EU Regulatory Roadmap Part 2: Avoiding Liability Pitfalls under MDR & IVDR

Hello, everyone, and welcome to today's webinar. I'm Sean Smith from MedTech Leading Voice. I'm going to turn it over to Alexia right away, and let's get started.

Thank you so much, Sean. Hello, everyone. Thank you warmly for joining us to this webinar today. This is part two of our EU regulatory Roadmap. For those of you that were with us in January for our webinar, we had part one, looking at a bit of a layout of the timeline and what to expect for the year with regards to potential… the way that things will go from a regulatory perspective, potentially with the revision. that is coming our way. We have part two today that focuses on avoiding liability pitfalls. Quite a number of things to go through in this topic and to discuss it with us We have Trishia Mercier, I hope I'm not pronouncing that in too much of a French way, Mercier, Head of Regulatory Affairs with the Philips Basile Accra, CEO of Accra Team, and Eric Vollebrecht, partner at Axon Lawyers.

We do want to remind you that today's session is recorded. Slides will also be shared with all of the participants by email. If you do want a certificate of attendance, it is available upon request. Please do write your name as you would like it to appear, and your email in the chat box. There will be a brief poll during the session that we do hope you will all take a moment to fill out. If you have questions for our speakers today, please do use the Q&A function in your Zoom platform. And the chat function for all other communications with myself or Sean, and again, the chat box for the certificates of

Attendance. With no further ado, I will hand things over to Basil for a short presentation, and then we will move into more of a discussion, looking at the topic through different angles with our speakers. Thank you so much.

Thank you so much, Alexia. Thank you for our, co-presenter today for being with us here to speak about, actually, the proposal of the medical device regulation IBDR. I'm looking actually to the background of Eric, and it's actually fitting well with what we kind of discussed today. Because we were, like, the past 9 years running on the road without actually, really, which is a bumpy road. It wasn't clear. People were getting, flat tires on the way, people were, like, stuck, they couldn't move forward. And today, in 2026, we started the year after actually getting a proposal in December last year, which is giving us some hope, some positive feedback about how the future could be for us.

Considering, actually, what the European legislators are trying to do, and trying to help us getting, actually, a better system. So today, I'm gonna give you, like, the current understanding, by reminding us, it's still a proposal. It's not actually a final tax, so don't run back home and say, let's fix everything and change it, and get the lean Future, because it's not actually officially published in the official European journal, so we cannot use it unless, actually, we will be ready today to prepare ourselves, understand the implication, and start educating our team what might happen if this proposal will become reality. Therefore, please listen carefully what we're going to share with you, and try to start preparing yourself

This proposal will undergo discussion between Parliament and Council, and just when they are in alignment, and they publish it officially, then you can make use of it based on what the final text would be telling us. The current text is nothing else than the proposed text, which might be completely revised, or actually adopted as is, or we might see some changes to some sections, so keep that in mind when looking to this proposal. Now, the topic today is actually related to liability and related to the measures that were proposed in the revised regulation. When you look to the previous text, we had a lot of, actually, obligation on various resources and various economic operators within the

MDR IBDR. And now, when we look to the proposal, we see, actually, A balance, proportional, activities to reduce some of the expectation and lean up processes. Why is the Commission doing that? They are trying to simplify, they are trying to help us for the future, but what does it mean for the various economic operators? What does it mean for the resources within the organization? Does it mean that we don't need to do things anymore? Or do we continue doing things, but in a different way? Does it mean that we are not liable anymore? Does it mean that the liability will disappear completely? All of these questions are raised by a lot of people, and we see, actually, changes to qualification requirements of PRRC, availability of PRRC, liability of authorized representative.

But also, the notified body involvement is getting actually different, it's changing. Less involvement, less oversight, less surveillance activities, a change to clinical evidence expectation, which was actually the biggest troublemaker for most of the manufacturers. introduction of, actually, better principle for well-established technologies, and down-classification of some devices. All of these measures are lovely. But they have also an implication on medical device industry and the economic operators within this field. Why, and why I'm saying that. Because if you reduce, actually, a requirement, manufacturers still need to assure that the quality is still actually achieved and fulfilled. And therefore, we need to discuss that and try to understand

What does it mean if a change like this will happen? What does it mean what I need to do as an organization? And, where can I relax my system, and where can I actually… where do I need to introduce new measures to ensure that the system is continuously compliant with the relevant requirement? And we're gonna have that discussion and try to understand what does that mean for all organizations, not just the manufacturers, but also authorized representatives, and perhaps other economic operators, like distributors, importers, which might be impacted by all of these measures that are suggested here.

