Analysis of Quality and Product Management Systems in a Medical Software Start-Up Company

(1)

Sara Sauranen

ANALYSIS OF QUALITY AND PRODUCT MANAGEMENT SYSTEMS IN A MEDICAL SOFTWARE START-UP COMPANY

Master of Science Thesis

Faculty of Medicine and Health Technology

Examiners: Research Director Alpo Värri

University Lecturer Jari Viik

May 2021

(2)

ABSTRACT

Sara Sauranen: Analysis of Quality and Product Management Systems in a Medical Software Start-Up Company

Master of Science Thesis Tampere University

Degree Programme in Bioengineering, MSc (Tech) May 2021

While the rapid development of technology brings various new solutions to the challenges of health and healthcare, their regulation to ensure safe and effective care is developed constantly.

Especially software as a medical device are subject to quickly evolving regulation, as they are becoming more and more common. With the continuously developing requirements that also depend on jurisdiction, medical device manufacturers must ensure effectively that their processes and products comply with all relevant requirements. In this study, the main objectives are to dis- cover what factors must be considered in the design of quality and product management systems of medical software companies. The linkages between regulation and business strategy are defined as well. Four of the quality and product management processes of the case company, Disior, are examined and proposals for their improvement are collected.

The objectives were reached by studying the topic through a literature review, interviews with professionals and a case study. In the literature review, the most important concepts of medical device and especially software regulation and quality and product management systems were clarified. Also the strategic linkages were studied in the literature review, but in addition, interviews were done with professionals with expertise in investments and medical device business to dis- cover how regulation affects the competitiveness and financing of medical device manufacturers in their opinion. In the case study, a process review was conducted on four processes of the case company and related records. After that, six employees were interviewed about the current compliance with the process descriptions as well as how the processes could be improved and the improvements implemented in the interviewees’ opinion.

It was found that in European Union, the central legislation of medical devices comprises Med- ical Devices Regulation and In-Vitro Diagnostic Medical Devices Regulation and in United states of America, the Code of Federal Regulations Title 21. Although regulation varies in different jurisdictions, in many markets the most important standards that should be followed designing quality and product management systems for medical software products include ISO 16142-1, IEC 62304, IEC 62366-1, IEC 82304-1, ISO 14971, IEC/TR 80002-1 and ISO 13485. How compliance with regulation is implemented depends on the size, product variety and target markets of the company. It was concluded that regulation affects the competitiveness and financing of companies and is thus linked to their strategy. Regarding competitiveness, market access, sales and distribution strategies and the efficiency of research and development processes are impacted by regulation and regulatory competence. Financing is linked to regulation as the regulatory status of a company and its products are closely evaluated by potential investors.

The case study resulted in 22 proposals for improvement for the software development, maintenance and risk management and the product realization processes and general-level aspects. Some proposals include a plan on their implementation as well. The proposals were prioritized into three urgency level groups based on their frequencies in the interviews. In addition, three larger themes were identified from the proposals: the need of more structure and con- sistency, the need of training and education on regulatory and other requirements and processes, and the need of continuous optimization and improvement of processes. Both the individual proposals and themes were also considered from a strategic perspective. It can be recommended that the proposals are implemented in the case company. The themes should be considered by not only the case company but also other similar companies. Other operators, such as regulators and universities, may reflect how they can support the medical device sector and its growth and individual businesses in the light of the findings and themes identified in this study.

Keywords: medical device, software, regulation, quality management, product management The originality of this thesis has been checked using the Turnitin OriginalityCheck service.

(3)

TIIVISTELMÄ

Sara Sauranen: Laadun- ja tuotteenhallintajärjestelmien analyysi lääketieteellistä ohjelmistoa valmistavassa startup-yrityksessä

Diplomityö

Tampereen yliopisto

Biotekniikan DI-tutkinto-ohjelma Toukokuu 2021

Teknologian kehityksen ja sen tuomien uusien terveyden ja terveydenhuollon haasteiden ratkaisujen myötä teknologian sääntely turvallisen ja tehokkaan hoidon takaamiseksi kehittyy jatkuvasti. Erityisesti lääkinnällisinä laitteina markkinoille tuotaviin ohjelmistoihin kohdistuu paljon uusia vaatimuksia, sillä ohjelmistojen käyttö lääkinnällisissä laitteissa yleistyy nopeaa tahtia.

Koska sääntelyä kehitetään jatkuvasti ja vaatimukset vaihtelevat alueittain, lääkinnällisten laitteiden valmistajien on varmistettava tarkoin, että heidän prosessinsa ja tuotteensa ovat relevanttien vaatimusten mukaisia. Työn tavoitteina on selvittää, mitä täytyy huomioida laadun- ja tuotteenhallintajärjestelmiä kehittäessä ja miten sääntely ja liiketoiminnan strategia vaikuttavat toisiinsa. Case-tutkielman kohdeyrityksen, Disiorin, neljää laadun- ja tuotteenhallintajärjestelmien prosessia tarkastellaan ja niihin liittyen kerätään kehittämisehdotuksia.

Tavoitteet saavutetaan tekemällä aiheeseen kirjallisuuskatsaus, haastattelemalla asiantuntijoita ja tekemällä case-tutkielma kohdeyrityksen prosesseihin liittyen.

Kirjallisuuskatsauksessa käsitellään tärkeimpiä lääkinnällisten laitteiden ja erityisesti ohjelmistojen sääntelyyn liittyviä käsitteitä. Myös strategian ja sääntelyn yhteyttä tutkitaan kirjallisuuskatsauksessa, mutta siihen liittyen tietoa hankitaan myös haastatteluista terveysteknologia-alan startup-yrityksiin sijoittamiseen ja alaan yleisesti perehtyneiden asiantuntijoiden kanssa. Haastatteluissa keskitytään heidän näkemyksiinsä siitä, miten sääntely vaikuttaa lääkinnällisten laitteiden valmistajien kilpailukykyyn ja rahoitukseen. Case-tutkielmassa tehdään katsaus neljään kohdeyrityksen prosessiin ja niihin liittyvään asiakirja-aineistoon. Kuutta yrityksen työntekijää haastatellaan liittyen siihen, miten prosessikuvauksia tällä hetkellä noudatetaan käytännössä, millaisia kehitysehdotuksia työntekijöillä on prosesseihin liittyen ja miten kehitysehdotukset voisi käytännössä toteuttaa.

