Electronic instructions for use of medical devices: here’s what you need to know

Back

The year 2022 opens with the new (long-awaited) EU Regulation 2021/2226 on electronic instructions for use (IFU) for medical devices. The Regulation, which entered into force on 4 January 2022, replaces the previous EU Reg. no. 207/2012 and aims to adapt the rules for electronic IFUs to the new EU Regulation 2017/745 (MDR), to technological developments of recent years and to the principles of the Green Economy. In particular, EU Regulation 2021/2226 has an impact on the field of medical software: for the first time it is regulating the rules for electronic instructions for use for “Software as medical devices” (SaMD), such as apps.

What the Regulation states

EU Regulation 2021/2226 lays down the precise conditions to be met by the manufacturer in order to provide the user with IFUs in electronic form, as well as certain requirements concerning the content and presentation of IFUs on manufacturers’ websites. According to Article 2 of the Regulation, IFUs in electronic form (eIFU) means “instructions for use which can be displayed in electronic form on the device, are supplied by the manufacturer, on a portable electronic medium together with the device or are made available by means of software or a website”. Obviously, eIFUs must also contain all the information required as mandatory for the preparation of IFUs for any medical device by Annex I, Chapter III, point 23.4. of the MDR.

To which medical devices does IFU apply?

Article 3 provides a closed list of the types of medical devices and associated accessories to which the Regulation may apply. These are:

Implantable medical devices (MDs), as defined in Article 2(5) MDR;
Active implantable MDs, as defined in Article 2(4) and (5), MDR;
Fixed installed MDs, defined in Article 2 of the Regulation as “devices and their accessories designed to be installed, fixed or otherwise secured at a specific location within a healthcare facility, in such a way that they cannot be moved from that location or removed without the use of tools or equipment, and which are not specifically intended for use in a mobile healthcare facility”;
MDs equipped with an integrated system for displaying IFU
software governed by the MDR.

Prohibition of application

The Rules do not apply to:

any other MDs other than those mentioned in the above list
products not intended for medical use listed in annex XVI of the MDR (in summary: contact lenses, products intended for introduction into the human body by body modification surgery, products for skin or facial filling, high-intensity electromagnetic equipment used on the human body and equipment intended for brain stimulation passing through the skull).

If the intended recipients are professional users or also patients

Implantable MDs, active implantable MDs, fixed installed MDs, and MDs in general (if equipped with an integrated system for displaying the instructions for use - Article 3(1), IFUR) may be accompanied by instructions in electronic format under the following conditions:

MDs must be intended for “professional users”;
it must not be “reasonably foreseeable” that the MD will be used outside the professional channel.

In contrast, all medical software can be marketed with eIFU only, regardless of whether it is intended for professionals or directly for patients. Therefore, all apps qualified as medical devices can be placed on the market with the instructions in electronic format only. However, the conditions legitimising this choice – which is already widespread in practice, although incorrect – are quite stringent.

Under what conditions can eIFUs be provided?

There is no doubt that the choice of eIFUs makes life easier for the manufacturer and saves paper and money. On the other hand, EU Regulation 2021/2226 stipulates that the manufacturer must comply with the following obligations:

carry out a “risk assessment” to demonstrate that the eIFUs maintain the level of safety provided by paper-based IFUs; the assessment must also updated in the light of experience gained in the post-marketing phase of the MD (Article 4(1));
provide eIFUs in all countries where the product is made available (Article 4(2));
have a system in place to provide the user with paper IFUs as well (Article 5(3) states that the period during which the user may request them free of charge must be determined by the manufacturer in the “risk assessment” referred to in the previous point);
provide information on foreseeable medical emergencies directly on the MD or on an accompanying leaflet (Article 5(4), first part);
also provide information on the commissioning of the device directly on an MD equipped with an integrated system, or on an accompanying leaflet (Article 5(4), second part);
ensure the proper design and functionality of the eIFU and be able, where appropriate, to provide evidence of checks and validations (Article 5(5));
ensure that the display of eIFU does not hinder the safe use of an MD with an integrated system for displaying IFU, especially with regard to life support functions or monitoring of vital signs (Article 5(6));
include information on the hardware and software used to display the eIFU in the web catalogue or other appropriate information medium (Article 5(7));
have a system in place to inform the MD user of any revisions made to the eIFU for safety reasons (Article 5(8));
keep the eIFUs for ten years from the date the product was last placed on the market (i.e. last sale) and for at least two years from the date of expiry of the last manufactured product, increasing to fifteen years for products without an expiry date and for implantable MDs (Article 5(9-10));
make the eIFU available to the user on the manufacturer’s website in the language of each country where the MD is made available (Article 4(11));
have a system in place to inform the user who has downloaded the eIFU from the website of any updates (Article 4(12));
make all previous versions of the eIFU available on the website together with their date of publication (Article 4(13)).

Information, access and form of eIFUs

Manufacturers must also indicate that the IFUs are supplied in electronic form rather than on paper, clearly indicating this choice:

on the label of the MD;
on the packaging of each product unit;
where appropriate, on commercial packaging;
on the product itself in the case of fixed installed MDs;
on the access point in the case of software.

The instructions for access and downloading must also be indicated: where it is not possible to provide this information at one of the above points, it may be indicated in a separate paper document provided with the MD.

Other indications

The manufacturer must also indicate:

any information needed to consult the eIFU and to identify the MD (including the name and, if applicable, the model);
the basic UDI-DI and/or the UDI-DI of the MD;
the manufacturer’s contact details, such as name, address, email address or other means of online communication and website;
the period within which the user can request the IFU in paper format free of charge;
where and how to request the IFU in paper format.

Finally, the Regulations stipulate that eIFUs must be accessible in their entirety; they may include symbols or graphics; they contain the same information as the IFU in paper format; they may contain video and audio in addition to the text.

Obligation to make IFU accessible on the website

The part regarding websites – which is always overlooked – is very interesting. The MDR already establishes for all MDs that, if the manufacturer has a website (almost all of them at this stage), the manufacturer is obliged to publish its IFU (created in paper format) also on the website (Annex I, point 23.1). EU Reg. 2021/2226 then details a number of more specific obligations in the case of eIFU. More precisely, it is established that, for MDs with an integrated system and in cases where eIFUs are supplied together with the MD on a “portable electronic medium”, not only does the manufacturer have an obligation to publish, but above all, the site must comply with the following profiles (Article 7):

it must be possible to consult the eIFU with software that is freely available and, of course, free of charge;
the site must be protected against unauthorised access or tampering that could compromise data security;
server downtime and display errors must be kept to a minimum;
the site must comply with the legislation on the processing of personal data laid down in EU Regulation 2016/769;
the Internet address of the website must be permanent and accessible;
any previous versions of the eIFU with their date of publication must be uploaded on the website.

Is a Notified Body necessary to implement eIFUs?

Article 8 of the IFUR states: “Where appropriate, compliance with the obligations set out in Articles 4 to 7 of this Regulation shall be examined by a notified body (NB) during the applicable conformity assessment procedure referred to in Article 52 of Regulation (EU) 2017/745”. Therefore, if the certification process involves an NB, compliance with the eIFU regulations will be verified by the NB itself during the assessment process under Article 52 MDR.

The IFUR does not apply to legacy MDs

EU Regulation 2021/2226 applies only to MDs under the MDR. For legacy MDs (Article 120 MDR), recital 9 states that the previous EU Reg. 207/2012 continues to apply, which does not include application to software. From a strictly legal point of view, this means that legacy SaMDs cannot have instructions for use in electronic format (i.e. apps should have paper instructions).