What is the IVDR?

There has been an EU Directive (98/79/EC) regulating in vitro diagnostic medical devices (IVDs) since 1993. However, problems emerged with the interpretation and application of that Directive, particularly that it provided only low levels of scrutiny for potentially ‘high risk’ devices.

By Alison Hall and Sara Payne

Policy briefing

Developments in life sciences and digital technologies have created opportunities for new IVDs, including increased use of algorithms. Reform was greatly needed to protect patient safety and to properly regulate novel products, as highlighted by the Poly Implant Prothèse defective breast implant scandal. So, how does the new EU Regulation for In Vitro Diagnostic Medical Devices (2017/746), seek to protect and encourage IVD innovation reflecting these dynamic scientific changes, whilst ensuring sufficient regulation of such IVDs to give public and patient protection?

IVDR essentials

The IVDR came into force on 26 May 2017 and has a 5-year period of transition. This ensures sufficient time for manufacturers and developers to utilise new pathways to market and for suppliers to adapt existing IVDs to comply with new requirements
Quality, safety and reliability of IVDs will be improved by the IVDR
The IVDR gives new definitions of what an IVD is and seeks to improve how IVDs are classified, kept under surveillance and regulated. For the first-time, algorithms satisfying these definitions will be regulated as IVDs
There are some challenges associated with how algorithms will be regulated by the IVDR

Lengthy transition time for the IVDR

The IVDR ‘entered into force’ on 26 May 2017, beginning a five-year transition period, so that it will only apply fully in EU Member States from 26 May 2022. The IVDR is immediately binding for all EU countries without requiring transposition into national law (as would be case with a Directive rather than a Regulation).

Moving from a Directive to a Regulation aims to ensure a wider scope of protection and more effective implementation of the rules on IVDs.

During the five-year transition period to 2022, IVDs can still be placed on the market under the current EU Directive or under the new IVDR (if they fully comply with it). Devices in the current lowest risk class (evidenced by self-assessment certificates for ‘European Conformity’) can remain valid for a maximum period of two years after CE marking has been secured (i.e. up to 25 May 2024 or even 26 May 2025 for some devices[2]). Consequently there is a long period of transition to the new rules.

Will the IVDR improve the quality, safety and reliable regulation of IVDs?

One aim of the new IVDR is to include clearer obligations for those involved in manufacturing and supplying IVDs. There is increased emphasis on traceability throughout the whole supply chain, with the introduction of a Unique Device Identification system and new standards for clinical evidence, which are to be supplied and accessible on the European Databank of Medical Devices. There will also be more rigorous post-market vigilance reporting and surveillance requirements, aligning the regulation of IVDs more closely with that of medicines within the EU. Thus the Regulation aims to balance proportionate responsible regulation with addressing an increasingly technological approach to healthcare, including in such areas as algorithms and software.

Raising standards and increasing regulatory scope: will this work in practice?

There are two key changes in the IVDR that seek to achieve this.

Broader definition of IVDs: The definition of IVDs in the IVDR includes devices that are ‘software or system’ where used in combination with the examination of specimens including blood and tissue for the purpose of obtaining in-vitro information concerning ‘predisposition to a medical condition or a disease’ or used to ‘predict treatment response or reactions’ (Article 2(2)), any of which could use algorithms.

Tighter regulation and harmonised classification rules: The IVDR introduces new classification rules based on the Global Harmonization Task Force System with four-risk based classes - Class A (low) to Classes B, C and D (highest risk). Under the current Directive most standalone algorithms that have a medical purpose and qualify as an IVD are simply required to be CE marked via self-assessment by the developer or manufacturer (i.e. the lowest-classification with light-regulation in Class A). Under the IVDR, most IVDs including algorithms, will ‘up-classify’ into the higher risk Classes B, C and D requiring the involvement of Notified Bodies (independent certification bodies) rather than simple self-assessment.

Examples given by MHRA (Medicines & Healthcare products Regulatory Agency) of Classification of IVDs are:

Adapted from the MHRA handbook

Challenges associated with algorithms that are IVDs

Validation and replication of algorithms used to ‘predict’ risk may be challenging due to the ‘black box’ nature of computer algorithms (i.e. viewed in terms of inputs and outputs without full understanding of internal workings).

Concerns have arisen in some medical IVD areas, including genetic and genomic testing, as to the ability of the new IVDR to better regulate use of such algorithms. The IVDR may have an impact on the genetics/genomics sector in several ways:

All human genetic tests are brought within the scope of the IVDR and classified as Class C IVDs

Clinical genomic services are increasingly reliant on algorithms to power technologies such as whole genome sequencing, and interventions such as risk stratification that rely on algorithms combining multiple genetic and non-genetic factors to make personalised risk predictions

The IVDR will impose more stringent requirements on test developers and manufacturers for conformity assessment and surveillance

Significant questions remain about how validation and replication will be proportionately regulated

Applying IVDR to algorithms and software: recommendations

Manufacturers and policy makers in the UK who are concerned with how the IVDR applies to algorithmic use in IVDs should:

Consider which regulatory route should be adopted, particularly for ‘high-risk’ IVDs, given the potential seven year transition period
Ensure that regulation of algorithms in IVD genetic/genomic testing is sufficient and broad enough to allow successful scientific development of the area as well as protection of individuals
Continue to evaluate how ‘black-box’ elements of algorithms might best be regulated under the IVDR
Address concerns that EU legislation will not be directly enforceable once Brexit is in place, probably from March 2019 and consider the continuing role for Notified Bodies in the UK

This briefing note is intended to provide general information and understanding of the law. It should not be considered legal advice, nor used as a substitute for seeking qualified legal advice.