Euroopan unionissa keskeinen lainsäädäntö koostuu asetuksesta lääkinnällisistä laitteista (eng. Medical Device Regulation, MDR) ja asetuksesta in vitro -diagnostiikkaan tarkoitetuista lääkinnällisistä laitteista (eng. In-Vitro Diagnostics Regulation, IVDR), Yhdysvalloissa Code of Federal Regulations osa 21:sta. Sääntely vaihtelee alueittain, mutta useilla markkinoilla standardeja ISO 16142-1, IEC 62304, IEC 62366-1, IEC 82304-1, ISO 14971, IEC/TR 80002-1 ja ISO 13485 on noudatettava laadun- ja tuotteenhallintajärjestelmiä lääkinnällisinä laitteina toimiville ohjelmistoille suunniteltaessa. Riippuu yrityksen koosta, tuotteista ja kohdemarkkinoista, miten vaatimustenmukaisuus käytännössä toteutetaan. Sääntely vaikuttaa lisäksi yritysten kilpailukykyyn ja rahoitukseen ja siten niiden strategiaan. Sääntely ja sääntelyosaaminen vaikuttavat markkinoillepääsyyn, myynti- ja jakelustrategian valintaan ja tutkimus- ja kehitysprosessien tehokkuuteen ja siten kilpailukykyyn. Sääntely vaikuttaa myös rahoitukseen, sillä sijoittajat arvioivat yritysten ja niiden tuotteiden sääntelyllistä statusta tarkasti.

Case-tutkielmasta tuloksena saatiin 22 kehitysehdotusta yleisellä tasolla ja ohjelmiston kehitys-, ylläpito- ja riskinhallinta- sekä tuotteen toteutusprosessiin liittyen. Osaan sisältyy myös käytännön toteutussuunnitelma. Ehdotukset priorisoitiin kolmeen kiireellisyysryhmään sen perusteella, kuinka monta kertaa ne mainittiin haastatteluissa. Lisäksi haastatteluissa ilmeni kolme laajempaa teemaa: järjestelmällisyyden ja johdonmukaisuuden tarve, sääntelyyn ja prosesseihin liittyvän koulutuksen tarve ja prosessien jatkuvan optimoinnin ja kehityksen tarve.

Yksittäisiä ehdotuksia ja teemoja tarkasteltiin myös strategisesta näkökulmasta. Kohdeyritykselle suositellaan kehitysehdotusten toteuttamista. Teemat kannattaa huomioida sekä kohdeyrityksessä että muissa samanlaisessa tilanteessa olevissa yrityksissä. Alan muut toimijat, kuten viranomaiset ja yliopistot, voivat pohtia miten terveysteknologia-alaa ja sen kasvua ja yrityksiä voisi tukea näiden tulosten ja teemojen näkökulmasta.

Avainsanat: lääkinnällinen laite, ohjelmisto, sääntely, laadunhallinta, tuotteenhallinta Tämän julkaisun alkuperäisyys on tarkastettu Turnitin OriginalityCheck –ohjelmalla.

(4)

PREFACE

This work was done for Disior Oy as part of the update of their quality and product management systems. I appreciate getting the opportunity to follow the company up close and learn about the medical technology business as well as write my thesis on an inter- esting and timely topic in collaboration with them. I would like to thank especially Markku Laitinen, my thesis supervisor from Disior’s side, for the helpful guidance and feedback I got during the thesis project. Also many others at Disior participated in the interviews of the thesis and gave feedback and advice on the work – thank you!

I want to thank Research Director Alpo Värri, my thesis supervisor from the university, for the valuable expertise, points of view and feedback on the thesis throughout the project. Thank you also to University Lecturer Jari Viik, the other examiner of the thesis, for the feedback on the work. For the inspiration of the thesis topic, the biomedical engineer- ing courses at the university have played a major role. I think it is great that aside from the technical content, also aspects such as regulation, quality and commercialization are discussed on many courses.

The years studying at the university have been absolutely great. I want to thank my group of friends for the all the fun moments, laughs and peer support through the years. Finally, the biggest thank you to my family for the continuous support and encouragement and always believing in me both in my studies and in life.

Tampere, 26 May 2021

Sara Sauranen

(5)

LIST OF ABBREVIATIONS

AAMI Association for the Advancement of Medical Instrumentation AIMDD Active Implantable Medical Devices Directive

ANVISA Agência Nacional de Vigilância Sanitária, Brazil ARTG Australian Register of Therapeutic Goods

CDRH Center for Devices and Radiological Health, a centre of United States Food and Drug Administration

CE Conformité Européenne, conformity with health, safety, and environmental protection standards for products sold in the European Eco- nomic Area

CFDA China Food and Drug Administration CFR Code of Federal Regulations, USA

DMR Device master record, a record required by FDA

EEA European Economic Area

EU European Union

FDA (United States) Food and Drug Administration FURLS FDA’s Unified Registration and Listing System GCP FDA Good Clinical Practice

GHTF Global Harmonization Task Force IDE FDA Investigational Device Exemption IEC International Electrotechnical Commission IFU instructions for use

IMDRF International Medical Device Regulators Forum

INMETRO Instituto Nacional de Metrologia, Qualidade e Tecnologia, Brazil ISO International Organization for Standardization

IVD In Vitro Diagnostic

IVDD In Vitro Diagnostic Medical Devices Directive IVDR In-Vitro Diagnostics Regulation

MDCG Medical device coordination group MDD Medical Devices Directive

MDR Medical Devices Regulation

MDSAP Medical Device Single Audit Program MDWS Medical device software

NAFDAC National Agency for Food and Drug Administration and Control, Ni- geria

NMPA National Medical Products Administration, China

QMS quality management system

QSIT FDA Quality System Inspection Technique QSR FDA Quality System Regulation

R&D research and development

SAHPRA South African Health Products Regulatory Authority SaMD Software as a medical device

TGA Therapeutic Goods Administration, Australia

TIR Technical Information Report, a document of Association for the Ad- vancement of Medical Instrumentation

UDI unique device identification

UDI-DI unique device identification device identifier US United States (of America)

USA United States of America WHO World Health Organization

(7)

1. INTRODUCTION

In this chapter, an overview is made of the topic of this thesis and the company which the thesis is conducted in collaboration with is introduced. The research objectives and questions as well as the scope and limitations of the study are discussed. In addition, the structure of the thesis is explained.

1.1 Background

Global health faces complex and changing challenges continuously, from the conditions of ageing populations to outbreaks of infectious diseases (WHO 2017a). Still, WHO re- ported in 2020 that globally, people are living both healthier and longer than before, with a life expectancy increase of over 8% between years 2000 and 2016 (WHO 2020).

