Principles of ideal diagnostic regulation and the IVDR

Regulatory frameworks for diagnostics need to be risk-based

This means that the regulatory requirements should take into account the expected clinical benefit and role (as intended by the manufacturer) the product will play for users and/or patients, as well as what risks the product could pose to these persons and/or to public health. Importantly, ‘clinical benefit’ in the EU IVDR means the benefit of the information. According to the EU IVDR [5] Article 2 (36) and (37) and Recital 64, the concept of clinical benefit for diagnostics is fundamentally different from that which applies in the case of pharmaceuticals or of therapeutic medical devices. The benefit of diagnostics lies in providing accurate medical information on patients, and the final clinical outcome for the patient is dependent on further diagnostic and/or therapeutic options.

The clinical benefits of diagnostic tests vary greatly, depending on if and how the manufacturer has intended its use in clinical decision making. A test can be driving treatment (e.g. a companion diagnostic to determine eligibility for a personalized cancer treatment) or be a critical determinant of making a diagnosis (e.g. tell if a patient has SARS-COV 2 or not). Other tests simply provide a small puzzle piece about a person’s physiological make-up at a given point in time (e.g. the level of creatinine in the body) or helps the pathologist further characterize a cancer (e.g. an adjunctive immunohistochemical (IHC) assay) as part of a test panel.

The regulatory status of a product must be assessed with these different purposes in mind. A risk-based approach should be applied in the qualification and classification of products, in the assessment of developers and manufacturers, when making changes to the product throughout its life-cycle on the market and in post-market surveillance. This approach helps maximize efficiency by allocating resources to areas of highest risk to patients, and increase compliance by focussing regulators’ and developers’ attention on those areas.

In the EU IVDR, a risk-based approach is reflected e.g. in the level of pre-market review per product class. Class A IVDs (considered as the lowest risk) are self-certified by the manufacturer and do not require Notified Body review, according to Article 48 (19) [5]. IVDs in class B and class C devices are sampled for review of the documentation, according to Article 48 (7)–(9) [5]. IVDs in class D receive a product-by-product review, as per Article 48 (3)–(6) [5]. This enables notified bodies to focus their resources on those devices that pose the highest risk to individuals and public health, relying on the manufacturer to self-declare devices of lower risk.

Another example of a risk-based approach in the IVDR is the post-market surveillance (‘PMS’) obligations of the manufacturer. The PMS system is explicitly proportionate to the risk class of the device, as per Article 78(1) [5]. E.g. Class A and B IVDs require a post-market surveillance (PMS) report which has some flexibility in content and frequency of updating under Article 80 [5] compared to a stricter requirement for class C and D IVDs, which requires a Periodic Safety Update Report (‘PSUR’) with more detailed content under Article 81(1) [5]. For class D IVDs, there is an additional obligation to submit the PSUR to the notified body (‘NB’) and the competent authority under Article 81(2) [5].

An example of a not entirely risk-based approach in the IVDR is the classification of cancer testing. All tests used ‘in cancer’ are automatically slated into risk class C (the second highest) as per IVDR Annex VIII, 2.3, 3 (h) [5]. While this may appear appropriate from a disease perspective, in fact such an approach is not truly risk-based because it does not take into sufficient account the intended purpose of the individual test, its role on the test panel and, importantly, the expertise employed around it in the form of a pathologist and clinician, and additional clinical information. This is very different from a companion diagnostic test, which directly guides treatment decisions and where class C is an entirely appropriate classification.

However, by and large, the IVDR offers a more risk-based approach to classification than its predecessor IVDD [6], which assigned tests into lists (In Annex II) without a nuanced approach to their use.

A future innovative approach to risk-based regulation in the EU could include alternative, entity-based approaches with proportionate regulatory oversight. The entity-based approach could be based on a Declaration of Conformity model, and include a pre-market excellence appraisal of interested and viable applicants. The excellence appraisal results in a designation of that entity to place products on the EU market in conformity with EU law without prior third party review. Under a declaration of conformity (DoC) model, the manufacturer takes full responsibility for compliance of the IVD with established standards, but does not need to submit the device for premarket or emergency use evaluation before commercialization. The use of entity-based approaches in a DoC model does not exclude the need for a proactive on-market surveillance during the whole life cycle of the device. It should be a voluntary scheme, operating in parallel to the regular framework and ensuring a level playing field, as not all entities may have an appetite for it.

