As discussed in our previous articles on the topic, the incoming EU Medical Devices Regulation (2017/745) (EU MDR) presents a number of challenges for medical device manufacturers. With regards to software medical devices, changes to classification have been a leading cause for concern. In particular, it appears that nearly all software medical devices are likely to be class IIa, or even class III (the highest risk category), where previously the majority have been class I.
The source of this potentially dramatic up-classification is Rule 11, Annex VIII of the EU MDR. The phrasing of Rule 11 is very wide and (until now) there has been no formal guidance on its interpretation. As such, many manufacturers have taken a cautionary approach to Rule 11 and assumed the highest classification will apply. However, on 11 October 2019, the Medical Device Coordination Group (MDCG) released its Guidance on Qualification and Classification of Software (Guidance). Below, we describe how the Guidance appears to soften the impact of Rule 11 and provides greater clarity with regards to classification of software medical devices.
The wide reach of Rule 11
The drafting of Rule 11 appears to allocate a significant proportion of software medical devices to the higher classes. We have highlighted below the sections that, in our view, appear to have a potentially very broad application:
Software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes is classified as class IIa, except if such decisions have an impact that may cause:
- death or an irreversible deterioration of a person’s state of health, in which case it is in class III; or
- a serious deterioration of a person’s state of health or a surgical intervention, in which case it is classified as class IIb.
Software intended to monitor physiological processes is classified as class IIa, except if it is intended for monitoring of vital physiological parameters, where the nature of variations of those parameters is such that it could result in immediate danger to the patient, in which case it is classified as class IIb.
All other software is classified as class I.
It is quite clear that the vast majority of software medical devices are intended to provide information which is used to take decisions with a diagnostic or therapeutic purpose. For example, even software that operates as a thermometer would be captured. As such, the starting point is that a significant number of software medical devices will be classified as class IIa.
However, many software medical devices will be further up-classified on a strict reading of Rule 11. This because the wording of Rule 11 makes an increase in class contingent on the impact of the decision made. As such, the significance of the software functionality is secondary to that of the decision. So, theoretically, software could perform a relatively innocuous function, but if the resulting decision (such as a decision not to treat a patient) could result in death or irreversible deterioration, a device is class III. Indeed, it is hard to think of a decision in the healthcare context which could never result in death or irreversible deterioration.
Consequently, software medical device manufacturers have faced a situation under the EU MDR where a previously class I device could suddenly be class III.
The MDCG Guidance
However, the Guidance appears to attempt to soften this effect somewhat, by suggesting a more nuanced approach to classification under Rule 11. In particular, it does so by reference to the position adopted by the International Medical Device Regulators Forum (IMDRF).
By way of background, the MDCG is established under the EU MDR to advise the European Commission on medical device regulation, including classification. As such, while the Guidance itself is not legally binding, the MDCG does have an official role.
The approach taken in the Guidance is as follows. In characterising Rule 11, the Guidance states that it is “…intended to address the risks related to the information provided by an active device, such as [medical device software]”. In this regard, it notes that Rule 11 was introduced in line with IMDRF guidance. The Guidance infers that Rule 11 “…describes and categorises the significance of the information provided by the active device to the healthcare decision (patient management) in combination with the healthcare situation (patient condition)”. Although neither of these terms are explicitly used in Rule 11.
The Guidance then divides Rule 11 into three ‘sub-rules’.
- ‘Rule 11a’ is the first three paragraphs of Rule 11 and the MDCG state that this sub-rule is ‘generally applicable’ to all software medical devices.
- ‘Rule 11b’ is the fourth paragraph of Rule 11 and is a specific rule intended to cover software medical devices that are for monitoring purposes only.
- ‘Rule 11c’ is the last paragraph of Rule 11 and covers ‘all other’ software medical devices. Although it is not entirely clear what type of software medical device would fall under this rule.
In discussing Rule 11a, the Guidance specifically cites the IMDRF approach to classification and states that Rule 11 was introduced to ‘mirror’ this approach. The IMDRF approach is based on the significance of the information the software provides to the healthcare decision in combination with the healthcare situation or patient condition.
The Guidance also includes a classification table based on the IMDRF Rise Framework with ‘possible’ corresponding EU MDR classifications. It notes that the table is for ‘illustrative purposes only’ and may provide ‘some useful indicative orientation on the risk class applicable’. Helpfully, the Guidance also sets out examples of software medical devices and suggests classifications.
In our view, the Guidance is good news for software medical device manufacturers. It introduces a pathway to potentially justifying a lower classification for software which is not, for example, directly treating or diagnosing a condition. We consider this to be a pragmatic approach to classifying software medical devices. In particular, it recognises that there is a different level of risk posed by software which acts directly in regards to a patient, and software which informs a clinician’s diagnostic or treatment decision. A strict reading of Rule 11 alone does not allow for distinctions such as this.
While the Guidance is not legally binding, in view of the official role of the MDCG under the EU MDR and the lack of any other guidance on this matter, we consider it likely that notified bodies and competent authorities will follow or, at least, recognise the Guidance. That being said, the wording of Rule 11 remains the same, so while the Guidance is helpful, it may not be seen as a total ‘life line’ by software medical device manufacturers.