United States General Accounting Office

GAO Report to the Chairman, Committee on

Labor and Human Resources, U.S.

Senate

March 1996 MEDICAL DEVICE

REGULATION

Too Early to Assess

European System’s

Value as Model for

FDA

GAO/HEHS-96-65

GAO United States

General Accounting Office

Washington, D.C. 20548

Health, Education, and

Human Services Division

B-260738 

March 6, 1996

The Honorable Nancy L. Kassebaum

Chairman, Committee on Labor

 and Human Resources

United States Senate

Dear Madam Chairman:

Medical devices play a vital role in promoting public health and diagnosing

and treating illness. The Food and Drug Administration (FDA) is the arm of

the U.S. Public Health Service responsible for ensuring that the American

public has access to devices that are safe and effective. Members of

Congress, representatives of the medical device industry, and others have

expressed concern that FDA takes too long to review and approve new

medical devices, thus delaying the public’s access to useful, and possibly

life-saving, medical care.1

In 1993, the European Union (EU) began to implement a new system to

regulate medical devices—a system whose approach differs from that of

the United States.2

 Many critics of FDA have suggested that the new EU

device review system offers a model that would enable innovative

technology to reach U.S. consumers more quickly without increasing risks

to the public’s health.

You asked us to examine both FDA’s and the EU’s device review systems.

The objectives of our review were to (1) identify key differences between

the U.S. and EU systems for reviewing medical devices; (2) compare

outputs of the two systems, such as review time, if data were available;

and (3) examine the feasibility of FDA’s adopting features of the EU system.

In preparing this report, we met with and analyzed data provided by FDA

officials; EU, United Kingdom (UK), and German government officials; and

representatives of private review bodies and the medical devices industry

in the United States, Germany, and the UK. We conducted field work in

1

See U.S. Congress, House of Representatives, Committee on Commerce, Subcommittee on Oversight

and Investigations, A Consumer’s Perspective on Medical Devices. Hearings: March 30, 1995, 104

Cong., 1st sess. (Washington, D.C.: U.S. Government Printing Office, 1995); and The Wilkerson Group,

Inc., Forces Reshaping the Performance and Contribution of the U.S. Medical Device Industry,

prepared for the Health Industry Manufacturers Association (New York: June 1995), p. xxvii.

2

The 15 member states of the EU, formerly the European Economic Community, are the United

Kingdom, Ireland, Denmark, Greece, Germany, France, Italy, Spain, Portugal, Belgium, Luxembourg,

The Netherlands, Sweden, Finland, and Austria. The medical device regulatory system we will discuss

in this report is being implemented in the European Economic Area, which was established in

January 1994 and consists of the EU member states plus Norway, Iceland, and Liechtenstein. We will

refer to the system as the EU system throughout the report.

Page 1 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

Germany and the UK because those countries were among the most

advanced in implementing the EU system. We conducted our review from

March through December 1995 in accordance with generally accepted

government auditing standards. For a complete description of our scope

and methodology, see appendix I.

Results in Brief The EU system for regulating medical devices is still evolving, with major

aspects of the system not yet fully in place. Drawing a meaningful

comparison between the EU and FDA is therefore not possible at this time.

The ability of the EU system to ensure the safety of medical devices and

provide an efficient review process will become more evident after the

system accumulates several years of experience.

However, it is possible to compare certain features of the medical device

regulatory systems in the United States and the EU. For example, the two

systems operate within different legal and policy contexts. U.S. law gives

responsibility for device regulation to the Food and Drug Administration,

an agency of the Public Health Service. FDA’s charge is a public health

mandate: to ensure that devices that reach the U.S. public are safe and

effective. The EU system’s mission is twofold. It is designed not only to

ensure that devices are safe but also to facilitate EU-wide trade by creating

a single review process that permits devices to be marketed in all member

states.

Key differences between the two systems include the roles of public and

private sector bodies and the relationships among the principal parties

involved in device production and regulation. In the United States the

government alone regulates devices. Under the EU system, both

governmental and private organizations—called “notified bodies”—review

and approve medium- and high-risk devices; most notified bodies (NB) are

private. Manufacturers contract with the NB of their choice to conduct

assessments of devices they would like to market. Reviewers in both the

United States and the EU are subject to conflict-of-interest rules, but the

rules that govern FDA reviewers are more comprehensive than those that

apply to NB employees.

The systems’ criteria for device approval and clearance also differ. In the

EU, devices are generally evaluated for safety and their ability to perform

as the manufacturer intended. The criteria FDA must use are safety and

effectiveness. Effectiveness includes the additional standard of providing

benefit to patients.

Page 2 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

Meaningful comparison of the length of review time in the United States

and the EU is not possible because there are no data documenting review

times under the new EU system comparable to data describing FDA’s

experience. FDA is attempting to better manage its review process by

experimenting with different procedures. Recent trends in FDA review time

vary by type of review but generally show improvement for applications

submitted in fiscal year 1994.

Background Medical devices encompass a wide array of products with myriad uses. A

medical device can be any product used to cure, prevent, diagnose, or

treat illness, provided that its principal intended purposes are not achieved

primarily by chemical or metabolic action, as would be the case with a

pharmaceutical. Devices range in complexity from simple tongue

depressors to heart pacemakers and sophisticated imaging systems. There

are more than 100,000 products in over 1,700 categories, and they cover a

wide spectrum of risk. The U.S. medical device industry grew from 5,900

firms in 1980 to 16,900 firms in 1995. U.S. consumption of medical devices

exceeded $40 billion in 1994.

Food and Drug

Administration

The 1976 Medical Device Amendments to the Federal Food, Drug, and

Cosmetic (FFD&C) Act gave FDA expanded responsibility for regulating

medical devices in the United States. FDA’s regulatory responsibilities have

three components: (1) approving new medical devices’ entry into the

market; (2) monitoring device manufacturers’ compliance with FDA laws

and regulations, including the good manufacturing practices (GMP)

regulation to ensure continued quality control; and (3) operating a

postmarketing surveillance (PMS) system to gather information about

problems that could necessitate withdrawing a device from the market or

taking other actions.3

The Office of Device Evaluation within FDA’s Center for Devices and

Radiological Health is responsible for the evaluation of medical device

applications. During fiscal year 1994, the Office of Device Evaluation

3

The GMP regulation, promulgated under section 520 of the FFD&C Act, requires that domestic or

foreign manufacturers of medical devices intended for commercial distribution in the United States

have a quality assurance program. The regulation requires that various specifications and controls be

established for devices and that finished devices meet these specifications. The PMS system under the

Safe Medical Devices Act of 1990 requires manufacturers, distributors, and user facilities to submit

medical device reports to FDA whenever a device has caused or contributed to serious adverse

incidents. In addition, manufacturers are required to conduct studies to gather data on the safety and

effectiveness of certain devices designated by FDA.

Page 3 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

received 16,905 submissions for review, of which it classified 10,293 as

major submissions.

