The Race to EU MDR Compliance Continues Despite progress over the past year, medical device companies are still facing many questions, according to annual KPMG/RAPS survey. kpmg.com With less than one year until May 2020, the Medical Device industry is still grappling with achieving MDR compliance. Organizations now have a better understanding of the legislation, enabling them to assess their progress toward compliance with the new requirements. However, there are new questions—many of which remain challenging to answer despite the looming May 26, 2020 Date of Application. To help organizations get a pulse on where the industry stands and their progress relative to competitors, KPMG and RAPS surveyed more than 230 industry leaders again this year. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Although this paper presents complete survey results and guidance on next steps, some significant highlights from our research include: – Only 28% of respondents with revenue of more than $1 billion plan to declare full MDR compliance by May 2020. – 57% of respondents are still in the process of renewing their MDD certificates so they can leverage the much-needed transitional provisions (noted in Article 120 of the EU MDR). This is not to say that industry is sitting idle. The amount of work and time required to fully remediate outweighs industry efforts thus far. It is of note that, in the 2019 KPMG/RAPS survey, respondents said the top two barriers to achieving MDR compliance were: 1 Lack of available timely guidance from the European Commission 2 Lack of internal resources Given these two concerns, it is reasonable to assume that MDR will negatively impact not only the cost and continuity of medical devices, but also manufacturers’ ability to innovate. Specifically: 36% of respondents estimate $5 million+ in expenditures to achieve EU MDR compliance More than 50% of respondents said they are planning on first/development product launches outside of Europe 66% of respondents have not started planning for the long-term organizational impacts of EU MDR, despite significant investment to date in remediation activities EU MDR Timeline © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 1 Over-All Progress The challenge While the majority of respondents to the KPMG/RAPS survey have made significant process towards MDR compliance, only 27% believe they will be fully compliant by May 2020 without using the transitional provisions. In addition, more than half of respondents continue to cite a lack of guidance on standards and documentation as their most significant barrier to MDR compliance. Therefore, ensuring an end-to-end review of technical requirements in the remaining months before May 2020 is critical for all organizations planning to sell products in Europe post-May 2020. What to do now As the countdown continues, the time to perform a meaningful gap assessment against MDR requirements is fleeting. To ensure a seamless transition to an MDR future state, organizations should address the items in the following checklist between now and May 2020: 1. MDD Certification – Status: 69% of respondents are in the process of renewing their MDD certificates (where possible/appropriate), which will allow them to avoid any misses during remediation and to use the transitional provisions to achieve compliance by May 2020. – Action: Confirm that your organization is aligned on its MDD recertification strategy and remember that Class I devices are not covered by the transitional provisions. 2. Technical Files and Clinical / Medical Safety Documentation – Status: When asked about the most significant documentationrelated challenges their organizations face, 83% of respondents cited remediating and managing updates to technical files and Clinical Evaluation Reports (CERs). – Action: As your organization manages its remediation process, now is the time to assemble a cross-functional team and verify: • Technical documentation is compliant with all 123 articles and 13 annexes of MDR. • All products have a MEDDEV 2.7.1 (Revision 4) compliant Clinical Evaluation Report. • All products have a process and template for a Post-Market Clinical Follow-Up Report. • In the absence of formal guidance from the EU Commission, a process and template for a Periodic Safety Update Report and Summary of Safety and Clinical Performance are developed. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 2 The race to EU MDR compliance continues 3. Notified Body Strategy 4. Device classification – Status: More than 35% of respondents stated that the availability of notified bodies is a significant barrier to MDR compliance. This is a genuine concern because, as of September 2019, only four notified bodies have been designated, with no more than 10-12 designations expected by the close of 2019. – Status: MDR has required re-classification of many devices to a higher risk level. – Action: If you have yet to secure a notified body, you should make this an immediate priority. If you have secured a Notified Body: • Confirm their designation, as well as their strategy and schedule, and adapt your organization’s MDR plan accordingly. • Early in the process, develop a schedule and strategy for reviews and audits. • Ensure your organization is communicating clearly with your notified body to avoid misunderstandings and misalignments in schedules and strategies for your compliance plan. – Action: Ensure that your product portfolio managers and the cross-functional team have assessed which, if any, products are impacted and implement an action plan for the applicable remediation of their technical documentation. 5. Quality Management System – Status: 58% of respondents highlighted that, although they have made some progress towards the successful implementation of changes to their Quality Management Systems (QMS), they have yet to implement all the changes. – Action: Ensure that your Quality organization has completed all required activities and updates before May 2020, including updating procedures and creating new ones, as necessary. Particular attention should be given to creating an internal audit checklist per the new requirements and conducting an internal audit before scheduling a Notified Body audit. The long run The rapidly approaching date of application means that Medical Device manufacturers will be balancing many priorities in the coming months. By taking a systematic approach to the EU MDR regulation, organizational stress can be alleviated while ensuring compliance against MDR standards is maintained. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 3 ISSUE 1 EUDAMED The challenge Nearly 48% of survey respondents have yet to develop a strategy for EUDAMED. As EUDAMED is one of the most significant changes specified by EU MDR, companies are still struggling to fully understand requirements and develop strategies for their implementation. For those organizations with a plan in place, 25% will continue with the manual process of data collection and submission to EUDAMED, 17% will leverage their existing IT infrastructure to manage master data requirements, and 7% will need to create new IT infrastructures. What to do now For companies that have yet to develop a strategy, it is critical to start with understanding the requirements and developing a roadmap for compliance. The European Commission’s EUDAMED IT team has released draft documentation that expands on the functioning and requirements of EUDAMED modules. This documentation can serve as a guide for the development of a EUDAMED strategy, which should address: 1. CAMD guidance and subsequent delays: EUDAMED is expected to go live in March 2020. Manufacturers have an 18-month grace period to register their devices in the database. The clock will either start in March 2020 (if EUDAMED is available), or in May 2020 (if EUDAMED is not available). In general, many manufacturers are choosing not to leverage the grace period, because the vigilance reporting requirements are effective from 2020. Device data will need to be registered in order to report vigilance MIR forms. 2. High-level EUDAMED requirements today: The EUDAMED database comprises six modules, of which four will require action by the manufacturer and two will be managed by the Notified Bodies and Competent Authorities. The four modules that must be managed by the manufacturer are UDID – UDI & Device Registration, ACT – Registration of Economic Operators, CIPS – System on Clinical Investigations, and VGL – System on Vigilance and PMS. The two modules managed by Notified Bodies and Competent Authorities are Certificates & Notified Bodies, and Market Surveillance. 3. Action plan for EUDAMED readiness: It is imperative to start EUDAMED planning and implementation now if it has not already begun. Companies can start by determining registration requirements for both legacy and MDR devices. They should also assess and assign Basic UDI-DI groupings to their devices. It is critical to understand the registration process for the different EUDAMED actors and obtain SRNs and roles/responsibilities for managing these actors. Manufacturers should also understand the additional reporting requirements for studies conducted in EU Member States, as well as more rigorous incident and complaint reporting expectations. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 4 The race to EU MDR compliance continues The long run While many components of EUDAMED have been defined by the commission, manufacturers are still frustrated with a lack of clarity when it comes to requirements. Manufacturers are also awaiting technical specifications and interface gateway specifics to implement finalized system solutions. Even with fully developed EUDAMED requirements, it is difficult to foresee all the possible glitches and issues that might occur once EUDAMED is live. For long-term sustainability, it is crucial to ensure that robust change control processes are implemented now so that data can be managed and maintained on an ongoing basis. Also, companies need to clearly understand their current IT and resource bandwidth and adopt solutions that are integrated with streamlined business processes so they can become compliant today and adapt to future changes. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 5 ISSUE 2 Acquiring notified bodies The challenge Last year’s KPMG/RAPS survey identified “the bandwidth of notified bodies” as a significant concern for most respondents. Today, although 58 notified bodies are registered under MDD, fewer than five are certified for MDR, with only months to go until the final deadline. Further, although the commission is targeting a total of 20 certified bodies by the end of 2019, the rate of progress and lack of guidance are weakening organizations’ confidence that they will be able to keep certain products on the market. What to do now While it is encouraging that 85% of survey respondents have identified and secured a notified body, it remains unclear whether they have done their due diligence to ensure their particular notified body will continue to meet their needs going forward. Further, the 15% of survey respondents that have not identified a notified body carry the greatest risk of not meeting MDR requirements. Both companies without a notified body and companies evaluating if their current notified body will continue to meet their needs should consider the following criteria before enlisting contract services: 1. Certification Offerings: Not all notified bodies are certified for all directives. Only eight are currently certified for all three directives: MDD, AIMDD and IVDD. Companies should ensure that their notified body is certified for the directives with which they must comply. The full list of notified bodies and their respective directives can be found here. 2. Experience: It is critical to ensure that the notified body and its auditors have experience with an organization’s device types. Since MDR is new for both notified bodies and companies, there will be a learning curve during which both may have to evolve together. Further, although auditors and companies may have different perspectives and interpretations of the requirements, they should be aligned on required device types and classes. 3. Markets Served: Some notified bodies support markets outside of the EU. If the company has products in multiple markets, a notified body that can certify devices within those markets and has a local office presence would be advantageous. 