General Overview: Steps to CE Mark IVDs

In order to sell your in vitro diagnostic (IVD) medical device in Europe, it must first be CE Marked to the IVD Regulation (IVDR). CE Marking is Europe’s version of marketing approval.

Click through the below steps to see the high-level process to CE Mark IVDs:

STEP 1
Classify your IVD
Devices are classified according to a set of risk-based ‘rules’ under IVDR Annex VIII: Class A, B, C and D  
  • If the IVD is Class A sterile, Class B, Class C or Class D, it will require a formal CE Certificate issued by a European Notified Body.
  • If the device is Class A non-sterile, the manufacturer will ‘self-certify’ the IVD.
STEP 2
Technical Documentation File

Draft a Technical Documentation File (TDF).

 

A TDF is made up of the following elements:

 

  1. Main Body that describes the device and verifies how the device has met the all the applicable general safety and performance requirements
  2. Performance Evaluation (procedure, plan and report)
  3. Risk assessment conducted for the device
  4. Post-market surveillance system
STEP 3
Quality Management System

All manufacturers must implement a quality management system (QMS).

 

Generally, manufacturers implement to EN ISO 13485. It is a standard that was developed specifically for medical devices and has been harmonized in Europe, i.e., it generally meets the QMS requirements of the IVDR.  

 

  • Class A non-sterile manufacturers: QMS may be less robust than higher-risk devices but must at least meet the minimum requirements under IVDR Article 10(8). Further, the QMS does not have to be audited by a third party.
  • All other manufacturers: implement a QMS and undergo review by a Notified Body.
STEP 4
Unique Device Identifier

Implement Unique Device Identifier (UDI) system.

 

If you already have a UDI system in place for another market (e.g., US FDA), then this is generally sufficient for Europe. The main differences are:

 

  1. The EU Commission only recognizes the following UDI issuing agencies: GS1, HIBCC, ICCBBA and IFA GmbH.
  2. The MDR/IVDR introduces a new concept: the Basic UDI-DI. This is unique to Europe, and must be established as part of the UDI system.
STEP 5
EU Authorized Representative

Non-European manufacturers must appoint a European Authorized Representative (EU AR).

 

The EU AR is the point of contact between you and the EU national competent authorities.

 

They are identified on your device labeling, Declaration of Conformity, and Notified Body issued CE Certificate (if applicable).

STEP 6
CE Mark the Device

Once the all the previous items are in place:

 

  • Class A sterile, Class B, Class C, or Class D devices must engage a Notified Body to CE Mark the device. The Notified Body will conduct an audit, and upon successful completion, issue a CE certificate. The Notified Body’s 4-digit number will be placed adjacent to the CE symbol.
  • Class A non-sterile devices do not require Notified Body review. Instead, the manufacturer will ‘self-affix’ the CE symbol to the device labeling.
STEP 7
Declaration of Conformity

Manufacturer must sign a Declaration of Conformity (DoC).

 

The DoC is a legally binding document, in which the manufacturer asserts that they have met the minimum requirements of the IVDR. 

STEP 8
Device Registration

IVDs must be registered in Europe.

 

If the manufacturer is established in Europe, they will register with their local Competent Authority. If they are not, then the EU Authorized Representative will register the foreign manufacturer’s device with their local Competent Authority.

 

NOTE: EUDAMED, the European databased on medical devices, will allow all manufacturers to register their devices independently. However, EUDAMED has been delayed. 

STEP 9
Begin Marketing in Europe

You may now begin marketing in Europe.

 

You must maintain CE marking for as long as the device continues to be marketed. This includes compliance with vigilance requirements: reporting serious incidents and field safety corrective actions, e.g., recalls. 

In Vitro Diagnostic Regulation (IVDR) 2017/746

The In Vitro Diagnostic medical devices Regulation (IVDR) is the current IVD legislation. Prior to that, IVDs were governed by the In Vitro Diagnostic Medical Device Directive (IVDD) 98/79/EC.

On 26 May 2022, the IVDR superseded the IVDD. This means that all IVDs newly being placed onto the European market after 26 May 2022, must comply with the IVDR.

