Commission Implementing Regulation (EU) 2022/2346 of 1 December 2022 laying down common specifications for the groups of products without an intended medical purpose listed in Annex XVI to Regulation (EU) 2017/745 of the European Parliament and of the Council on medical devices (Text with EEA relevance)

Article 1

Common specifications

Annex I lays down common specifications for all those groups of products without an intended medical purpose.

Annex II lays down common specifications for contact lenses as specified in Section 1 of that Annex.

Annex III lays down common specifications for products intended to be totally or partially introduced into the human body through surgically invasive means for the purpose of modifying the anatomy, with the exception of tattooing products and piercings, as specified in Section 1 of that Annex.

Annex IV lays down common specifications for substances, combinations of substances, or items intended to be used for facial or other dermal or mucous membrane filling by subcutaneous, submucous or intradermal injection or other introduction, excluding those for tattooing, as specified in Section 1 of that Annex.

Annex V lays down common specifications for equipment intended to be used to reduce, remove or destroy adipose tissue, such as equipment for liposuction, lipolysis or lipoplasty as specified in Section 1 of that Annex.

Annex VI lays down common specifications for high intensity electromagnetic radiation (for example, infra-red, visible light and ultra-violet) emitting equipment intended for use on the human body, including coherent and non-coherent sources, monochromatic and broad spectrum, such as lasers and intense pulsed light equipment, for skin resurfacing, tattoo or hair removal or other skin treatment as specified in Section 1 of that Annex.

Annex VII lays down common specifications for equipment intended for brain stimulation that apply electrical currents or magnetic or electromagnetic fields that penetrate the cranium to modify neuronal activity in the brain as specified in Section 1 of that Annex.

Article 2

Transitional provisions

A product for which the manufacturer intends to perform, or is performing, a clinical investigation to generate clinical data for the clinical evaluation in order to confirm the conformity with the relevant general safety and performance requirements set out in Annex I to Regulation (EU) 2017/745 and the common specifications set out in this Regulation, and in the conformity assessment of which a notified body has to be involved in accordance with Article 52 of that Regulation, may be placed on the market or put into service until 31 December 2029 , provided that the following conditions are met:

(a) the product was already lawfully marketed in the Union before 22 June 2023 and continues to comply with the requirements of Union and national law that were applicable to it before 22 June 2023;

(b) there are no significant changes in the design and intended purpose of the product.

By way of derogation from the first subparagraph of this paragraph, from 22 June 2024 until 22 December 2024, a product that meets the conditions laid down in that subparagraph may only be placed on the market or put into service, if the sponsor has received from the Member State concerned a notification, in accordance with Article 70(1) or (3) of Regulation (EU) 2017/745, confirming that the application for the clinical investigation of the product is complete and that the clinical investigation falls within the scope of the Regulation (EU) 2017/745.

By way of derogation from the first subparagraph, from 23 December 2024 until  31 December 2027, a product that meets the conditions laid down in that subparagraph may only be placed on the market or put into service, if the sponsor has started the clinical investigation.

By way of derogation from the first subparagraph, from 1 January 2028 until 31 December 2029, a product that meets the conditions laid down in that subparagraph may only be placed on the market or put into service, if a written agreement for the performance of the conformity assessment has been signed by the notified body and the manufacturer in accordance with Section 4.3, second subparagraph, of Annex VII to Regulation (EU) 2017/745.

A product for which the manufacturer does not intend to perform a clinical investigation, but in the conformity assessment of which a notified body has to be involved in accordance with Article 52 of that Regulation, may be placed on the market or put into service until 31 December 2028 , provided that the following conditions are met:

(a) the product was already lawfully marketed in the Union before 22 June 2023 and continues to comply with the requirements of Union and national law that were applicable to it before 22 June 2023;

(b) there are no significant changes in the design and intended purpose of the product.

By way of derogation from the first subparagraph, from 1 January 2027 until 31 December 2028, a product that meets the conditions laid down in that subparagraph may only be placed on the market or put into service, if a written agreement for the performance of the conformity assessment has been signed by the notified body and the manufacturer in accordance with Section 4.3, second subparagraph, of Annex VII to Regulation (EU) 2017/745.

Article 3

Entry into force and date of application

This Regulation shall be binding in its entirety and directly applicable in all Member States.

ANNEX I

Scope

1.This Annex applies to all the devices covered by Annexes II to VII.

Risk Management

2. General requirements

2.1.Manufacturers shall establish and document responsibilities, operative modalities and criteria for the execution of the following steps of the risk management process:

(a) risk management planning;

(b) identification of hazards and risk analysis;

(c) risk evaluation;

(d) risk control and evaluation of residual risks;

(e) risk management review;

(f) production and post-production activities.