4. MDR compliance plan: If a notified body is not currently certified, ascertain whether there is a timeframe during which certification is expected. Although the MDR effective date is May 2020, the industry and commission are skeptical that there will be enough certified notified bodies to meet the demand. The commission is evaluating alternative plans for notified bodies to become MDR certified, including allowing other authorities to conduct assessments. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 6 The race to EU MDR compliance continues 5. Reputation: Determine whether a notified body is a member of the Team NB, The European Association for Medical Devices of Notified Bodies. Team NB is an organization of notified bodies committed to quality and transparency among industry, health authorities, and themselves. Membership shows a commitment to “continuous improvement and development of products, allowing patients increased access to safe yet innovative devices.” Notified bodies are assessed annually by the responsible authority to determine if they still satisfy the requirements identified in MDR Annex VII, with a summary of the assessment provided publicly. Consider whether the notified body has continued to earn successful assessment reports. 6. Fit: Organizations should evaluate fees, expertise, resources, and expected timelines to determine which notified body is the best fit for the company. As with most contracting processes, evaluating two or more notified bodies is desirable. 7. Agreements: Once a notified body has been identified and/or if a company does decide to change its notified body, a detailed agreement should be established between the company, new notified body and, if applicable, the previous notified body to address: the dates certificates become invalid, transfer of documents, and the last date the previous notified body’s ID number can be used by the company, including on promotional materials. For those companies that have already identified a notified body, many challenges are still present. The small number of MDR-certified bodies is insufficient to support the current demand from industry. Therefore, companies should consider the following tips: • Clearly communicate with your notified body. Continuous communication of needs, expectations and wants will help minimize delays and misinterpretations. • Schedule assessments and audits months in advance to give the notified body and company time to prepare. • Manage timelines through project managers to mitigate stock outs, shortages and missed product launch timelines. The long run Going forward, companies and notified bodies will need to work collaboratively to meet EU MDR requirements. Notified bodies are reporting that audits from the competent authorities are more detailed than previous audits so companies should be prepared for more scrutiny. Specifically, quality system, technical documentation, demonstration of clinical evidence, post-market safety reporting, and more are being requested and reviewed before authorities come onsite. Further, authorities are prepared with observations and detailed questions. Notified bodies and companies should be aware of factors that affect each other’s business objectives. MDR still requires that each notified body have a unique ID and CE Mark placed on the product, label, and packaging. The availability of this information will affect a company’s’ regulatory affairs, production, and supply chain organizations. The European Commission, Industry and Trade Organizations are compiling a wealth of information to assist notified bodies and companies in developing strategies to become compliant with EU MDR by May 2020 and to sustain compliance in the future. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 7 ISSUE 3 MDR Readiness & Sustainability The challenge 66% of survey respondents have yet to develop a plan for post-MDR sustainability. Since sustainability requires strict timelines, detailed data analysis/review, and crossfunctional collaboration, it is imperative that organizations think about some of the most significant impacts on their long-term success after obtaining their CE mark and declaring MDR compliance. What to do now 1. Develop clinical evaluation reports 40+% of all survey respondents noted that preparing MEDDEV 2.7.1 Revision 4 Clinical Evaluation Reports was one of the largest barriers to compliance. This is of concern since one of the central tenets of EU MDR is to ensure the health and safety of EU citizens using medical devices. Therefore, any medical device sold in Europe must have an up-to-date CER as part of its Technical File in order to receive its CE mark. The CER must, at a minimum: • Adhere to MEDDEV 2.7.1 Revision 4 requirements. • Support all claims made on the device. • Support the intended use and intended purpose of the device. • Highlight the risk/benefit profile to the end-user of the device. Further, the regulation puts a greater emphasis on supportive clinical data and equivalence. As new information and data points are available post-launch, manufacturers are expected to update their CER regularly and evaluate the claims above, intended uses, and risk/benefit profile of the devices. As MDR becomes law in 2020, equivalence claims will be more challenging to quantify, particularly for high-risk devices. Organizations’ notified bodies would expect to see that, not only does a device have the same clinical and technical characteristics as the reference device, but also that the organization has access to data on that equivalent device. This means that, for implantable and Class III devices, an agreement must be in place to access the clinical and technical documentation of the device for which equivalency is claimed. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 8 The race to EU MDR compliance continues Class I Risk Review PMSP CER Class IIb Class III 2 years PMCF PSUR Class IIa 5 years 1 year (implant) 2 years (non-implant) 2 years Tech File 1 year 1 year 1 year (implant) 2 years (non-implant) As needed To ensure that CER processes adhere to the regulation without causing bottlenecks, organizations must adopt strategies that outline not only the process of developing CERs themselves but also management and evaluation of data on an ongoing basis. To accomplish this, organizations should: • Complete a gap analysis on existing CERs and define all data gaps. • Define inputs to the CER, including PMS, risk/benefit, intended use, and indications. • Develop an end-to-end Standard Operating Procedure so that the organization is equipped with appropriate sources and steps to address the complexities of a CER. • Hold regular meetings at appropriate intervals to review risk data, plan for technical documentation updates, and review benefits/claims. An established process will allow manufacturers to reinforce their CER processes to withstand additional review from notified bodies and, ultimately, ensure long-term patient safety and market access. 2. Comply with PMS Requirements According to the survey, one of the most significant barriers to EU MDR compliance is the lack of guidance documents or standards for all the new required PMS reports. Specifically, 43% of respondents have not started to update their PMS procedures or create any templates for the reports, and 13% do not even have a PMS strategy in place. Only 11% have updated all the procedures and reports and can manage the 15-day reporting timelines, and 33% are in the process of finalizing their PMS plan and templates. Since PMS requirements have become much more stringent under EU MDR as compared to MDD, organizations should update PMS procedures, and create the new documents, such as PSUR, PMSR, SCCP, etc. required under EU MDR. Due to lack of guidance around report development, it is important for organizations to keep a flexible approach when creating templates. Once the EU Commission releases templates for all the reports, organizations will be expected to use them. Organizations should also start communicating with their notified bodies about expectations on report completion. Finally, review and upgrade of systems may be required to meet the new timing parameters, especially the 15-day reporting timeline. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 9 ISSUE 3 MDR Readiness & Sustainability Continued 3. Assign a Personal Responsible for Regulatory Compliance The findings from last year’s EU MDR survey are comparable to this year’s when it comes to the person responsible for regulatory compliance (PRRC) role. The 2018 KPMG/RAPS survey indicated that 40% of respondents hadn’t identified PRRC individual(s), 30% had identified the individual(s) but didn’t document the role, and 9% were unaware of the requirement. This year, 26% of respondents have not identified PRRC individual(s), 40% have identified the individual(s) but haven’t documented the role, and 4% are unaware of the requirement. Organizations need to clearly identify PRRCs, as well as their roles and responsibilities to carry out the requirements listed in EU MDR and meet the deadline. Additional considerations should be given to training and document repository access as part of the implementation strategy. The long run Even as organizations seek to comply with imminent EU MDR guidelines, it is critical to start planning and developing frameworks for long-term sustainability. In fact, the effort to sustain changes long term should be a continuous process as the regulation continues to evolve. It is possible to manage the additional workload that sustainability will require if organizations start planning now for the 2-5 years after application of the regulation. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 10 The race to EU MDR compliance continues © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 11 ISSUE 4 Manage resources The challenge Survey results demonstrate that 91 out of the 230 respondents plan to increase headcount to address longterm EU MDR challenges. This approach may seem to be the easiest way to address these challenges, but it requires additional costs and has implications across the organization. Companies need to find ways to maintain their profit margins while addressing such challenges as maintaining and updating post-surveillance activities, reporting, and clinical evidence. Survey results demonstrate that 105 of 230 respondents have identified increasing responsibilities/ updating role definitions as a top challenge. Clearly, they need to address the impact of EU MDR efforts on employee engagement, quality of work, and resource constraints. Overall, there appears to be a gap in developing appropriate resource strategies for MDR sustainability: only 25% of survey respondents have fully developed a strategy, while the remaining 75% have not started to create a strategy or do not see any additional impact. What to do now Training and change management programs will be a necessary solution for 105 out of 230 survey respondents, and this is consistent across companies of all sizes. Although companies with established EU MDR programs may have robust strategies, it is critical to provide the necessary leadership and financial support to meet resource requirements. Therefore, role requirements and responsibilities must be clearly identified and divided across each impacted functional area, e.g., regulatory affairs, quality assurance, research & development, operations, information technology, and supply chain. Such programs will help ease the complexity of the change and help manage the additional workload, employee morale, and new organizational business changes. Organizations should benchmark against their peers in order to support their own transitions, implementations, and business continuity efforts. Further, companies should seek to benchmark strategies to justify additional requests for funding. Finally, organizations should ensure that they continue to attend conferences and trainings, such as share forums or RAPS Convergence. There is immense value in conversations with peers and experts alike, as the entire industry is learning together – manufacturers, Notified Bodies, and consultants. Communicating with one another and sharing experiences are vital for calibration and application of resources. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 12 The race to EU MDR compliance continues The long run In the short-term, companies may temporarily extend resource requirements to key functional areas. However, a truly prepared organization will ensure enough funding and additional resourcing for the long-term sustainability of MDR compliance. Therefore companies must be innovative in developing solutions to capacitate the rising expectations that come with EU MDR. Companies should develop a comprehensive change management program to execute the complex changes, alongside a detailed training program that can be ready for implementation at a moment’s notice. It is critical to note that, without adequate planning and budgeting, EU MDR sustainability compliance efforts could have the unwanted impacts of strained resourcing, employee resistance, insufficient training, and communication failures across the organization. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 13 Conclusion The good news is that there is still time to accomplish all of the above and more, if companies work smart. While the biggest challenge may be securing the resources and budgets to ensure that all pieces of the puzzle can be addressed, it will likely be helpful to position your EU MDR effort with leadership as more than just a regulatory obligation. Companies should instead reframe their EU MDR initiatives as an opportunity to simultaneously transform their organizations’ processes, products, systems, and structures—a mindset shift that will have far-reaching value, long after compliance is achieved. About KPMG KPMG is a leading professional services firm with senior healthcare and life sciences practitioners dedicated to regulatory affairs, data & analytics, R&D and commercial strategy, risk consulting, and M&A. Our one firm approach to client engagements results in an enterprise-wide view from strategy through results. In particular, our life sciences advisory team focuses on providing strategic support to pharmaceutical and medical device companies seeking to comply with regulatory initiatives and assists them in anticipating, navigating and balancing the myriad of issues that arise when undertaking a compliance project. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 14 The race to EU MDR compliance continues About RAPS The Regulatory Affairs Professionals Society (RAPS) is the largest global organization of and for those involved with the regulation of healthcare and related products, including medical devices, pharmaceuticals, biologics and nutritional products. RAPS tracks regulatory developments and evolving professional competencies, and uses the latest information to develop tools and resources to meet the current and emerging needs of regulatory professionals. We connect the global regulatory community and empower professionals to share knowledge, ideas and expertise with one another. Both online and in person, we provide multiple opportunities for discussion, networking and relationship building among those based in disparate parts of the world or within the same local area. We also deliver relevant regulatory news and analysis for busy professionals, and informational and educational resources for those who need a deeper understanding on key topics. As the need for qualified regulatory professionals continues to grow around the world, we help promote a competent regulatory workforce. RAPS created and continues to support Regulatory Affairs Certification (RAC), the profession’s only accredited post-academic credential. RAPS helps regulatory professionals effectively communicate the vital role they play in ensuring safe and effective healthcare products for patients and healthcare providers—giving them a voice in important conversations within their organizations and beyond, as they are increasingly being called upon to play leading roles. Survey procedure The KPMG & RAPS EU MDR survey was distributed to the RAPS member base and is an analysis of 230 responses from various medical device organizations. The range of respondents represented includes 50% with revenue less than US$100 million, 23% with revenue between US$100-99 million,15% with revenue between US$1-9 billion, and 12% with revenue of US$10 billion or more. The geographies represented by participating companies spanned Africa, Asia, Europe, the Americas, the Middle East, and Oceania, with 91% of participants from the EU and North America. Most respondents were regulatory affairs or quality assurance directors and managers. The survey closed on 21 June 2019. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 15 KPMG and RAPS EU MDR Survey Results and Key Findings Survey Participants $10 billion or more 12% Vice President 12% Class I 16% $1­– $9 billion 15% Director 29% Class Ir 5% $100­– $999 million 23% Manager 32% Class IIa 31% Less than $100 million 50% Associate 9% Class IIb 27% Other 18% Class III 21% Engineering 1% Africa 1% Executive Management 2% Asia 5% Legal 1% Caribbean/South America 1% Manufacturing 1% Europe 37% QA 13% Middle East 2% R&D 1% North America 53% Regulatory Affairs Supply Chain Other 76% Oceania 1% 1% 4% Note: 1. The total number of respondents (N) for each question may vary, depending on their responses 2. The terms ‘Respondents’ and ‘Organizations’ have been used interchangeably in some cases, as we have considered each respondent to be a unique representative of his/her organization. In most of the cases, a single individual from each organization has taken part in the survey © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 16 The race to EU MDR compliance continues KPMG and RAPS EU MDR Survey Results and Key Findings What is the current status of the EU MDR remediation efforts in your organization? My organization has started EU MDR remediation efforts and is on target to meet the compliance timeline by utilizing the Transitional Provisions (May 2024) 46% My organization has started EU MDR remediation efforts and is on target to meet the compliance timeline by May 2020 27% My organization has not started EU MDR remediation efforts and is currently working on MDD re-certification to leverage the Transitional Provisions under EU MDR 15% My organization has not started EU MDR remediation efforts My organization will