The conformity assessment activities described under Article 52 / Article 48 apply to any certificate issued under the new regulations. As no exceptions were established under the regulations for the migration or transfer of MDD/AIMDD/IVDD certificates to the MDR / IVDR the general provisions should apply. Therefore, all devices to be certified under the MDR / IVDR should be subject to an initial certification according to the applicable annex. The notified body should ensure that all requirements under the MDR / IVDR are fulfilled. It may not restrict its procedures to gap audits or gap file reviews. However, when possible, the notified body should make use of leveraging evidence (see Q&A IV.13).

It should be noted that MDD/AIMDD/IVDD certificates shall be considered to be valid as long as conditions laid down in Article 120(3) of the MDR and 110 (3) of the IVDR are complied with (16).

The MDR/IVDR established that the audit of the manufacturer premises must include an audit on the premises of subcontractors and/or suppliers if appropriate. Therefore, the notified body should have criteria for auditing these actors on the basis of their criticality. At the very least, the criteria defined in Section 4.5.2(b) of Annex VII should be applied (i.e. the control over the supplier/subcontractor and its influence on the conformity of the device is essential whereas the sole existence of a certificate against ISO 13485 is not sufficient).

(9)

Certificates do not need to include reference to relevant common specifications or harmonised standards as long as such information on all examinations and tests performed is traceable and available from e.g. report(s) which are mentioned in the certificate.

While MDR Article 58(1) / IVDR Article 53(1) sets out the requirements for a transfer agreement, it does not specify the conformity assessment activities to be performed by the incoming NB.

The incoming NB may decide not to carry out full conformity assessment activities according to Article 52 MDR / Article 48 IVDR, as long as it does have sufficient information in respect to the conformity activities performed by the outgoing NB.

For quality management system certificates, the incoming NB needs to perform appropriate on-site audit(s) and assessments to ensure that the manufacturer in question applies the approved QMS and the post-market surveillance plan prior to the issue of any certificate. In respect to the assessment of technical documentations on a sampling basis, the incoming NB shall review the previous assessment results together with a sample of a technical documentation and draw up or amend a sampling plan.

For product certificates (Annex IX Chapter II/Annex X), new certificates without a comprehensive (initial) review may be issued as long as the documentation received does not identify ongoing existing or other concerns.

The incoming NB assumes full responsibility for the new certificates issued following the transfer.

The MDR / IVDR does not distinguish between OBL (10) and other manufacturers. There are just „manufacturers“ and therefore OBL manufacturers must comply with the legal requirements, as any other manufacturer (11).

The internal or otherwise integrated clinician is responsible to identify when specialist input is required for the assessment of the clinical evaluation as defined in Section 3.2.4 of Annex VII of the MDR and IVDR. This decision will be made by the internal or integrated clinician on a case-by-case basis, based on the products covered by the applications lodged by the manufacturer and the clinical expertise available. The internal clinician or integrated clinician will be responsible for this process in all cases where the conformity of the device to the requirements of annex I is achieved also by clinical data. In cases where demonstration of conformity to requirements of Annex I based on clinical data is not deemed appropriate (in accordance with Article 61(10)) the internal or integrated clinician will also examine the justification provided in order to assess its adequacy. The internal or otherwise integrated clinicians will decide if the review of clinical evaluation is to be carried out by themselves, to be delegated to other qualified staff or if it necessitates the input of external clinical experts. This process is also defined in Section 4.3 of Annex IX of the MDR and Section 5.4 of NBOG’s best practice guide 2017-2 as endorsed by the MDCG.

Section 3.2.4 of Annex VII defines that there must be a clinician who is either internal (= employee) or otherwise integrated into the CAB’s assessment and decision- making process. To be regarded as integrated, a clinician (who is not an employee) must have access to all the information, required to perform its activities, circulating in the CAB and must be involved in the internal processes in the same way as an employee, the only difference to an employee being that there is no employment contract, but a service contract and therefore this person should not be considered final reviewer or decision-maker as per 3.2.7 of Annex VII.