Healthcare and access to healthcare services plays an essential role in the maintenance and improvement of public and individuals’ health. The tools utilized in healthcare systems to overcome the challenges of health are manifold, including medicines, infrastruc- ture, trained healthcare professionals, information systems and technology. The role of medical devices, a part of health technology, is becoming more and more highlighted with the rapid development and continuous research of different technologies. (WHO 2017a) The important role is also indicated by the size of the global medical device market: it is currently estimated to be over 440 billion euros, of which the European market accounts for roughly 27% (MedTech Europe 2020). In 2017, the annual growth forecast of the global market was 5,1% (Healthtech Finland 2018).

Although the term medical device has traditionally mainly comprised physical applica- tions, nowadays software is utilized in many medical devices both alone and in connection to other medical devices (Baird & Cobbaert 2020). For example, implantable pace- makers, medical imaging equipment, health information systems, programs analysing medical measurement data and treatment planning programs use software to function (FDA 2017). In Finland, many manufacturers have expertise related to for example artificial intelligence and internet of things. Digital solutions and software have a significant role in the range of products produced by Finnish medical device manufactures, and in 2018, Finland was even ranked second in the world regarding the economic growth potential enabled by artificial intelligence. (Healthtech Finland 2018) Thus, both in Finland and globally, software brings various new opportunities to solve health and healthcare

(8)

challenges, and new possibilities emerge constantly with the development of technology.

Also new business and economic growth opportunities become available with the utili- zation of software.

As medical devices directly affect patients’ health and safety, they are in most countries regulated by legislation. The objectives of regulation are to minimize the potential risks of devices and ensure access only to safe, effective and high-quality devices. In many jurisdictions, regulation is applied to all stages of the lifecycle of a medical device – before, while and after the product is brought to market – and both the product and different processes and systems around it are regulated. (WHO 2017a) Because there are various types of devices with very different features in the market, also the regulatory requirements are device type specific. For example, software as a medical device have only been recognized in different regulatory systems since the 2000s, but nowadays there are plenty of very specific requirements, standards and guidance with which manufacturers of medial software and their products must comply. Due to continuous research and quick development of technologies, standards and regulatory requirements are up- dated and additions are made quite frequently, and to top it all, the requirements are often quite different depending on the jurisdiction. (Baird & Cobbaert 2020)

Therefore, it is clear that companies manufacturing medical devices must invest in eval- uating the requirements of the different regulatory environments in which they operate and deciding which of them apply to them and their products. Continuous evaluation of new requirements and updates of standards and guidance is necessary as well. This is not an easy task. In 2017, regulation and regulatory requirements was the second most common answer in a survey in which Finnish medical device manufacturers were asked about the biggest challenges of being successful in the medical device sector. (Grönlund et al. 2017) Thus, it is crucial for manufacturers to put effort into the continuous evaluation and improvement of their products and processes so that they comply with all the applicable requirements.

Disior is a Finnish medical device software start-up company whose processes and their improvement especially from the perspective of compliance with regulatory requirements is at the focus of the empirical part of this study. Currently, Disior produces software that segments, quantifies and models three-dimensional medical imaging data for the support of diagnosis, treatment planning and outcome assessment. The fields of application of the products include for example orthopaedics. Disior collaborates with major university hospitals and clinics around the world and has a diverse, global customer base currently focusing on the European Union (EU) and United States of America (USA, US) markets.

Disior’s software are brought to market as medical devices, making them and the whole

(9)

company subject to regulatory control and requirements. (Disior 2020) In this study, the focus is on the quality and product management systems of Disior.

1.2 Research objectives, scope and structure

This study has three main objectives. Firstly, the study aims to provide an overview of the aspects that should be considered while organizing product management and quality management systems (QMSs) in a start-up company. Especially regulation and the regulatory requirements affecting these systems are researched. Secondly, the study covers the strategic implications of different decisions related to product and quality management and their regulation, and how regulation and strategy are related. It is also considered how regulation could be handled in a way that supports the achievement of business and strategic goals. Finally, four processes of the quality and product management systems of the case company are examined and points of improvement for these processes are identified. How these improvements could be implemented and the processes made an integrated part of the company’s daily work is studied as well. The objectives are summarized to the following three research questions which this study aims to answer.

1. Which aspects should be considered while organizing product and quality management systems in a start-up company manufacturing medical devices?

2. How are regulation and the strategy of a company manufacturing medical devices linked?

3. How could the quality and product management related processes of the case company be improved?

By answering these questions, an overview is formed of how product and quality management systems can be organized efficiently, sustainably and so that they support the strategy of a company manufacturing medical devices, and how these topics are realized in the case company and what could be done to improve the processes at focus.

The focus of this study is on the regulation of medical devices and especially software, as the products that the case company currently manufactures are exclusively software.

In vitro diagnostic (IVD) medical devices are out of the scope of this work, as they and their regulation are in many aspects quite different from regular medical devices.

Throughout the study and especially in the description of different regulatory processes, mainly the perspective of a medical device manufacturer is used, as it is the most relevant to the case company. However, in some cases also for example regulatory authorities’ points of view are presented. Because the case company is Finnish, the perspective

(10)

of specifically Finnish companies is highlighted in many parts of the study. Geograph- ically, the main focus is on the EU and US markets and their regulatory systems, as they are the most relevant markets for the case company and many other Finnish companies, and some of the most remarkable markets globally. A brief overview of the regulatory systems of China, Brazil and Australia and a comparison of the systems of four African countries are given to outline the diversity and development trends of regulatory systems.

Various different regulations and laws apply to medical devices, but this study is focused on the requirements for the quality and product management systems. In the empirical part studying the quality and product management systems in the case company, the focus is on a few processes selected by the case company. They are the product realization process of the QMS and software development, software maintenance and software risk management process of the product management system. These processes are prioritized as they are considered central to the operations of the company and on the other hand, require urgent updates. The rest of the processes are left out, as including them would make the scope too large for a Master’s thesis. In addition, special at- tention is paid in the empirical part to the themes of traceability and post-market surveillance.

The thesis is divided into two main parts: the theory part in which the concepts related to medical device regulation and its linkages to strategy are introduced through a literature review and a few interviews, and an empirical part, where processes of the quality and product management systems of the case company are reviewed and improvement ideas for them are gathered in the form of case study. The case study consists of a process review and interviews with employees of the case company. In addition to these main parts, the methodology and the process of the empirical part of this study are explained in a separate chapter. Separate chapters are also devoted to the discussion of the results and conclusions of the whole research.