The 1976 amendments established a three-part classification system for

devices, based on the device’s level of risk and the extent of control

necessary to ensure the safety and effectiveness of the device. Most

medical devices are Class I or Class II (low and medium risk) and reach

the market through FDA’s premarket notification—or 510(k)—process.4

Under its 510(k) authority, FDA may grant clearance for the marketing of

devices if it determines that they are substantially equivalent to certain

devices already on the market—called predicate devices. Once FDA has

made that determination, a manufacturer can begin to market the new

device.

High-risk, or Class III, devices enter the market through the premarket

approval (PMA) process.5

 A PMA review is more stringent and typically

longer than a 510(k) review. If a manufacturer needs to test a new device

in human subjects before applying for marketing approval or clearance,

and if the device presents a significant health risk to subjects, the

manufacturer applies to FDA for an Investigational Device Exemption (IDE)

to allow use of the device in clinical studies. See appendix II for a more

detailed discussion of FDA’s review processes.

The U.S. medical device industry values FDA’s “stamp of approval” but has

leveled several criticisms against FDA. The industry contends that FDA takes

too long to review applications and that review time increased drastically

in the early 1990s. Manufacturers maintain that FDA’s review process is

unpredictable and burdensome, particularly with regard to the amount and

types of data they must submit. Additionally, the industry has stated that

FDA is not always reasonable when it requires randomized human clinical

trials to demonstrate that a device is safe and effective.6

4

Premarket notification is commonly called 510(k) in reference to section 510(k) of the FFD&C Act.

5

A PMA is a premarket approval application for a Class III medical device. Another type of application

is the PMA supplement, an abbreviated application made subsequent to an approved PMA for approval

of a change or modification in a Class III medical device.

6

The medical device industry was also critical of the Health Care Financing Administration’s (HCFA)

policy of refusing to allow Medicare coverage for certain procedures and devices undergoing clinical

trials. In September 1995, HCFA announced that it would modify this policy and that FDA would assist

in identifying nonexperimental investigational devices for which the underlying questions of safety and

effectiveness have been resolved, and that therefore may be eligible for Medicare reimbursement.

Page 4 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

European Union In 1990, the EU began to adopt a series of three directives to regulate the

safety and marketing of medical devices throughout the EU. The directives

specify roles in the device regulatory system for the European

Commission;7

 the governments of member states; and review and approval

organizations called notified bodies, which are often private entities. When

this system is fully in place in several years, every medical device

marketed in the EU will have to carry a “CE” mark, indicating that it meets

common standards of performance and safety, known as essential

requirements.8

 Devices carrying the CE mark can be marketed throughout

the EU.

The first EU directive, for active implantable devices, covers powered

devices that remain in the human body, such as heart pacemakers. It first

took effect on January 1, 1993. During a 2-year transitional period, member

states could continue to implement their national laws governing these

devices, and manufacturers had the choice of either seeking approval to

market a device in individual countries under each country’s laws or

following the procedures that would allow the device to carry the CE mark

and be marketed throughout the EU. As of January 1, 1995, all active

implantable devices were subject to the new EU system alone.

The second directive, known as the Medical Devices Directive (MDD),

covers most other medical devices, ranging from bandages to hip

prostheses. The MDD took effect on January 1, 1995, and its transitional

period will last until June 13, 1998. The third directive, covering in vitro

diagnostic medical devices, such as blood grouping reagents and

pregnancy test kits, is under development and will not take effect until at

least 1998.

Device Review Has

Different Goals in

United States and

European Union

The U.S. and EU medical device regulatory systems share the goal of

protecting public health, but the EU system has the additional goal of

facilitating EU-wide trade. Another distinction between the two systems

pertains to the criteria for reviewing devices. Devices marketed in the EU

are reviewed for safety and performing as the manufacturer intended;

devices marketed in the United States are reviewed for safety and

7

The European Commission is the executive branch of the EU and has 22 Directorates General to carry

out EU legislation. Additionally, the Commission has exclusive authority to initiate EU legislation,

which must be approved by the European Council (the principal law-making body) and often the EU

Parliament.

8

Custom-made medical devices and devices intended for investigational use are not required to carry

the CE mark but do have to meet the essential requirements for safety.

Page 5 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

effectiveness. Effectiveness includes the additional standard of providing

benefit to patients.

EU System Intended to

Promote Trade and Public

Health

One goal of the EU medical device review system is to lower trade barriers

and achieve a single market throughout the EU by harmonizing member

states’ regulatory controls. At the EU level, the Directorate General for

Industry is responsible for implementing the medical device directives.

The directives specify that a member state may not create obstacles to the

marketing of a CE-marked device within its territory.

The other goal of the EU system is to protect public health. Medical devices

that circulate in the EU must meet the medical device directives’ essential

requirements, the first one being that devices will not compromise the

health and safety of patients. The responsibility for enforcing the national

regulations that implement the directives in the member states lies with

each country’s Department of Health. Before the inception of the EU

system, the level of regulation in member states varied widely, and in some

countries most medical devices were not regulated at all. Therefore,

although the system was created within the context of encouraging trade,

in many European countries the directives will increase the level of

medical device safety regulation.

The U.S. medical device regulatory system exists within a public health

context. FDA’s mandate is to ensure that devices that reach the public are

safe and effective. The agency has limited statutory responsibility to

promote trade.9

9

The Office of International Relations in FDA was established by statute in 1990 to facilitate commerce

by, for example, encouraging mutual recognition of good manufacturing practices, testing protocols,

and other regulations. FDA has a Division of Small Manufacturers Assistance, as mandated by the 1976

Medical Device Amendments, to provide technical assistance and regulatory guidance to

manufacturers to help them comply with FDA requirements for medical devices. Additionally, the

Secretary of Health and Human Services, in establishing effective dates for medical device

performance standards, must attempt to minimize losses to domestic and international trade.

Page 6 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

Devices Must Meet

Different Criteria in

European Union and

United States

Devices marketed in the EU under the new regulatory system must

conform to the essential requirements contained in the applicable medical

device directive.10 Because the directives cover a wide range of products,

the essential requirements provide broad targets for manufacturers to

meet. The essential requirements are divided into two sections. First, the

general requirements state that devices must be designed and

manufactured in a way that will not compromise patient health and safety

and that devices must perform as the manufacturer intended. Second, the

design and construction requirements cover topics such as chemical,

physical, and biological properties; labeling; radiation safety; and accuracy

of measuring functions.

The EU system relies greatly on recognized performance standards, which

can be international, European, or national.11 Demonstrating that a device

meets such standards is voluntary, but this is an acceptable—and often

convenient—way to demonstrate that a device complies with the essential

requirements.12

In reviewing medical device applications FDA uses the two criteria

mandated by law—safety and effectiveness. For devices entering the

market through the 510(k) route, the manufacturer must demonstrate

comparative safety and effectiveness, that is, the new device is as safe and

effective as the legally marketed predicate device. In evaluating the safety

and effectiveness of a Class III device through the PMA route, FDA must

determine that the application demonstrates a reasonable assurance that

the device is safe and effective.