The IVDR is much more robust legislation, up-classifying most IVDs on the European market.

IVDD/IVDR Progressive Rollout Dates

The IVDR granted a transition period for most devices that held valid IVDD CE Marking on 26 May 2022. Those are called “legacy” devices and they have the following timeframes to comply with the IVDR.

Eventual IVDR ClassificationCompliance Deadline (“IVDR Progressive Rollout”)
Class A non-sterile26 May 2022 – No transition period granted; must comply immediately
Class A sterile26 May 2027 – An additional five years granted
Class B26 May 2027 – An additional five years granted
Class C26 May 2026 – An additional four years granted
Class D26 May 2025 – An additional three years granted

The above transition period was granted for devices that require Notified Body certification under the IVDR. This was necessary, due to 1) the lack of Notified Bodies accredited to the IVDR at the time the IVDR was to come into force and 2) the extensive number of IVDs that were upclassed (now requiring Notified Body certification) under the IVDR.

Further, some elements of the IVDR were applied to all IVDs on 26 May 2022, its date of application (DoA), irrespective of the transition timelines. For example, the IVDR’s vigilance, post-market surveillance and market surveillance requirements will apply to every IVD on the market, even those that are IVDD CE marked as ‘legacy’ devices under the above transition period.

For more information, please read: What are Legacy Devices?

Need Help?

Whether you need a quote or just want to discuss the best options for your business, we will help guide you.

Email us

Classifying IVDs

IVDs are classified according to risk level, with Class A being the lowest risk and Class D being the highest risk. Manufacturers should refer to IVDR, Annex VIII for the full set of classification rules.

Included in the table below are some examples for reference.

ClassExamples
Class A (sterile /non-sterile) – General reagents (not assay specific) used with a Class A instrument, e.g. general sequencing consumable reagents used with a sequencer.
– Specimen containers or evacuated or non-evacuated tubes, empty or prefilled with a fixative solution or other general reagent to preserve the condition, stimulation, transport, storage and collection of biological specimens (e.g. cells, tissues specimens, urine, faeces) for the purpose of in vitro diagnostic examinations.
Class B – Urine dipstick to determine urinary tract infection at point of care.
– Rapid tests for the detection of Group A Strep, Respiratory Syncytial Virus, and Influenza virus(es).
– Antibody tests for HAV, dengue, chikungunya and West Nile virus.
– Control materials used to verify the migration of immunochromatographic assays.
Class C – Medical device software for high-resolution analysis of HLA sequencing data, for transplantation purposes.
– Devices intended for detecting the presence of, or exposure to, a sexually transmitted agent, e.g., Chlamydia trachomatis, Human papilloma virus (HPV).
– Blood glucose reagents / strips for patient monitoring.
– Mobile cardiac marker monitoring test for acute presenting patients: Troponin I, Troponin T, CKMB (when intended to be used for monitoring cardiac muscle injury).
Class D – Tests for Hepatitis B, C, D.
– Tests for Human Immunodeficiency Virus (HIV) 1 and 2.
– Tests for SARS CoV and SARS-CoV-2.
– Tests for Haemorrhagic fever viruses, e.g. Ebola, Marburg, Lassa, Crimean-Congo Haemorrhagic fever.

Refer to MDCG Guidance Document 2020-16 rev.2 for more explanation (and examples) regarding IVD device classification.

IVDR Compliance: Key Elements

Prior to CE Marking an IVD, manufacturers must compile technical and performance documentation to demonstrate compliance with the IVDR.

All IVDs, irrespective of classification and risk level, require the following elements from the IVDR:

  1. IVDR, Annex II – Technical Documentation File (TDF), which includes information related to product design and manufacturing, product verification and validation, and risk analysis and management
  2. IVDR, Annex III – Post-Market Surveillance (PMS) appendix
  3. IVDR, Annex XIII – Performance Evaluation Report (PER)

Not all the requirements outlined in each section above may apply to your device. Manufacturers should determine which sections within each Annex (TDF/PMS/PER) are applicable for their device. Where a section is deemed not applicable, manufacturers should document a rationale as to why this has been excluded from the Technical Documentation File (TDF) and/or Performance Evaluation Report (PER).

