How to verify that medical devices and personal protective equipment can be lawfully placed on the EU market and thus purchased and used – also in the COVID-19 context

How to verify that medical devices and personal protective

equipment can be lawfully placed on the EU market and thus purchased and used – also in the COVID-19 context

Introduction and scope of this document

The purpose of this guidance document is to provide basic indications to allow those interested parties who are unfamiliar with the regulated sectors of medical devices and personal protective equipment to identify whether a product is lawfully placed on the EU market and can continue to be made available, thus purchased and used.

Such clarification has proven especially necessary in the context of the COVID-19 pandemic1. The related extraordinary circumstances have rapidly increased the need

and demand for certain devices and equipment: this has resulted in the involvement of economic operators and other interested parties not previously in the supply and verification chain of these products. In addition, recent experience indicates the need to be attentive to misleading or falsified documents as well as to counterfeit products.

Question 1: What is the applicable regulatory framework for medical devices and

personal protective equipment in the EU?2

Medical devices within the EU are currently regulated by the following Directives:

•  Council Directive 90/385/EEC of 20 June 1990 on the approximation of the laws of the Member States relating to active implantable medical devices3 (hereafter referred to as AIMDD)
•  Council Directive 93/42/EEC of 14 June 1993 concerning medical devices4

(hereafter referred to as MDD)

•  Directive 98/79/EC of the European Parliament and of the Council of 27 October 1998 on in vitro diagnostic medical devices5 (hereafter referred to as IVDD)

Medical devices can also already be placed on the EU market if they comply with the following new Regulations which entered into force in May 2017:

1 Commission’s coronavirus response: https://ec.europa.eu/info/live-work-travel-eu/health/coronavirus-response. 2 See also Question 9 for more detailed information. 3 OJ L 189, 20.7.1990, p. 17. 4 OJ L 169, 12.7.1993, p. 1. 5 OJ L 331, 7.12.1998, p. 1.

•  Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC6 (hereafter referred to as MDR, fully applicable as from 26 May 2021)
•  Regulation (EU) 2017/746 of the European Parliament and of the Council of 5 April 2017 on in vitro diagnostic medical devices and repealing Directive 98/79/EC and Commission Decision 2010/227/EU7 (hereafter referred to as IVDR, fully applicable as from 26 May 2022) The temporal scope and the conditions of applicability of the relevant legal requirements to devices, from the AIMDD, the MDD and the IVDD (hereafter referred to as Directives) to the MDR and the IVDR (hereafter referred to as new Regulations on medical devices), are governed by specific transitional provisions8. On the other hand, personal protective equipment within the EU is currently regulated by Regulation (EU) 2016/425 of the European Parliament and of the Council of 9 March 2016 on personal protective equipment and repealing Council Directive 89/686/EEC9 (hereafter referred to as PPER).

Question 2: How can a product be lawfully placed on the EU market?

In order to lawfully place on the EU market medical devices under the scope of the Directives or the new Regulations, as well as personal protective equipment under the scope of the PPER, these products must be CE-marked10 with the EC or EU declaration of conformity signed and issued by the manufacturer. In the EC or EU declaration of conformity, manufacturers must declare that their products comply with the applicable EU legislative act(s) and requirements. There are however no obligations in the EU legal framework to separately draw up declarations of compliance with national legislation, as well as with national, European or international standards. The Directives and the new Regulations on medical devices, and the PPER, in line with the main pieces of the EU legislation concerning the internal market for goods, lay down essential safety and performance requirements and health and safety requirements, respectively , but do not prescribe any specific mandatory technical solutions for the manufacturing and design of the products. Therefore, the manufacturer can choose which technical solution (s) to use to comply with these legal

6 OJ L 117, 5.5.2017, p. 1. 7 OJ L 117, 5.5.2017, p. 176. 8 See Article 120 MDR and Article 110 IVDR. 9 OJ L 81, 31.3.2016, p. 51. 10 The CE marking must be affixed according to the specific provisions laid down in Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 (OJ L 218, 13.8.2008, p. 30) as well as in the applicable EU legislation.