Similar approaches are already used or planned by regulators around the world, primarily in the area of software-enabled devices.

In Japan, the IDATEN [7] (Japanese for a guardian of the Buddha who is also a very fast runner) scheme of the Pharmaceutical and Medical Devices Agency (PMDA) allows the manufacturer to make on-market changes to AI-based programs and software whose performance is constantly changing and improving. The change plans will be confirmed already during the approval review process so that partial amendments to approvals can be made promptly within the scope of such plans during the devices’ post-market lifecycles.

The UK MHRA has confirmed [8] that it intends to make provision in upcoming legislation for predetermined change control plans (PCCPs) for Software as Medical Device (SaMD), including providing details on how to define what metrics to track and how to agree performance ‘bands’, such that change inside those bands does not have to be reported to the regulator.

In 2017, the US FDA started a pilot (‘Pre-Cert Pilot’) [9] to explore innovative approaches to regulatory oversight of SaMD developed by organizations that have demonstrated a robust culture of quality and organizational excellence, and that are committed to monitoring real-world performance of their products once they reach the market. Specifically, the US FDA would review the developer’s processes and key performance indicators (KPIs) in relation to five excellence principles [10]: clinical responsibility, patient safety, proactive culture, cybersecurity responsibility and product quality. The US FDA stated in its key findings report [9] in September 2022 that “While the pilot enabled FDA to explore innovative techniques and approaches to regulatory oversight with stakeholders, FDA encountered challenges with implementing the proposed approach under our current statutory authorities”. Moreover, the FDA stated [9] that “in particular, the pilot excellence appraisals enabled FDA to better understand the practices that pilot participants and others use in designing, developing, and managing digital health products” and that “based on these observations from the pilot, FDA has found that rapidly evolving technologies in the modern medical device landscape could benefit from a new regulatory paradigm, which would require a legislative change”.

As is evident from the above approaches, mature regulators are testing the waters with entity-based regulatory clearance models.

While software-enabled diagnostics have the innate need for speed in on-market updates, the concept of pre-market entity-based excellence appraisals has great potential beyond software-enabled diagnostics. The underlying regulatory principle – the risk-based approach – applies to cutting edge, software-enabled diagnostics but also to traditional diagnostics. It can be argued that entity-based approaches are particularly suitable for traditional diagnostics with a long established use.

Could entity-based designations work under the EU regime? As part of the ‘New Approach’ legislation, the EU medical device regime has been based on a DoC-based, standards-based approach since 1985 [11, 12], under which the manufacturer takes the final decision whether it deems the product compliant with the regulation and affixes the CE mark to the product. This principle applied under the IVDD (Article 9) [6] and continues to apply under the IVDR (Article 10 [5] and [17]) [5], to both self-declared and notified-body-reviewed products. The CE-marking scheme also allows choice for the legislator in what conformity assessment modules are appropriate for the sector in question. According to the European Commission Blue Guide [12] “Whenever appropriate for a specific sector, the legislator may acknowledge the fact that manufacturers operate very well equipped testing laboratories or premises. This may be the case for new innovative complex products for which the testing know-how remains inside the manufacturers”. It also states that “Wherever possible, a choice of inspection, certification, and/or quality assurance modules should be provided”. Consequently, entity-based regulatory approaches, preceded by excellence appraisals of an entity’s systems, expertise and culture, would fit conceptually well within the legislative technique of the EU CE-marking scheme. The helicopter view of such a regulatory regime is one of a floating centre of gravity in regulatory oversight from ‘the what’ (product) to ‘the who’ (e.g. manufacturer or other entity) – in a more individualized way than what is possible today under EU IVDR conformity assessment.

Such a program can be invaluable during a public health emergency, but also part of a robust risk-based regulatory paradigm in normal times. By regulating the market exit – not the market entry – for entities who were appraised for excellence, such approaches could have a tremendous impact on the speed to market for innovation. Finally, as in any risk-based approach, entity-based designations can be earned, lost and regained (with significant effort).