Now, in summary, what we know, there is a reduced involvement of notified bodies, which is actually recommended by the new legislative texts. And we see, as well, reduced periodicity of actually reporting, like PSUR, reduced involvement of notified bodies, and reviews of some other document, like SSCPs. Less surveillance activities from an auditing perspective, less, actually, review of documentation in cooperation to the past, especially for lower-risk devices, which are based on sampling. and simplification and higher flexibility in the holistic process. All of these sounds actually great and lovely, because we were, like, in a painful, experience the past 9 years, and now we need something to relax the system.

But we need to be also prepared. This is what I'm trying to tell you today. We need to be prepared because we need to ensure continuous compliance as a stakeholder in this field, and it's not actually, if the regulation is relaxing, that we don't need to do, actually, what is required. And this is very important that we should not forget at the end. This is what I wanted to share with you today, a short, like, overview, and give you, like, some reason to understand why we are sitting here today, why we are discussing those topics, and try to help you as well, raising your questions. We have an industry representative with Trisha.

We have Eric, a lawyer, which we always need, and I gave Eric the abbreviation CE, which is saying, call Eric in the past, and I think it is hopefully not always necessary, but if you need to actually deal with a legal case and you want to have good feedback, you need to call Eric. And I'm happy to be with you here to talk about regulation and interpretation, and to help you shaping as well the future in the right way, by reducing complexity, but also improving compliance in a way that you are not attackable, and you are making sure that devices entering the market are always safe and performing as intended.

So, moving from the short presentation, I would like to start the discussion with our speakers and experts in this field, and I will start with you, Tricia. To talk about this topic, because, you know, we see a lot of, reduction, simplification of requirements, clarification. In my view, they are the best that we could get, actually, the past years. You know, after… when you undergo a painful, experience over years, and suddenly someone starts to recommend to you, we're going to reduce the requirement. It sounds great, it feels good, and this was a Christmas gift that actually the European legislator gave to us before Christmas. And now, after Christmas, the year started, and we need to start looking, what does it mean? What does it mean for us? How can we do it? How can we do it in the right way?

Now, looking into PRRC topic. One of the relaxation that the legislation brought in is the qualification expectation. In the past, it was actually a very specific requirement on the qualification of a PRRC, and now we are moving to a much more flexible principle. And, how would a company like you deal with that? What does it mean for a company like you? And, how you would be still compliant and be prepared for auditing activity by considering, actually, this expansion of the qualification requirement? Is it beautiful? Do you like it? Or do you feel, actually, you need to sell it to your management to make sure that it is actually adopted and implemented accordingly?

Yeah, it's a great question. I think the interpretation now, or the interpretation of the new language allows for more flexibility, and moving from formal credential compliance with more prescriptive requirements to a substantive competence demonstration can really change the way that you would select and qualify the PRRC for your organization. But what that can mean, you can be looking at the knowledge of the requirements and understanding of the quality management system. It can look at… you can look at potentially using additional, additional people, so you could have different people covering different aspects of the regulation.

And looking at the… your ability to ensure conformity and compliance based upon the expertise that you have within the people that you'd be designating as your PRRC. So, with the current standard, we still have the MDCG guidance that may be revised, but as of right now, that's still the document that we're using to demonstrate compliance. But ultimately, I think we're all going to have to create a definition within our own quality management systems to define what the PRRC qualifications should be, anchored in the requirements of Article 15 of the MDR, and to really define and provide a written qualification memo explaining how your PRRC is qualified, and be prepared to show that and defend it in an audit.

Thank you so much, Tricia. You mentioned something very important. It's still actually my responsibility as a manufacturer to say, you know, how I will implement the requirement. The lawmaker will tell you, actually, this is the frame where you can move. And you might decide, actually, to do it in a different way, at least as you are meeting the minimum expectation. And this must be defined in your quality management system, which is actually meeting your vision, your mission, as an organization. This is key and important.

Eric, from a point of view of a legal perspective, now looking to it from a different side, now, in the old legislative tax, which is still valid, because it's still.

the official tax, SMEs were able to include external PRRCs, and SMEs are organizations that are meeting the definition of an SME in the European Union, and we are talking here about very small manufacturer business-wise and resources-wise. Now, with the new tax, How do you draw the line of accountability between, actually, manufacturer and the external resource? Particularly if something goes wrong, you know? This is now… the new tax is actually saying you can have less… less specifically qualified people. And now you say, I can delegate this activity to external, which are just on a high level, meeting a specific expectation. How can you do that to protect as well, you know, the manufacturer as well as the PRRC who's acting externally?

Yeah, it's basically the answer was already given, right? In the end, the fact that there is a PRC and the PRC does its job in the quality system, that is manufacturer responsibility. But then, the relation between the manufacturer and the external PRC That is a contractual one, so that is basically an agreement in which you need to specify the service level of services that the external PRC will provide to the manufacturer. and then see that you almost, by means of kind of a quality agreement kind of approach, that you tie that into your quality system requirements that Tricia just mentioned, right? So you have your internal procedures of

what a PRC should look like, what a PRC should do for the company, and that has to connect into the services agreement of the external PRC. And if the external PRC doesn't perform, for example, I don't know, because the PRC decides I am going on a sabbatical of half a year, bye-bye, I am gone. Right? Then, yeah, then the manufacturer doesn't have PRC anymore. How are you going to deal with that? So, in that sense, the PRC, external PRC, is really on the hook, I would say, as quite an important, big cog in the manufacturer's quality management system. So if I were an external PRC, if I would engage in those services, I would be very careful to do it as a single consultant, because your backup is basically zero.