requirements. Manufacturers can use those offered in harmonised European standards or in other standards or technical specifications, or can come up with their own technical solution(s). The use of harmonised European standards is a voluntary means to comply with the legal requirements . These standards, developed by the relevant European standardisation organisations11, contain specific technical solutions that can be used to comply with the legal requirements. When the reference of a harmonised European standard is cited in the Official Journal of the European Union (OJEU), the use of such standard confers on the product a presumption of conformity with the legal requirements it aims to cover (as listed in the relevant Annex Z) . In practice, where a manufacturer chooses to follow a harmonised European standard to which the reference is cited in the OJEU, the product is presumed to be in conformity with the applicable legal requirements covered by such standard . On the contrary, where a manufacturer chooses not to follow a harmonised European standard, it must demonstrate that the alternative technical solution applied is adequate to ensure compliance of the product with the applicable legal requirements. The manufacturer must also prepare and maintain the relevant technical documentation for the product , in support to the compliance claimed in the EC or EU declaration of conformity . Such technical documentation has to be kept and made available to national competent authorities upon their request. For medical devices, manufacturers outside the EU must designate a single authorised representative in the EU. Information on the authorised representative must be available at least on the EC or EU declaration of conformity, on the certificate where applicable, and on the labelling of the device. For certain medical devices12 and personal protective equipment13, the manufacturer needs to involve a notified body in the prescribed conformity assessment procedure(s). Once the notified body assesses the compliance of the product with the relevant requirements of the applicable EU legislation, it will issue the appropriate certificate (as for example an EC or EU type-examination certificate, a design-examination certificate or a quality management system certificate ). Such product must be CE-marked followed by the 4-digits identification number (NB xxxx) of the notified body. Conformity assessment procedures can include audits of manufacturers and/or critical suppliers/subcontractors, testing or review of technical documentation (such as test reports, manufacturer’s risk assessment and/or management process, drawings and clinical data) in support of compliance of the product with the applicable legal requirements.

11 The European Committee for Standardization (CEN) and the European Committee for Electrotechnical Standardization (CENELEC) for the medical devices and personal protective equipment sectors. 12 Medium and high-risk devices such as medical face masks supplied in sterile condition, respiratory patient ventilators, in vitro diagnostic devices listed in Annex II to the IVDD and diagnostic self-tests. 13 Risk categories II and III such as respiratory protection face masks.

Question 3: Can other documents be valid to lawfully place a product on the EU market? Only documents which are explicitly referred to in the applicable EU legislation (namely the EC or EU declaration of conformity and , where needed, certificates issued according to the relevant conformity assessment procedures) may be drawn up and used for the purpose of lawfully placing a product on the EU market. Therefore, any other document is not valid for such a purpose. In practice there are several examples of documents which have no legal status according to the applicable EU legislation , for instance the so-called “certificate of compliance ”, “ attestation of compliance ”, “certificate of conformity ”, “certificate of notification ”, “certificate of registration ”, “documentation review” or similar, which do not comply with the requirements of an EC or EU declaration of conformity issued by the manufacturer or a certificate issued by a notified body. Those “other documents” with no legal status according to the applicable EU legislation are issued by different kinds of entities, for instance non-notified conformity/certification bodies but also bodies notified under other EU legislative acts , or testing houses or laboratories, or even authorised representatives, etc. Even if such documents may include some elements of a declaration of conformity or a certificate, they are usually voluntary statements that manufacturers request from third parties but do not provide any legal basis to place products on the EU market. These statements may address different issues such as compliance with legislation or standards, appropriateness of the technical documentation and so on, but do not constitute “declarations of conformity” (because valid declarations of conformity can only be issued by manufacturers) nor “certificates” ( because valid certificates can only be issued by notified bodies designated for the specific legislative act ) within the meaning of the applicable EU legislation. These voluntary statements may be included in the technical documentation as supporting documents to provide evidence of compliance with certain applicable requirements. However, they can never replace the EC or EU declaration of conformity issued by the manufacturer, or the certificate(s) issued by notified bodies, as prescribed by the applicable EU legislation.

Question 4 : Which are the main characteristics of a valid declaration of conformity? A valid EC or EU declaration of conformity must be drafted and signed by the manufacturer, and include as a minimum14:

14 The model structure of the EC declaration of conformity is set out in Annex III to Decision No 768/2008/EC of the European Parliament and of the Council of 9 July 2008 (OJ L 218, 13.8.2008, p. 82). In addition, indications on the contents of the EU declaration of conformity can be found in “The ‘Blue Guide’ on the implementation of EU products rules” (see Question 9).