Regulatory frameworks for diagnostics need to be globally convergent

In dealings with each other, regulators should use reliance and recognition mechanisms. Recognition according to the World Health Organization is the acceptance of the regulatory decision of another regulator or trusted institution [13]. Reliance is the act whereby the regulatory authority in one jurisdiction takes into account and gives significant weight to assessments performed by another regulatory authority or trusted institution, or to any other authoritative information, in reaching its own decision [13].

E.g. Singapore HSA supports [14] confidence recognition and reliance models, leveraging the approvals of HSA’s reference regulatory agencies (TGA Australia, Health Canada, the US FDA, European Union Notified Bodies, and Japan’s MHLW), coupled with prior safe marketing history of the products.

The UK MHRA has stated [15] that it could accept approvals from other international medical device regulators. Devices with approvals accepted by the MHRA could be subject to a domestic assurance process in which UK Approved Bodies could perform an abridged assessment of the device with appropriate levels of scrutiny […].

The Swiss legislator is currently considering [16] introducing reliance on US FDA approvals into Swiss medical device legislation.

As also noted by the UK MHRA [15], reliance principles should apply beyond premarket evaluations, as well, to enable inspections, for example. The Medical Device Single Audit Program (‘MDSAP’) [17] is one example in which the five MDSAP member countries accept MDSAP inspections in lieu of their own inspections. Because MDSAP lacks a fully harmonized set of audit requirements and instead includes each MDSAP members’ requirements, it is more of a work-sharing model. Auditing against each member’s inspection requirements adds unnecessary complexity to the program. Basing MDSAP on international consensus standards, such as ISO 13485, would make the program more effective and efficient. Observer countries may choose to leverage the MDSAP certificate in lieu of performing their own inspection, which would be a form of recognition.

While the EU within itself is a full mutual recognition scheme among its 27 members and the three EEA EFTA states – Iceland, Liechtenstein and Norway – the IVDR offers no robust legal basis for notified bodies or competent authorities to rely on non-EU- and non EEA-EFTA regulators’ decisions and assessments. Nevertheless, the MDCG issued guidance [18] for notified bodies on the use of MDSAP audit reports in the context of surveillance audits carried out under the EU MDR and EU IVDR, stated that the use of MDSAP audit reports within the EU legislative framework is possible (only) where the MDSAP audit covers similar or equivalent MDR/IVDR requirements. The MRA between EU and Switzerland which enabled mutual recognition of diagnostic conformity assessments since 2002, became invalid [19] on 26 May 2022 when the EU IVDR entered into force.

A touch of global convergence can be identified in the IVDR Recital 5 [5], which states that “To the extent possible, guidance developed for in vitro diagnostic medical devices at international level, in particular in the context of the Global Harmonization Task Force and its follow-up initiative, the International Medical Devices Regulators Forum, should be taken into account to promote the global convergence of regulations which contributes to a high level of safety protection worldwide, and to facilitate trade, in particular in the provisions on Unique Device Identification, general safety and performance requirements, technical documentation, classification rules, conformity assessment procedures and clinical evidence”. It is also evident that the risk classification scheme in the EU IVDR is not identical but closely built on the GHTF principles of in vitro diagnostic medical devices classification [20].

Finally, although the EU itself does not formally rely on others, the EU CE marking scheme remains one of the leading regulatory regimes in the world, trusted and relied upon by countries worldwide.

Regulatory frameworks for diagnostics need to foster connections

This means connections between parties in the wider regulatory network, connections to data in the system, connections of actors through digital means and connections of minds in co-creating solutions.

Connecting the parties in the wider regulatory network means connecting e.g. notified bodies and competent authorities to other regulatory actors in the system such as the European Medicines Agency (EMA). Such connections are critical to make efficient use of expertise available in the system, when and where it is needed. Such connections could also help to synchronize, as far as possible within the respective regulatory regimes, the regulatory clearance of products that are dependent on each other to unleash value for healthcare systems and patients, such as elements of combined and integrated products [21]. One example of a disconnect is that the EU IVDR does not accommodate for – where relevant – a synchronized and timed regulatory clearance of a companion diagnostic and the marketing authorisation of the medicinal products [22]. The scenario is entirely possible that a medicine is authorised before the corresponding test is CE-marked, resulting in a possible lack of access or delay to patient access to the medicine. At the time of submission of this article, no companion diagnostic had yet been certified under the EU IVDR according to a recent Notified Body survey [23].