And also. you would really need to manage the consequences of your action. I mean, you might really get a manufacturer in severe problems. Actually, I had my first legal case last year of a PRC defrauding the company for which he was working as an external PRC, which was really quite serious, and then you get into very serious liability issues as well. which are determined by the contract. So, a good external PRC agreement will look a lot like, yeah, the kind of thing that an authorized representative would conclude, so there would be a lot of indemnifications and limitations of liability in there, because otherwise, as an external PRC, it's way too risky, I think, to do this.

Thank you, Eric. This is very useful and helpful to remind us, actually, how important it is to be as an organization, regardless if we are internal or external, prepared and have clear Quality management processes which support us actually meeting requirements, but also set clear agreement between the parties to make sure that the requirements are fulfilled in line with the requirement, but also our expectation and our understanding of what is proportionate for the service that we are offering and delivering as well. So, let's shift a bit of… shift gear and look into a key topic which you mentioned, Eric, liability.

Now, liability is a very important topic where a lot of people are discussing about that, and now one of the measures of simplification was removal of some of the liability obligation. The mandatory financial coverage obligation sounds like a relief if you take it away, but what does it mean in practice? If you remove, actually, something which was mandatory, talking about, actually, financial coverage, what does it mean.

before.

organization. Can you tell us a bit more about that from your perspective as, you know, a lawyer supporting various economic operators? Is this actually… is this removal really a relief, or is it just… In adoption, which still need to be addressed by an organization, in their quality management system and in their setting.

Yeah, that's a good question, because I would say yes and no. Of course, they would say, stupid lawyer. You also say, it depends, and now you say yes and no. What is it, right? So, what we've seen in the proposal is that there are several, liability-related provisions that are struck. So, there is the, there is the, Article 11-5, right, which is about liability of the authorized representative that is going out And, there is, there is also the, the sufficient coverage, one that you mentioned from, Article 1015 that is going out. Yeah, I mean, I'm happy, actually, that Article 1015, or sorry, 1016 is going out, because it led to no end of discussions with notified bodies.

what is sufficient coverage, and I must say that I have been very much against these provisions from the start, because on the one hand, they are provisions that, yeah, basically impose auditable requirements for the quality system. But on the other hand, they are audited by notified body auditors that do not have legal training. So, I've been in quite, quite some cases where, for example, yeah, you would have discussions about, yeah, so what is sufficient financial coverage? And then notified body would say, oh, that must be insurance. And then I would say, no, that's not what it says. It says sufficient financial coverage. And it would be, yes, that's insurance. And I say, how do you know?

Or they say, well, you have a contract with an insurance company, and we think it's not sufficient. And then you're like, okay, so why? Yeah, because this is not enforceable. I'm like, oh, enforceable, or do you have legal training? And then they're like, no. I say, okay, then you're not qualified to make this statement, so… These discussions are gone. This is fantastic. On the other hand, What we also have, is something that people forget. Is that in 2024, we had a revision of our super ancient product liability directive from 1985. Which has been completely updated. And it has been updated so much that actually all the liability clauses that went out of the MDR

actually are in that product liability directive, which now also specifically includes the authorized representative as potentially product liable economic operator who can even be jointly and severally liable together with the manufacturer. So, everything that went out of the MDR went into the new product liability directive. So, I think now, basically, what we are looking at in the MDR is just housekeeping. And these requirements have finally found their right place in the new product liability directive. That's the short version.

I think… I think what they did, they actually were listening to you, Eric, and they got, actually.

I hope so.

Lasagna, because you keep saying it was the lasagna, and now the lasagna is getting salted. to have pasta and the sauce next to it. So, this is what we are getting, and it is good to have, like, at least not conflicting, like, regulation, and to have the topic of liability addressed, actually, specifically, but it's good message that you are sharing with all of us, and I think Tricia and medical device industry would appreciate that, that everyone knows that For a medical device, or generally any product. it's not always one single regulation which is actually unique to meet. You need to identify the requirement which must be met in general, and you might have requirements in various legislation which you have to fulfill, and this is very important to consider during your preparation. Now, Tricia, I mean, I always, when I look to liability insurance coverage and so on, I put a smile on my face, because

If you are a business, you know, business person, and you build a company, the first thing that you look to it is actually setting… you insure yourself by actually setting a system which is protective for what you are planning to do, and then you start looking into Getting policies to, have coverage, to protect yourself from the potential harm, and it's not actually because you want to create it, it's more about actually being prepared and ready, because you want to protect your business and your vision and mission. Now, Tricia, from your company perspective, what does a robust voluntary insurance framework look like in practice? What should it cover?

