Vigilance Reporting for

Medical Devices in the EU

By Salma Michor, PhD, RAC

24 September 2009
Manufacturers putting medical devices on the subparagraph above leading to systematic
market in the European Union (EU) must have recall of devices of the same type by the
a vigilance system in place for collecting and manufacturer6
evaluating reported incidents and taking correc- Information from package inserts for approved morphological evaluations.9 If the
tive action if necessary to prevent the recurrence drugs1are
Table another
shows thesource of information.
sections of the directives that ularly a novel ocular drug—has no
of such incidents. The main purpose of a medical refer to A better approach,
vigilance however, is to develop
reporting. ously studied, ocular route studies
device vigilance system is to improve protection Incident
a robust drugreporting
development applies
plan to Class
based on I,pub-
IIa, IIb (typically nonrodents) are preferred
of patients’ and other users’ health and safety orlicly
III available
medical information
devices, activeand implantable
consultation with devices authorities. One species may be su
by reducing the likelihood that a device incident and in vitro diagnostics.
experts in this area of specialty. The next step is to proper justification, especially in c
will recur.1 At a higher level, the vigilance system meetInwith
addition, any incidents
the regulatory reported
authorities early tobygar-
medi- biologic homology in other species
is an integral part of a postmarket surveillance cal practitioners or medical institutions to the
ner buy-in for the initial drug development plan. is best to gain FDA buy-in at the p
(PMS) system. Competent Authorities should be reported to
The medical device directives establish Formanufacturer
the ophthalmic products, particular importance
or the authorized representa- Ocular pharmacokinetic studi
two principal mechanisms for providing is placed
tive on Based
as well. efficientupon
preclinical development
an assessment by the one species, are needed to examine
feedback and information about marketed and the pre-IND
Competent and subsequent
Authority together with meetings with
the manufac- distribution, metabolism and excre
medical devices.2 The first is PMS, which is the FDA.orDrugs
turer for ophthalmic
the authorized use in the US
representative, are
Member in the various ocular compartment
systematic review and analysis of postproduction States are obliged
regulated by FDA’stoDivision
inform of both the European
Anti-Infective and of study generally needed is ocular
information including clinical follow-ups, quality Commission and otherThe
Ophthalmic Products. Member
advisoryStates about the
committee that of the drug, including irritancy. Th
complaints, customer feedback, vigilance and incidents and any
provides expert corrective
opinions actions
for New Drugtaken.
Application are customarily conducted in rabb
new scientific information and literature. This approval of these products is the Dermatologic and toxicokinetic studies are needed on
information should be used to facilitate process Postmarket Surveillance
Ophthalmic Drugs Advisory Committee. tissues are evaluated. Ocular toxico
and product improvements to meet customers’
expectations. The second mechanism is related Nonclinical
The medical devicedevelopment
directives for novel ocular
collectively require are generally not needed. Systemic
to the vigilance system and includes the drugs is device
medical not wellmanufacturers
defined. Nonclinical safety assess-
to implement ies via another route of administra
requirement to notify the appropriate Competent systematic
ment of theprocedures to review
drug is crucial device
to protect experi-
subjects intravenous or oral are required in
Authorities about any incidents occurring in ence in the postproduction
participating in clinical trials, hence Itanisoverall
phase. 7
important
risk vitro genotoxicity tests are also req
their territory/country. This function must be toassessment
distinguish forbetween
humans is vigilance
required.reporting
9 and
It is crucial chromosomal mutations and clasto
performed by a person with the education and PMS. Annex II.3.1 of both the Medical Device
that a thorough assessment be conducted to ensure While a pre-IND meeting an
training needed to distinguish reportable from Directive (MDD 93/42/EEC8) and the Active
that the proper species are selected for testing and towards the end of Phase 2 develo
nonreportable incidents. Implantable Medical Device Directive (AIMDD
that the study
90/385/EEC 9 design is robust, including adequate
) and Annex III.5 of the In Vitro standard in drug development, m
communication with the agency i
Legal Basis to ensure that the development pr
The provisions for setting up vigilance and PMS in line with FDA guidelines. It is
systems are outlined in the following directives: idea to have the Division of Anti-
• Directive 93/42/EEC of 14 June 1993 Ophthalmic Products review the p
concerning medical devices3 (Article 10), pivotal studies prior to obtaining
as amended
and starting clinical trials. This w
• Directive 90/385/EEC of 20 June 1990
all FDA requirements are addresse
relating to active implantable medical
devices4 (Article 8), as amended ple, in glaucoma treatment, certai
• Directive 98/79/EC of 27 October 1998 on in must show significant treatment e
vitro diagnostic medical devices5 (Article 11) cific time points. If these are not
• Directive 2007/47 of 5 September 2007 into the research design, the drug
amending Directives 93/42/EEC and timelines may be significantly imp
90/385/EEC and Directive 98/8/EC company may have to repeat the
concerning the placing of biocidal products lyze existing data.
on the market