The theory part is covered in Chapter 2 Key concepts in which the aim is to answer the first and second research questions. In Chapter 2, medical device regulation and its central concepts are discussed in general and specifically for software that are brought to market as medical devices. The EU and US regulatory systems and the processes of obtaining market authorizations through them are discussed in more detail, and an over- look of a few other markets is provided as well. The concepts of product and quality management and the regulatory requirements, for example the central internationally recognized standards, which they are subject to are explained in Chapter 2 as well. Fi- nally, the strategic linkages between regulation and strategy as well as the central role of regulation in the medical technology operation environment are discussed. Especially

(11)

regulation’s impacts on competitiveness and financing are reviewed. In Chapter 3 Mate- rials and methods, the methods of data collection and analysis of this study are explained. The choice of case study as a method for the empirical part is motivated. The course of the case study process is outlined and the steps of the process are explained in detail.

In Chapter 4 Results, the results of the case study, as in the proposals for improvement for the processes at focus, are presented in detail. Thus, the third research question is addressed in this chapter. The results are prioritized based on how urgently they must be implemented. In Chapter 5 Discussion, the results are analysed for trends or themes and their impact on the company, other similar companies and the whole medical device sector is discussed. The results are also compared to the theory part. The strategic im- portance of the proposals is reflected based on the strategy part of the theory chapter.

The sources of error in the study and its overall successfulness are evaluated. In addition, opportunities for further research both in the case company and more generally around the topic of this study are presented. In Chapter 6 Conclusions, the most important results and their consequences are summarized.

(12)

2. KEY CONCEPTS

The key concepts of this study are explained in this chapter, starting with an overview of medical device regulation, its purpose and scope as well as regulatory bodies in different parts of the world and how regulation appears to a manufacturer in the marketing authorization process. The special characteristics of medical software regulation are discussed as well. Next, the concepts of quality and quality and product management in the context of medical technology and their regulatory significance are introduced. Some of the most important standards for the quality and product management systems are reviewed. Finally, the linkages between regulation and business strategy are discussed from the perspectives of competitiveness and financing.

2.1 Medical device regulation

By definition, medical device is any instrument, apparatus, implement, machine, appli- ance, implant, reagent for in vitro use, software, material or other similar or related article used for human beings that can be used for the activities of diagnosis, prevention, monitoring, treatment, alleviation, compensation, investigation, replacement, modification and support in relation to disease, injury or anatomy or physiological process, or that supports or sustains life, controls conception, disinfects medical devices or provides information by means of in vitro examination of specimens derived from the human body.

A medical device does not operate by pharmacological, immunological or metabolic means, but its intended function may be assisted by them. The definition varies slightly in different jurisdictions, for example disinfection substances are included in the definition in some regions, while in some others, they are not. (WHO 2017a)

Regulation of medical devices has two main objectives: it aims to minimize potential risks associated with the devices as well as to provide patients with access to safe, effective and high-quality medical devices while restricting access to unsafe or ineffective products. The proper implementation of medical device regulation contributes not only to the improved safety and health of individuals but also to better public health. (WHO 2017a) Effective regulatory systems strengthen health systems, improving health outcomes overall (WHO 2017b).

In principle, medical device regulation addresses two critical elements: the product itself and its use. Both contribute to the safety and effectiveness of patient care and on the other hand, are potential sources of risk. As a third element, the representation of the

(13)

product to the user, including for example training and instructions for use (IFU), is crucial, whether verbal, visual or in other form. The regulatory activities and control before the release of the product are called pre-market regulation and include for example the risk classification and definition of the medical device as well as its essential principles of safety and performance. Post-market regulation addresses safety and effectiveness while the product is already in use and includes activities such as adverse event reporting. The regulation of activities such as advertising and sales can be referred to as placing-on-market regulation, which covers for example the listing of medical devices, registration of establishments and import controls. (Cheng 2003; WHO 2017a)

These three regulatory phases apply to the different lifecycle stages of a medical device as presented in Figure 1. Pre-market control covers the conception and development of a medical device, its manufacture, packaging and labelling, while placing-on-market control regulates the device’s advertising and sale. The use and disposal of the device are controlled by post-market surveillance. It is worth noting that while the pre-market lifecycle stages are controlled by the manufacturer, the placing-on-market and post-market activities depend on the possible distributor and the user, which is why it is critical for the manufacturer to provide the distributors and users with all the information required for them to operate safely and effectively and to communicate with them continuously and efficiently. (Cheng 2003)

Figure 1 Regulatory phases in relation to the lifecycle stages of a medical device.

(Cheng 2003)

The nature of regulation depends on the type and features of the medical device. Ac- cording to WHO (2017b), in 2017 there were approximately two million different types of medical devices on the world market divided into more than 22 000 generic device groups. It is therefore clear that the same regulation cannot be applied to all of them, but their differences have to be taken into account in order to ensure their safety and effectiveness and, on the other hand, decrease unnecessary, non-applicable regulatory burden to ensure patient access to different kinds of devices. The extent to which these differences are considered in the legislation depends on the jurisdiction. For example, in EU and USA there are classification systems for medical devices that determine how

(14)

intense regulation the devices are subject to, while in some other jurisdictions, all devices are regulated in an almost similar manner. (WHO 2017a)

Medical devices are usually regulated through a national legal framework. According to WHO (2017a) in 2016, 113 of 194 WHO member states had established regulation on medical devices and 53 had not. For the remaining 28 states, no information was available. The proportion of countries with legislation was lowest in the African region and the highest in Europe. Only 45% of low-income countries with data available had a legal framework for medical devices, while in high-income countries the corresponding num- ber was 84%. In most countries with legislation on medical devices, a national regulatory authority is responsible for the implementation and enforcement of medical device regulation. Whereas in many regions the regulation is country-specific, in some legally uniform areas the legislation can be common for all the countries in that area. (WHO 2017a) For example in EU, the medical device legislation is currently organized in such manner that the regulation enacted by the legislative bodies of EU is directly binding to all member states. Thus, EU forms a uniform jurisdiction in terms of medical device regulation.

(MDR 2017)

Globally, medical device regulation is observed and influenced by the International Med- ical Device Regulators Forum (IMDRF). It is a voluntary group formed by medical device regulators from different parts of the world aiming to promote the harmonization and convergence of international medical device regulation. The predecessor of IMDRF was the Global Harmonization Task Force (GHTF), a group with similar objectives as IMDRF that consisted of government and industry representatives from Australia, Japan, EU and USA. After IMDRF was founded in 2011, representatives from Brazil, Canada, China, Russia, Singapore and South Korea have joined, and also WHO is involved as an official observer. (IMDRF 2020a) IMDRF has worked and is working on for example matters related to device identification, auditing, terminology, cybersecurity and artificial intelligence as well as many other current topics (IMDRF 2020b). The statements and work that IMDRF publishes are considered in the legislation of many countries (IMDRF 2020a).