•  the identification and description of the product;
•  the EU legislative act(s) to which conformity is claimed;
•  the name and address of the manufacturer, and/or of the authorised representative, where applicable;
•  a statement that the declaration is issued under the sole responsibility of the manufacturer;
•  the conformity assessment procedure(s) applied;
•  references to the relevant harmonised European standard (s) or common specification(s) used, where applicable;
•  the name and the 4-digits identification number (NB xxxx) of the notified body and reference to the certificate(s) issued, where applicable;
•  date of issue of the declaration, identification and signature of the manufacturer. The minimum contents of the EU declaration of conformity according to the new Regulations on medical devices are laid down in the respective Annexes IV. The minimum contents of the EU declaration of conformity according to the PPER are laid down in Annex IX. If a product falls under the scope of two or more EU legislative acts providing for the CE marking, a single EU declaration of conformity must be drafted and signed by the manufacturer, declaring conformity with the applicable two or more pieces of legislation. This is the case, for instance, of “ double-purpose” medical protective equipment, such as some types of face masks or gloves, providing protection to both users and patients: they fall under the scope of both the MDD and the PPER, therefore their EU declaration of conformity will refer to both pieces of legislation.

Question 5: Which are the main characteristics of a valid certificate?

There are two types of certificates that can be issued by a notified body under the applicable EU legislation, in view of placing medical devices or personal protective equipment on the EU market: product certificates and quality management system certificates. The first certifies that the product complies with the relevant requirements (after the notified body has reviewed the relevant technical documentation and/or has performed the relevant tests). The latter certifies the quality management system of the manufacturer for a defined product range (either in its entirety or in aspects limited to production or product quality assurance). A valid certificate under the applicable EU legislation (as for example an EC or EU type-examination certificate, a design-examination certificate or a quality management system certificate) is issued by a notified body after the successful completion of the conformity assessment procedure applicable to the product . Notified bodies are designated by the relevant national authorities to perform specific conformity assessment procedure(s) and thus to issue the related certificate(s), for specific types of products or quality management systems under different EU legislative acts. Only

those notified bodies listed in the Commission’s NANDO information system https://ec.europa.eu/growth/tools-databases/nando/ are entitled to issue valid certificates, within their scope and competences:

• - List of notified bodies for the AIMDD: https://ec.europa.eu/growth/tools-databases/nando/index.cfm?fuseaction=directive.notifiedbody&dir_id=8-List of notified bodies for the MDD: https://ec.europa.eu/growth/tools-databases/nando/index.cfm?fuseaction=directive.notifiedbody&dir_id=13-List of notified bodies for the IVDD: https://ec.europa.eu/growth/tools-databases/nando/index.cfm?fuseaction=directive.notifiedbody&dir_id=20-List of notified bodies for the MDR: https://ec.europa.eu/growth/tools-databases/nando/index.cfm?fuseaction=directive.notifiedbody&dir_id=34-List of notified bodies for the IVDR: https://ec.europa.eu/growth/tools-databases/nando/index.cfm?fuseaction=directive.notifiedbody&dir_id=35-List of notified bodies for the PPER: https://ec.europa.eu/growth/tools-databases/nando/index.cfm?fuseaction=directive.notifiedbody&dir_id=155501 A conformity assessment body must be notified under each specific EU legislative act in order to be able to perform determined conformity assessment procedure(s) for specific types of products under the said legislative act , as indicated in the notification with its scope and the competences of the notified body. Thus, even if a body is notified under one or more EU legislative act(s) and has thus been granted a 4-digits identification number (NB xxxx) in NANDO , such notified body is not automatically allowed to perform conformity assessment procedures under other EU legislative act(s) or for different scope and competences . A separate notification is therefore necessary, even if the notified body will keep the same identification number under each EU legislative act. The NANDO information system can be consulted searching by “Country”, “Legislation” or “Body”. For each notified body and notifying /designating authority, information and contact details are included : this can be used to submit requests for specific information on the status and competences of notified bodies , as well as on their activities. In addition, several notified bodies listed in NANDO for medical devices and personal protective equipment have dedicated websites where the most relevant information on their certificates can be consulted. A manufacturer can choose any of the notified body listed in NANDO if notified for the specific EU legislative act(s), irrespective of where the notified body is located. Every certificate issued by a notified body prior to placing medical devices or personal protective equipment on the EU market must specify the conformity assessment procedure applied, and may include references to the test reports if applicable and other relevant technical documents, as well as to the harmonised European standards used if it is the case. The name and the 4-digits identification number (NB xxxx) of the notified body must be clearly indicated on the certificate.

