating systems in remote locations (e.g. operating in the cloud, on a computer, mobile phone, or as an additional functionality on a hardware medical device), qualify as MDSW, as per the EU MDR. Software intended for non-medical purposes, like, invoicing or staff planning and ‘Simple search’ referring to retrieval of information, are not qualified as MDSW.

The MDSW are classified into four classes based on inherent risks associated with the intended use - Class I (low risk), Class IIa (medium risk), Class IIb (medium/high risk) and Class III (high risk). The rule 3.3 of Annex VIII of Regulation (EU) 2017/745 is applicable to software influencing the use of a device and an independent software. In addition, Recital 5 of the MDR and international guidance from IMDRF introduced a new classification rule 11, exclusively for software, which describes and categorises the significance of information provided by active device to healthcare decision (patient management) in combination with healthcare situation (patient condition). Besides the intended use, the healthcare scenarios such as, critical condition, serious condition, non-serious condition, in which MDSW will be used, determine the class of MDSW. 

*High significance when used to treat or diagnose a health condition, Medium significance when used to drive clinical management and Low significance when used to provide information for clinical management.

Software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes is classified as Class IIa, except if such decisions have an impact that may cause death or an irreversible deterioration of a person's state of health, in which case it is in Class III; or a serious deterioration of a person's state of health or a surgical intervention, in which case it is classified as Class IIb. Software intended to monitor physiological processes is classified as Class IIa, except if it is intended for monitoring of vital physiological parameters, where the nature of variations of parameters could result in immediate danger to the patient, in which case it is classified as Class IIb and all other software products are classified as Class I.

All SaMDs shall undergo clinical evaluation. The clinical evaluation of a SaMD is a set of ongoing activities conducted in the assessment and analysis of a SaMD’s clinical safety, effectiveness and performance, as intended by the manufacturer in the SaMD’s definition statement. There are three components, valid clinical association or scientific validity, analytical validation and clinical validation or performance, to be considered when performing clinical evaluation. Though the components do not represent a distinct stepwise approach, they portray a methodological principle for the generation of clinical evidence. 

Valid clinical association is an indicator level of clinical acceptance and how much meaning and confidence can be assigned to the clinical significance of SaMD’s output in the intended healthcare situation and clinical condition or physiological state. Analytical validation provides confirmed evidence that, the software is correctly constructed with reliable input data and generates output data with appropriate level of accuracy, repeatability and reproducibility and demonstrates that the software meets the specifications conformed to user needs and intended uses. Clinical Validation of a SaMD is evaluated based on its ability to yield clinically meaningful output for the intended use, as well as for the healthcare situation. 

The manufacturers shall establish and maintain a Clinical Evaluation Plan (CEP) and define the criteria applied to generate the necessary clinical evidence based on the characteristics of the MDSW. The manufacturer shall identify relevant data on performance and/or safety of the device and any unaddressed issues or gaps in the data, analyse available data and its relevance to demonstrating conformity with General Safety and Performance Requirements (GSPRs) and document the data, their assessment and the clinical evidence derived therefrom, in the clinical Evaluation Report (CER). The clinical evaluation shall be updated and documented throughout the life cycle of the MDSW concerned with data obtained from implementation of the manufacturer's Post Market Clinical Follow-up/Post Market Performance Follow-up (PMCF/PMPF) plan.

To access the European market, the device is expected to comply with all the European Regulatory requirements regarding health, safety and environment and is mandatory to have a CE certification. The foreign manufacturers of all MDSW classes, shall appoint an authorised representative (EC REP) located in the EU and who is qualified to handle any regulatory issues. The EC REP name and address should be placed on the device label and obtain a single registration number from EUDAMED (once available). CE marking can be obtained by the following steps:

• Classification and assessment of medical device 
• Establish a Quality Management System (QMS) to ensure product’s design, manufacturing process and quality are safe and effective 
• Creating a technical dossier – manufacturers should compile a technical file enclosing the conformity requirements of the device
• Audit by the notified body – Class I devices are not subjected to QMS audit by the Notified Body and other device classes are audited by the notified body and upon successful completion of the audit, an ISO 13485 certificate will be issued for the facility
• Conformity declaration – For Class I MDSW, prepare a Declaration of Conformity and affix the CE marking. For all other device classes, post to a successful audit, a CE marking certificate will be issued by the notified body, following which a Declaration of Conformity document is created 
• UDI Assignment to Medical Device Software (MDSW) - The basic UDI-DI (Device Identifier), connects software with same intended purpose, risk class, essential design and manufacturing characteristics. Any modification that changes the original performance, the safety of the software or the interpretation of data such as, inclusion of new or modified algorithms, database structures, operating platforms, architecture, user interfaces and new channels for interoperability are considered “significant” and require a new UDI
• Post CE Mark Compliance - Register the device and its Unique Device Identifier (UDI) in the EUDAMED database (once available) and the UDI must be on the label. The technical file and CER must be kept up to date for Class I devices and for the other device classes, clinical evaluation, PMS (Post Market Surveillance), PMCF (Post-market Clinical Follow-up) activities must be performed to maintain certification. ISO 13485 certification must be renewed every year and CE certification is valid for a maximum of five years, but are reviewed during annual surveillance audits The Notified Bodies will conduct annual audits to ensure ongoing compliance with the MDR and failure to pass the audit will invalidate the device CE marking certificate

The software-driven medical devices gained magnifying importance with their ability to be independent of hardware and process accurate information for end-users. SaMDs are constantly evolving, posing opportunities and challenges for device organisations and regulators. Hence, the Regulatory paradigms of SaMDs are piloted for better innovation, while ensuring the patient safety and clinical effectiveness. The SaMD developers can navigate through the EU MDR regulations right from the defining aspect, qualification criteria, classification, clinical evaluation, CE certification and QMS. For continued innovation and in interest of public health, the SaMD manufacturers should understand the proposed regulations and adopt a robust system supporting all the device and software functionalities with the EU MDR Regulatory recommendations, to ensure high quality and compliant patient healthcare.