In addition to this, the internal or otherwise integrated clinician will clinically judge the opinion provided by any external expert (including verification of comparability and consistency of the assessments of clinical evaluations conducted by clinical experts) and will be responsible to make a recommendation to the decision maker on the adequacy of the clinical evaluation.

Allocation of resources is to be understood as the allocation of appropriately authorised and qualified personnel and means (including equipment and facilities) for a given project (application), as stated in second paragraph of Section 4.4 of Annex VII „appropriate resources including personnel“. Section 4.4 of Annex VII describes the assignment of tasks within a project to “individuals”, starting with the individual responsible for ensuring that the assessment of that application is conducted in accordance with the relevant procedures and for ensuring that the appropriate resources including personnel are utilised for each of the tasks of the assessment (often referred to as project leader (20)) and following with the identification of individual personnel that will carry out each task of a given project.

The assessment of the resources needed for each application is a key function that has to be fulfilled as part of the internal activities of the CAB as indicated in Section 4.1 of Annex VII and any changes on such allocation should be documented.

The notified body may assign the tasks of allocating resources, documenting of any change on such allocation and/or ensuring that the assessment of that application is conducted in accordance with the relevant procedures to different functions (individuals). In this case, the notified body needs to specify and document clearly the roles and responsibilities. For every project, the notified body needs to identify clearly which individual is taking care of a specified task. Any of the tasks specified in Section 4.4. need to be fulfilled as internal activity.

According to Annex XII information on tests and examinations performed as part of the conformity assessment activities need to be included on the certificates issued by notified bodies. This information might be of interest for competent authorities and third parties.

If the certificates do not include explicitly references to relevant common specifications, harmonised standards or other standards or referential but include a reference to the relevant report(s), the CAB should ensure that competent authorities and interested parties can have access this information on request. For example, the certificate may include a sentence like „information on examinations and tests as per Annex XII, section 10 is available on request“ and possibly provide a contact (e.g. e-mail).

The Regulations – in Annex VII and in the specific conformity assessment annexes (i.e. Annex IX, X and XI) -establish the need for the manufacturer to notify certain planned changes. Section 4.9 of Annex VII contains general requirements for notified bodies in respect to changes.

For manufacturers, the specific conformity assessment annexes (i.e. Annex IX, X and XI) detail such requirements e.g. asking for plans for “any” changes (e.g. MDR Annex IX, 5.2 f), 5.3.1 d) or Annex X 5.2), for changes could affect the safety and performance of the device or the conditions prescribed for use of the device (e.g. MDR Annex IX 4.10) or for “substantial” changes only (e.g. MDR / IVDR Annex IX 2.4). With regard to the latter, the CAB needs to make clear in its communication to the manufacturer (e.g. in the terms and conditions) what it considers as “substantial changes” to the quality management system or the device-range covered.

In order to fully comply with all the relevant requirements the CAB must have documented procedures defining how different changes need to be notified and assessed prior to their implementation and how the assessment will be documented. In particular, the CAB will define in its procedures when the approval of such changes will take the form of a supplement of the previously issued certificate.

Surveillance audits according to the Regulations can take place only after a MDR or IVDR certificate has been issued. According to the Regulations, surveillance audits have to be carried out on at least annual basis (Section 4.10 of Annex VII MDR/IVDR), further specified in Section 3.3 of Annex IX MDR/IVDR and Section 7 of Annex XI MDR/Section 4 of Annex XI IVDR as at least every 12 months. The first surveillance audit should be scheduled 12 months after the certification decision date. This is the so called “due date” (e.g. December) which defines the target dates for all upcoming regular surveillance audits (e.g. each December).

In order to take in consideration, the necessity for contingent scheduling adjustments, surveillance audits can be conducted within a limited window of +/- three months from the due date without particular concern. However, if the surveillance audits are conducted outside this time window (earlier or later) this should be exceptional and must be justified and documented in consideration of the possible impact on the certificate’s validity. A cumulation of deviations over the years, e.g. changing the due date is not allowed.