Can you share with us, like, from a manufacturer perspective, what would you do if someone will tell you you should be voluntarily insured?

Yeah, so I think that comes down to defining where your risk lies and what sort of liabilities you could be taking on, and ensuring that you have, as Eric had mentioned, the right contact Contracts and agreements to make sure that you're appropriately quantifying your risk, and then ensuring that you have the right coverage and, you know, whether it's insurance or other forms of coverage to ensure that you have addressed any potential liabilities or pitfalls that you could step into. So, ultimately, it really comes down to creating the right framework, appropriately identifying the risks that… that could exist, financial and otherwise, and ensuring that you are taking

A risk-based approach, both to the way that you are marketing your product and launching your business, but also to the insurance and coverages that may be appropriate to ensure that you're not putting yourself or your company in a bad position.

I think you mentioned something very good, Tricia, because you mentioned risk. management. Risk management is key, and this is what a lot of organizations, when you talk about risk management, they always have the device risk management in their brain, because this is what they typically would do. But risk management is actually in everything that we do in life. It's actually everywhere. When you go to the kitchen and you start cooking, you apply a risk management principle as well, because you would not actually put your hand in a boiling water because if you would do it, you know what's gonna happen? So risk management-wise, you would be trying to avoid situations like this, because this is the principle which is important. Legally, risk management is also an important measure to protect me from attacks and make me actually ready for the future. Eric, from a legal standpoint.

Could the absence of voluntary financial coverage be used against the manufacturer in litigation as evidence of inadequate risk management? What would you say as a lawyer?

Well, I would say, you have risk management at several levels, right? So you have risk management as part of product compliance, because, I mean, your medical device needs to have a positive risk-benefit ratio, so there's risk management involved there. And then, as Tricia just explained, there is risk management at company level, like, which risks do you want to insure? And which risks don't you want to insure? So, yeah, if you choose to ensure certain risks, but not others, I would say that that doesn't… Yeah, it doesn't necessarily, is, like, evidence of you being a bad company, or, or, evidence of, making, bad products.

But I do think that the way you think about risks may reveal, It may reveal the compliance culture in the, in the company, and let me give you an example of that. For example, if we look in the MDCG guidance on cybersecurity, right, that's already… yeah, it's pretty old, 2019. That has an annex in the back with examples of cybersecurity incidents, right? And these could also, So these are incidents that could happen, and even a lot of these cybersecurity risks are even data breaches. Okay. So, then the question is… Let's say I am a software, a medical device software company, so my device is a software device.

am I going to, and I want to, take out insurance for product liability coverage? Typically, these insurances will, will exclude data breaches and consequential damages and cybersecurity risks and consequential damages. So, yeah, I mean, these… so you really need to pay attention that you do have the appropriate coverage, and that you might need to want to pay more to get this additional coverage in order to make sure that you do. And if you… Yeah, if you repeatedly have liability cases like that, yeah, it will also reveal that you have a bad compliance culture. Even if these are cases for which you are not necessarily liable, but there are still vigilance issues about it, it may reveal a lot

About the compliance culture in your company. And it may also reveal so much that an insurance company may say, if you go for the cybersecurity coverage at some point, that they say, no, sorry, we refuse this coverage to you, because you have had too many small cyber incidents already, we don't trust your compliance posture for your product.

And honestly speaking, you know, if I look to it business-wise, between the various stakeholders. I own multiple companies, and I collaborate with a lot of companies as well. The first thing when you sign an agreement, you ask yourself both sides, be directional, what is your coverage, actually? liability cases. So, you have that already. You don't need regulation to tell you about that. It's your risk management which is trying to address it. And therefore, I think what Trisha mentioned to us at the very beginning, the most important piece is to keep in mind That you, as an organization, build a quality management system, not just to fulfill the goal, but you build it because you want to get your risk under control, you want to ensure continuous quality assurance methods which are meeting your expectation, your vision, what you want to fulfill. And in parallel, you are still

ensuring compliance to the requirements which are adding to what you want to achieve, and this would make it actually the best scenario. Now, talking about this, we know another topic, and I'm shifting gear to go to to another topic where liability is a big discussion is the authorized representative. You know, with the MDR-IBDR introduction, authorized representative suddenly became Piable for defective devices with the manufacturer of those devices. Now, with the proposal to be simplifying the process, it's saying, actually, the joint liability will be removed. you teach us, Eric, that actually this is a joke, because it is actually taken from the regulation but put somewhere else. Now, considering the fact that it is taking out, and I'm looking to you, Tricia, shortly, just to hear your view. You know, if someone will tell you you are not required

to, to be, like, you are not anymore co-liable, with your authorized representative. And I, I think an organization like yours might have authorized representative as well by, internally, as, as an economic operator. would you believe that this will change the behavior of an authorized representative to say, I don't care anymore, I don't have to do anything? Or what would be actually the impact on the normal standard process that an authorized representative must fulfill?