2.2.Top-level management of the manufacturers shall ensure that adequate resources are allocated and that competent personnel is assigned for risk management. Top-level management shall define and document a policy for establishing criteria for risk acceptability. Such policy shall take into account the generally acknowledged state of the art, known concerns related to safety expressed by interested parties and shall include the principle that risks are to be eliminated or reduced as far as possible by means of control measures without adversely affecting the overall residual risk. Top-level management shall ensure that the risk management process is executed and shall review its effectiveness and suitability at planned intervals.

2.3.The personnel responsible for performing risk management tasks shall be appropriately qualified. They shall have, where that is needed for the performance of tasks, proven and documented knowledge of and experience in using the particular device, equivalent devices without an intended medical purpose or analogous devices with a medical purpose, as well as knowledge of the technologies involved and risk management techniques. Evidence of qualification and competences of personnel, such as education, training, skills and experience, shall be documented.

An analogous device with a medical purpose shall be understood as the same device with a medical purpose or a medical device for which equivalence to the same device with a medical purpose has been demonstrated by the manufacturer in accordance with Section 3 of Annex XIV to Regulation (EU) 2017/745 of the European Parliament and of the Council (¹).

2.4.The results of the risk management activities, including the reference to the device, the reference to the persons who carried out the activities and the dates of execution of such activities, shall be recorded. For every identified hazard, the records shall provide traceability to the results of risk analysis, risk evaluation, risk control and evaluation of residual risks.

2.5.Based on the results of the risk management process, manufacturers shall define the categories of users and consumers that are to be excluded from the use of the device or for which special conditions of use have to be applied. A consumer shall be understood as a natural person on whom a product without an intended medical purpose is intended to be used.

2.6.Throughout the entire lifecycle of a device, the manufacturer shall establish a system to ensure a continuous systematic update of the risk management process in relation to that device.

3. Risk management planning

3.1.Risk management planning documents shall include:

(a) references and description of the device, including its parts and components;

(b) a list of the activities to be performed in each step of the risk management process, their scope and the actions for the verification of completion and effectiveness of the risk control measures;

(c) a specification of the life cycle phases of the device covered by each activity included in the plan;

(d) a specification of responsibilities and authorities for the execution of the activities, for the approvals of the results and for the risk management review;

(e) a specification of criteria for risk acceptability based on the policy referred to in Section 2.2;

(f) a specification of criteria for the collection of relevant information from the production and from the post production phases and for the use of such information to review and update, if necessary, the risk management results.

3.2.The criteria for risk acceptability shall include the description of the criterion for the acceptability of the overall residual risk. The method for the evaluation of the overall residual risk shall be defined and documented.

3.3.In defining the criteria for risk acceptability in accordance with the principles established by the policy referred to in Section 2.2, manufacturers shall consider that all risks, including those related to surgical intervention, are to be eliminated or reduced as far as possible. If the undesirable side-effects are of transient nature and do not require medical or surgical intervention to prevent life-threatening illness or permanent impairment of a body function or permanent damage to a body structure, residual risks may be considered as being acceptable. If one or more of the conditions laid down in this Section is not met, the manufacturer shall provide a justification explaining the reasons for the acceptability of the risks.

4. Identification of hazards and risk analysis

4.1.Documents for the identification of hazards and risk analysis shall:

(a) include a description of the device, its intended use and the reasonably foreseeable misuse;

(b) list the qualitative and quantitative characteristics that could affect the safety of the device;

(c) list the known and the foreseeable hazards associated with the device, its intended use, its characteristics and its reasonably foreseeable misuse, when used in both normal and fault conditions;

(d) list the hazardous situations resulting from the consideration of the foreseeable events for each identified hazard;

(e) include the qualitative or quantitative terms and descriptions, or the categorization, for the estimation of the severity and the probability of occurrence of harms.

(f) for each hazardous situation, list the estimated severity and probability of occurrence of harms and the resulting estimation of risks.

4.2.The description of the intended use of the device shall include information on the part of the human body or type of tissue interacted with, the categories of users and consumers, the use environment and the treatment procedure.

4.3.In the risk analysis manufacturers shall take into account the specificities of various user and consumer groups. This includes considering whether the user is a healthcare professional or a lay person. In the case of a lay person distinction shall be made between a person without qualification for the use of the device and a person who uses a device in the context of his or her professional activities, and who, although not being a healthcare professional, has a proven qualification for the use of the device. It shall be presumed by the manufacturer that all those user and consumer groups have access to the device unless the device is only sold directly to healthcare professionals.

4.4.Manufacturers shall consider clinical data as one of the sources of information for the risk analysis and for the estimation of the severity and the probability of occurrence of harms.