2.1.1 EU

In EU, medical devices are regulated through both EU level control and member states’

own legislation. There are two kinds of legislation applied on medical devices on EU level: directives that bind the member state to reach certain objectives in their national legislation, thus to change their laws to be consistent with the directive, and regulations that are immediately enforceable as laws in all member states, as in overrule national

(15)

laws about the same subject matter. National legislation also has to be made consistent with the regulation. The legislative bodies of EU – European Parliament, Council of the European Union and European Commission – are in charge of EU level law-making, whereas the national laws are set by each member state’s own legislative bodies. In addition to legally binding directives and regulations, European Commission has pub- lished guidelines, informative documents and consensus statements over the years.

(Pommelin 2017)

The most important aspects of the EU regulation have been the Medical Devices Di- rective (MDD, 93/42/EEC), In Vitro Diagnostic Medical Devices Directive (IVDD, 98/79/EC) and Active Implantable Medical Devices Directive (AIMDD, 90/385/EEC).

They were established and launched in the 1990s, and a few directives were launched later, in the 2000s, to clarify and modify them. (Pommelin 2017) However, soon a need for a new framework emerged in order to update the legislation to align with the vast progress of the sector over the years since the launch of the directives and due to the differences in the interpretation of the directives between different member states. Two regulations replaced the three directives on 5 April 2017: Medical Devices Regulation (MDR, EU 2017/745) and In-vitro Diagnostics Regulation (IVDR, EU 2017/746). Cur- rently, the dates for full application following the transition period are May 2021 for MDR and May 2022 for IVDR. (European Commission 2020a) This work focuses on MDR, as IVDR is not applicable to the products of the case company.

As in MDD, also in MDR there are plenty of key concepts that the system is built around.

Some of the most important include the classification system, notified bodies and Con- formité Européenne (CE) marking. The classification system is based on the properties and potential risks of devices as well as the vulnerability of the human body. It ensures the efficient and flexible conformity assessment of each device and aims to protect patients from potential risks. There are four classes in the MDR classification system: I, IIa, IIb and III from the lowest risk to the highest. The class is defined based on the 22 classification rules of Annex VIII of MDR and considers both the intended use and the potential risks of the device. For example such properties as invasiveness, activity, sterility and duration of use are considered in the classification. The class also defines what kind of assessment a device is subject to before obtaining a CE mark. (MDR 2017)

CE mark is a marking for administrative purposes indicating conformity with health, safety and environmental protection requirements for products sold in the European Eco- nomic Area (EEA). CE mark is the manufacturer’s declaration that the product meets the legal requirements for CE marking and can move freely in the EEA – not a certification or quality mark. (Tukes 2020a) For medical devices, the class of the device defines the

(16)

route to obtaining a CE mark. Depending on the class, the process might include activities such as implementing a quality management system (QMS) and preparing a technical file and a clinical evaluation report. The process is described in detail later in this section. The company’s and product’s alignment with the requirements are audited by a notified body. All new medical devices and CE-marked devices to which a significant change is made must obtain a CE mark. (Ståhlberg 2015, MDR 2017)

By definition, a notified body is an organization designated by an EU member state that carries out conformity assessment of certain products, when a third party is needed, before they are placed on the market. The conformity is assessed based on applicable regulations and laws. The notified bodies are also involved in the assessment of other than medical devices, and a list (New Approach Notified and Designated Organisations NANDO) of the notified bodies as well as the tasks for which they have been notified is maintained by the European Commission. (European Commission 2020b) Regarding medical devices, the notified bodies are involved in the process of obtaining a CE mark, since they assess the conformity of the product and other aspects such as a QMS with the legislation. The complete requirements for notified bodies are described in the Annex VII of MDR. (MDR 2017) Compared to MDD, the position of notified bodies has changed in MDR: they are subject to more assessment, designation and monitoring activities than before (Pommelin 2017).

In addition to the notified bodies – that can operate not only in EU but also outside of it to assess products aiming to the EEA market – there are national authorities that monitor medical devices and their manufacturers in EU member states. In Finland, this authority is Fimea to which the responsibility was transferred from Valvira starting in the beginning of 2020 (Valvira 2019). The responsibilities of Fimea include for example the maintenance of a device register and processing notifications about incidents related to the safety of devices (Fimea 2020). Similar national authorities operate in other EU member states as well.

As medical devices and the systems and processes around them need to be strictly compliant with regulation in order for a device to obtain a CE mark, the process of obtaining a CE mark is an accurate description of some of the important systems and concepts of medical device regulation in EU. A simplification of the process for medical devices under MDR is presented in Figure 2. In this description, the additional requirements from national laws are not taken into account, as they may vary per EU member state.

In addition, the process is not isolated but happens simultaneously and interactively with other processes. For instance, the first step – determining the intended use of the device – is naturally vital also to the product development process and must be done when the

(17)

concept of the product is designed. In general, it is recommended to integrate the regulatory process to all the operations of the company. Otherwise complying with the regulatory requirements may require a disproportionate amount of resources. According to MDR, a person responsible for regulatory compliance has to be defined in each manufacturer organization. This should be done early, preferably when the product development and thus the regulatory work is started. Manufacturers not physically present in EU should appoint an authorized representative that is jointly and severally with the manufacturer liable for the regulatory compliance. (MDR 2017)

Figure 2 The process of obtaining a CE mark for a medical device.

The process of obtaining a CE mark starts with determining the intended use of the device. The intended use defines whether the device is a medical device, with which regulation it has to comply and to which class it belongs. Hence, the intended use has an impact on how broadly the conformity has to be demonstrated. This process describes medical devices that are under MDR. In addition to the regulation of medical devices, the device can be subject to other regulation as well depending on its features. For example regulation on machinery, patient data, ionizing radiation or electromagnetic com- patibility may be relevant. Aside from the regulatory affairs, the intended use also affects the market access and expected demand of the product: the broader the intended use, the more regulatory burden the device is likely subject to and thus, the more resources complying with the regulation requires. On the other hand, a very narrow intended use may limit the size of the customer segment and demand for the product. (Ståhlberg 2015) Once the intended use and applicable regulation are defined, the device is classified based on its intended use. There are differences in the process for obtaining a CE mark for different MDR classes: class I devices that are not sterile, measuring or reusable surgical instruments are self-certified, meaning that a notified body will not audit some of the systems and documentation that are audited for class II and III devices. Nonetheless, it is still the manufacturer’s responsibility to assure compliance with regulation and the quality of the device. There are also differences in the process for class II and III devices,

(18)

and naturally there are more requirements for devices that include a higher potential risk.