Another operational disconnect in the system exists between drug- and diagnostic clinical studies and their respective IT infrastructures Eudamed [24] (intended for diagnostic studies under IVDR) and CTIS [25] (intended for e.g. drug trials under the EU Clinical Trial Regulation [EU CTR] [26]). The lack of integration of the two databases Eudamed and CTIS is likely a consequence of the regulatory approaches for notification/authorisation procedures for studies in the IVDR and the CTR not being integrated. The situation occurs where a diagnostic used in a drug trial, is in itself subject to a clinical performance study under the IVDR, and thus compliance with two frameworks is necessary. The dire situation with studies is further discussed below under ‘Efficient’.

To foster innovation in the EU, and to harness the potential of integrated solutions and to keep pace with the rapid advancement of science and technology, EMA can play a leading role in orchestrating modern, streamlined regulatory approaches and procedures with all relevant authorities, bodies and stakeholders necessary in order to deliver innovations to patients more quickly [27].

Connections to data in the system means, from a regulatory perspective, that regulatory policies should allow and promote the use of alternative sources of evidence, including real world data [28]. The EU IVDR [5], in Article 56 (1) and (4) and Annex XIII (which provides detail on accepted data sources in part A, 1.2.3.), supports the use of a broad menu of evidence sources including Real World Data, to support declaration of conformity under the IVDR, as long as the developer can justify the chosen type of data. Guidance could be more explicit.

However, while the IVDR appears to do ‘its part’ in enabling RWD/RWE, one of the of the biggest obstacles developers face to track test performance is not related to the IVDR, but to the difficulty to access data that identifies which patient got what test, when, and to link those results to patients, treatments, and outcomes. The interoperability issues that exist are governed by other legal frameworks in the EU such as the upcoming European Health Data Space (EHDS) [29], and the data access is regulated by the EU data privacy law GDPR [30]. A further discussion of the interoperability elements go beyond the scope of this article. However, it cannot be emphasized enough that interoperability and data access is one of the most foundational ingredients to ‘get right’, beyond the core regulatory framework. Thoughtful recommendations on these matters can be found in the MedTech Europe’s EU Data Act position paper [31] and in a multi-stakeholder coalition statement [32] on the EHDS.

Finally, connection of actors through digital means, was another learning from the pandemic. It is the possibility to digitize regulatory registrations and inspections, including remote or virtual inspections. This practice can not only enable regulators to get the work done during a pandemic, but also to make wise use of resources. It also has potential to increase the number of inspections that regulators can do, over the same time-period. While helpful MDCG guidance [33] in this area was published, encouraging hybrid audits, the IVDR itself is silent on this topic. This is an area where a clear future mandate, allowing the use of digital tools for such regulatory activities, should be explored.

Connections of minds in the form of strategic public-private partnerships should be encouraged, in which manufacturers work closely with regulators and other organizations to develop, validate and commercialize diagnostics – during public health emergencies and beyond. COVID-19 demonstrated the power such an ecosystem can have in bringing high-quality diagnostics to patients when faced with a crisis. South Korea demonstrated [34] how increased collaboration and transparency between clinical laboratories, government agencies and IVD developers expedited solutions in a public health emergency. The same public-private partnerships that demonstrated such a favourable impact on the management of COVID-19 in South Korea can be used to co-create future regulatory frameworks that can adapt to advances in technology without compromising patient safety.

Regulatory frameworks should be co-created by an ecosystem of regulators, industry, healthcare professionals (HCPs), patient groups, and legislators and other stakeholders who share a common interest of improving patient and public health. The EU already has extensive processes and platforms in place to involve stakeholders in public consultations on roadmaps, impact assessments and draft legislation. It also has a strategic ‘Better Regulation’ agenda; including its Regulatory Fitness and Performance (REFIT) [35] programme, established in 2012, followed by a ‘Fit for Future’ Platform [36], set up in 2020 and replacing the original REFIT platform. A cornerstone [37] of the better regulation approach is to learn from the past by evaluating existing legislation. Monitoring is crucial in the policy cycle and requires systematic collection of data. Monitoring and review clauses in legislation ensure that the necessary data is collected and evaluated. The review clause in the IVDR [5] Article 111 states that the European Commission shall assess the application of IVDR and produce an evaluation report on the progress towards achievement of the IVDR objectives by 27 May 2027.