Eric, do you want to go first, or do you want me to take the second question?

I'm fine either way, Trish.

Oh, okay. So, I… I would say that what we're seeing so far is not that the authorized representatives are reneging at all on the compliance obligations that they have. I do think that they still take those very seriously, and I think that the agreement that you have between the manufacturer and the authorized representative still becomes very crucial and critical to ensure that you have the appropriate coverage for the responsibilities of the authorized representative. as well as the liabilities of the manufacturer. So you're still relying on your authorized representative to help you ensure that your product meets the requirements. They're meant to be an additional source of that sort of regulatory guidance, and they're meant to be another resource that a manufacturer can use to ensure compliance.

I think that we should still use them in that way, and let them be helpful to the manufacturers as well. So that… that things are not missed and products are placed on the market in a compliant way.

Yeah. I think these are wise words, and I mean, what we see here is that although the requirement is removed in the MDR, like I said, it's moved to the product liability directive, and then they even take it up a notch, because So, the new product liability directive says authorized representatives can also be liable either by themselves or jointly and separately with other parties. So, it means that they can be liable not even only with the manufacturer, which is what the MDR said, but the product liability directive says, oh, they can also be jointly liable with a distributor, with an importer, with a freaking fulfillment services provider, even if there's nobody else that they can find in the union.

And… Not only that, there is also the requirement, which I referred to earlier, of the non-compliance with product regulation. being an assumption of effectiveness, and this is killing for the authorized representative. Why? Because the manufacturer basically doesn't comply with product regulation. There's an assumption that the product is defective because of that. And then it is still the authorized representative's joint liability personally. So this is actually… this is taking it up a notch, because in the old article, 11.5, It said that only if the manufacturer did not comply with its obligations of Article 10,

The authorized representative could be could be jointly liable, but the product liability directive gives this a much wider scope, so it means that really it is a huge mistake for authorized representatives, and also for other economic operators, to think that because Article 11-5 is removed. the joint liability is gone. I would say it's worse for authorized representatives, so they need to protect themselves better.

Okay, so this is… this is a very good, actually, feedback, because it is actually glorifying, again. that you shouldn't be just focusing on what is proposed as a tax. You need to look into what does it mean in general for me by considering additional legislation which might impact an organization. And we should not forget, at the end. The reason for having an authorized representative is not just to have an address or have a single name. it has a responsibility, and therefore, you need to work together, collaborate, based on what Trisha mentioned. Manufacturer and authorized representative are actually partners toward, actually, compliance, and it's not actually just a figure which you have somewhere for… for saying, I have someone. You have that organization to help you ensuring continuous compliance, and this is key.

So, let us shift a bit of… let's shift gear and move to other topics, and we look into, you know, questions related to devices that are now placed on the market. We hear a lot of… about, like, potential court cases, challenges between common authorities. and, notified bodies and manufacturers. A lot of discussion, what will that be in the future, considering all of these changes? And there is a liability exporter considering, not just the tax of the changes in legislation, but also considering the interpretation. And, what we saw in the past years, inconsistent approaches across the union market. So, there are actually

expectation in Germany, which might defer to the Netherlands, which might differ to Italy, liability, especially with regard to single, you know, responsibilities, like PRRCs, which might differ between Italy and other countries, where Italy will take, perhaps, extreme expectation versus other countries, which might be much more relaxed. Do you think, Eric, considering this actually changed to the proposal, that we might see much more consistent approach in the future, or will it be the same? Because you just mentioned that it's going out from NPR, going to a liability directive, but will that imply that actually, at the end, the single member state will become now harmonized, or we will still have the same problem?

No, I think, this is also a really interesting question that goes right to the governance of the MDR system, right? Which is also one of these things that, of course, everybody well, at least I have been making bets with friends and colleagues about what the governance system would look like in a proposal, right? Because People like me, we can say lots of things in public about what we think is a good way for the governance system to be constructed. But what we've seen is that the proposal takes a, I would say, a very cautious and conservative approach to the governance system, because basically, where you see the harmonization happening.

is that the, I would say the clinical aspects are, are harmonized at, expert level, expert, sorry, expert, panel level under IMA auspices. But, the interpretation of notified body behavior, for example, that still remains very much a national case, so still. the situation that we had, that it might happen, that Germany will say to its notified bodies, you are not doing remote audits, and the Netherlands will say, yeah, no problem, you can do remote audits. That kind of thing. is not resolved.