not be able to meet the EU MDR timeline and we are planning to withdraw our product from EU or apply for derogation 9% 3% Percentage figures are rounded off to whole number Detailed Data Breakout 10 B+ 1-9B 100-999 M < 100M 45% 65% 46% 40% 34% 23% 33% 24% 10% 6% 11% 20% 7% 6% 8% 12% 4% 0% 2% 4% Key observations – The majority of respondents across all company sizes plan on utilizing the transitional provisions to achieve MDR compliance – A small number of both large and small companies plan on withdrawing product from market as a result of EU MDR – 24% of respondents have not started EU MDR remediation efforts © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 17 KPMG and RAPS EU MDR Survey Results and Key Findings Under EU MDR requirements, Class IIa, IIb, and III products can be sold under transitional provision article 120 (3) through May 2024. How is your organization approaching the transitional provision requirements? My organization is in the process of renewing MDD certificates while remediating for MDR compliance 57% My organization has renewed our MDD certificates for our entire product portfolio 19% We have not renewed our MDD certificates and will be MDR compliant by the May 2020 date of enforcement 12% My organization has yet to renew our MDD certificates 12% Percentage figures are rounded off to whole number My organization has evaluated the Notified Body that meets our needs, but has not secured it 15% DetailatData Breakout this point My organization1-9B has evaluated100-999 and secured a Notified Body, but does not have a MDR 10 B+ M < 100M strategy in place 22% 79% 74% 58% 46% My organization has evaluated and secured a Notified Body and has a MDR strategy in place 3% 9% 19% 26% 31% 11% 6% 13% 14% My organization has evaluated and secured a Notified Body, has a MDR Strategy in place, and has developed a Brexit strategy 32% 7% 11% 10% 14% Key observations – 19% say their organization has renewed MDD certificates for their entire portfolio – The majority of respondents are renewing their MDD certificates while remediating for MDR compliance – Larger corporations are pursing renewal of MDD certificates while remediating, while smaller companies have already renewed their MDD certificates prior to remediating. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 18 The race to EU MDR compliance continues KPMG and RAPS EU MDR Survey Results and Key Findings Will your organization discontinue or withdraw product currently sold in the EU as a result of the EU MDR Regulation? 43% Yes 57% No Percentage figures are rounded off to whole number Detail Data Breakout Note: 10 B+ 1-9B 100-999 M < 100M 55% 63% 48% 32% 45% 37% 52% 68% 1. More large companies are planning on withdrawing or discontinuing product as a result of EU MDR than smaller companies. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 19 KPMG and RAPS EU MDR Survey Results and Key Findings If yes, what percent of the product? 51% 0-10 % 10 B+ 1-9B 100-999 M < 100M 63% 77% 44% 36% 25% 9% 32% 25% 12% 0% 12% 14% 0% 5% 4% 3% 0% 9% 4% 6% — 0% 0% 0% 0% — 0% 0% 0% 0% — 0% 0% 0% 0% 0% 0% 0% 3% 0% 0% 4% 13% 23% 10-20% 20-30% Detailed Data Breakout 10% 3% 30-40% 40-50% 5% 0 50-60% 0 60-70% 0 70-80% 80-90% 1% 90-100% 6% Percentage figures are rounded off to whole number Key observations – On an average, about 22% of the product is expected to discontinue or withdraw (on the basis of survey response) due to EU MDR regulation – The majority of all companies who are discontinuing or withdrawing product say that 20% or less of their products will be effected – Smaller companies are, generally, planning on withdrawing or discontinuing more products than larger companies. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 20 The race to EU MDR compliance continues KPMG and RAPS EU MDR Survey Results and Key Findings Does your organization plan to apply for derogation (exemption) of any of its products in the European Union member states due to inability to meet the EU MDR timeline? Yes No 12% 88% Percentage figures are rounded off to whole number © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 21 KPMG and RAPS EU MDR Survey Results and Key Findings As a result of stricter requirements defined by the EU MDR, is your organization planning on first product launches outside of Europe? 54% Yes No 46% Percentage figures are rounded off to whole number © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 22 The race to EU MDR compliance continues KPMG and RAPS EU MDR Survey Results and Key Findings What is the estimated cost of EU MDR Remediation for your organization (in USD)? 64% Less than $5 million 25% $5 to $25 million Greater than $25 million 11% Percentage figures are rounded off to whole number © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 23 KPMG and RAPS EU MDR Survey Results and Key Findings What are your organization’s greatest barriers to EU MDR compliance? Lack of guidance or standards on documents and requirements (SSCP, PSUR, etc.) 127 107 Resourcing the project Availability of designated notified bodies 91 Meeting the tight timeline 90 The cost associated with remediation & sustainability 58 51 Lack of internal expertise/knowledge 49 Understanding the requirements Impact of Brexit 34 Other 8 We don't have any barriers to compliance 6 Figures represent number of respondents. Key observations – Most respondents felt that Lack of “Guidance or standards on documents and requirements,” “Resourcing the project,” the “Availability of designated notified bodies,” and “Meeting the tight timeline” are the greatest barriers to EU MDR compliance © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 24 The race to EU MDR compliance continues KPMG and RAPS EU MDR Survey Results and Key Findings How would you gauge your organization’s Notified Body strategy with one year remaining in your EU MDR journey? My organization has evaluated and secured a Notified Body, has an MDR Strategy in place, and has developed a Brexit strategy 32% My organization has evaluated and secured a Notified Body and has an MDR strategy in place 31% My organization has evaluated and secured a Notified Body, but does not have an MDR strategy in place My organization has evaluated