10Medical device regulation in the EU follows the approach to harmonized regulation that the EU is

applying in many different regulatory arenas for a variety of products. The strategy is to achieve

harmonization through essential requirements that are both general and mandatory, and that are

complemented by European standards that are both detailed and voluntary. See Linda R. Horton,

“Medical Device Regulation in the European Union,” Food and Drug Law Journal, Vol. 50 (1995), pp.

461-476.

11There are three levels of performance standards. Level I are global, or horizontal, standards, which

are common to all medical devices and relate to broad dimensions like electromagnetic compatibility

and sterilization processes. Level II, or vertical, standards apply to a family of devices, such as all

implantables (for example, pacemakers and artificial joints), and relate to subjects like materials and

toxicity. Level III standards are product-specific (for example, for heart valves). For additional

information on standards, see Medical Technology: Quality Assurance Systems and Global Markets

(GAO/PEMD-93-15, Aug. 18, 1993), pp. 27-28.

12The European Commission has mandated European standards organizations, such as the European

Committee for Standardization (CEN), to prepare harmonized European standards for medical devices

that will enable manufacturers to show that their products comply with the essential requirements. A

European Commission official told us that the Commission expects to develop 250 standards within a

few years. Manufacturers may use national or international standards when there is no European

standard.

Page 7 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

To satisfy the effectiveness requirement, a device must provide beneficial

therapeutic results in a significant portion of the target patient

population.13 The U.S. criterion of effectiveness encompasses more than

the European criterion of performing as the manufacturer intended; it

requires the device to benefit certain patients. For example, to market an

excimer laser in the United States, the manufacturer must demonstrate not

only that the laser can cut tissue from the patient’s cornea, but also that

the laser procedure lessens or eliminates the patient’s nearsightedness. In

the EU, if the manufacturer specified that the purpose of the device was to

eliminate a patient’s nearsightedness, it would have to demonstrate the

validity of that claim. However, if the claim was restricted to the device’s

ability to remove tissue in a particular way, judgment of the appropriate

use of the device would be left to clinicians.

In evaluating effectiveness, FDA generally reviews an individual device on

its own merits. In certain situations, however, reviewers consider whether

a new device is potentially less effective than available alternative

therapies. FDA’s position is that the agency evaluates comparative

effectiveness only when a less effective device could present a danger to

the public, that is, when a device is designed to treat a disease that (1) is

either life-threatening or capable of causing irreversible morbidity, or

(2) is a contagious illness that poses serious consequences to the health of

others.

United States and EU

Review Systems

Structured Differently

The EU gives major regulatory responsibilities to public and private bodies;

in contrast FDA has sole responsibility in the United States. Both systems

link the level of medical device review to the degree of control needed to

ensure device safety. However, the two systems use different procedures

to reach approval or clearance decisions.

Public Agencies and

Private Notified Bodies

Have Roles in EU Device

Regulation

Governmental and private organizations both perform major functions in

the EU system for regulating medical devices. Each member state

designates a competent authority, usually in the Department of Health,

which is responsible for implementing and enforcing the medical device

directives in that country.14 The competent authority ensures that the

13Effectiveness means the same thing in the 510(k) and PMA processes, but is largely presumed for

510(k)s and must be proven for PMAs.

14The structure of Germany’s competent authority is different from that of other countries because the

central government has delegated some medical device functions to the 16 state governments, or

Bundesländer. As a result, the Ministry of Health and agencies at the state level share responsibilities

that in other countries are generally performed by only one central agency.

Page 8 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

directives are incorporated into national law, approves clinical

investigations of devices, and operates the country’s reporting system for

adverse incidents. Additionally, the medical device directives contain a

safeguard clause. This clause gives the competent authority the power to

withdraw an unsafe device from the market; the competent authority can

be overruled by the European Commission after consultation among all of

the parties concerned. (See app. III for a more detailed discussion of the

safeguard clause.) The competent authority also serves as the country’s

liaison with the European Commission and other member states.

One of the most important responsibilities of the competent authority is to

designate and certify the notified bodies located in that country. NBs are

the organizations that perform conformity assessments on medical devices

of medium or high risk that require the intervention of an independent

organization prior to CE marking. The NBs determine whether a device

conforms to the essential requirements in the relevant medical device

directive. If the device is judged to be in conformance, the manufacturer

may then place the CE mark on the product and market it throughout the

European Union. NBs may be governmental or private entities, but most

are private.

In making their NB designations, competent authorities consider whether

organizations meet the criteria for NBs contained in the medical device

directives. These criteria include standards of competence, impartiality,

and confidentiality. Competent authorities may periodically audit NBs and

can withdraw NB status from an organization that does not continue to

meet the criteria.

The competent authority certifies that an NB is qualified to evaluate certain

types of devices and to perform specific conformity assessment

procedures. Some NBs have a limited certification; for example, they can

evaluate only active medical devices or can perform only certain types of

quality assurance reviews. Others are qualified to evaluate almost the full

range of devices. If an NB is not competent to perform an assessment

procedure that a device requires, it can subcontract with another NB or

with another organization, such as a testing laboratory, to perform that

part of the assessment.

A manufacturer may select an NB located in any member state to assess its

device. This is a contractual relationship, with the manufacturer paying a

fee for the NB’s services. As of October 1995, there were 40 NBs throughout

the EU. Germany and the UK had the largest number, 16 and 8, respectively.

Page 9 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

Representatives of European industry groups and public and private

officials in the UK and Germany told us that manufacturers consider

several factors when selecting an NB. These include the NB’s expertise and

experience with specific devices and assessment procedures, language,

cost, and whether the manufacturer has worked with the NB previously.

FDA Regulates Devices in

the United States

In the United States, regulatory responsibilities rest with one government

body—FDA. Currently, however, FDA is creating a pilot program to test the

use of private third parties to review low- to moderate-risk devices

requiring 510(k) clearance. The agency will individually review and accept

third-party review organizations interested in participating in the pilot.

After completing a device review, the third party will make a clearance

recommendation to FDA. In contrast with the role of European NBs, the

private reviewers participating in FDA’s pilot program will not have

authority to make clearance decisions. FDA will retain that authority and

will base its decision on the third party’s documented review.

Manufacturers’ participation in the pilot will be voluntary; they may

continue to opt for FDA review. Applicants that must submit clinical data

on their devices will not be able to select third-party review; FDA has

prepared a preliminary list of devices that may be included in the pilot. FDA

expects that applicants that do participate will pay a fee directly to the

third party to conduct the review.15 The pilot is scheduled to begin in

mid-1996 and will operate for 2 years; during the second year FDA plans to

evaluate the feasibility of using third parties to conduct timely and

high-quality reviews of devices.

Both Systems Link Level of

Review to Device Risk

Like the United States, the EU has a risk-based device classification

system. The EU has four categories, however, instead of three. The

manufacturer determines the appropriate class for a new device, based on

classification rules in the directives. The manufacturer may also consult

with the NB reviewing the device.16 In the United States, the manufacturer

makes a claim regarding which class a device belongs in when it submits

15FDA does not expect to take part in determining these fees. Fees will be negotiated between the third

party and the applicant.