CABs need to consider all the available guidance, common specifications and harmonised standards to carry out its assessments. This means, that CABs will have to consider this documentation when developing its own procedures and processes (including checklists and report templates) and when assessing the manufacturers QMS (e.g. by taking into consideration EN ISO 13485) and technical documentation.

For instance, in order to assess if the solutions adopted by the manufacturer are state of the art and in line with expectations, the CAB need to use the available guidance documents and standards. It should be noted that non-conformities will not be raised against standards or guidance but need to be phrased against legal requirements. For instance, Annex I Chapter I Section 1 of the Regulation which states that “devices shall be safe and effective […] taking into account the generally acknowledged state of the art” can be used when the technical documentation does not follow standards or guidance.

Based on an application by the manufacturer and according to Article 56(2) of the MDR / Article 51(2) of the IVDR and Section 4.11 of Annex VII of the Regulations, notified bodies can extend the validity of QMS certificates (EU quality management system or EU quality assurance certificates) as well as product certificates (EU technical documentation assessment or EU type-examination certificates) for further periods of maximum five years (re-certification).

Re-certifications are not repetitions of initial certifications.

Notified bodies should have documented procedures and appropriate forms for re- certifications of

• product certificates requiring the manufacturer to submit a summary of changes and scientific findings as outlined in Section 4.11 of Annex VII, to perform a targeted assessment of this information and to pay particular attention to clinical data from post-market surveillance and PMCF activities undertaken since the previous certification or re-certification, including appropriate updates to manufacturers‘ clinical evaluation reports.
• QMS certificates ensuring that all relevant Regulation requirements for conducting audits (i.e. those covered in Section 4.5.2 of Annex VII, and Sections 2.2 and 2.3 of Annex IX) are assessed in their entirety at least once after issuing the certificate and before their expiry date. They should foresee the notified body to review the results of all surveillance activities carried out, announced or unannounced, in accordance with Section 4.10 of Annex VII during the certification cycle, especially on-site audits of the manufacturer, its subcontractors / suppliers, and product tests carried out, as well as the outcome of technical documentation assessments on sampling basis to verify whether the approved quality management system still conforms to the relevant provisions of the Regulation. In addition, they should contain an obligatory check whether the audit programme and the sampling plan drawn up according to Section 4.5.2 (a) of Annex VII are still up to date or need to be adjusted.

In both cases, the procedures should foresee that the notified body, before renewing a certificate, ensures:

• that all nonconformities identified are either closed or followed up by an adequate and accepted Corrective Actions and Preventive Actions (CAPA) plan with appropriate timelines,
• if the scope of the certificate needs to be adjusted, especially restricted,
• when the certification was subject to specific conditions or limitations to verify whether those are still valid or obsolete or need to be changed,
• or if new conditions need to be imposed.

According to Annex VII Section 4.11, for the decision on re-certification the notified body shall use the same methods and principles as for the initial certification decision, meaning a final review and decision shall be made in accordance with Sections 4.7 and 4.8 of Annex VII.

According to MDCG 2022-14, action item 2, notified bodies should avoid unnecessary duplication of work when performing their conformity assessment activities. In this respect, a differentiation between evidence provided by the manufacturer and assessment of such evidence already performed by notified bodies needs to be made.

As part of the structured dialogue (see Q&A I.6.3), for (a) specific device(s), manufacturers and notified bodies should discuss and agree in the pre-application phase if / which evidence provided with previous applications by the manufacturer can be referred to. In principle, this is possible as long as the evidence provided still meets the “state of the art”.

To facilitate such an approach, manufacturers should clearly indicate which parts of a technical documentation have changed compared to previous ones.

Notified bodies should make (partial) use of the assessments previously performed on such evidence. This is generally recommended as long as

• the applicable assessment requirements (including harmonised standards and common specifications used to prove compliance with the requirements) didn’t change,
• the assessments were performed by personnel demonstrably meeting the qualification requirements of the Regulations,
• the applicable reporting requirements in Section 4.6 of Annex VII of the Regulations are met and traceability is ensured.

In these cases, the report should identify what part of the technical documentation assessment has been performed by leveraging evidence from previous assessments and ensure traceability.