Although the exact wording used in these

Overall Clinical Drug
directives is slightly different, they all address Development Issues
information on incidents occurring following the Development plans for topic
placement of devices on the market. “Incident” is drugs tend to be simpler and less
defined as: for many systemic drugs. It is easi
• any malfunction or deterioration in the the safety and efficacy of topical p
characteristics and/or performance of a because they are associated with f
device, as well as any inadequacy in the events (AEs) and serious adverse e
labeling or the instructions for use that
While topical products could hav
might lead to or might have led to the death
plications, the majority of these c
of a patient or user or to a serious deteriora-
tion in his state of health due to a lack of efficacy rather tha
• any technical or medical reason in relation cerns. When failure is not due to
to the characteristics or performance of a it is usually related to a lack of an
device for the reasons referred to in the tolerance rather than significant A

Regulatory Focus 25
50 June 2009
Table 1. Provisions for Vigilance Reporting for Medical Devices2
Mechanism AIMDD 90/385/EEC4
Medical Devices Vigilance Article 8
System Annex II.3.1
Annex IV.3
Annex V.3.1
AIMDD = Active Implantable Medical Devices Directive
MDD = Medical Devices Directive
IVDD = In Vitro Device Directive
Diagnostic Device Directive (IVDD 98/79/EC10)
clearly state that when a manufacturer submits
an application for assessment of its quality sys-
tem with a Notified Body, the application must
include a description of the PMS system. The
purpose of the PMS system is to implement and
maintain a systematic procedure to review expe-
rience gained from devices in the postproduction
phase and apply any necessary corrective
action.11
Typical sources of information on device
experience include:
• customer surveys
• user surveys
• adverse incidents (vigilance system)
• user reports
• user feedback
• customer complaints
• customer requirements, contract informa-
tion and market needs
• patient follow-up after clinical trials or
investigations
• service and evaluation reports
• scientific papers in peer-reviewed journals
• reports on similar products by competitors
• compliance-related communications from
regulatory agencies
• changes to relevant standards and
regulations12
The PMS system is also part of the standard
EN ISO 13485,13 which indicates manufacturers
should establish documented procedures for a
feedback system to provide early warning of
quality problems and input to the corrective and
preventive action processes. These processes are,
in turn, aimed at detecting and minimizing risk
(ISO 14971:200714).
ISO 14971:2007 specifies a process for a
manufacturer to identify the hazards associated
with medical devices, including in vitro diag-
nostic (IVD) medical devices, to estimate and
evaluate the hazards’ associated risks, to control
these risks and to monitor the effectiveness of
the controls. The requirements of ISO 14971:2007
are applicable to all stages of a medical device’s
lifecycle.
Typically, manufacturers perform reason-
ably well-documented initial risk assessments.
Compliance issues mostly occur due to inad-
equate follow-up measures; old files are rarely
MDD 93/42/EEC3 IVDD 98/79/EC5
Article 10 Article 11
Annex II.3.1 Annex III.5
Annex IV.3 Annex IV.3.1
Annex V.3.1 Annex VI.3
Annex VI.3.1 Annex VII.3.1
Annex VII.4
revisited and updated to account for new infor-
mation and risk perspectives after product release.
Vigilance Reporting
Vigilance/incident reporting, part of the larger
PMS system for medical device manufacturers,
is the responsibility of manufacturers, national
Competent Authorities and the users.
Manufacturers or their authorized repre-
sentatives must notify the relevant Competent
Authority about incidents and file safety cor-
rective actions when the reporting criteria are
met.15 In addition, manufacturers are responsible
for investigating incidents and taking corrective
action if necessary.
National Competent Authorities must
appoint vigilance contact points and monitor the
incident investigations carried out by manufac-
turers. Competent Authorities must disseminate
any information necessary to prevent further inci-
dents and make all parties, including end users,
aware that their cooperation is vital in providing
the first link in the vigilance chain.16
Users should report incidents to the
manufacturer or national Competent Authority,
depending upon national practice.
The person responsible for vigilance report-
ing (manufacturer or authorized representative)
must submit an initial incident report to the
Competent Authority followed by a final report.
The initial report of an incident should contain as
much relevant detail as is immediately available,
but should not be delayed for the sake of gath-
ering additional information. The timelines for
reporting incidents are given below; final reports
should be submitted as soon as data related to the
incident become available but, at the latest, within
30 days of the initial report submission. Not all
incidents lead to corrective action; however, in
case of doubt about the reportability of an inci-
dent, there should be a predisposition to report.17
Requirements for an Incident to be Reportable
An event has occurred.
The list below provides some examples of
typical incidents.
• malfunction or deterioration in device char-
acteristics or performance
Regulatory Focus 27
 • false positive or false negative test
result falling outside the declared test
performance
• unanticipated adverse reaction or side effect
• device degradation/destruction
• inaccuracy in labeling, instructions for use
and/or promotional materials