16If the NB does not agree with the manufacturer’s interpretation of the medical device directive, it will

present to the competent authority the manufacturer’s reasons for believing its device belongs in a

different class. The competent authority can then make a decision regarding the correct device

classification. The competent authority can, if necessary, ask the European Commission for a ruling.

The European Commission would act in conjunction with a committee composed of experts from the

member states.

Page 10 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

an application for FDA review. FDA, however, has final authority over the

classification decision. (See app. III for a more detailed discussion of the

EU classification system and app. II for a more detailed discussion of the

FDA classification system.)

Just as every device released in the United States must demonstrate safety

and effectiveness, every device in the EU, no matter what its class, must

comply with the essential requirements. In both systems, the purpose of

classifying devices is to dictate the level of control the system exerts to

ensure that devices comply with the respective requirements.17

The EU directives set out a complex array of assessment procedures that

manufacturers must follow to demonstrate that a device conforms to the

essential requirements. A device’s class determines the type of conformity

assessment review the device must undergo, but the manufacturer is

usually permitted to choose an assessment route from at least two

options—often involving two general approaches. One approach is a

review of the full quality assurance (QA) system that governs every phase

of the manufacture of a device, from design through shipping.18 Officials of

a German NB told us that one goal of a full QA review is to ensure that the

manufacturer has written quality control procedures for every one of these

phases and that these procedures are followed.19 NB reviewers conduct

on-site inspections as part of this process.

The other approach consists of two components. The first is a procedure

called a type examination, in which the NB physically tests a prototype of

the device to determine if it meets certain standards. The type examination

component is paired with a limited QA review focused only on the

production phase of manufacture. This review is intended to ensure the

consistency of product quality. We refer to this overall approach as the

type examination route. Appendix III contains a more detailed description

17Individual devices or device categories may not be subject to the same level of control in the U.S. and

EU systems.

18A manufacturer choosing the full QA system route for a Class III device is also required to submit a

design dossier for the NB’s review. The dossier may include specifications and performance data of

the product as claimed; risk analysis, including risk control methods; electrical/mechanical/chemical

constructional data, including drawings; design verification documents; and, when relevant, clinical

investigation data.

19The phases involved in producing a new device for the market include a feasibility phase; the design

phase, which results in a written definition of the device; design verification, which involves creating

prototypes; mass production; and full market release. At each of these phases the manufacturer must

ensure that it has defined the requirements for completing that phase and that the “deliverable” for

that phase—be it a product design or a packaged device—is verified by qualified staff.

Page 11 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

of the different routes of conformity assessment and the assessment

requirements for different device classes.

The EU system includes both of these device approval routes as a

compromise between member states that tended to rely on one approach

or the other. For example, in the UK a voluntary oversight system had

emphasized full QA system review, while the type examination approach

had prevailed in Germany’s regulatory system.

Both the EU and U.S. systems minimize oversight for the devices

considered least risky. For EU Class I devices that do not involve a

measuring function or sterile products, manufacturers may simply furnish

a declaration that the device conforms to the essential requirements and

maintain technical documentation that would permit review of the device.

There is no NB review, but the manufacturer must register such devices

with the competent authority in the country of the manufacturer’s place of

business. In the United States, FDA exempts selected low-risk devices from

premarket notification requirements. Manufacturers must still register

their devices with FDA and must comply with GMP rules.

Most new U.S. devices fall into Class I or Class II and are evaluated for

substantial equivalence to devices already on the market. FDA determines

whether a device has the same intended use and same technological

characteristics as a predicate device by reviewing a 510(k) application

submission. If a new device has the same intended use and technological

characteristics, FDA deems it substantially equivalent to a predicate device

and allows the device to be marketed. Also, if a device has new

technological characteristics and FDA determines that they do not raise

different questions of safety or effectiveness, FDA will find the device to be

substantially equivalent. If the device has new technological

characteristics and raises different questions of safety and effectiveness,

the device will be found not substantially equivalent. The manufacturer

can then seek approval for it through the premarket approval process.

FDA requires a PMA review for most Class III devices. This is a more

rigorous review because of the device’s inherent high risk or lack of

established safety and effectiveness information. A multidisciplinary staff

at FDA evaluates the PMA application. Nonclinical studies that the team

reviews may include microbiological, toxicological, immunological,

biocompatibility, engineering (for example, stress, wear, fatigue), and

other laboratory or animal tests as appropriate. The team also reviews the

results of any clinical investigations involving human subjects. Generally,

Page 12 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

FDA evaluates a manufacturer’s tests and does not perform its own tests on

products. For a small portion of PMA reviews, FDA reviewers seek advice

from an advisory panel of clinical scientists in specific medical specialties

and representatives of industry and consumer groups.20

U.S. device manufacturers have expressed concern that FDA asks them to

submit an excessive amount of data during the 510(k) review process. The

director of FDA’s Office of Device Evaluation told us that FDA requires only

what is necessary to establish that a device is as safe and effective as its

predicate. She also told us that FDA has chosen to interpret the 510(k)

requirements so that more devices can go through that review process

rather than the longer PMA process. As a result, the agency needs enough

data to demonstrate that those 510(k) devices meet the standard of

substantial equivalence and do not raise new concerns regarding safety

and effectiveness.

EU Quality Assurance

Approach Does Not

Examine Individual

Devices

When an NB certifies a manufacturer’s full QA system, the manufacturer

may be able to attach the CE mark to several related products. The

philosophy behind this approach is that if a company has a good design

and manufacturing system, the devices it produces will be safe and

perform as the manufacturer claims. Therefore, the full QA assessment

route does not require the NB to conduct individual reviews of related

devices that are produced under the same QA system, although the NB can

do so when the situation warrants it. The certification covers the related

devices, allowing the manufacturer to market all of them without going

through an additional conformity assessment. Representatives of a British

industry group told us that the QA approach makes it possible to

continually monitor a company without testing individual items that may

not be representative of the overall quality of production.

Officials who work in the EU system told us that they expect

manufacturers to choose the full QA route to conformity assessment more

frequently than the type examination route. This route can be particularly

advantageous for larger companies. The officials believe the type

examination route is more likely to appeal to smaller companies that do

not produce many product lines or a company that wants to get a

particular device to market before it has time to put a full QA system in

place.

20FDA requests panel involvement when (1) it does not have the knowledge or experience to properly

evaluate safety and effectiveness, (2) the specific PMA raises a new issue best addressed by the

experience of the panel, or (3) the data establishing the clinical performance of the device reveal

unanticipated safety and effectiveness questions.

Page 13 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

The kinds of standards manufacturers must meet during European QA

reviews are similar to the GMP requirements in the U.S. system. (See app. II

for additional information about GMP requirements.) However, in contrast

to the ability of a full QA review to stand alone as a conformity assessment

route for some devices in the EU, FDA never bases a 510(k) clearance or PMA

approval decision solely on a GMP inspection.

Use of Clinical Trials May

Expand Under EU

Directives

Some U.S. medical device manufacturers have raised concerns that FDA

sometimes asks that a new medical device be tested in a clinical trial when

the manufacturers believe that approach is inappropriate and

unwarranted. They have also asserted that clinical trials can be performed

more quickly in Europe.