(MDR 2017)

A QMS has to be implemented already in the beginning of the design phase. The system has to include plans for such operations as risk management, clinical evaluation and post-market clinical follow-up, post-market surveillance and processes for reporting of serious incidents, among many others. A QMS is required from all devices, but a notified body will not audit the QMS of class I self-certified devices. (MDR 2017) The QMS requirements and design are discussed in detail in Section 2.2 Conformance in medical technology.

Next, the conformity with the requirements has to be demonstrated. The demonstration is done from the perspective of both the device and QMS (Ståhlberg 2015). A technical file, or in the case of class III devices, a design dossier, including documentation related to the description and specifications, design and manufacturing, safety and performance, risk management and verification and validation of the device as well as post-market surveillance must be prepared. In detail, these include information on for example the physical composition of the device, its intended use, testing, risk management, labelling, instructions for use, clinical evaluation and testing. Also the conformity of QMS with the requirements must be demonstrated – hence, it is crucial that the organization of and activities and processes related to the system are documented. The exact requirements for each device are defined based on its class and type. (MDR 2017) If there are any specific requirements that are not applicable to the device, their non-applicability has to be justified (Ståhlberg 2015). Aside from self-certified class I devices, a notified body will conduct an audit to assess the conformity.

As a part of the conformity demonstration, clinical data on the performance and the de- tected and risk analysis-based side effects of the device is required from all devices. The evaluation of the device based on the clinical data is called clinical evaluation. (Fimea 2020). Most of the data must refer to the subject device, but also existing data from similar devices can be utilized in some cases. Clinical investigations are always required from implantable and class III devices, and they must be performed according to the latest scientific and technical standard of the industry and planned properly, for example with the help of the standard EN ISO 14155 Clinical investigation of medical devices for human subjects — Good clinical practice. (Ståhlberg 2015, Fimea 2020, ISO 14155:2020) Clinical investigations are discussed on MDR and its Annex XV and clinical evaluation on Annex XIV. (MDR 2017). A European Competent Authority, in Finland Fimea, must be informed about the clinical studies. (Fimea 2020)

(19)

Before being set on the market, a unique device identification (UDI) device identifier (UDI-DI) has to be appointed to each device, and the device and its UDI-DI must be registered on Eudamed, the European Database for Medical Devices. UDI-DI includes information on the device model and its manufacturer, and Eudamed is a set of electronic systems containing information on medical devices, economic operators, notified bodies and other related topics. The UDI and Eudamed systems are explained on MDR and its Annex VI. (MDR 2017) Once every applicable requirement is fulfilled and the device has an UDI-DI, the device can be CE-marked. A prerequisite for a CE mark is that the manufacturer takes full responsibility for the conformity of the device, which is claimed with a declaration of conformity. (Ståhlberg 2015) It is a relatively short document including information about the device and its manufacturer as well as the regulation with which the manufacturer declares the product to comply and standards based on which the conformity is demonstrated (Tukes 2020b). Depending on the type of the device, the original, signed declaration of conformity has to be archived for ten or more years from the manufacture of the last device (MDR 2017).

When the declaration of conformance is completed, the device can be CE-marked. In many EU member states, the device has to be registered to a national device register immediately after the CE-marking. (Ståhlberg 2015) In Finland, Fimea maintains a register for medical devices. Fimea as a European competent authority is also responsible for market surveillance, to which a medical device is subject once on the market. The purpose of market surveillance is to ensure there are no unsafe products on the market and that regulation is being followed. (Fimea 2020)

In MDR, a post-market surveillance system is required from each device on the market.

The system is designed for collecting, recording and analysing information about the safety, quality and performance of the device during its lifecycle. The system is used for example to improve the features of the device, update the evaluation processes, determine and perform preventive and corrective actions and detect and report trends. Espe- cially the requirements for reporting serious incidents are strict, so the system must consider the handling of incidents and feedback. In addition, a periodic safety update report is required from all class IIa, IIb and III devices. (MDR 2017) The post-market activities in which the manufacturer takes part may in practice also include installation, training and maintenance as well as disposal of the device. The responsibility of the manufacturer only ends when the last device has been removed from the market. (Ståhlberg 2015)

(20)

2.1.2 USA

In USA, the authority responsible for the regulation of medical devices is the Center for Devices and Radiological Health (CDRH) of the United States Food and Drug Admin- istration (FDA). The responsibilities are divided between different offices such as Office of Product Evaluation and Quality and Office of Policy as well as the offices operating under them, such as the Offices of Cardiovascular Devices and Regulatory Programs.

Currently, CDRH is being reorganized. (FDA CDRH 2020) In addition to the federal authorities, also state authorities play a role in the regulation of medical devices for example through their own, additional regulation and communication with manufacturers bringing their products to the US market through that state. (Ståhlberg 2015) While third party notified bodies have a major role in EU, in USA FDA takes the majority of responsibility for reviewing manufacturers, and only a rather small part of manufacturers is involved in a Third Party Review Program. (Ståhlberg 2015, FDA 2020b)

The regulation of medical devices in USA is defined in the Code of Federal Regulations Title 21 (21 CFR). Especially its parts 800-1299 are important to medical device manufacturers, however, medical devices are discussed in other parts too. In the legislation, medical devices are divided to 19 groups such as Orthopedic, Microbiology and Dental, and considered in respective sections of the 21 CFR. FDA also provides guidance documents for the interpretation of the legislation. Unlike in EU, there is no separate regulation for IVD medical devices and medical devices, but the same laws are applicable to both. Nonetheless, their differences are recognized in the legislation and some specific requirements based on their special characteristics are placed on IVD devices. In addition to the federal regulations that apply to all US states, some states have their own, additional regulation and requirements that medical devices must fulfil. (Ståhlberg 2015) Also in USA, one of the most important concepts of the regulation of medical devices is the classification system. Medical devices are classified in class I, II and III from the lowest risk to the highest. In class I and II, there are also exemptions to which different requirements in the regulatory process are applied. The rules for classification and limitations of exemptions are explained in 21 CFR. Classification is usually done by comparing the device to other devices in the FDA database, but if no suitable point of reference exists in the database or classification is otherwise difficult, FDA also provides guidance by request. FDA also maintains a list of the exempt devices. As in EU, also in USA the class of the device strongly affects the regulatory requirements with which the device has to comply. Depending on the class and the features of the device, it may be subject to general controls alone or both general and device-specific special controls. (Ståhlberg 2015)

(21)

