Supply chain controls are an unpopular topic. Supply chain activities are often carried out by business partners with the primary intention of selling devices. Regulatory controls are considered an unattractive burden because they require work on both sides to define and meet the responsibilities for each party. Typically, this also requires the involvement of regulatory and legal experts who might produce more concrete regulatory or legal requirements. These requirements might be covered in supply agreements or quality agreements. Nevertheless, supply chain controls to deliver and market safe medical devices are essential.  

What is the current regulatory framework in the EU?

When the European Parliament and the Council reinforced the European regulatory framework for medical devices and in vitro diagnostic medical devices in 2017, the main objectives were to protect patients and users, enable a smooth functioning of the internal market for devices, and establish a more robust system of conformity assessment to ensure the quality, safety, and performance of devices placed on the EU market. They introduced a system for identifying and tracing devices (EUDAMED, UDI - Unique Device Identifier) and defined obligations for parties involved in the supply chain of devices. These are called Economic Operators under Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR).

The following four legal entities defined under EU IVDR may be designated as Economic Operators for your company and may be part of your supply chain (distribution):  

• Manufacturers (sometimes referred to as “legal manufacturers” to distinguish them from contract manufacturers)

• Importers

• Distributors

• Authorized Representatives (sometimes referred to as “European Authorized Representatives” to distinguish them from Authorized Representatives in other countries)

What are the obligations for Economic Operators in the EU?

Each Economic Operator in the supply chain has specific obligations defined in EU IVDR Articles 10 to 16. These obligations apply irrespective of the device class. They include requirements on:

• how to verify CE Marking;  

• registration and labeling (including UDI);  

• storing the device under the specified conditions;  

• controlling and notifying other Economic Operators about non-conformities, complaints, and FSCA or incidents;

• managing complaints;

• keeping documents; and  

• cooperating with the Notified Bodies and Competent Authorities.  

This new framework's overall intention is to detect supply chain problems and ensure that Economic Operators work together smoothly.

The obligations have applied since May 2022 for all IVD devices marketed in EU, including legacy devices (see MDCG 2022-8 Annex - table illustrating IVDR requirements applicable or not applicable to ‘legacy devices’).

Are these “new” obligations for Economic Operators?

In general, no. Though the detailed supply chain obligations were not defined in the IVDD,  numerous guidance and regulations were published that described general Good Distribution Practice requirements and practices for specific products marketed in the EU (e.g., 2022/C 247/01 ‘Blue Guide’ on the implementation of EU product rules, 2013/C 343/01 on Good Distribution Practice of medicinal products for human use).

Therefore, supply chain obligations were applicable under IVDD and are indirectly defined in EN ISO 13485 as well, which is the standard used by most organizations involved in the design, production, installation, and servicing of medical devices and related services. ISO 13485 clause 4.1.1 states, “Roles undertaken by the organization can include manufacturer, authorized representatives, importer or distributor.” Thus, IVD manufacturers who have a Quality Management System according to EN ISO 13485 should control their “outsourced activities” for Economic Operator supply chain activities through written quality agreements (ISO 13485 clause 4.1.5). The respective quality agreements should reference the detailed obligations defined in the IVDR and describe how these will be met by each party. It does not matter if the auditor already audited you on this topic; an existing ISO 13485 Certificate is not adequate to avoid a nonconformity.  

Note that a crucial supplier or critical subcontractor should not be considered an Economic Operator, but the responsibilities should be defined in a quality agreement or other legal agreement, as well.

What are current problems for manufacturers controlling the supply chain?

As mentioned above, the roles of the Economic Operators need to be determined by the manufacturer and written quality agreements need to be in place, which should include the applicable obligations defined in IVDR Article 10-16.  

These first steps seem simple, but in practice they can require significant work, regulatory expertise, and careful assessments. The most common issues include:

1. The distributor or importer role in the supply chain is not clearly defined.

Distributors and importers are sometimes named as “customers” or “partners,” leaving the final role in the supply chain open ended, even though these roles are clearly defined in the IVDR. Business scenarios may involve logistic distribution centers, direct supply to hospitals, and differences in the way the devices are physically delivered, while contracts and payments are made for border and tax reasons. Non-tangible devices, such as software, that are not supplied in the traditional way must define the same roles and controls in the agreements, as applicable. Further, the supply from or in non-EU countries, such as the UK and Switzerland, may create supply chain scenarios with different legal obligations for supply chain agreements.  

2. The obligations for Economic Operators involved in the supply chain are not clearly defined in the quality agreement.

The quality agreements do not refer to nor specify the obligations from the IVDR, so there is no evidence for how the Economic Operators must meet these obligations. To be clear, distributors, importers, or EU ARs do not need to have an ISO 13485-certified quality management system. However, the legal manufacturer must verify how they have qualified their outsourced Economic Operators, and the Economic Operators must demonstrate how they comply with the obligations defined in the IVDR. Older agreements require an update to IVDR. This may even require an audit of the Economic Operator’s quality management system.

How does changing supply chain controls impact IVD manufacturers?

In the past, the supply chain controls for IVD manufacturers through registrars or authorities were extremely poor. This continues to change with new obligations for labelling and registration, which allow better identification and traceability through the supply chain (e.g., at customs borders). Labelling standards (EN ISO 15223-1) have added new symbols for distributors and importers for information to be supplied by the manufacturer to indicate compliance with IVDR. Manufacturers, EU ARs, and importers must register in EUDAMED. As Economic Operators, Distributors must also meet certain obligations under the IVDR, even though they are not registered in EUDAMED.

IVDs can be controlled at the border for adequate labelling or accompanying documentation. For example, many IVDs may require the use of specific safety symbols for their reagents (chemicals) and must include Safety Data Sheets in accordance with REACH regulations. The database EUDAMED, which becomes more functional every day, can also be used for systematic searches and wrong entries for follow-up by National Competent Authorities.  

‍