Medical devices and the Medical Device Regulation (MDR) 

• The European Medical Device Regulation entered into force in April 2017, and manufacturers have had to comply with it since May 2021.
• All DiGA (digital health applications) are medical devices under the MDR or the former Medical Device Directive (MDD).
• To be certified as medical devices, digital health products must undergo a conformity assessment procedure in accordance with the MDR.
• Additional requirements apply to digital medical devices, for example with regard to data protection.

‍

Medical devices are products with a medical intended purpose for use in humans. Examples include medical instruments, hearing aids and implants, but also software solutions and smartphone apps such as digital health applications (DiGA).

If manufacturers want to place their medical devices on the market within the European Union (EU), they must demonstrate that their products meet the requirements of the European Medical Device Regulation (EU) 2017/745 (Medical Device Regulation; MDR) with regard to safety and technical and medical performance. To do so, the medical devices must successfully complete a conformity assessment procedure.

Medical devices can affect patients' health in different ways. Under the MDR (Annex VIII), they are therefore assigned to one of four risk classes as part of the conformity assessment procedure:

• Class I (with three subclasses): low risk
• Class IIa: medium risk
• Class IIb: medium to high risk
• Class III: high risk

‍

 In Vitro Diagnostic Regulation (IVDR)

Devices, reagents and other products for the in vitro examination of human specimens such as blood and urine (in vitro diagnostic medical devices) are also medical devices. However, their market access is governed by the requirements of the European Regulation on in vitro diagnostic medical devices (EU) 2017/746 (In Vitro Diagnostic Regulation; IVDR), not the MDR. 

At present, IVD products cannot be DiGA.

‍

How are the MDR, DiGA and DiPA connected?

All digital health applications (DiGA) are medical devices in risk class I, IIa or IIb under the MDR. This means that before digital health solutions can be recognised as DiGA, they must successfully complete a conformity assessment procedure in accordance with the requirements of the MDR.

Unlike DiGA, DiPA (digital care applications) may be certified as medical devices under the MDR on a voluntary basis. In this case, DiPA can belong to risk class I or IIa.

‍

From smartphone app to medical device

Under the MDR, smartphone apps such as DiGA are classed as "medical device software (MDSW)". What distinguishes them from a non-medical device is the intended purpose described by the manufacturer, including the accompanying instructions for use and promotional materials. The MDR lists a number of intended purposes that make a smartphone app a digital medical device, for example if it is intended for the "diagnosis, prevention, monitoring, treatment or alleviation of disease". In this context, certain "indicative functions" of a smartphone app point towards classification as a medical device. For example, a function for "decision support or autonomous decision-making, for example regarding therapeutic measures" indicates medical device status.

Before they can be certified, digital medical devices must undergo a conformity assessment procedure. The manufacturer carries out the assessment itself. The procedure depends on which risk class the manufacturer assigns its product to. The conformity assessment may therefore consist of one or more modules covering, among other things, the following aspects: 

• Technical documentation
• The manufacturer's quality management

‍

Above all, the manufacturer must demonstrate that…

• it has established processes that can ensure the safety and performance of its products on an ongoing basis. 
• its products are also safe and perform as intended under clinical conditions of use. This may require the manufacturer to conduct clinical studies.

For products above class I, a "notified body" must be involved in the conformity assessment procedure. It reviews the manufacturer's conformity assessment and certifies that it meets all legal requirements (certificate of conformity). The manufacturer may then declare the conformity of its product, affix the CE marking and place it on the market.

‍

MDR: particular challenges for digital medical devices

The MDR's requirements for medical devices are generally high. However, manufacturers of digital health products face additional challenges:

• Digital medical devices are classified according to stricter criteria than other categories of medical devices.
• Compared with conventional, non-digital medical devices, digital health products undergo technical changes much more frequently, and their conformity with the MDR requirements must be demonstrated again each time.
• In addition to safety and performance, digital medical devices must meet additional requirements regarding the protection and security of the data they process.
• If digital medical devices contain technologies based on artificial intelligence (AI), they are also subject to the requirements of the European Regulation (EU) 2024/1689 on artificial intelligence (AI Act).

‍

Answers to frequently asked questions about the MDR

What is the Medical Device Regulation (MDR)? 

The European Medical Device Regulation (MDR) sets out the safety and performance requirements that medical devices must meet before they can be placed on the market within the EU.

Does the MDR also apply to DiGA?

All DiGA are medical devices under the MDR (or MDD). This means that they must successfully complete a conformity assessment procedure in accordance with the MDR requirements before they can be recognised as DiGA. For DiPA, certification as a medical device is voluntary.

Which MDR risk class are DiGA assigned to?

DiGA are medical devices in risk class I, IIa or IIb under the European Medical Device Regulation (MDR).

What is a conformity assessment procedure?

In the conformity assessment procedure, manufacturers demonstrate that their products meet the safety and performance requirements of the European Medical Device Regulation (MDR). The medical devices may then bear the CE marking.

‍

‍