Regulatory frameworks need to be nimble

Regulatory frameworks need to be nimble, to manage regulatory clearance during ‘normal’ times as well as times of crisis, such as pandemics. Covid-19 had a transformative impact on regulatory practices worldwide. During COVID, many regulators, including most of the ones engaged in IMDRF, adopted some type of Emergency Use Authorisation (EUA) pathway [38]. Regardless of the scope, the EUAs dramatically reduced time to market compared to non-emergency timeframes [38].

The EU went through Covid-19 under the IVDD regime. Under the IVDD, no pan-European EUA pathway existed. The impact of the lack of such a pathway is difficult to assess. The healthcare community may not have felt the impact of a missing EUA pathway, because SARS-COV2 could be self-declared under the IVDD (apart from self-tests). Under the IVDR this has changed.

Under the EU IVDR, SARS-COV-2 diagnostic tests will in most cases be classified as class D IVDs, falling in the highest risk class and requiring Notified Body review of each product, and as well involvement of other parties such as reference laboratories. It is one of the most complex paths to market for a diagnostic in the EU. The IVDR contains no formal EUA path. An alternative to an EUA path exists in IVDR [5] (Article 54), although it only became applicable on 26 May 2022. This path does not result in a CE-marked product; it is a mechanism for allowing non-conform diagnostics to be placed on the EU market under certain conditions. As evidenced by the lack of a published implementing act (a legal instrument required to use the exemptions under Article 54) in Eurlex on this matter, it can be concluded that the mechanism has not yet been formally used. Therefore it is not possible to say whether the IVDR derogation mechanism is helpful to get diagnostics quickly to the market during a health crisis. It is noteworthy that the same path under Article 59 under Regulation (EU) 2017/745 on medical devices (‘EU MDR’) [39] was already applicable during a part of the pandemic – but not used by the authorities. (It is the national competent authorities in the EU who need to trigger this mechanism; a manufacturer cannot formally request that the path is used.) The European Commission issued a guidance in 2020 on the use of Article 59, arguing an approach for speeding up the adoption of EU-wide derogations, if needed [40].

Ideal regulatory frameworks for diagnostics need to be efficient

Ideal regulatory frameworks for diagnostics need to be efficient. The EU IVDR aims to “ensure the smooth functioning of the internal market as regards in vitro diagnostic medical devices, taking as a base a high level of protection of health for patients and users, and taking into account the small and medium-sized enterprises that are active in this sector” [5].

It is reasonable to expect that the EU will deliver an efficient system to match this ambition. Unfortunately, it has not yet materialized.

Close to half of the 5 year transition time for the IVDR took place during the Covid-19 pandemic. The Covid-19 outbreak presented all stakeholders with challenges to implement the IVDR and severe delays to its infrastructure. It finally led to a postponement [41] in 2022 of some of the requirements in the IVDR, essentially allowing diagnostics certified under the IVDD to stay on the EU market under certain conditions, one being that no significant changes could be made to those devices. This solution is a temporary fix that will provide some relief but risks postponing problems – unless missing infrastructure is in place and declared fully functional. The IVDR amendment, as such, does not contain any commitment on timelines for delivery of the ever lagging infrastructure, including the database Eudamed.

MedTech Europe (MTE) expressed [42] on 26 May 2022 that “the incomplete IVDR infrastructure poses critical ongoing risks that need urgent solution,” including but not limited to, “[building] other system infrastructure needed to implement the IVDR including requirements for performance studies, post-market, vigilance, and EUDAMED database, etc.”

According to the current rollout timeline for EUDAMED, the clinical investigation and performance studies module will not be fully active and its use not mandatory until Q4 2024 [43]. Delays to this critical module not only impact the ability to do clinical research on IVDs, but also clinical research on new medicines. The role IVDs play in clinical research cannot be emphasized enough. Demonstrating the urgency of the infrastructure challenges, the European Federation of Pharmaceutical Industries and Associations (EFPIA) has [44] “call[ed] on the Commission to address these challenges to avoid any unintended consequences that may ultimately lead to a reduction of clinical trial sites in Europe, as well as delayed access to novel therapies for European patients who have exhausted all other treatment options.”.

At the time of submission of this article, it was still uncertain what additional measures might be taken at EU and national levels to ensure a proper functioning of the EU clinical research infrastructure.