the Notified Body that meets our needs, but has not secured it at this point 22% 15% Percentage figures are rounded off to whole number © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 25 KPMG and RAPS EU MDR Survey Results and Key Findings How far along is your organization in updating your Quality Management System (QMS) to become MDR compliant by May 2020? My organization has a fully developed strategy and is currently working toward implementing all the required changes 38% My organization has developed a strategy and done an overall gap assessment but has not started implementation 23% My organization has done a preliminary assessment, but strategy needs to be developed 23% 12% My organization has not started any work on updating the QMS My organization has implemented all required changes 4% Percentage figures are rounded off to whole number Detailed Data Breakout 10 B+ 1-9B 100-999 M < 100M 62% 60% 40% 24% 7% 26% 31% 23% 14% 8% 21% 31% 10% 6% 4% 18% 7% 0% 4% 4% Key observations – Only 4% of respondents say their organization has implemented all required changes – 12% respondents say their organization hasn’t started any work on updating the QMS – Larger companies have made more progress developing a detailed QMS strategy. – Smaller companies are further behind in their QMS strategy development, and 18% have yet to start. – Very few respondents (from any company size) have completely updated their QMS as of June 2019. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 26 The race to EU MDR compliance continues KPMG and RAPS EU MDR Survey Results and Key Findings A person responsible for regulatory compliance must be identified within the organization in order to ensure that supervision and control of the manufacture and post-market surveillance activities are carried out in a compliant manner. Have you considered the individual(s) within your organization that should be identified as the Person(s) Responsible for Regulatory Compliance? Our organization has identified and documented the individual(s) who will be designated as PRRC 40% Our organization has identified a PRRC, but hasn't documented the role and responsibility of the individual(s) 30% Our organization is aware that a PRRC is required, but hasn't yet identified the individual(s) Our organization was unaware of this requirement and has not yet defined a PRRC 26% 4% Percentage figures are rounded off to whole number Detailed Data Breakout 10 B+ 1-9B 100-999 M < 100M 27% 49% 42% 39% 41% 31% 23% 29% 24% 20% 31% 26% 8% 0% 4% 6% Key observations – 30% of respondents say their organization has identified individuals for Person(s) Responsible for Regulatory Compliance – A large majority of respondents have defined their PRRC, but haven’t documented roles and responsibilities for the PRRC – Larger companies have made better progress at identifying their PRRC than smaller companies – There remains a subset of respondents across large, medium, and small companies who are still unaware of the requirement. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 27 KPMG and RAPS EU MDR Survey Results and Key Findings Has your organization developed a plan for economic operators and their registration? We are currently in the process of identifying all the economic operators' requirements and will communicate them later this year 40% 28% We have not started working on economic operators' requirements We have mapped out all the requirements and communicated all the requirements but do not have a registration strategy in place We have mapped out all the distributor, importer, and Authorized Representative requirements, communicated to our economic operators and established a plan for their registration 19% 13% Percentage figures are rounded off to whole number © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 28 The race to EU MDR compliance continues KPMG and RAPS EU MDR Survey Results and Key Findings Has your organization reviewed the supply chain strategy to account for all Original Equipment Manufacturers (OEMs) and made necessary changes? 32% We do not have OEMs We have identified all our OEMs but have not developed a strategy for transition We have identified all our OEMs and have a strategy in place to transition to legal manufacturer or distributor, but have not started any updates 26% 16% Yes, we have identified all of our OEMs, are in the process of either transitioning to legal manufacturer or distributor for these products, and are in the process of updating our quality agreements 13% We are still in the process of identifying all our OEMs 13% Percentage figures are rounded off to whole number © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 29 KPMG and RAPS EU MDR Survey Results and Key Findings What is the biggest regulatory documentation-related challenge your organization faces in achieving MDR compliance? Clinical Evaluation Report (CER) remediation (inclusion of CER for all products to MedDev Rev. 4 standards) 42% 41% Remediating and managing updates to technical files Labeling 8% Risk management file (inclusion of appropriate updates of and adherence to ISO 14971:2012 standards) 5% Other 4% Percentage figures are rounded off to whole number Key observations – Risk management file and labeling are the least challenging in document-related MDR compliance – Remediation of clinical evaluation reports and Updates to technical files are among the greatest challenges companies face © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 30 The race to EU MDR compliance continues KPMG and RAPS EU MDR Survey Results and Key Findings What is your organization’s strategy for submissions to the European database (EUDAMED) required by EU MDR? We have yet to develop a strategy for EUDAMED 48% Continue the process of manual data collection and submissions to EUDAMED 25% 17% Leverage our current IT/master data management infrastructure to manage data requirements 7% Create a new IT infrastructure to manage master data requirements Other 3% Percentage figures are rounded off to whole number © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 31 KPMG and RAPS EU MDR Survey Results and Key Findings EU MDR will require changes to your product labeling.