4.5.Where due to the nature of the devices or for ethical reasons data on the probability of occurrence of harm cannot be generated, manufacturers shall estimate the risk on the basis of the nature of the harm and a worst case estimate of the probability of the harm occurring. In the technical documentation manufacturers shall provide evidence justifying the reason for not providing data on the probability of occurrence of harm.

4.6.The description of the scope for the risk analysis shall be recorded.

5. Risk evaluation

5.1.For any hazardous situation, manufacturers shall evaluate the estimated risks and determine whether the risks are acceptable in accordance with the criteria referred to in Section 3.1, point (e).

5.2.Where the risk is not acceptable, risk control shall be performed.

5.3.Where the risk is acceptable, risk control is not needed and the final estimated risk shall be considered as a residual risk.

6. Risk control and evaluation of residual risks

6.1.Documents for risk control and evaluation of residual risks shall include:

(a) a list of the implemented risk control measures and the evaluation of their effectiveness;

(b) a list of the residual risks after completed implementation of the risk control measures;

(c) the evaluation of acceptability for residual risks and for the overall residual risk, in accordance with the criteria referred to in Section 3.1, point (e);

(d) the verification of the effects of the risk control measures.

6.2.Risk control measures to be implemented by the manufacturer shall be selected from the following categories of risk control options:

(a) inherent safety ensured by design;

(b) inherent safety ensured by manufacturing;

(c) protective measures in the device or in the manufacturing process;

(d) information for safety and, where appropriate, user training.

Manufacturers shall select risk control measures in the priority order from points (a) to (d). Measures from a risk control option shall not be implemented unless the measures from the previous option cannot be implemented or, where implemented, have not resulted in the risk acceptability.

6.3.Manufacturers shall ensure that the information for safety is not limited to the instruction for use or to the label, but also available by other means. Information integrated in the device itself that the user cannot disregard and public information easily accessible to the user shall be considered. Where appropriate, user training shall be considered. The information shall be presented taking into account the degree of understanding of users and consumers as referred to in Section 9.

6.4.Risk control measures shall be taken even if the performance of the device is thereby reduced as long as the main function of the device is maintained.

6.5.When deciding on risk control measures, manufacturers shall verify whether the risk control measures generate new harm, hazards or hazardous situations and whether the estimated risks for previously identified hazardous situations are affected by those measures. The reduction of a risk shall not increase one or several other risks so that the overall residual risk could be increased.

7. Risk management review

7.1.Documents for risk management review shall include a review before the release for commercialisation of the device. The review shall ensure that:

(a) the risk management process has been carried out in accordance with the risk management planning documents referred to in Section 3.1;

(b) the overall residual risk is acceptable and the risks have been eliminated or reduced as far as possible;

(c) the system to collect and review information on the device from the production and the post-production phases is implemented.

8. Production and post-production activities

8.1.Documents for production and post production activities shall:

(a) specify the system to collect and review information on the device from the production and the post-production phases;

(b) list the sources of publicly available information on the device, on equivalent devices without an intended medical purpose or on analogous devices with a medical purpose;

(c) specify the criteria to evaluate the impact of the information collected on the results of previous risk management activities and the consequent actions on the device.

As part of the system to collect and review information on the device from the post-production phases, manufacturers shall consider clinical data from the post market surveillance, and, where applicable, clinical data from the summary of safety and clinical performance referred to in Article 32 of Regulation (EU) 2017/745 or the post-market clinical follow-up referred to in Part B of Annex XIV to that Regulation.

8.2.For the specification of the criteria to evaluate the impact of the information collected, the manufacturer shall consider:

(a) hazards or hazardous situations that have not been identified previously;

(b) hazardous situations for which the risk is no longer acceptable;

(c) whether the overall residual risk is no longer acceptable.

Any impact of the information collected affecting the effectiveness and suitability of the risk management process shall be considered as an input for the top-level management review referred to in Section 2.2.

8.3.For the specification of the consequent actions on the results of previous risk management activities, manufacturers shall consider an update of the former results of the risk management activities to:

(a) include new hazards or hazardous situations and evaluate the related risks;

(b) re-evaluate hazardous situations, residual risks and the overall residual risk no longer acceptable;

(c) establish the need for actions in relation to the devices already made available on the market.

8.4.Manufacturers shall take account of any changes in risks identification, analysis and evaluation which could arise from new data or changes in device use environment.

Information for safety

9.When providing information for safety referred to in Section 6.2, point (d), and on the risks linked to the use of the device referred to in Sections 11.2, point (c) and 12.1, point (c), manufacturers shall take into account:

(a) the different degree of understanding of users and consumers, with particular emphasis on devices intended to be used by lay persons;

(b) the work environment where the device is intended to be used, especially in case of use outside a medical or otherwise professionally controlled work environment.