Executive Summary
The scale of responsibilities for a virtual manufacturer under the EU's new Medical Device and IVD Regulations may deter many companies from taking on this role. Elisabethann Wright, partner at Cooley law firm, explains why.
It is not necessary to physically produce a device to be a manufacturer. A company can source products from other manufacturers (often referred to as original equipment manufacturers ? OEMs) and thereby become a "virtual manufacturer".
But in so doing, and in putting its own name on the product, the virtual manufacturer accepts legal responsibility for the device and is regarded as "the manufacturer."
This means that the regulatory requirements applying to a virtual manufacturer are the same as for a manufacturer. And those responsibilities and the resources needed to meet them have increased under the new EU Medical Device and IVD Regulations compared with the medical device directives.
Now, virtual manufacturers face increased requirements relating to technical file submissions, as well as an obligation to fulfil post-market surveillance and vigilance activities and, where relevant, the need for notified body oversight. There are liability considerations too.
Medtech Insight asked Elisabethann Wright, partner at law firm Cooley, about the current changing regulatory factors impacting virtual manufacturing.
Medtech Insight: What is the scale of virtual manufacturing in the EU?
Elisabethann Wright: Under the former Medical Device Directive
(MDD), the Active Implantables Directive (AIMDD) and the IVD
Directive (IVDD), virtual manufacturing was fairly common in the
EU, in particular in relation to less complex medical devices such
as home-use pregnancy tests, contact lenses or condoms. However,
even before adoption of the MDR and the IVDR, the practice became
less common following publication of the European Commission's
2013 Recommendation on the audits and assessments performed by
notified bodies in the field of medical devices. The Recommendation
introduced the requirement that virtual manufacturers, or own-brand
labelers (OBLs) as they were known at that time, should be
considered the legal manufacturers of the medical devices placed on
the EU market under their name.
The principles of the Recommendation have now become a legal
obligation imposed on the virtual manufacturer by the relevant
provisions of the MDR and the IVDR. The practical requirements for
fulfilment of these obligations, particularly the obligation to
prepare and keep up to date relevant technical documentation, may
result in a further decrease in the number of virtual manufacturers
in the EU.
How have the rules for virtual manufacturing changed in the EU MDR and IVDR compared with the medical device directives?
Wright: In principle, the MDR and IVDR impose the same basic
obligations on virtual manufacturers as did the medical device
directives. In practice, however, the Regulations have introduced
more stringent requirements. These include the requirement for
ongoing access to the original equipment manufacturer's
(OEM's) technical documentation related to the device and an
obligation to prepare and keep up to date their own technical
documentation, an obligation to fulfil post-market surveillance and
vigilance activities and, where relevant, the need for notified
body oversight.
In addition, unlike the equivalent provisions in the MDD and the
IVDD, Article 10 of the MDR and IVDR now detail the general
obligations that manufacturers, including virtual manufacturers,
must fulfil.
Moreover, while notified bodies may previously have accepted
submission by virtual manufacturers of an abbreviated technical
file to support conformity assessment of medical devices, this
practice will no longer be acceptable under the MDR and IVDR. It is
anticipated that, as a result, many virtual manufacturers will face
greater challenges when seeking to demonstrate compliance with the
MDR or IVDR than they did under the MDD and the IVDR.
Are the same issues relevant when it comes to virtual manufacturing under the MDR and the IVDR?
Wright: Yes, the MDR and the IVDR impose the same general obligations on virtual manufacturers of both medical devices and in vitro diagnostic medical devices. This includes a similar approach to post-market surveillance and vigilance activities.
What distinguishes a virtual manufacturer/own-brand labeler from a distributor of a medical device?
Wright: The Medical Devices Regulation 2017/745 (MDR) and the In
Vitro Diagnostic Medical Devices Regulation 2017/746 (IVDR) provide
very different roles for virtual manufacturers and
distributors.
Moreover, while the Regulations include a specific definition of a
distributor as "any natural or legal person in the supply
chain, other than the manufacturer or the importer" who makes
a medical device available on the EU market, there is no specific
definition of a virtual manufacturer.
In addition, while Article 14 of both the MDR and IVDR detail the
specific responsibilities of the distributor, no equivalent details
are provided for virtual manufacturers.
Virtual manufacturers are assimilated into the definition of
manufacturers. In accordance with Article 10(4) of the MDR and the
IVDR, this means that virtual manufacturers of medical devices must
comply with the obligation imposed on "real"
manufacturers, including the obligation to draw up and keep up to
date technical documentation for the devices. Virtual manufacturers
and distributors, therefore, have very different responsibilities
and obligations regarding the medical devices they make available
on the EU market.
Who needs to apply for conformity assessment from the notified body? Will the OEM be required to CE mark a medical device for which there is also a virtual manufacturer?
Wright: Where both a virtual manufacturer and an OEM place a CE
marked device on the EU market, both parties are considered to be
legal manufacturers of the devices they place on the EU market in
their own name. As a result, both the OEM and the virtual
manufacturer must conduct required conformity assessment and affix
the CE mark to the device. If the conformity assessment process
requires the involvement of a notified body, both the OEM and the
virtual manufacturer must individually engage with a notified body
for the assessment of their device. In practice, there may be
benefit in the OEM and virtual manufacturer choosing the same
notified body.