* How are you planning to implement these changes? * Core Challenges: Labeling Space Constraints, Language Translation Requirements, and New ISO Harmonized Symbol Requirements My organization will be able to implement these changes with our current business processes 50% My organization is re-defining and implementing new systems and processes to address EU MDR label changes 22% My organization is increasing headcount to support label changes required by EU MDR Other 20% 8% Percentage figures are rounded off to whole number Detailed Data Breakout 10 B+ 1-9B 100-999 M < 100M 52% 37% 46% 55% 24% 17% 29% 20% 24% 43% 17% 14% 0% 3% 8% 11% Key observations – Half of the respondents say they plan to implement product requirement changes without any changes to current business process – Larger companies are more likely to increase headcount and implement processes for labeling when compared with smaller companies © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 32 The race to EU MDR compliance continues KPMG and RAPS EU MDR Survey Results and Key Findings Has your organization updated their Post Market Surveillance (PMS) procedures and created a PMS plan along with all relevant reports* required under MDR to meet May 2020 compliance? *Reports: Periodic Safety Update Report and Post Market Surveillance Our organization has identified all the impacted procedures but have not begun updating them or creating any templates 43% Our organization has updated all the relevant procedures and are in the process of finalizing the PMS plan and all other templates We do not have a PMS strategy in place Our organization has updated all the relevant PMS procedures, created a PMS plan and reports for all for relevant class devices, and developed a strategy to manage 15-day reporting requirements 33% 13% 11% Percentage figures are rounded off to whole number Detailed Data Breakout 10 B+ 1-9B 100-999 M < 100M 48% 23% 44% 47% 31% 57% 40% 23% 7% 9% 6% 19% 14% 11% 10% 11% Key observations – 13% respondents say they don’t have a PMS strategy in place – Most large companies have, at a minimum, done a gap assessment on their systems – A surprising subset of respondents across all company sizes do not have a PMS strategy in place as of June 2019 © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 33 KPMG and RAPS EU MDR Survey Results and Key Findings Does your organization expect an increase in complaints due to the new reporting requirements for Importers and Distributors? 38% Yes 62% No Percentage figures are rounded off to whole number Detailed Data Breakout 10 B+ 1-9B 100-999 M < 100M 59% 43% 33% 34% 41% 57% 67% 66% © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 34 The race to EU MDR compliance continues KPMG and RAPS EU MDR Survey Results and Key Findings Does your organization understand the long-term impact of MDR and has your organization developed a strategy to maintain compliance after May 2020? My organization has not started any work on a strategy for MDR sustainability, but plans to start post-May 2020 36% We haven't started - up until this point, we have only focused on remediation 30% My organization has a fully developed strategy and is currently working toward implementing this strategy for maintaining MDR sustainability We don't see additional impact to our business operations 25% 9% Percentage figures are rounded off to whole number Detailed Data Breakout 10 B+ 1-9B 100-999 M < 100M 38% 40% 38% 33% 10% 20% 25% 41% 52% 34% 27% 14% 0% 6% 10% 12% Key observations – 30% respondents say they are focused on remediation rather than long-term impact of MDR © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 35 KPMG and RAPS EU MDR Survey Results and Key Findings Compared to the initial strategy for MDR compliance, what are now perceived as the top challenges in maintaining long-term MDR sustainability for your organization? Maintaining and updating clinical evidence 154 Maintaining post surveillance activities and reporting 115 Maintaining Eudamed database 94 Maintaining PMS procedures and reporting 81 Maintaining economic operators 66 Maintaining risk management files Maintaining the PRRC role 48 25 Figures represent number of respondents Key observations – “Maintaining and updating clinical evidence” and “Maintaining post surveillance activities and reporting” are top challenges in maintaining long-term MDR sustainability © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. 36 The race to EU MDR compliance continues KPMG and RAPS EU MDR Survey Results and Key Findings What solutions has your organization developed to support long-term sustainability of MDR compliance? Increased responsibilities / updated role definition 105 Training & change management programs 105 91 Increased headcount Infrastructure updates (security, database updates, ERP, etc.) 62 59 Outsourcing 50 Not yet decided 47 System automation Others 10 Figures represent number of responses Detailed Data Breakout 10 B+ 1-9B 100-999 M < 100M 20% 16% 18% 22% 23% 18% 17% 21% 20% 20% 19% 14% 14% 17% 11% 9% 7% 14% 10% 12% 5% 3% 12% 13% 11% 11% 12% 6% 0% 1% 1% 3% Key observations – “Training and change management programs” and “Increased responsibilities/ updated role definition” are top solutions in maintaining long-term MDR sustainability © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The race to EU MDR compliance continues 37 KPMG contacts Rajesh Misra Principal, Life Science Advisory 617-988-1184 rkmisra@kpmg.com RAPS contact Christopher Mauch Manager, Life Science Advisory 312-877-3986 cmauch@kpmg.com Paul Brooks RAPS Executive Director 301-770-2920 pbrooks@raps.org To learn more about KPMG’s Healthcare and Life Sciences practice, visit us at: www.kpmg.com/us/ healthcarelifesciences Some or all of the services described herein may not be permissible for KPMG audit clients and their affiliates or related entities. © 2019 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Printed in the U.S.A. The KPMG name and logo are registered trademarks or trademarks of KPMG International. The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act upon such information without appropriate professional advice after a thorough examination of the particular situation. kpmg.com/socialmedia