Notified Bodies

Further, unless the device is the very lowest risk class, it must undergo a conformity assessment review by a Notified Body. Notified Bodies are organizations accredited and supervised by the European National Competent Authorities, and their role is to evaluate if products have met the minimum safety and efficacy requirements. The Notified Body issues “CE Mark Approval” for the device by issuing a CE certificate

Casus Consulting can help you understand how the IVDR applies to your device, and the required information to be included in each file. We can also provide support in conducting a gap analysis of your ‘legacy’ device technical files and upgrading them to the IVDR.

Technical Documentation File (IVDR Annex II)

Manufacturers should consider the technical file as a whole when drafting, rather than looking at the sections as standalone items. For example, the General Safety and Performance Requirements (GSPRs) include information from the Risk Management section, and elements of the Risk Management section need to be considered for the Post-market Surveillance plan.

Technical Documentation File (Main Body)

The main body of an IVDR complaint TDF should include key details and documentation related to the device, including the description, labeling/IFUs, design and manufacturing information, product verification and validation (i.e., data to prove the safety and efficacy of the device).

Two key components that manufacturers need to develop for the IVDR TDF are the General Safety and Performance Requirements and Risk Management section.

General Safety & Performance Requirements (GSPRs)

  • The GSPRs detail the specific criteria manufacturers must meet to establish minimum safety and efficacy requirements for their device, e.g., requirements for performance, risk management, design, etc.
  • The GSPRs, located in Annex I of the IVDR, are similar to the Essential Requirements Checklist (ERC), located in Annex I of the IVDD.
  • European Harmonized Standards should be utilized, where available. The reason is that use of harmonized standards ‘presumes compliance’ to the applicable requirement.
  • Where the EU Commission has released Common Specifications for specific product types, they should be applied to the device unless the manufacturer “can duly justify that they have adopted solutions that ensure a level of safety and performance that is at least equivalent hereto”.

Resource: List of Harmonized Standards & Common Specifications

Risk Analysis & Management

  • Manufacturers must assess possible risks related to their device and rate the probability of occurrence against the severity of harm if it does occur. Manufacturers should detail the procedures in place to mitigate the risk or actions to take if it occurs. An approach some companies follow is to incorporate a Failure Mode and Effects Analysis (FMEA) template as part of their overall risk management system.
  • EN ISO 14971:2019, for medical device risk management, is harmonized standard under the EU IVDR.
  • Annex I, section 3 of the IVDR includes specific criteria that manufacturers must meet when implementing their risk management system. This section states that risk management is “a continuous iterative process throughout the entire lifecycle of a device, requiring regular systematic updating”.

EU Guide: Post-Market Surveillance

Learn the difference between market surveillance & post-market surveillance. Plus how PMS Plans and Reports, PMCF/PMPF, Trend Reporting and Vigilance all intertwine.

Click Here

Post-Market Surveillance (IVDR Annex III)

Post-Market Surveillance Plan

  • The Post Market Surveillance (PMS) section of the TDF details the manufacturer’s plan to collect and assess post-market data. The PMS Plan should include information from serious incidents, complaints, public information on other similar medical devices, and more (refer to IVDR Annex III, Section 1(a)).
  • The PMS Plan must also establish how the manufacturer will use the data collected to take action when needed. Actions may include making updates to device documentation, such as the PER, improving the risk management and/or taking preventative or corrective action.

Post-Market Performance Follow-up (PMPF) Plan

  • The Post-Market Performance Follow-up (PMPF) plan is a subset of your PMS Plan and is very much intertwined with your risk management and performance evaluation. The PMPF plan is intended to help identify previously unknown risks and to confirm the device’s safety and performance.
  • A PMPF Plan can include a PMPF study when warranted. However, other methods can also be used to address gaps in your pre-clinical data and to demonstrate a continued positive benefit-risk ratio, when appropriate. Examples include feedback via patient or physician surveys and screening of scientific literature.