Even if the OEM has not placed the device on the EU market, or
does not plan to do so, the virtual manufacturer entity may still
contract with the OEM to manufacture the device on their behalf. In
this case, however, the OEM would be a contract manufacturer for
the virtual manufacturer. This would mean that the virtual
manufacturer entity would be the sole legal manufacturer of the
device in the EU.
The virtual manufacturers must hold the full technical documentation for any product they place on the market under their name. What obligations must virtual manufacturers fulfil to ensure that they have access to technical documentation held by the OEM and what related documentation must they possess?
Wright: For the virtual manufacturers to ensure continuous
access to updated technical documentation it will be necessary for
them to either acquire a duplicate of the OEM's technical
documentation and ensure ongoing updates to the documentation or,
conclude an agreement with the OEM whereby the OEM agrees to give
ongoing access by the virtual manufacturer to their technical
documentation.
The technical documentation to which the virtual manufacturer has
access must be appropriate and adequate to support the conformity
assessment and CE mark of the devices marketed in the EU in their
name. It must also include the information provided in Annexes II
and III to the MDR and IVDR. This includes documentation relating
to the design and manufacturing processes of the device, risk
management processes, verification and validation data as well as
technical documentation on post-market surveillance activities and
plans.
One difficulty that virtual manufacturers may face in negotiating
access to the OEM's technical documentation is that this
documentation will commonly include OEM commercially-confidential
information. As a result, the OEM may not be willing to share
certain the information with the virtual manufacturer necessary to
ensure fulfilment of the obligations imposed by the MDR and the
IVDR.
Is it necessary to conclude a written agreement between the OEM and the virtual manufacturer concerning access to technical documentation?
Wright: There is nothing in either the MDR or the IVDR that
imposes an obligation on the virtual manufacturer and the OEM to
conclude a written agreement concerning access to the technical
documentation. It is, however, inconceivable that a written
agreement would not be concluded between the parties.
Access by the virtual manufacturer to the OEM's technical
documentation is likely to constitute access to the OEM's
commercially-confidential information.
Virtual manufacturers must demonstrate how their quality
management system (QMS) enables them to ensure continuous
compliance with the requirements of the applicable regulation. Any
agreement concluded with the OEM would be part of the virtual
manufacturer's QMS. The agreement may, therefore, be audited by
the notified body, as applicable.
What factors should be covered in such an agreement?
Wright: The agreement between the virtual manufacturer and the OEM should clearly state the conditions under which the virtual manufacturer will have access to the OEM's technical documentation, including whether this will be in hard copy or by remote access, and how updated access is to be assured. The agreement should, moreover, set out the roles and responsibilities of each party and determine how the parties will cooperate throughout the lifetime of the device.
Cooperation between the parties will be particularly important for fulfilling post-market vigilance obligations. Virtual manufacturers and OEMs could consider including within the agreement provisions addressing among other things:
- Where both the virtual manufacturer and the OEM plan to CE mark and market a medical device in the EU;
- How the parties plan to establish a clear link between the party and the medical devices placed on the EU market in their name;
- How the parties plan to cooperate in relation to post-market surveillance and vigilance activities such as the communication of incidents and post-market clinical follow-up;
- Communication between the parties regarding potential changes to the devices;
- Facility auditing by the parties and their notified bodies; and
- Fulfilment of registration requirements in the Eudamed database.
Who owns the rights for product design in the case of virtual manufacturing of OEM?
Wright: It is the OEM who commonly owns the rights for product design of medical devices provided to virtual manufacturers. Given that the OEM will take practical responsibility for manufacture of the device, modifications to the device by a virtual manufacturer that would constitute significant changes are, in our experience, uncommon.
Where does the virtual manufacturer stand regarding the OEM in terms of product liability?
Wright: The fact that the virtual manufacturer does not take
practical responsibility for the manufacture, and commonly the
design, of a medical device would not exclude it from liability for
any injury or damage resulting from use of devices that it has
placed on the EU market. This is because these devices are placed
on the market at the discretion of, and consequently the liability
of, the virtual manufacturer. Should the virtual manufacturer face
an action in damages related to injury or damage caused by the
device it could, however, either seek to join the OEM as a
defendant in any action or sue the OEM to recover any subsequent
losses.
The OEM would be independently responsible and liable for any
injury or damage related to medical devices that they have placed
on the EU market in their own name.
Does the potential income from virtual manufacturing outweigh the regulatory challenges, in your view, and is virtual manufacturing likely to be on the increase or decrease under the MDR/IVDR?
Wright: The obligations imposed on virtual manufacturers by the
MDR and the IVDR may mean that they will face significantly higher
related costs than was previously the case. In the past, given that
the virtual manufacturer could rely on an abbreviated version of
the OEM's technical file, related costs were largely supported
by the OEM. Where, as is common, the medical devices that virtual
manufacturers seek to market in the EU are low-value, high-volume,
the additional costs that they will incur to comply with MDR and
IVDR obligations may outweigh the benefits of virtual
manufacturing.
In addition, some OEMs may consider that the risks that they may
face in sharing their technical documentation and related
commercially-confidential information with a virtual manufacturer
outweigh the potential income generated in supplying medical
devices to virtual manufacturers.
Consequently, unless OEMs and virtual manufacturers can agree on
an individual basis how access to technical documentation will be
shared, we would anticipate that virtual manufacturing will
decrease under the MDR and IVDR.
Medtech Insight, January 27, 2022
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.