The new article elaborates further on the requirements to be fulfilled by the entities involved in the activity considered remanufacturing based on considerations described in the previous article.
Table of content
The Food and Drug Administration (FDA or the Agency), the US regulating authority in the sphere of healthcare products, has published a final guidance document dedicated to remanufacturing medical devices based on the relevant drafts published earlier in 2021. The document describes in detail the applicable regulatory requirements and also provides additional clarifications and recommendations to be taken into consideration by medical device manufacturers and other parties involved in order to ensure compliance.
It is also important to mention that FDA guidance documents are non-binding in their legal nature, nor are they intended to introduce new rules or impose new obligations. Moreover, an alternative approach could be applied, provided such an approach is in line with the existing legal framework and has been agreed with the authority in advance.
Changes Involving Software in Medical Devices
As it was mentioned before, unlike other modifications, changes to software in medical devices necessitate a different approach. The flowchart and its accompanying text described in the previous article should not be applied to software changes due to the unique nature of software modifications.
Many software changes can significantly impact a device’s software architecture, requirements specifications, and unresolved anomalies, often leading to remanufacturing. Traditional statistical methods cannot accurately determine the probability of software failures, making a risk-based assessment inappropriate for software changes.
The FDA identifies several software-related activities that typically do not significantly change the performance or safety specifications of a device, and thus are not considered remanufacturing.
These activities include the following:
- Actions authorized or performed on behalf of the OEM to return the device to its original performance and safety specifications or maintain its intended use
- Implementing OEM-authorized updates and upgrades
- Running hardware diagnostics via software
- Conducting virus, malware, and cybersecurity assessments
- Reinstalling OEM software to restore original specifications
- Reverting software to a previous configuration
- Installing OEM-authorized cybersecurity updates
- Enabling or disabling connectivity features like Wi-Fi and Bluetooth as per OEM’s intended use
- Performing data backup and recovery operations
- Assessing software inventory
- Collecting system logs
- Managing user accounts
- Accessing diagnostic and repair information
At the same time, software changes that significantly alter a device’s performance or safety specifications are likely to be considered remanufacturing. Any software modification that significantly changes the device’s intended use also falls under remanufacturing.
Entities must document their decision-making process, particularly if they believe a software change does not significantly impact performance or safety specifications. This documentation should comply with the guiding principles outlined in the FDA’s guidance.
Moreover, entities should consider the unintended consequences and cumulative effects of software changes. They must evaluate whether each activity and the cumulative effects of multiple activities constitute remanufacturing.
Proper documentation of this assessment process is crucial for regulatory compliance and to facilitate understanding by FDA investigators or third parties.
Regulatory Requirements for Remanufacturers
The document further describes in detail the requirements for the entities involved in activities considered remanufacturing based on the considerations outlined in the guidance. In particular, the authority states that under the existing legal framework, remanufacturers are treated as manufacturers under the FD&C Act and FDA regulations, meaning they are subject to the same regulatory requirements as the original equipment manufacturers (OEMs).
These include but are not limited to, the following:
- Establishment Registration and Medical Device Listing (21 CFR part 807): Remanufacturers must register annually with the FDA and list their devices and activities.
- Marketing Authorization: The device’s risk classification determines the type of premarket submission required. Remanufacturers must obtain FDA authorization before conducting remanufacturing activities.
- Medical Device Reporting (21 CFR part 803) and Electronic Product Reports (21 CFR part 1002): Remanufacturers must report adverse events and certain malfunctions.
- Reports of Corrections and Removals (21 CFR part 806) and Notifications of Defects (21 CFR part 1003): Remanufacturers must submit reports and maintain records of any corrections or removals.
- Quality System Regulation (21 CFR part 820): Remanufacturers must implement a quality system for their devices.
- Labeling Requirements (21 CFR parts 801, 809, 830, and 1010): Remanufacturers must comply with labeling regulations, including any necessary changes due to modifications in device performance or safety specifications.
Thus, remanufacturers should comply with the requirements similar to the ones applicable to medical device manufacturers creating brand-new products.
Compliance and Inspections, Registration, and Authorization
In addition to the above, registered remanufacturers are subject to FDA investigations and inspections to ensure compliance. The FDA employs a risk-based approach to allocate resources for inspections effectively.
Non-compliance can result in enforcement actions, although manufacturers typically take voluntary corrective actions to avoid such measures. Entities involved in remanufacturing must register annually with the FDA and list their devices independently of the OEM’s listing.
This requirement ensures traceability and regulatory oversight of remanufactured devices. Under the general rule, medical devices are classified into three classes (I, II, and III) based on risk, which dictates the premarket submission required.
Remanufacturers must obtain appropriate FDA marketing authorization (e.g., 510(k) or PMA) for significant changes to a device’s performance or safety specifications or intended use.
Additional Requirements
The document further outlines additional requirements remanufacturers are subject to, such as the ones related to reporting, QS regulation, and labeling.
According to the guidance, these requirements include:
- Remanufacturers must report device-related adverse events and product problems to the FDA. This reporting ensures ongoing monitoring and mitigation of risks associated with remanufactured devices.
- Remanufacturers must also report any corrections or removals initiated to reduce health risks or remedy FD&C Act violations. Even if not required to report, records of such actions must be maintained.
- Remanufacturers must establish and maintain a quality system in compliance with FDA regulations, ensuring the design, manufacture, packaging, labeling, storage, and servicing of medical devices meet required standards.
- Remanufacturers must ensure that the labeling of modified devices provides adequate instructions for use and reflects any changes in performance or safety specifications. This includes updating device-specific information, precautions, and warnings.
- OEMs should provide comprehensive servicing instructions to facilitate the routine maintenance and repair of reusable devices, thereby preventing unintentional remanufacturing. These instructions should cover key performance and safety specifications, maintenance activities, troubleshooting steps, error codes, and software version information.
Conclusion
In summary, the present FDA guidance provides extensive clarifications regarding the regulatory requirements remanufacturers should meet in order to be allowed to undertake these activities. The document compares their legal status to the status of medical device manufacturers, highlighting certain similarities based on similar risks associated with the products.
How Can RegDesk Help?
RegDesk is an AI-powered Regulatory Information Management System that provides medical device companies with regulatory intelligence for over 120 markets worldwide. It can help you prepare and publish global applications, manage standards, run change assessments, and obtain real-time alerts on regulatory changes through a centralized platform. Global expansion has never been this simple.