European officials told us that prior to the issuance of the EU medical

device directives, Europe had very few requirements for clinical

investigations. Under the new system, manufacturers may be required to

provide clinical evidence that a device meets the essential requirements

for safety; this evidence may come from either published scientific

literature on similar devices or data from a clinical trial on the device

under consideration. Implementation of the EU medical device directives

may result in clinical trials being required more frequently than they had

been in the past.

Officials from a German NB discussed with us circumstances under which

they would be likely to need data from a clinical trial to evaluate a new

device under the EU directives. If the device uses an accepted technology

to treat a medical indication for which use of that technology is also

accepted, a clinical trial would not be necessary. If both the technology

and the application are novel, however, they said they would require a

clinical trial. In situations where there is a mix of novel and approved

device technology and medical indication, they would need to make a

judgment call. They said that regardless of whether a clinical trial is

necessary, clinical data, based on either previous clinical trials, scientific

literature, or field experience, would have to be provided.

Although it is unclear how frequently European reviewers will ask

manufacturers to perform clinical trials, FDA officials believe that clinical

trials are often needed to establish the safety and effectiveness of devices

undergoing PMA review. According to FDA, fewer than 10 percent of the

medical device products FDA reviews under the 510(k) process require

clinical trials. When FDA does require a clinical trial during a 510(k) review,

Page 14 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

the agency is looking for clinical confirmation that a device is as safe and

effective as the legally marketed predicate device.

Notified Bodies’

Independence

Complicated by Dual

Roles

NBs carry out a regulatory function within the EU’s medical device system,

but the manufacturers whose devices they review are also their clients.

This raises questions about the independence of the NBs. Additionally, NB

employees are subject to less comprehensive conflict-of-interest rules than

are FDA device reviewers.

Notified Bodies Have

Client Relationship With

Subjects of Review

Unlike FDA, an NB is in the complicated position of both performing a

public health function—and in that capacity having to answer to a

governmental competent authority—and having a client relationship with

the manufacturer that has hired it to review a device. NBs have a duty to

ensure that medical devices that carry the CE mark conform to the EU

medical device directives’ essential requirements regarding safety and

performance. At the same time, however, they are in competition with

each other to secure the business of manufacturers seeking assessment

services.

The businesses of some NBs include consulting work as well as product

reviews, which can further complicate their independence. The director of

the UK competent authority told us that if an organization has a consulting

arm, his agency checks to see if the consulting function is kept separate

from the conformity assessment function. Only then can it be designated

as an NB. An EU official told us that he believes the European Commission

needs to address this problem of potential conflict of interest for NBs.

EU Reviewers Subject to

Less Comprehensive

Conflict-of-Interest Rules

Than FDA Reviewers

The EU medical device directives require the staff of NBs to be free of all

pressures and inducements, particularly financial, that might influence

their judgment or the results of their reviews, especially from anyone with

an interest in the outcome of the review. To meet this requirement, NBs

and their personnel must comply with European standards governing

potential conflicts of interest.21 These standards are very general.

Essentially, they (1) prohibit anyone involved in product testing or

accreditation from having a commercial, financial, or other interest that

could affect their judgment; and (2) attempt to shield laboratory and

certification personnel from control by anyone with a direct financial

interest in the outcomes of testing and accreditation. Key terms in the

21Criteria governing these personnel are in the EN 45000 series of European standards.

Page 15 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

standards, such as control, direct, commercial interest, and financial

interest, are not defined.

Officials of NBs we visited told us that their employees are bound by

international standards and that they must disclose potential conflicts of

interest in connection with their assignments. One official told us that as

an internal control, the staff who conduct the periodic follow-up

surveillance reviews of manufacturers after the initial certification of a

product or QA system are different from those who conducted the initial

review.

FDA employees are subject to a more comprehensive set of rules than are

NB personnel. FDA rules include a substantial list of general rules that

encompass all the goals and prohibitions included in the EU rules. In

addition, they include supplemental guidance on specific matters that

could present conflicts of interest, for example, outside employment,

stock ownership, gifts, entertainment, filing responsibilities, and political

activity. The EU rules are silent on how the general rules might apply in

these situations.

Information Not

Available to Compare

Outcomes of New EU

System and a

Changing FDA

The EU medical device system is new and not yet fully operational.

Although FDA’s system has been in place for almost 2 decades, the agency’s

process is in flux as managers try to respond to criticism by experimenting

with streamlined procedures. It is too early to evaluate the impact of those

efforts on the length of FDA’s review process. At this time there are no data

on the experience of the EU device review system that permit meaningful

comparison with FDA.

EU Device Review System

New and Still Evolving

In contrast to FDA’s almost 20 years of experience in carrying out the U.S.

device review program, implementation of the EU system is quite new. The

only medical device directive that is fully in effect is the one for active

implantable devices. The transition period for the directive that covers

most devices began just 1 year ago.

The system is not yet fully in operation. For example, each competent

authority is supposed to establish a system for manufacturers to report

adverse incidents with devices; eventually all of these national systems

will be electronically linked. The UK already had an extensive voluntary

system in place that it can build on, but most countries have barely begun

to develop their systems. A UK official told us it will probably be a few

Page 16 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

years before an EU-wide system is in place. In the meantime officials are

communicating by fax and letter when they identify problems.

It is too early to know how some aspects of the EU system will translate

from the directives into a practical working system. For example, the

various competent authorities are bound by the same criteria when

designating NBs, and the various NBs—both within and across individual

member states—are all supposed to use the same criteria to perform

conformity assessments. At present there is no way to measure whether

that consistency is occurring in practice.

European officials told us that experience levels among the competent

authorities and NBs vary. For example, in countries that previously had a

regulatory program in place, such as the UK and Germany, the competent

authorities already had experience carrying out some of the functions the

EU system requires of them. Similarly, some NBs have long histories of

evaluating medical devices or QA systems, while others have considerably

less experience. Even well-established NBs may have greater experience

with particular conformity assessment routes or device categories. For

example, NBs in the UK tend to have extensive experience performing full

QA system reviews and some German NBs have extensive experience with

product testing.

Results of FDA Initiatives

to Reduce Review Time

Not Yet Clear

Medical device manufacturers in the United States have charged that FDA

takes too long to approve new medical devices and have asserted that the

review process in Europe is faster. In response to criticism about the

length of its device review process, FDA is attempting to better manage and

streamline its system by experimenting with different review procedures.

Agency officials believe these initiatives have reduced review time, but it is

too early to evaluate their impact.

FDA’s management actions include the May 1994 implementation of a

three-tier system of review to improve management of its workload and

better link the rigor of review with a device’s level of risk. In addition,

since December 1994, FDA has exempted close to 300 additional medical

devices from premarket notification requirements and moved other

devices into lower classification categories in an effort to concentrate on

riskier products and reduce the regulatory burden on manufacturers.

