Under the MDD 93/42/EEC, the role of the medical device Distributor was largely unaddressed in the Medical Device legislation within the European Union. Whereas, such operators do fulfill an essential role in the distribution of medical devices throughout the Union and beyond. It is not uncommon for Distributors to perform actions beyond receipt, storage, and forward distribution. For example, introducing changes to the labels, packaging, and more. Distributors play a key role in the traceability of medical devices from the Manufacturer up to the end customer, which is essential information when conducting a field safety corrective action (FSCA).
In this blog post, we will examine how the Medical Device Regulations (MDR 2017/745 & IVDR 2017/746) have introduced changes to the requirements that apply to Distributors. We will also examine how this applies to software medical devices and the interaction with the AI Act (2024/1689).
Legislative Framework
The MDR and the IVDR, jointly referred to as the European Medical Device Regulations, are significant sets of legislative frameworks governing the development, production, release, distribution, and post-market activities of medical devices on the European Union market.
The MDR and IVDR were adopted on the 5th of April, 2017, and came into full effect on May 26, 2021, and 2022 respectively. The regulations replaced the previous Medical Device Directives (MDD), In-Vitro Medical Device Directive (IVDD), and Active Implantable Medical Devices Directive (AIMDD), which were in place since the 1990s.
The new legislation is part of the EU’s broader effort to ensure high standards of safety and performance for medical devices, reflecting advances in technology, including the fast pace of digitalization, and responding to public health concerns, such as those raised by the PIP breast implant incident.And as with most other parts of the MDR and IVDR, also these parts are supported by Guidance Documentation, such as the MDCG 2021-27 and MDCG 2018-6.
Who is a medical device Distributor?
Within the legislation, the definition of a medical device Distributor is explained as per the below.
There are a few takeaways from the definition that is provided:
- Distributors are parties that make devices available on the European Union market up until the point of putting the devices into service, and
- A Manufacturer or Importer does not take on the role of a ‘Distributor’
In simpler terms, Distributors are entities that store and supply medical devices to retailers, healthcare providers, or directly to end-users. In several European Union countries, Distributors are required to register themselves with the local authorities. If the Distributor receives the product from a non-EU region, they also may take on the role of importer for the products.
As a Manufacturer using a distribution partner (or multiple), it may be worthwhile to verify whether Distributors have actually complied with their local registration requirements as part of the selection process and specifically in the event of software provided over online distribution platforms, where this may not be straightforward.
Software distribution
For software medical devices, there are more interesting notes. For example, if and where medical device software is integrated into a larger system provided to the market by a third party, the provider of the entire system (e.g. a PACS with embedded third-party AI tools) may be considered the ‘Distributor’. Similarly, when making medical device software available through a platform (e.g. the Apple App Store or Google Play Store) these may also take on the role of medical device Distributor.
A more detailed analysis of the requirements incumbent on those parties (specifically Apple and Google) has been investigated in detail by Sadare et al, in 2023. A quick review of the Apple App Store however quickly reveals that for medical device apps critical information is missing, e.g. the relevant symbols as mandated under the MDR are not displayed in the App Store, as for the CE mark of the products.
Let’s explore further what requirements must be met by Distributors.
Article 14: The core article for Distributors
The MDR and IVDR place significant responsibilities on Distributors, which go beyond simply handling and delivering medical devices. As called out in the introduction of this blog post, the role of the Distributor is broadly to ensure (1) distribution of compliant products, (2) compliance with the instructions provided by the Manufacturer, and (3) facilitate product traceability.
Compliance verification activities
When a Distributor starts their distribution activities for a medical device Manufacturer they must ensure that the CE marking and EU conformity declaration are present and compliant. This may not only apply to the first-time distribution only, but also for any consequent updates and releases of new CE certificates and Declarations of Conformity. In the event of software with frequent updates, this process may require fast interactions between both parties.
Consequently, the Distributor is tasked to ensure that the labeling is adequate, and for the countries to which they distribute, taking language requirements into consideration may need to be considered. If there are multiple Distributors along the full distribution chain, it may require different verification steps as each Distributor bears the same responsibilities. Where an importer is involved, the Distributor should also take note of whether their details are clarified.
As applicable, sampling procedures may be applied at a Distributor.
Traceability
The Distributor should retain overviews of the parties to whom they have supplied medical devices (per Article 25.2 MDR / 22.2 IVDR). As a Distributor, it may prove useful to keep track of the Basic-UDI & UDI-DI’s that have been distributed to support traceability. For class III implantable devices, this is even obligatory. Further requirements may be installed by the European Commission through implementing acts for specific devices, categories or groups of devices, up to the level of tracing UDI-PIs.
Non-Compliance
Distributors are further required to ensure that they do not distribute non-compliant devices with the regulations, and inform relevant parties immediately if they suspect that a device may be non-compliant (including the Manufacturer, authorized representative, importer, and in some cases the competent authorities).
It is pertinent for Distributors to implement procedures where they define their definitions of non-compliance and when to inform such parties. For example, a medical device that includes a mistake within the labeling may already fulfill these requirements (e.g. incorrect translations within an Instructions for Use).