What I have seen is that there are some tiny tweaks that the Commission has attempted in the proposal. Like, for example, there was this funny provision in the Notified Bodies Accreditation clause in Chapter 4 that said that even if there was a negative opinion of the MDCG, A member state could still go ahead and notify the notified body, even if nobody wanted it. This is now proposed to be taken out. Fantastic. But, for more harmonization in the sense that you were implying in the question, we would really need it to have, basically, the notified bodies being brought under control of the Commission.

like, for example, was proposed in, the Peter Lisa Initiative, which basically had this, had this, basically, this, this medical devices office within DG Health of the Commission that would run notified bodies, basically. that was, I think, a bridge too far for the Commission politically, and they've decided the member states will basically revolt against that, so we're not going to try this. So, unfortunately, I think, yeah, we are still at the mercy of how well the member states want to play together in the MDCG and the MDCG subgroups here.

Thank you so much, Eric. This is very useful. Tricia, when we talk about, actually, liability and challenges which might come in connection with this proposal changes. How should the manufacturer be thinking about legacy devices, product already on the market, under NDR, IVDR? Because we are talking… we are now doing this proposal potentially 9 or 10 years after the initial publication of the regulations, so we have devices which are an extension period, we have devices which are already MDR certified, undergoing recertification already. And now we get something new, which is saying, like, we have new changes, and especially with regard to post-market surveillance obligation and liability continuity. So, do we need to touch it back, go back and change everything? Or how can we deal with that from a manufacturer perspective? Can you give us some insight based on your experience?

Yeah, so we're not starting over here. I definitely… I would say that the expectations related to post-market surveillance and compliance remain that… that where the burden may be changing in some areas. that's reinforced throughout this regulation that the system still expects post-market surveillance to be complied with and governed through the QMS, that manufacturers should continue to be monitoring All of the relevant stakeholders in that end-to-end post-market surveillance process should continue to act In the way that they have before. Your risk management and quality management systems may be updated, ultimately, to reflect some of these changes that may be coming through some of the liabilities and other things, but the practical takeaway is to really continue to run your post-market surveillance at this point.

In the way that you have before, and according to your quality management system. I would also say that, at least from my perspective, and I think Eric has reinforced this as well, that even removing some of these clauses or changing some of these clauses does not take away the exposure or the liability associated with some of these, so continue to ensure that your practices align with the MDR, that you are appropriately protecting yourself and your company and your products, and your products continue to comply with the appropriate clauses and regulations.

Thank you so much, Trisha. Now I want to go to another topic, Eric. You know, the proposal is actually trying to achieve what wasn't achieved in the initial tax, being supportive for SMEs as well, because There was some high-level communication in the initial tax to support SMEs, but it wasn't really executed accordingly, and SMEs globally. So a huge disadvantage and problems in connection with the implementation and MDR and IBDR. Now, the proposal is trying to be more flexible, helping SMEs, and one topic is, for example, the new PROC flexibility and frame of SMEs. How would really an SME benefit from this? Will the role and responsibility of a PROC change? I see that as a question from one of the audience, based on what the new recommendation is.

Or, what are the benefits that you can explain are connected with those changes that, actually, the European legislator are proposing?

Yeah, specifically with regarding to PRC flexibility, the thinking, behind the, behind the change was really that small companies were unable to internally field enough, they didn't… they didn't really have a lot of people to choose from, with regard to the PRC qualification requirements. So this is basically why the Commission, as far as I know, relaxed these requirements. That's also what you see back in the staff working documents about this. So, it is not so much that they are trying to lower the bar on what a PRC must do. Rather, they are making it easier for small and medium-sized companies to have access to a PRC,

And also, to have access in a PRC that a very… that basically a qualification straitjacket doesn't throw a spanner in the works for them. But otherwise, if you look at the substantive requirements of what a PRC must do in Article 15, nothing changes, right? So the PRC still has the exact same responsibilities Except that it's easier for people to qualify as PRC, but it doesn't mean that the PRC Suddenly is allowed to do things to a lower standard.

But they are now also, on top of this, SMEs do not need to have permanent availability of a PROC, they just need to have someone available. How will that impact, you know, they are still liable as small manufacturer for the devices placed on the market.

Absolutely.

And they are using an external PRRC, which is potentially, on a high level, qualified, and just available for them, not permanently available. Are they actually.

E.

being now under risk, because… and how can they protect themselves? Do you have any recommendation?

Yeah, this is… this is a really tricky change, I think, because, because the… the language that they need a PRC permanently available is basically that the thinking is that these processes that the PRC needs to oversee that they happen, and that they run are run correctly. that assumed that the PRC was always available to basically exercise oversight about this from a quality management perspective. So what you now see with this external PRC that does not need to be permanently available. what you see is that you will get kind of a more, let's say, arm's length involvement of the PRC.