Other concepts especially important to understand are the Premarket Notification 510(k) and Premarket Approval (PMA) submissions that medical device manufacturers must submit and get approved in order to place their product on the market in USA. All new medical devices and devices to which a significant change is made are required a 510(k) or PMA procedure. Their purpose is to ensure that the devices marketed in USA are as safe and effective for their intended use as required and fulfil the regulatory requirements to which they are subject. The choice of submission depends strongly on the class of the device. (Ståhlberg 2015) 510(k) is required from all devices unless they are required a PMA or are exempt of the 510(k) requirements. The 510(k) procedure is based on the comparison of the device to a substantially equivalent, legally marketed device or devices, and there are three types of 510(k) procedures – traditional, special and abbrevi- ated – that are applied based on the type and status of the device. The objective of the manufacturer is to demonstrate their device to be as safe and effective as the predicate device. As a result of a successful 510(k) submission, the device is declared substantially equivalent, meaning it can be placed on the market. The requirements for a 510(k) submission are described on 21 CFR Part 807. (FDA 2020b)

The PMA procedure was developed to evaluate devices whose safety cannot be suffi- ciently ensured by only general and special controls, and it is mandatory for all class III devices. It is significantly more complex than a 510(k) and requires a significant amount of resources from the manufacturer. Also other than class III devices that cannot be compared to a predicate device are subject to either a PMA or a De Novo process, which is a risk-based classification procedure applied to low to moderate risk novel medical devices. (Ståhlberg 2015) The De Novo approach is not described in detail here, as it only concerns a rather small fraction of devices. The PMA process includes detailed regulatory and scientific review of the safety and effectiveness of medical devices. Unlike with 510(k), the devices subject to the PMA procedure are not compared to a predicate device but evaluated on their own. The PMA submission also requires significantly more data, usually including non-clinical laboratory studies and clinical investigations. Once the PMA procedure is passed successfully, the device can be placed on the market. The regulation related to PMA is described in 21 CFR Part 814. (FDA 2019a)

Similarly as in EU, in USA the regulatory procedures related to obtaining a marketing authorization describe the requirements set for the devices and their manufacturers ac- curately, as the compliance with requirements has to be demonstrated in those procedures. The process of obtaining a US marketing authorization through either of the two most common procedures, 510(k) and PMA, is described in Figure 3. This process only takes into account the federal regulation, not state-specific legislation. As both the 510(k)

(22)

and PMA procedures are very complex and include even device-specific requirements, Figure 3 only presents a high-level description outlining the rough course of the process.

Also in this case, the regulatory processes are not isolated from other operations such as product development and marketing and sales, but have to be integrated to the context of the whole company in order to ensure market access and efficient use of resources. If the manufacturer does not have local presence in USA, a local representative has to be appointed as a point of contact with FDA. (Ståhlberg 2015)

Figure 3 The process of obtaining a US marketing authorization for a medical de- vice.

The intended use of the device strongly affects to what extent of regulatory control the device is subject in USA as well. The intended use defines whether the product is a medical device or not. The US definition of a medical device is mostly similar to the EU definition, but there are some differences in the scope and especially the interpretation of the definition that should be clarified and taken into account for each device before starting the regulatory processes to bring the product to a new market. If the product is considered a medical device, the intended use is used as a basis for the classification of the device that, in turn, determines which regulatory procedure has to be followed in order to place the product on the market. In USA, the larger term used for the intended use and the target population, clinical setting and anatomical sites is ‘indications for use’.

Considering the indications for use of a device is highly important as they affect for example the scope of the required clinical studies and the size of the customer segment.

(Ståhlberg 2015)

In USA, there are no specific classification rules for medical devices, but the classification is generally done by referring to the FDA product classification database and comparing the device to medical devices that are already on the US market and their classification.

The class of the device determines the regulatory procedure followed for obtaining the marketing authorization: generally, class I exempt devices must only be listed to the FDA’s Unified Registration and Listing System (FURLS), while class III devices require a PMA procedure and all other devices a 510(k) procedure. Since there are plenty of exceptions and special proceedings in the regulation, the requirements not only for each

(23)

class but also for each device type should be reviewed carefully in the beginning of the regulatory process. (Ståhlberg 2015)

After the class of the device is determined, a QMS compliant with the Quality System Regulation (QSR) of 21 CFR Part 820 has to be established and implemented. Only some class I devices are partly exempt from the QSR requirements. (21 CFR § 820.1) The US requirements for the QMS are significantly more stringent than in many other jurisdictions. FDA also monitors manufacturers’ QMSs by performing routine site inspections. (Ståhlberg 2015) The QMS requirements and design are explained more exten- sively in Section 2.2 Conformance in medical technology.

Demonstrating conformity with requirements is the key aspect of both the 510(k) and PMA submission. FDA requires plenty of documentation on numerous aspects related to the device and its manufacturer. For example, each device must have a device master record, a document containing all information and specifications needed to produce a device from start to finish (21 CFR § 820.181). Essentially, the topics of the required documentation are similar as in EU – the intended use, labeling and physical composition of the device, its testing, risk management, instructions for use, a QSR-compliant QMS et cetera – but the scope is usually larger and the level of detail higher, making the US regulatory procedures more intense and resource-intensive. (Ståhlberg 2015)

As a part of the conformity demonstration, FDA may require clinical studies in support of the 510(k) and PMA submissions, especially from innovative class II and III products. In general, an FDA-approved investigational device exemption (IDE) is required in order to perform human studies of significant risk devices in USA. It allows the collection of safety and effectiveness data of devices not yet approved to be marketed in USA. Clinical studies are regulated by the good clinical practice (GCP) of 21 CFR parts 812, 50, 56, 54 and 820. (FDA 2019b) Especially regarding clinical studies and the complex regulatory processes associated with them the requirements may often be unclear. FDA offers different programs for manufacturers to request information and feedback prior to submitting the final submission. The most common is Pre-Submission, a formal written request from the manufacturer for feedback from FDA. The feedback is provided as a written response, and also a feedback meeting can be arranged if the manufacturer wishes. The Pre-Submission and other feedback programs are voluntary but can provide important guidance related to for example clinical studies or in a situation where feedback or guidance is crucial for proceeding with the submission preparation or product development.