Post Market Activities
Once the device has been made available to the end-user, the Distributor continues to play a role in the distribution process. For example, they should ensure that they can respond to questions from the market, such as complaints and other forms of feedback provided by the end-user. Complaints and potential reported incidents will need to be logged by the Distributor. At the same time, they have the responsibility to support the Manufacturer in implementing Field Safety Corrective Actions (FSCA), e.g. fixing devices, recalling devices, and or withdrawing devices from the market. Such execution of FSCA may also be requested to the Distributor directly by a Competent Authority.
If the Distributor considers a medical device to present a serious risk to safety, they further are obliged to inform the Competent Authorities without delay. It should be noted here, that again procedures including definitions of serious risk are important to ensure proper implementation. Before informing Competent Authorities it is strongly recommended to include a liaison with the Manufacturer to ensure that their concerns are indeed correct.
Installation and Servicing
In addition to the above, Distributors may take on further responsibilities as agreed on with the Manufacturer. Typical examples of such activities include the execution of installation and servicing activities. The Manufacturer is required to ensure that these activities are executed in line with their Quality Management System and they should clarify their requirements in a written agreement.
Records of such activities may need to be forwarded to the Manufacturer on an ongoing basis, or the Manufacturer may decide to implement monitoring activities, e.g. conducting regular audits on those activities executed by the Distributor.
In such a setup, the Distributor may want to consider implementing an ISO 13485 certification, to conduct these activities under their own Quality Management System and reduce the control activities executed by the Manufacturer.
Where Distributors take on even more responsibilities per Article 16
There are various situations where Distributors perform activities that go beyond what is described in Article 14, and that’s where Article 16 of the EU Medical Device Regulation (MDR) comes in. Under Article 16 Distributors may take on responsibilities of the Manufacturer. Here is when that happens:
Branding the Device as Their Own
If an importer or Distributor puts a device on the market under their own name, trademark, or brand, they take on the same responsibilities as the Manufacturer. In other words, the Distributor no longer qualifies as a Distributor. The only exception is if there is an agreement where the actual Manufacturer is clearly identified on the label and remains responsible for the device.
Changing the Medical Device’s Purpose
If the Distributor alters the intended purpose of a device that’s already available on the market, they will also be considered the Manufacturer.
Modifying the Device
If they make changes to a device that could affect its compliance with regulations, they must meet the same requirements as the Manufacturer.
Some activities don’t count as modifying a device. For example:
1.Translating Manufacturer Information
Translating instructions or labels for a new market is not considered a modification, as long as it doesn’t affect the device’s compliance.
2.Repackaging
Changing the outer packaging or pack size to suit a different market is not seen as a modification, provided the device remains in its original, compliant condition.
Quality and Compliance Are Key
Distributors and importers engaging in these activities under I & II should note that it is their responsibility to ensure everything is done to a high standard. This includes a requirement to implement a robust quality management system that keeps translations accurate, repackaging tidy, and the device in perfect condition. They also need to be ready to respond to any corrective actions taken by the Manufacturer, especially if there are safety concerns.
Notifying the Manufacturer and Authorities
Before making any repackaged or relabelled devices available, Distributors or importers must inform the original Manufacturer and the relevant authorities in the Member State where the device will be sold. This notification has to happen at least 28 days in advance, and they may need to provide a sample of the relabelled or repackaged device, along with a certificate proving their quality management system is up to scratch.
Distribution of Medical Device Software including Artificial Intelligence
On August 1 the Artificial Intelligence Act (2024/1689) ‘AI Act’ entered into force. The AI Act brings further requirements for the distribution of medical device software. In this section, we highlight the differences with the above, where duplications are not highlighted.
Verification of Compliance
Similar to the Medical Device Regulations, under the AI Act, the Distributor has the responsibility to verify compliance of the product against the requirements set out in the AI Act. They also bear the responsibility to ensure that the Manufacturer has a Quality Management System in place. Where the Distributor of a High-Risk AI System considers the system to be non-compliant with Chapter 2 of the AI Act, they must inform the Manufacturer and cease distribution until it has been made to comply with Chapter 2
Where responsibilities shift from the Manufacturer to the Distributor (or Deployer)
Similar to the Medical Device Regulations, under certain conditions, the Distributor (or e.g. the Deployer such as a healthcare institution) will take on the responsibilities of the Manufacturer if introducing substantial changes to the AI System. With AI Systems, where AI algorithms may be updated by re-training, it could substantially alter the performance of the AI system and consequently the Distributor or Deployer executing the retraining may become the Manufacturer (or provider in the terms of the AI Act). If that situation would occur, the initial Manufacturer is obliged under the AI Act to make available all relevant information, technical access, and assistance for the Distributor or Deployer to become compliant with the requirements for High-Risk AI systems.
This may not apply where the Manufacturer has clearly specified that their AI system should not be altered.
If you have any queries regarding the role of the medical device Distributor and their significant responsibilities, feel free to get in touch.