Still… these processes that are mentioned in Article 15 are still hardcore core processes of your quality system. So, you can't say, like, oh, well, our PRC is less involved, so, yeah, so we can sort of, yeah, just be more literal with core processes of our quality system. No, that is really… that would be… would be misguided thinking. So we go back all the way to basically what Trisha started with, is that you need to implement the PRC processes in your quality system in a way that your quality system works. So, what we will see, I think, is that for small and medium-sized enterprises, the PRC might become more of a, let's say, advisor at the distance.

But still… the management of the company is responsible for the quality system functioning, and these procedures running. The provision in Article 15 that, PRC role may also be, let's say, cut up in smaller pieces that are distributed over more people. that will become more important in this way. So what will happen is that more of the operational PRC work will still need to be done in the company. while the formal responsibility of the PRC is, let's say, a bit more standoffish, but still needs to happen.

Thank you so much, Eric, for this very detailed response, and I think we answered some of the questions as well of the audience, which I'm monitoring in parallel to make sure that they are getting, actually, answers to their questions. Atricia, I want to move much more now to a practical risk management approach, and I would like to look to You know, across the whole changes that we look to it, what are the top two to three concrete actions do you believe a manufacturer should be taking right away? before the proposals are finalized. So they want to be, you know, either 13485 or Good Quality Management System always tell us you need to actually monitor regulatory developments and make sure that you are aware about what is upcoming. What would be your recommendation? What are the top three things that you need to do now, even if the proposal is still a proposal and not the final text?

Yeah, I… I would start with reviewing your post-market surveillance. I think that's going to be really critical, especially, especially as we move to a… a risk-based approach for auditing and everything else that's going to be based a lot on that post-market surveillance and reporting. So, I would want to make sure that your post-market surveillance process and requirements are future-proofed and strong, so that you have A really good process for evaluating your post-market surveillance and performance. I think that that complies with the regulation as it stands today, but also look at how you can make improvements so that you are looking at really strengthening that moving forward.

I think that ensuring that any friction points that you find in your technical documentation or in your product design, development, anything like that, or anything you're placing on the market, making sure that you're working through those to ensure that the safety and conformity expectations continue to be met. And addressing any areas that… that are likely to stay a high priority. You know, cybersecurity is a great example. Vigilance reporting, things like that, things that we know are definitely going to be on radar right now, and they're going to be areas where there's going to be a demonstrable

And visual, you know, something that's going to be really apparent to your notified bodies and your competent authorities as to how your product is performing in the field. So, I would say those are two areas that I would look at, and just making sure that you're reviewing your agreements, your governance and legal frameworks, and your processes within your QMS to ensure that you have the appropriate coverage for yourself and for your products.

Thank you so much, this is very useful. I would just add to it, you know, I typically always tell people, the first starting point is always for me, read the proposal. Second important point, which I would start doing, understand the implication of on your quality management processes and technical documentation. So do your due diligence by doing gap analysis. And, train and educate your people on what might be upcoming, because this is important to get people, like, informed. and do whatever you said as well, Tricia, because those are relevant, specific points, which you will identify from the second step of gap analysis. A lot of people, you know, discuss about the proposal, and I met a lot of people that said, like, oh, there is a new proposal in Europe. I was like, did you read it? The first thing, no, no, tell me what's inside it. But this is important, this is our job. We need to read and understand what is behind it. This is… this would help us, actually.

understand the implication on our organization, because every organization might be different. We'd like to shift a bit, Eric, to the questions from the audience, just to help actually addressing some of the remaining questions. We answered a lot of them already, but I see one question which is actually referring back to PRRC. And, we spoke about the PRC and having external PRC, and one of the audience saying, the financial risk sounds high. Who appears the cost of financial liability? when we talk about insurance coverage, if there is, is it the PRRC himself or herself, or is it actually the company who's actually hiring, internally or externally PRC? Is there anything that you can share on that?

Oh, yes, absolutely. So, again, you should always go back to the, let's say, the umbrella responsibility for compliance of the products. That is always the manufacturer, right? So, The manufacturer is always responsible, and that means that the manufacturer is also the party placing products on the market, so in case there's product liability or whatever, people will go to the manufacturer first, or the authorized representative, not the PRC. PRC is either an employee of the manufacturer or an external party. If the PRC is an employee of the manufacturer, then it's quite easy. The PRC is protected against external liability, like any other employee would be of the company, right? So, as long as you do your job.

And you don't do things that are outside the scope of your dog description, no problem. If you are an external PRC, then you are still, if there's a liability issue with the product of the company, that doesn't mean that you as PRC are automatically liable, because you have a duty of care, since it's a service contract, to basically do your best for the company. So you would need to make it clear in the service contract that I tell you what is a good idea. And you decide what to do as a manufacturer. It's not my responsibility to make you do things, right? I can tell you what's a good idea, and then you take my advice, or not.