The manufacturer’s device is suspected of being a

contributory cause of the incident.
For an incident to be reportable, there
must be a clear link between the device and the
incident. This may be especially difficult to deter-
mine when there are multiple devices and drugs
involved in complex situations. In making a deci-
sion, manufacturers should take into account:
• the opinion, based upon available evidence,
of healthcare professionals
• the results of the manufacturer’s own pre-
liminary assessment of the incident
• evidence of previous, similar incidents
• other evidence held by the manufacturer

The event led, or might have led, to one of the

following outcomes:
• death of a patient, user or other person
• serious deterioration in state of health of a
patient, user or other person

A serious deterioration in state of health can

include:
• life-threatening illness
• permanent impairment of a body function
or permanent damage to a body structure
• a condition necessitating medical or surgical
intervention to prevent either of the above
• any indirect harm as a consequence of
incorrect diagnostic or IVD test results
when used within instructions for use
• fetal distress, fetal death or any congenital
abnormality or birth defect18

Conditions Where Reporting Under the Medical

Device Vigilance System is Typically Not Required
Reporting of incidents is not required under
certain circumstances:
• deficiencies in devices found by the user
prior to use
• event caused by patient conditions
• medical device service life or shelf life has
been exceeded
• event that did not lead to death or serious
deterioration in state of health because pro-
tection against a fault functioned correctly
• incident that did not lead to death or seri-
ous deterioration in state of health and
when, within a full risk assessment, the risk
of death or serious deterioration has been
quantified and found to be negligible
• expected and foreseeable side effects19

When Must an Incident be Reported?

Incidents should be reported according to the
following timelines:

28 September 2009
BIO1003_RAPSAD_081309.indd 1 8/13/2009 1:35:09 PM
 • serious public health threat: immediately
(without any delay that could not be justi-
fied) but not later than two calendar days
following the date of awareness of the event
• death or unanticipated serious deterioration
in state of health: immediately (without any
delay that could not be justified) but not
later than 10 elapsed calendar days follow-
ing the date of awareness of the event
• others: immediately (without any delay that
could not be justified) but not later than 30
elapsed calendar days following the date of
awareness of the event
To Whom Should Manufacturers Report?
Companies should report to the national
Competent Authority in the country where the
incident occurred. This means that a manufacturer
based, for example, in the UK and selling a prod-
uct on the German market must report an incident
that happened in Germany to the German
Competent Authorities, even though the company
and its Notified Body are located in the UK.
Due to the nature of the CE marking process,
manufacturers of medical devices are not obliged
to have a local entity in the EU country where
the device is marketed. A single person respon-
sible for vigilance reporting for the whole EU is
acceptable. However, in practical terms, incidents
should be reported in the country of occurrence
and any dialogue with the national Competent
Authorities may take place in the local language,
making it important to have a local vigilance rep-
resentative. Manufacturers must make sure their
local distributors are aware of their reporting
responsibilities and have a solid system to cap-
ture and report incidents locally.
Postmarket Monitoring and
Compliance
The relevant national Competent Authorities are
responsible for follow-up and monitoring of any
investigation being carried out by the manufac-
turer, including these aspects:
• course (direction the investigation is taking)
• conduct (how the investigation is being car-
ried out)
• progress (how quickly the investigation is
being carried out)
• outcome (whether the results of device
analysis are satisfactory)
If more than one country is involved, Competent
Authorities should choose a single Competent
Authority to coordinate these activities. The
coordinating Competent Authority is normally
the one that is responsible for the manufacturer
or the authorised representative.
Notified Bodies do not play a key operation-
al role in the medical device vigilance system,
but are responsible for:
• assessing the vigilance procedures
• auditing implementation of the vigilance pro-
cedures, and the link with other systems, e.g.,
Corrective and Preventive Action (CAPA),
Field Safety Corrective Action (FSCA)
• assessing the impact of vigilance issues on
the certification granted
• acting as a liaison with the national
Competent Authority, if required
Assessment and Monitoring
Systems
Even though the Medical Devices Directives have
been mandatory since the 1990s and stipulate that
manufacturers have the legal obligation to report
adverse events (incidents) according to European
Competent Authorities, incident reporting is still
at a level where underreporting is assumed to
be widespread. This is partly due to the fact that
some manufacturers are reluctant to report since
they feel this may put them at a disadvantage or
indicate negligence on their part.
However, another contributing factor
may be that the Competent Authorities are not
directly involved in monitoring manufacturers’
vigilance systems, rather this is performed by the
Notified Body. Incidents, however, are reported
to the Competent Authorities. It is essential to
consolidate assessment and monitoring systems
to ensure that vigilance systems not only look
good on paper but actually function.
In many cases, companies make do with
a single person in the EU for vigilance report-
ing. This should be thoroughly assessed during
inspections since reporting incidents to the
Competent Authority in the country where the
incident occurred is usually where companies
fail to meet their full reporting obligations, espe-
cially small companies with limited resources.
Companies in a position to CE mark products
and put them on the market should also be in a
position to meet their vigilance obligations.
Conclusion
Vigilance reporting is a legal obligation of medical
device manufacturers. In the EU, incidents must
Regulatory Focus 29
 be reported to the national Competent Authority
in the country where the incident occurred. This
may pose difficulties where reporting in the local
language is foreseen or where in-person dialogue
with the local authority is necessary.
Notified Bodies play a key role in assessing
the quality and effectiveness of a manufacturer’s
vigilance system. Many vigilance systems are
not foolproof and leave room for improvement.
Notified Bodies together with the Competent
Authorities should improve their assessment and
monitoring systems to capture critical system
shortcomings and defects. Only with stricter
monitoring and penalties will manufacturers be
motivated to invest in and improve their vigi-
lance and PMS systems.
References
1. MEDDEV 2.12/1: Guidelines on a Medical Devices
Vigilance System (rev 5) (April 2007)
2. Fundamentals of EU Regulatory Affairs, 4th edition,
2008, Regulatory Affairs Professionals Society, pp
1-15.
3. Council Directive 93/42/EEC of 14 June 1993 con-
cerning medical devices
4. Council Directive 90/385/EEC of 20 June 1990 on
the approximation of the laws of the Member States
relating to active implantable medical devices
5. Directive 98/79/EC of the European Parliament
and of the Council of 27 October 1998 on in vitro
diagnostic medical devices
30 September 2009
6. Ibid 3.
7. Ibid 2.
8. Ibid 4.
9. Ibid 3.
10. Ibid 5.
11. Ibid 4.
12. Ibid 2.
13. International Organization for Standardization.
EN ISO 13485:2003 Medical devices–Quality
management systems – Requirements for
regulatory purposes.
14. International Organization for Standardization. ISO
SO 14971:2007 Medical devices—Application of
risk management to medical devices
15. Ibid 1.
16. Ibid 1.
17. Ibid 1.
18. Ibid 1.
19. Ibid 1.
Author
Salma Michor, PhD, RAC, is CEO and principal consultant
at Michor Consulting e.U., her recently established regula-
tory consulting business specializing in regulatory affairs and
compliance, Quality Assurance, risk management and interim
management. Previously, she worked in the medical device
and pharmaceutical industries for companies including Croma
Pharma, Wyeth and Chiesi. She is an independent expert for
the European Commission and teaches regulatory affairs and
clinical strategies at the postgraduate level. Michor is a mem-
ber of the Board of Editors for Regulatory Focus and can be
reached at michor_salma@hotmail.com.