FDA is also experimenting with an expedited review process for

life-sustaining and life-saving devices under which selected applications

Page 17 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

move to the front of the review queue. At least 40 devices had been

reviewed under this process as of July 1995. Additionally, FDA is refusing to

accept deficient or poorly prepared applications until manufacturers

provide the information needed for review.

We recently analyzed patterns in review time for FDA device applications

submitted from October 1988 to May 1995.22 Review times for 510(k)

applications and PMA supplements submitted in 1994 were still higher than

they were in 1990 but had decreased from 1993 levels. The trend for

original PMAs was less clear, in part because FDA has not yet completed the

review of a large portion of those applications.

No Comparable Data on

Length of EU Review

Process

The EU does not have data on the length of its review process that can be

compared with the data available about FDA’s experience. The EU system

has been in effect for only a short time. Anecdotal information suggests

review time may be shorter in the EU, but differences between the systems

make it difficult to find comparable benchmarks. For example, NBs may

have extensive interaction with manufacturers before the review process

formally begins, and they sometimes perform preliminary reviews before

beginning the official conformity assessment. This could make it difficult

to identify the date on which the NB’s review begins. For similar reasons of

lack of comparable data, it is also difficult to compare FDA’s record with

the experience of individual European countries prior to initiation of the

EU-wide system.

Conclusions The EU system for regulating medical devices is not only new—it is not yet

fully in place. Therefore, it is too early to evaluate its success in ensuring

the safety of medical devices and bringing them to market in an efficient

manner. Because the major actors in the EU system have not had sufficient

time to establish a record on how they will carry out their duties, it will be

some time before information is available to answer the following

questions:

• How strictly will competent authorities oversee NBs, for example, will

competent authorities rescind certifications of NBs if warranted?

• Will the performance of all competent authorities and NBs be of equal

quality, and therefore, will public health authorities and consumers be able

to have the same level of confidence in devices no matter where they are

reviewed?

22See Medical Devices: FDA Review Time (GAO/PEMD-96-2, Oct. 30, 1995).

Page 18 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

• Will the full QA system and type examination conformity assessment routes

both prove to be appropriate ways to regulate devices?

• Will NBs maintain the necessary degree of independence from

manufacturers who are their clients?

• How will NBs implement requirements for clinical evidence on new

devices?

• Will an adequate postmarket surveillance system be developed?

U.S. government officials who want to consider integrating features of the

EU approach into the U.S. device review system will be better able to

assess the value of the EU system after it accumulates several years of

experience. The U.S. medical device industry has advocated giving private

third parties a role in the review of medical devices, and FDA is exploring

this possibility in a pilot project. Ensuring that private reviewers have the

necessary independence, requisite expertise, and sufficient resources

would enhance the confidence of the Congress and the American public in

the integrity of the device review process. The importance of this

assurance would increase if private review organizations were given the

added authority of clearing new devices for marketing.

Agency Comments FDA and European officials reviewed a draft of this report. FDA’s written

comments are reproduced in appendix IV. FDA generally found the report

to be accurate and complete and made a number of technical comments

clarifying aspects of the agency’s review processes. We incorporated these

as appropriate, basing the changes in some instances on further

discussions with FDA officials. We also incorporated technical

clarifications on the EU system received from European officials.

In its comments, FDA stated that the EU system does not evaluate individual

devices, but instead evaluates a manufacturer’s quality assurance system.

As we noted in the draft report, in some situations the EU system does

evaluate individual devices, such as when a manufacturer chooses the type

examination route of conformity assessment or when a Class III device’s

design dossier is reviewed.

We will distribute this report to the Secretary of Health and Human

Services, the Commissioner of the Food and Drug Administration, and

other interested parties.

Page 19 GAO/HEHS-96-65 Medical Device Regulation
B-260738 

This report was prepared under the direction of Mark V. Nadel, Associate

Director for National and Public Health Issues. If you or your staff have

any questions, please call me at (202) 512-7119 or Bruce D. Layton,

Assistant Director, at (202) 512-6837. Other major contributors to this

report include Helene F. Toiv, Claude B. Hayeck, Mary W. Freeman,

Michele Grgich, and Liv Gorla.

Sincerely yours,

Sarah F. Jaggar

Director, Health Financing and

 Public Health Issues

Page 20 GAO/HEHS-96-65 Medical Device Regulation
Page 21 GAO/HEHS-96-65 Medical Device Regulation
Contents

Letter 1

Appendix I 

Scope and

Methodology

24

Appendix II 

Description of

Selected Aspects of

FDA Processes for

Regulating Medical

Devices

25

Device Classes 25

Triage 26

Premarket Notification—510(k)s 26

Premarket Approval 28

Investigational Device Exemptions 28

GMP Inspections 29

Postmarketing Surveillance 30

Appendix III 

Description of

Selected Aspects of

European Union

System for Regulating

Medical Devices

31

Device Classes 31

Conformity Assessment Routes 31

Assessment Requirements for Device Classes 33

The Safeguard Clause 35

Appendix IV 

Comments From the

Food and Drug

Administration

37

Related GAO Products 48

Figure Figure III.1: Conformity Assessment Routes in European Union

Medical Devices Directive

34

Page 22 GAO/HEHS-96-65 Medical Device Regulation
Contents

Abbreviations

CEN European Committee for Standardization

EU European Union

FDA Food and Drug Administration

FFD&C Federal Food, Drug, and Cosmetic

GMP good manufacturing practices

HCFA Health Care Financing Administration

IDE Investigational Device Exemption

IRB institutional review board

MDD Medical Devices Directive

NB notified body

PMA premarket approval

PMS postmarketing surveillance

QA quality assurance

SMDA 90 Safe Medical Devices Act of 1990

UK United Kingdom

Page 23 GAO/HEHS-96-65 Medical Device Regulation
Appendix I 

Scope and Methodology

For our review of the European Union’s medical device approval process,

we conducted field work in Germany and the United Kingdom. These

countries were ahead of most other member states in adopting the EU

regulatory system into their national laws and had greater experience with

implementing the new system. Additionally, over half of the notified

bodies, which review and approve medical devices under the EU system,

were located in these two countries.

In Germany and the UK we interviewed government health officials

responsible for medical device regulation; officials from two NBs, TÜV

Product Service and the British Standards Institution; and representatives

of medical device industry groups. We also interviewed EU officials and a

representative of an EU-wide industry association. We reviewed EU

documents governing the EU regulatory process. Several officials we

interviewed reviewed a draft of this report.

We reviewed Food and Drug Administration documents and policies as

well as laws and regulations governing FDA. In addition, we interviewed

officials from FDA’s Center for Devices and Radiological Health.

We talked with representatives of the U.S. medical device industry,

including the Health Industry Manufacturers Association, the National

Electrical Manufacturers Association, and the Medical Device

Manufacturers Association, as well as representatives of individual device

companies. We also reviewed position papers of several industry groups.

We interviewed representatives of organizations with expertise on product

review and certification, including officials from the U.S. Department of

Commerce; Underwriters Laboratories Inc.; the American National

Standards Institute; and the Emergency Care Research Institute.