Of course, there can still be cases where somebody might decide, you know what, we are still going to try and see if we can target the PRC for liability purposes, whether the PRC is an employee or not. So this is why, as a PRC, if you're an employee, you might want to ask the company, please include me on the company's liability policy for people that have external roles, like, for example, the management, they have an external role, they can also be personally liable, but under very limited circumstances. Same thing for the PRC. Ask that you're included on the so-called directors and officers policy for the company.

External PRC, since you are an independent service provider, you are literally on your own. So that means that you have to ensure your own risks. What are your own risks? a third party targets you, for example, because they say, oh, you are like the PRC of the PIP breast implant company, you have been knowingly signing off on false batch records for the company, and now, I have health damage. Yeah, theoretically, that you could be in a case like that, but then you need to take out your own insurance. Or, you agree in the contract, in the service contract with the company. If I do this for you, and anybody ever looks at me wrong, including you, manufacturer, you will indemnify me and protect me in court. This is also typically what you find in authorized representative agreements.

So that's basically, how you protect yourself as a, as a PRC.

Thank you so much, Eric, and I think you summarized it well, and both of you, Tricia and you, you made us… you reminded us how important it is to, first of all, document the processes in the right way, and ensure, actually, clarity. and addressing, actually, the legal obligation. On the other side, you stated the importance of good contractual agreement, which are covering how you want to work with each other in the supply chain. And Tricia mentioned as well in her response, when you look now to the proposal, you need to re-look to the validity of the current contract that you might have, and whether you need to take any actions. At the end, liability is a kind of, actually, risk mitigation measures to protect you, but you need to have processes in place in advance to protect you from getting to such a situation where you talk about liability implication, because if your processes are not actually good enough, your contractual agreement are not clear enough.

then you get into that problem. And on top, what I would recommend, especially for PRRC activities, and when talking about liability cases, documented evidence. It's not about, you know, someone told me this, and someone said that. It has to be documented. You need to make sure that you have a process in place which ensures that actually decisions are documented in writing, because whatever is not available in writing is… was never available in a legal case. And therefore, you need to make sure that you have really everything available in a way that you can protect yourself and have the conversation going in the right direction when it hits to a problem, which hopefully will never be actually the standard, but an exemption instead of being a standard case.

Can I add one thing, you know, with regard to PRC liability? Because you, you really jogged my, my thinking here. One of the really important things, as you said, documented evidence, right? And this is super important, because as PRRC, your best line of defense against liability, personally, either as a PRC in the company, or externally as external PRC, is good documentation. So how do you do this? You make sure that at the very, very, very, very, very least. What always happens in an adverse scenario with a company, you are PRC, either they fire you, they kick you out, or as an external PRC, they say, oh, we terminate the contract, bye-bye.

Then, if… everything you did for the manufacturers, and the manufacturer's SharePoint. environment, for example, and they close that off to you, no more data! So you really need to make sure that everything that you did for the manufacturer is documented, and that you will also have access to that post-termination of the relationship. This is the best way to protect yourself as a PRC.

Very good answer, and actually very supportive to what I would recommend to manufacture, and I think this is very important to all of us. I think this topic is very interesting, and we're gonna keep talking about the proposal and the implication. And I potentially didn't answer all the questions that you might have, but keep watching us and following us, because I think Alexia and Sean will share with you also additional events that we would be planning. Important is, like I said, remember what we told you today. Read it, prepare yourself. Praise your question today and start looking to the future. It is not that simple. All of these proposals will have an implication on us. It's positive, but it doesn't mean that we don't need to take responsibility. We are still responsible for compliance. We are still responsible for good product getting to the market, which are safe and performing as intended.

reduction, relaxation of regulations means for us, actually, a good option for improvement, but it doesn't mean for us we are now on vacation. So we're gonna keep working and making sure that we are innovating and giving the market actually well-performing safety biases, ensuring, actually, that the healthcare system is benefiting from what we do as subject matter experts in this field. Alexia, I will hand it over to you to close with your remarks and support us as well on understanding the next steps.

Absolutely. Thank you so much, Basil. Thank you, as well, Trisha. And, Eric, it's been a very, very, comprehensive view of the topic, and I'm quite happy that I've been able to learn so much myself through, through the session. I see a lot of claps and thumbs up, so thank you for, the audience's attention as well. As Basil mentioned, do stay tuned. We will be sharing very soon now some information about upcoming, live events in person. We are actually going to be coming to you in different locations in Europe. So, check your inboxes, and do make sure that you follow our activity on LinkedIn as well.

Quick reminder that the recording for today's session will be made available to all participants, and Sean, any closing words on your side?

I would just like to ask people, if you've requested a certificate, please feel free to share it on LinkedIn after the fact. We'll try to get it to you in 24 to 48 hours. We make them by hand, so we'd really appreciate that. We'd also really appreciate your feedback in the survey. Thank you so much for your time, everyone.

Thank you, everyone, and have a lovely day.

Jay?

Take care.

Thanks so much, goodbye.