Guidance on content of certificates issued by notified bodies for medical devices in accordance with the Directives can be found in the document NBOG BPG 2010-315, detailing information to be reported depending on the relevant conformity assessment procedure performed. The minimum contents of certificates according to the new Regulations on medical devices are laid down in their respective Annexes XII. The minimum contents of an EU type-examination certificate according to the PPER are laid down in its Annex V.

Question 6: When is the intervention of a notified body required?

For medical devices, the involvement of a notified body is required for the conformity assessment procedures applicable to class III, IIa and IIb devices, as in the case of respiratory patient ventilators, as well as for class I devices supplied in sterile condition or with measuring functions . For other class I devices, as in the case of medical face masks (often referred to as type I, II or IIR masks16), gloves and overalls when supplied in non-sterile condition, the intervention of a notified body is not required, and manufacturers are entitled to carry out the applicable conformity assessment procedure under their sole responsibility (“self-assessment”). For in vitro diagnostic medical devices, under the IVDD, notified body intervention is required for devices intended for self-testing, i.e. devices intended by the manufacturer to be used by lay persons in a home environment17. It is also required for devices listed in Annex II of the IVDD. Under the IVDR, notified bodies are involved in conformity assessment of class B, C and D devices, as well as class A sterile devices. For products under the scope of the PPER, a notified body is required for the conformity assessment procedures applicable to risk categories II and III equipment. In particular, respiratory protection face masks used in the COVID-19 context (often referred to as FFP2 or FFP3 masks18) are products falling in category III and as such a notified body must be systematically involved in the conformity assessment procedures prior to placing these products on the EU market.

Question 7: Can a test report in accordance with a standard allow for the placing on the EU market of a product? A test report issued after carrying out testing on a product in accordance with a standard is not sufficient by itself for lawfully placing the product on the EU market.

15 http://www.doks.nbog.eu/Doks/NBOG_BPG_2010_3.pdf. 16 As defined in the harmonised European standard EN 14683:2019+AC:2019. 17 Article 1(2)(d) IVDD. 18 As defined in the harmonised European standard EN 149:2001+A1:2009.

This is the case also for harmonised European standards providing presumption of conformity to certain requirements. Test reports, as well as documentation of the manufacturer’s risk assessment and/or management process , drawings, clinical data etc., are to be included in the technical documentation prepared by the manufacturer. Where applicable, these elements must be submitted to a notified body, which will review them and conduct additional tests if necessary. Notified bodies cannot issue any certificate based on test reports only: the relevant conformity assessment procedure(s) have to be performed. Once the relevant conformity assessment procedure has been successfully completed , in order to place products on the EU market according to the applicable legislation, such products must be CE-marked (followed by the 4-digits identification number (NB xxxx) of the notified body when applicable) with the EC or EU declaration of conformity signed and issued by the manufacturer. This is the case, for instance, of test reports for medical face masks in accordance with the harmonised European standard EN 14683:2019+AC:2019 , or test reports for respiratory protection face masks in accordance with the harmonised European standard EN 149:2001+A1:2009 (in this case, documentation should be submitted by the manufacturer to the notified body which will perform the tests and the applicable conformity assessment procedures ). Reports of tests performed against the relevant standards could be considered as one, but not the only, element based on which the manufacturer can issue the EC or EU declaration of conformity for products intended to be placed on the EU market.

Question 8: Are derogations from the legal requirements possible (for instance, products not CE-marked, or without a declaration of conformity) , in particular in the context of the COVID-19 pandemic? Under exceptional circumstances, the medical devices Directives and Regulations19 empower national competent authorities, on a duly justified request, to authorise the placing on their national markets of medical devices for which the relevant conformity assessment procedures have not been carried out, but the use of which is in the interest of protection of health, or in the interest of public health or patient safety or health respectively (“national derogation”). On the contrary, the PPER does not envisage such possibility. Nevertheless, in the context of the COVID-19 pandemic, the Commission Recommendation (EU) 2020/403 of 13 March 2020 on conformity assessment and