We conducted our review from March through December 1995 in

accordance with generally accepted government auditing standards.

Page 24 GAO/HEHS-96-65 Medical Device Regulation
Appendix II 

Description of Selected Aspects of FDA

Processes for Regulating Medical Devices

This appendix provides additional information about several features of

the U.S. system for regulating medical devices and FDA review procedures.

The process of bringing a new medical device to market takes one of two

routes—premarket notification or premarket approval. Most new devices

are variations of already marketed devices, are classified as low to

moderate risk, and reach the market through FDA’s premarket

notification—or 510(k)—review process. During the 510(k) review, FDA

judges whether a device is substantially equivalent to one already on the

market. The premarket approval (PMA) process is reserved for high-risk

devices. PMAs and PMA supplements require a more stringent FDA review,

which may include the analysis of clinical data to provide a reasonable

assurance of safety and effectiveness. In addition, manufacturers must

comply with certain postmarket requirements such as reporting of certain

device-related adverse events. In fiscal year 1994, FDA’s Office of Device

Evaluation received 6,434 510(k) applications and 415 PMAs and PMA

supplements.23

Device Classes Medical devices are grouped into three classes according to (1) the degree

of potential risk and (2) the types of regulatory control needed to

reasonably ensure their safety and effectiveness. Class I devices (for

example, bedpans and tongue depressors) are those for which general

controls provide reasonable assurances of safety and effectiveness. Class

II devices (for example, syringes and hearing aids) require special controls

in addition to general controls. Class III devices (for example, heart valves

and pacemakers) are subject to general controls and must undergo more

rigorous scientific review and approval by FDA as well.

General controls include registering device manufacturing facilities,

providing FDA with regularly updated lists of marketed devices, complying

with good manufacturing practices, and maintaining records and filing

reports of device-related injuries and malfunctions. The Safe Medical

Devices Act of 1990 (SMDA 90) revised the requirements for Class II devices,

subjecting them to both general and special controls.24 Special controls

include performance standards, postmarketing surveillance, patient

registries, and other controls as deemed necessary. Class III devices are

23In addition, this office received about 10,000 other submissions for review. They include

Investigational Device Exemption applications, PMA amendments, and 510(k) and IDE supplements.

24Prior to SMDA 90, Class II devices were to be regulated by performance standards encompassed by

FDA regulations. FDA has not implemented performance standards for these devices, with the

exception of a number of devices that are radiation-emitting electronic products under the radiological

health provisions of the Federal Food, Drug, and Cosmetic Act.

Page 25 GAO/HEHS-96-65 Medical Device Regulation
Appendix II 

Description of Selected Aspects of FDA

Processes for Regulating Medical Devices

subject to the PMA process, which requires the manufacturer to present

evidence, often including extensive clinical data, that there is a reasonable

assurance that a device is safe and effective before placing it on the

market.

Triage To help assess the appropriate level of review for devices, the Center for

Devices and Radiological Health in May 1994 introduced a three-level

“triage” system that, within the existing classification system, assigns

priorities for application review based upon the complexity and risk of the

device. A tier I review is essentially a labeling review to ensure that the

label correctly identifies the intended use of the device. Most Class I

devices fall within tier I because a less rigorous scientific evaluation of

these low-risk devices does not adversely affect the public health. A tier II

review is a scientific and labeling review. This tier encompasses the

majority of 510(k)s and select PMA supplements. A tier III review is an

intensive scientific and labeling review, using a team review approach for

devices utilizing new technology or having new intended uses. FDA

convenes an advisory panel when it lacks the expertise to address

questions of safety and effectiveness for devices placed in tier III or when

it is otherwise appropriate to obtain advice on scientific matters.

Premarket

Notification—510(k)s

Most new medical devices incorporate incremental changes to devices

already on the market. To clear these devices for marketing, FDA

determines whether they are substantially equivalent to (that is, as safe

and effective as) legally marketed predicate devices.25 Substantial

equivalence means that a device has (1) the same intended use and same

technological characteristics as the marketed device or (2) the same

intended use and different technological characteristics—but is as safe

and effective as the marketed device and does not raise different questions

of safety and effectiveness.

FDA initially determines whether a 510(k) submission is sufficiently

complete before undertaking a substantive review.26 During the review,

FDA determines the intended use of a device by examining the

25A legally marketed predicate device is (a) a device that was legally marketed before May 28, 1976

(date of the Medical Device Amendments of 1976, which expanded FDA’s authority to regulate medical

devices); (b) a Class III device that has been reclassified into Class I or II; or (c) a device that is

substantially equivalent to a device placed in (a) or (b).

26For example, the FDA reviewer determines whether the application contains the information

required under the Federal Food, Drug, and Cosmetic Act. Also, the application should have

photographs of the device as well as engineering drawings of it.

Page 26 GAO/HEHS-96-65 Medical Device Regulation
Appendix II 

Description of Selected Aspects of FDA

Processes for Regulating Medical Devices

manufacturer’s proposed label statements, including statements in

promotional materials that describe the device and its use. To evaluate

technological characteristics, FDA reviews the physical and performance

characteristics of the device, such as device design, materials used, and

power source. For example, in reviewing a new pacemaker lead made of

polyurethane, FDA would assess performance testing information to

confirm that the new lead is substantially equivalent to the predicate (or

previously approved) lead. This is necessary because differences in

chemical formulations of polyurethane or differences in design and

assembly can affect safety and effectiveness.

In arriving at a determination, FDA reviewers may use voluntary standards

and guidance about a particular device.27 Reviewers also commonly used

earlier agency decisions on 510(k)s for similar devices. Another resource

is the files of the Center for Devices and Radiological Health, such as

establishment inspection and postmarketing surveillance files. These files

allow reviewers to examine the reviews of similar device types and to

determine what questions, if any, were raised by FDA inspectors about a

particular type of device.

During the review of a 510(k) application, the reviewer may determine that

additional information about the device is necessary to complete the

review. This additional information may be descriptive information and/or

performance testing information. Descriptive information includes the

intended use, physical composition, method of operation, specifications,

and performance claims of the device. Performance testing information

can be data from bench testing or from animal or clinical testing.

Upon completion of the review, the Office of Device Evaluation issues a

decision letter, which is then sent to the manufacturer. The letter may

contain one of the following:

• a substantially equivalent decision,

• a not substantially equivalent decision,

• a request for additional information, or

• a determination that the device is exempt from a 510(k) submission.

27FDA uses a variety of voluntary standards and draft guidance against which to judge the design and

performance of medical devices. Some of these voluntary standards were developed and endorsed by

groups such as the Association for the Advancement of Medical Instrumentation, often with FDA

assistance. In addition, FDA staff develop FDA guidance documents for their own internal use.

Manufacturers use many of these FDA internal guidance documents to help ensure that they submit a

complete medical device application to FDA.

