featured-image-4

IVDR Compliance Under Pressure: A Regulatory Affairs Scenario for Medical Device Manufacturers

Scenario Introduction

A regulatory affairs manager at a mid-sized in vitro diagnostics manufacturer is three weeks out from submitting a dossier to a notified body for CE marking under EU Regulation 2017/746 (IVDR). During a final internal review, the team discovers that the device’s classification has not been formally reassessed against the IVDR’s new risk-based framework. Under the old In Vitro Diagnostic Directive (IVDD 98/79/EC), the device was self-certified as a low-risk product. Under IVDR, the same device may fall into a higher risk class, which would require third-party notified body involvement in the conformity assessment, not just a self-declaration.

The submission date is fixed. A commercial partner in Germany has already communicated a Q4 product launch timeline to distributors. The regulatory affairs manager is the person in the room who just found this.

Situation Details

Location: Internal regulatory affairs meeting, manufacturer’s European headquarters.

Device: A laboratory analyzer used to detect a specific protein biomarker associated with cardiac risk. Currently CE-marked under IVDD as a general laboratory instrument (self-certified, Annex I). No previous notified body involvement.

Key facts in play: – IVDR went into full effect on May 26, 2022 for new devices; transitional provisions have since been extended by Regulation (EU) 2024/1860, but these apply only to legacy devices already certified under IVDD, not to new submissions. – Under IVDR’s new risk classification framework, between 70% and 80% of IVDs are reclassified into higher risk classes than they occupied under the old IVDD, according to Criterion Edge’s analysis of the regulation. – A cardiac biomarker detection device used in a clinical decision-making context would likely fall into Class C or Class D under IVDR, both of which require notified body involvement in the conformity assessment. – Manufacturers must have within their organisation at least one person responsible for regulatory compliance who possesses the requisite expertise in the field of in vitro diagnostic medical devices, per Article 15 of IVDR. – Technical documentation under IVDR must follow the structure outlined in Annex II and Annex III of Regulation (EU) 2017/746 and be kept up to date and available for review by the Notified Body and Competent Authorities.

People in the room: regulatory affairs manager, quality director, head of commercial, legal counsel.

Available resources: existing IVDD technical file, internal QMS, a notified body relationship that hasn’t been formally engaged for this device, the IVDR text (published in EUR-Lex).

Decision Point

The regulatory affairs manager has just flagged the classification gap. The head of commercial wants to know: can we proceed with the submission in three weeks?

What should happen next?

Option A: Proceed with the current submission as planned, relying on the IVDD self-certification framework since the device has existing CE marking under IVDD, and address the IVDR classification question after the launch.

Option B: Halt the submission, conduct a formal IVDR classification review, engage the notified body, and reset the commercial timeline based on what that review reveals.

Option C: Submit the dossier to the notified body on the current timeline but flag the classification question in a covering note, asking the notified body to assess it as part of their review.

Option D: Escalate to senior leadership and legal counsel immediately, treat this as a material compliance risk, and make the timeline decision after a structured risk assessment rather than in the meeting.

Analysis

Option A is not viable. The transitional provisions introduced by Regulation (EU) 2024/1860 extend deadlines for legacy devices that already hold valid IVDD certificates, but they do not apply to new submissions going through conformity assessment for the first time under IVDR. Submitting a dossier built on an IVDD self-certification framework for a device that, under proper IVDR classification, requires notified body involvement would be a material regulatory non-conformance, not a procedural technicality. Placing a misclassified device on the EU market under an invalid CE mark creates post-market liability, potential market withdrawal, and the risk of regulatory action from national competent authorities.

Option B is the correct core response, but the binary framing of “halt everything” misses something. The right action is to halt the current submission in its current form, yes. But the timeline impact of that decision depends on what the classification review actually reveals, and that review can begin immediately and move quickly if resourced properly.

Option C sounds pragmatic but creates a worse problem. Submitting a dossier to a notified body with a known unresolved classification question in a covering note doesn’t transfer the compliance risk to the notified body. It signals to the notified body that the manufacturer hasn’t completed the foundational work required before submission, which is likely to result in the submission being returned, creating a longer delay than a properly sequenced pause would have.

Option D is the right framing for escalation, but it’s not a substitute for action. Senior leadership and legal counsel need to be informed immediately, both because this is a material commercial and compliance risk, and because the timeline decision being made under commercial pressure in a regulatory affairs meeting is exactly the kind of decision that needs visibility above that level.

The correct sequence: Escalate to leadership and legal counsel same day. Initiate the IVDR classification review immediately in parallel. Do not submit the current dossier. Reset the commercial timeline based on what the classification review reveals, rather than assuming the worst-case delay.

The classification review itself may not take as long as feared. If the device falls into Class C (which requires notified body involvement in the technical documentation review), the path forward is defined. If it falls into Class D (the highest risk class, for devices used in screening for life-threatening conditions), the conformity assessment is more extensive and the notified body relationship needs to be formally engaged under a new scope. Either outcome is manageable if addressed now. Neither outcome is manageable if discovered after market placement.

Learning Points

IVDR classification is not self-assessable for most devices. Between 70% and 80% of IVDs are reclassified at a higher risk level under IVDR compared to IVDD, according to regulatory analysis of the framework. Teams that assume their IVDD classification carries forward to IVDR without formal review are a common source of post-market compliance gaps.

Commercial timelines don’t override regulatory sequence. The pressure to protect a Q4 launch date is real and legitimate. But a CE mark placed on a device that hasn’t completed the correct conformity assessment under IVDR is not a valid CE mark, and the consequences of market withdrawal significantly outweigh the consequences of a delayed launch.

The person who raises the gap is doing their job. In the scenario above, the regulatory affairs manager found a serious problem three weeks before a submission. That’s a success of the internal review process, not a failure of project management. Organisations that penalise or marginalise the person who surfaces a compliance issue late in a timeline create cultures where compliance issues don’t get surfaced until they’re much harder to fix.

Article 15 of IVDR requires named regulatory competence inside the organisation. The requirement for at least one person responsible for regulatory compliance with demonstrated expertise in IVDs is not just a documentation requirement. It exists precisely so that situations like this one are caught before they become enforcement issues.

Post-market obligations under IVDR extend well beyond CE marking. The IVDR requires manufacturers to implement a proactive, risk-based post-market surveillance (PMS) system for every device, designed to monitor real-world performance, detect risks early, and implement corrective actions where needed. Getting to market is not the end of the compliance cycle.

Related Resources

Sources

Add a Comment

Your email address will not be published. Required fields are marked *