19 Article 9(9) AIMDD, Article 11(13) MDD and Article 9(12) IVDD; Article 59 MDR and Article 54 IVDR. The referred Articles of the MDR and the IVDR establish also the possibility for the Commission, in exceptional cases relating to public health or patient safety or health, to extend for a limited period of time the validity of an authorisation granted by a Member State to the territory of the EU, and set the conditions under which the device may be placed on the market or put into service.

market surveillance procedures within the context of the COVID-19 threat20 allows for some degree of flexibility, to improve the availability of certain personal protective equipment21 and medical devices22, under strict conditions and bound to healthcare workers. In this sense, national competent authorities of the EU Member States may authorise the making available on their national markets of some products, for a limited period of time and while the necessary procedures are being carried out, even though the conformity assessment procedures, including the affixing of CE marking , have not been fully finalised.

Question 9 : Where can more detailed information on the applicable EU regulatory framework be found? All the relevant information on the EU legislative acts on medical devices and on personal protective equipment, with the related legal texts and requirements, guidance documents, working parties, lists of harmonised European standards and of notified bodies, contact points etc., can be found in the respective Commission’s sectorial websites:

• - Medical devices: https://ec.europa.eu/growth/sectors/medical-devices. Contact: SANTE-MED-DEV@ec.europa.eu-Personal protective equipment: https://ec.europa.eu/growth/sectors/mechanical- engineering/personal-protective-equipment. Contact: GROW-PPE@ec.europa.eu Among the available guidance documents, the following ones provide further overview information about the current regulatory framework for medical devices and personal protective equipment in the EU:
• - Conformity assessment procedures for protective equipment: https://ec.europa.eu/docsroom/documents/40521-Guidance on medical devices, active implantable medical devices and in vitro diagnostic medical devices in the COVID-19 context: https://ec.europa.eu/docsroom/documents/40607/ For more specific information on products , their characteristics and performance, as well as the related documents, to check whether they can be validly placed on the EU market or not, it is necessary to contact the national competent authorities of the EU Member State(s) where such products are intended to be placed, as per the lists available on the Commission’s sectoral websites:
• - Medical devices: https://ec.europa.eu/growth/sectors/medical-devices/contacts
• - Personal protective equipment: https://ec.europa.eu/growth/sectors/mechanical- engineering/personal-protective-equipment

20 OJ L 79I, 16.3.2020, p. 1. 21 In particular respiratory protection face masks, gloves, protective coveralls and eyewear protection. 22 In particular medical face masks, examination gloves and gowns.

Horizontal information and guidance applicable to the various pieces of EU legislation on internal market for goods, which also include the medical devices Directives and Regulations and the personal protective equipment Regulation, are available on the following Commission’s webpages:

• - The ‘Blue Guide’ on the implementation of EU product rules: https://ec.europa.eu/docsroom/documents/18027/
• - CE marking: https://ec.europa.eu/growth/single-market/ce-marking/
• - Technical documentation and EU declaration of conformity: https://europa.eu/youreurope/business/product-requirements/compliance/technical- documentation-conformity/
• - Single market for goods: https://ec.europa.eu/growth/single-market/goods
• - New legislative framework: https://ec.europa.eu/growth/single-market/goods/new- legislative-framework
• - Market surveillance for products: https://ec.europa.eu/growth/single-market/goods/building-blocks/market-surveillance
• - Harmonised standards: https://ec.europa.eu/growth/single-market/european- standards/harmonised-standards
• - NANDO (New Approach Notified and Designated Organisations) information system: https://ec.europa.eu/growth/tools-databases/nando/
• - Safety Gate: the rapid alert system for dangerous non-food products (RAPEX): https://ec.europa.eu/consumers/consumers_safety/safety_products/rapex/alerts/rep ository/content/pages/rapex/index_en.htm

_____________________________________________________________________ N.B. These Guidelines are intended solely for facilitating the application of the Directives and Regulations on medical devices and the Regulation on personal protective equipment. The Commission accepts no responsibility or liability whatsoever with regard to the information in this document. The information provided in this document is:

•  of a general nature only and is not intended to address the specific circumstances of any particular individual or entity;
•  not necessarily comprehensive and complete;
•  sometimes referring to actions of external actors over which the Commission services have no direct control and for which the Commission cannot assume responsibility;
•  not of a professional nature or should not be read as legal advice. To the extent that these Q&A’ s may interpret legislation, the Commission’ s position is without prejudice to any interpretation of this legislation that may be issued by the Court of Justice of the European Union. _____________________________________________________________________