(FDA 2019c)

(24)

While in EU the notified bodies audit the systems and documentation of manufacturers pursuing a CE mark, in the submission-based system of USA, the submission itself has to include certain components defined by FDA in addition to the documentation that the manufacturer has to continuously maintain on its own. For a 510(k) submission, for example a statement of indications for use and the substantial equivalence comparison with the predicate device must be included. For PMA, for example a summary of safety and effectiveness data, a summary of studies and marketing history are required. The requirements for the submissions are detailed and should be carefully reviewed for each device, as missing attachments might delay the process remarkably. The requirements for 510(k) and PMA submissions can be found on Parts 807 and 814 of 21 CFR. (FDA 2019d)

Once compliance with all the applicable FDA requirements is ensured and the submission prepared, the submission fee can be paid and the submission sent to FDA. The FDA processing and review times depend on the type of submission and the class of the device and vary from 3 up to 30 months. For devices requiring a PMA, FDA performs an inspection of the manufacturer and major suppliers involved in the design and production in connection with the submission. Both the manufacturer and suppliers must be compliant. The inspection can be seen as a part of demonstrating conformity in the process description, as it requires thorough preparation and knowledge of regulation. (Ståhlberg 2015) If the submission is successful and the product is authorized to be marketed in USA, FDA issues the manufacturer a 510(k) clearance letter or a PMA approval letter.

The device must be listed at the FURLS of FDA and the listing fee paid. Also the manufacturer must be registered at FURLS as a medical device establishment and pay an annual registration fee. (FDA 2018a)

Like in EU, post-market activities are also required in USA. Manufacturers are for example responsible of submitting incident reports related to their products in a manner compliant with the Part 803 of 21 CFR, maintaining tracking systems and registering facilities where devices are produced and distributed. Manufacturers may also take part in the installation of devices and the training of customers. (FDA 2018b) In addition, FDA performs site inspections to manufacturers’ facilities generally once every three years, and a comprehensive annual report must be provided on each device that requires a PMA.

Once again, it is important for the manufacturer to clarify and consider these responsibilities early in their regulatory process, as noncompliance might lead to serious consequences, even an import prohibition. (Ståhlberg 2015)

(25)

2.1.3 Other regions

In addition to the markets at focus in this study, EU and USA, there are various different regulatory systems for medical devices around the world. As the systems are often quite complex, detailed descriptions are out of the scope of this study, but short overview on the special features of the regulatory environments and registration processes in China, Brazil and Australia is given. They were chosen because all of them are large, quite stable markets potentially relevant to the case company in the future. In addition, an overview of the regulatory landscape in Africa is provided and four example countries – Kenya, Uganda, Nigeria and South Africa – are discussed briefly. Africa as a rapidly developing region with multiple growing economies is of interest to any future-oriented company, and the example countries were chosen because of their contrasting regulatory systems and markets with different characteristics.

In China, the national authority for medical device regulation is the National Medical Products Administration (NMPA), formerly known as the China Food and Drug Admin- istration (CFDA). Also drugs and cosmetics are regulated by NMPA. Its responsibilities include for example supervising medical device safety, monitoring the management of quality and risks of medical devices and developing the regulation and supervising its implementation in China. (NMPA 2019) The definition of a medical device is somewhat the same in China as in EU. Also the classification is quite similar: there are three device classes based on the potential risks of the devices. (Chang, Liu & Chatwin 2016) The legislation on medical devices is presented in CFDA Medical Device Regulations, and other information can be found on CFDA Guidance documents for example on labelling, software registration, clinical evaluation and adverse event monitoring. (Ståhlberg 2015) All foreign manufacturers must appoint an agent located in China that coordinates the device registration with NMPA. The Chinese marketing authorization process refers partly on other regions’ regulatory approvals: all foreign manufacturers aiming to place their product on the Chinese market must demonstrate that their device has been approved in another area, usually their country of origin. NMPA requires documentation in Simplified Chinese on both the qualification of the manufacturer, for example an ISO 13485 certificate, and the technical features of the device, including clinical evaluation data from Chinese settings. As a special feature of the system, class II and III as in medium and high-risk devices must be sent to a Chinese test centre authorized by NMPA for testing. NMPA may also perform QMS audits at the facilities of foreign manufacturers.

Class I devices are only subject to an administrative review that requires that the documentation is filed to NMPA for review. All manufacturers are also required post-market activities such as incident reporting. (Ståhlberg 2015) If the NMPA review is successful,

(26)

the device is certified and can be marketed in China. Class I record filing certificates do not expire, and class II and III registration certificates are valid for five years. (Chang, Liu

& Chatwin 2016)

Agência Nacional de Vigilância Sanitária (ANVISA) is the national authority regulating medical devices in Brazil. ANVISA for example issues market authorizations, regulates medical device export to Brazil, monitors quality and risk management and safety of products and performs site inspections. (ANVISA 2020a) In addition to medical devices, it regulates cosmetics, drugs, pesticides, tobacco and food (ANVISA 2020b). The definition of a medical device in Brazil is roughly the same as in EU, but some borderline products are treated differently. The device classification system is also risk-based, but there are four classes: class I, II, III and IV. The most important regulations include for example Resolutions RDC 185/2001 Classification and Registration Requirements of Medical Products, RDC 16/2013 GMP Requirements for Medical Devices and IVDs, and RDC 206/2006 Technical regulation on in-vitro diagnostic products and its changes from year 2012. In addition, ANVISA offers plenty of guidance documents on other requirements for medical devices. (Ståhlberg 2015)

For all foreign manufacturers, it is mandatory to appoint an ANVISA-approved representative based in Brazil, a Brazil Registration Holder, who has a significant role in the marketing authorization process and takes care of the registration process. There are two main pathways to a marketing approval in Brazil: “Registro”, available for all devices, and less stringent and quicker “Cadastro”, only available for low-risk class I and II devices. The registration requires technical documentation in Portuguese and clinical studies, if applicable, but in “Cadastro” the scope is narrower. Unlike in many other regions, ANVISA also requires manufacturers’ financial information in some cases. All devices and manufacturers must be compliant with and class III and IV devices are audited on Brazil Good Manufacturing Practice, which is partly equal to the ISO 13485 standard, but includes plenty more details that manufacturers must be familiar with when aiming for the Brazilian market. In addition, all electronic devices must hold a certificate from Instituto Nacional de Metrologia, Qualidade e Tecnologia (INMETRO). In addition to the requirements for a marketing authorization, also post-market activities are required.

(Ståhlberg 2015) A marketing authorization issued by ANVISA for class I and II devices does not expire and for class III and IV devices is valid for 10 years (ANVISA 2020c).

In Australia, Therapeutic Goods Administration (TGA) is the national authority responsible for the regulation of medical devices as well as medicines, blood and blood components and other therapeutic goods. TGA is involved for example in the supply, export, advertising and manufacturing of medical devices, and issues marketing authorizations

Analysis of Quality and Product Management Systems in a Medical Software Start-Up Company

Sara Sauranen