Post-Market Surveillance Report (PMSR)

Manufacturers of Class A and B devices must prepare a post-market surveillance report (PMSR) based on data collected once the product is on the market. The PMSR is generated through review and analysis of the gathered PMS data and should also include any preventative or corrective actions taken.

The IVDR states the PMSR should be updated ‘when necessary’ and made available to the notified body and competent authorities ‘upon request’.

Periodic Safety Update Report (PSUR)

Manufacturers of Class C and D devices are required to prepare a Periodic Safety Update Report (PSUR) for each device.

The PSUR is a living record in which the manufacturer systematically assesses their PMS data to ensure the device continues to be safe and effective and to provide an accurate picture of the products’ performance post-market. This includes any preventative or corrective actions taken and volume of sales.

The PSUR must be updated at least annually. A Class C manufacturers must make the PSUR available to its notified body, upon request. Manufacturers of Class D IVDs must provide the updated PSURs to their notified body and the PSUR will further be accessible to all national competent authorities and the EU Commission.

Performance Evaluation (IVDR Annex XIII)

The Performance Evaluation Report (PER) is a crucial element of the technical file, and includes the following information:

  • basic device information,
  • Performance Evaluation Plan (PEP),
  • common specifications and harmonized standards,
  • a literature review,
  • data from a performance study (if required),
  • Post-Market Surveillance (PMS) data,
  • Post-Market Performance Follow-Up (PMPF) data,
  • a plan for continual updates to this section, and
  • other relevant device documentation, such as the IFU.

The PER is intended to be a ‘living’ document and should be continually updated. Specifically, the regulation states that the “clinical evidence and its assessment in the performance evaluation report shall be updated throughout the life cycle of the device concerned with data obtained from the implementation of the manufacturer’s PMPF plan…and the post-market surveillance plan…”.

Quality Management System (QMS)

All manufacturers must implement a quality management system (QMS).

Class A non-sterile manufacturers may develop a QMS that is less robust than higher risk device manufacturers. However, at a minimum it must meet the requirements outlined under the IVDR, Article 10(8). Further, the QMS does not have to be assessed by a third party.

All other manufacturers must implement a QMS and undergo Notified Body review as outlined in Annex IX, X, XI, as applicable.

ISO 13485 is the international standard on medical device quality management systems. It has been harmonized in Europe under the MDR and IVDR (EN ISO 13485:2016).

Other Requirements

European Authorized Representative

All non-European manufacturers must appoint a European Authorized Representative (AR). They are also referred to as an EC Rep.

The EU AR is the point of contact between you and the EU national competent authorities, and is identified on your device labeling, Declaration of Conformity, and Notified Body issued CE Certificate (if applicable).

UDI System

Manufacturers must implement a Unique Device Identification (UDI) system for its devices. The UDI system is generally similar to the US FDA’s UDI system. Some differences exist, however, such as:

  • The EU Commission only recognizes the following UDI issuing agencies: GS1, HIBCC, ICCBBA and IFA GmbH.
  • The MDR/IVDR introduces a new concept: the Basic UDI-DI. This is unique to Europe, and must be established as part of the UDI system.

Device Registration – EUDAMED

EUDAMED is the European databank on medical devices. It’s the central system for device data management, including housing all manufacturers, importers, authorized representatives, devices on European market, vigilance, clinical investigations, performance evaluations, and more.

After a manufacturer has CE Marked their device, they must register themselves, and the device in EUDAMED. If the manufacturer is not located in Europe, then it must first link itself to its EU Authorized Representative, in order to complete the registration.

Currently, EUDAMED is voluntary. It has been postponed, and is still under development.

Vigilance

Manufacturers must report vigilance (serious incidents and Field Safety Corrective Actions (FSCAs)) to the applicable European Competent Authorities. To ensure this requirement is met, manufacturers should develop a vigilance procedure that describes how to identify if an incident is reportable; and, if it is deemed reportable, the timeframes and method to do so.

Additional Resources

Please see below for additional materials on how to comply with European requirements.