Page 27 GAO/HEHS-96-65 Medical Device Regulation
Appendix II 

Description of Selected Aspects of FDA

Processes for Regulating Medical Devices

Premarket Approval As it does for 510(k)s, FDA first decides whether to accept the PMA or refuse

to file it because it does not meet minimum requirements. If FDA accepts

the application, a multidisciplinary staff evaluates the filed PMA. The team

reviews nonclinical studies such as microbiological, toxicological,

immunological, biocompatibility, animal, and engineering tests. The team

also reviews the results of clinical investigations involving human subjects.

During this stage, FDA prepares a critique of the scientific evidence of the

safety and effectiveness of the device.

During the review, FDA may, on its own initiative or if requested by the

applicant, refer the PMA to an advisory committee representing the

appropriate medical field for a “panel” review. FDA will request such a

review when it lacks the knowledge or experience to evaluate the safety

and effectiveness questions posed by the device or when it is otherwise

appropriate to obtain advice on scientific matters. Problems identified in

FDA’s critique of the scientific evidence can be discussed further during

advisory panel meetings. The committee submits a final report to FDA, but

the agency is not bound by the committee’s recommendations.

The review team also checks the manufacturer’s compliance with the GMP

regulation and makes a judgment about the quality controls used in the

manufacture of a device. The purpose of the review is to ensure that the

manufacturer is capable of producing devices of high quality.

At the end of the approval review stage, FDA may take one of the following

actions:

• Issue an order approving the PMA.

• Issue an order denying approval.

• Send the applicant an approvable letter indicating that the FDA intends to

approve the device if certain problems (for example, labeling deficiencies)

are resolved.

• Send the applicant a not-approvable letter describing significant

deficiencies in the application. Eventual approval is not precluded if the

manufacturer provides an adequate response.

Investigational Device

Exemptions

Almost all PMAs and a small subset of PMA supplements and 510(k)s require

clinical trials to obtain answers to questions on safety and effectiveness. A

researcher wishing to conduct a study involving human subjects to

develop safety and effectiveness data for a medical device can apply to FDA

for an IDE. An approved IDE application permits the use in a clinical study

Page 28 GAO/HEHS-96-65 Medical Device Regulation
Appendix II 

Description of Selected Aspects of FDA

Processes for Regulating Medical Devices

of a device that would ordinarily be subject to market clearance

procedures. An IDE approval is needed for a significant risk device. For a

nonsignificant-risk device (for example, daily wear contact lenses)

investigation, the sponsor presents the proposed study to an institutional

review board (IRB) along with a report of prior investigations and the

investigational plan.28 If the IRB approves the investigation as a

nonsignificant-risk study, the investigation is considered to have an

approved IDE and can begin immediately. FDA is not involved in the

approval process of the clinical study. If the IRB or FDA determines,

however, that the proposed investigation involves a significant-risk device

(for example, a heart valve), the sponsor must submit an IDE application to

FDA.

29 The application must contain an investigational plan that includes

such information as the purpose of the study, a written protocol, a risk

analysis and description of patient selection, a description of the device,

monitoring procedures, labeling, and consent materials. An IDE application

may also include data on the design of the device and data from bench and

animal tests.

FDA determines whether the study should be approved, considering such

factors as whether the benefits of the investigation outweigh the risks and

whether the proposed study is scientifically sound. The investigation can

begin after the sponsor obtains both FDA and IRB approval for a

significant-risk investigation. FDA conducts bioresearch monitoring

inspections to help ensure that clinical investigations are conducted in

accordance with study protocols and that the rights and safety of study

participants are protected.

GMP Inspections FDA determines compliance with the GMP regulation primarily through

factory inspections conducted by its field staff. Section 704(a) of the FFD&C

Act gives FDA authority to conduct GMP inspections of medical device

manufacturers.30 During these inspections, FDA investigators examine

28An IRB is any board, committee, or other group formally designated by an institution to review, to

approve the initiation of, and to conduct periodic review of biomedical research involving human

subjects. The purpose of such review is to ensure the protection of the rights and welfare of human

subjects, the appropriateness of the method for securing the subjects’ informed consent to participate,

and the balance of risks and benefits. The board must be composed of a minimum of five members

sufficiently qualified to foster a complete and adequate review of research activities commonly

conducted by the institution.

29FDA is the final arbiter of whether an investigation is a significant- or nonsignificant-risk study. FDA

learns of IRB nonsignificant-risk decisions through various means, including bioresearch monitoring

and communications from IRBs and other sources, and can overrule an IRB’s decision.

30Anyone who manufactures, labels, packages, imports, or stores a medical device can be inspected. A

manufacturer is any person, including a repackager or relabeler, who writes specifications for,

manufactures, fabricates, assembles, or processes a medical device.

Page 29 GAO/HEHS-96-65 Medical Device Regulation
Appendix II 

Description of Selected Aspects of FDA

Processes for Regulating Medical Devices

facilities, records of manufacturing processes, and corrective action

programs. The results provide information necessary to evaluate a firm’s

compliance with the medical device GMP regulation.

FDA may initiate a GMP inspection for any of several reasons. These include

routine scheduling, the need to obtain data on an industry new to FDA,

investigation of a consumer or trade complaint, a product defect report, an

adverse reaction to a device, or a device-related death. FDA also conducts

GMP inspections in conjunction with approval of products.

Postmarketing

Surveillance

One key provision of the Safe Medical Devices Act of 1990 requires that

manufacturers conduct postmarketing surveillance, such as studies to

gather data on the safety and effectiveness of certain devices. This

requirement applies to devices that (1) are permanent implants, the failure

of which may cause serious adverse health consequences or death; (2) are

intended for use in supporting or sustaining human life; or (3) present a

potential serious risk to human health. FDA also has discretion to require

postmarketing surveillance for other devices under certain circumstances.

Another provision of SMDA 90 requires manufacturers and distributors to

submit medical device reports of certain adverse events related to a device

they manufacture or distribute. Specifically, manufacturers and

distributors must report to FDA whenever they become aware of

information that suggests that a device (1) caused or contributed to a

death, serious illness, or serious injury; or (2) malfunctioned, and there is

a probability that if the malfunction were to recur, the device would cause

or contribute to a death, serious injury, or serious illness. Medical device

user facilities such as hospitals, nursing homes, and outpatient treatment

facilities are also required to report to FDA serious adverse incidents

involving device problems.

Page 30 GAO/HEHS-96-65 Medical Device Regulation
Appendix III 

Description of Selected Aspects of

European Union System for Regulating

Medical Devices

This appendix expands on information provided in the report about

several features of the EU system for regulating medical devices.

Device Classes The EU Medical Devices Directive, which covers most devices, established

a four-part classification system for medical devices. The rules for

classification take into account the riskiness of the device, the device’s

degree of invasiveness, and the length of time the device is in contact with

the body.

• Class I devices are generally regarded as low risk and include most

noninvasive products, certain invasive products, and reusable surgical

instruments.

• Class IIa devices are generally regarded as medium risk and include both

invasive and noninvasive products, generally for short-term use. This class

includes some wound dressings; certain products that channel and store

blood for administration into the body; surgically invasive devices for

transient or short-term use; most active therapeutic devices that

administer or exchange energy; and active diagnostic devices that supply

energy (other than for illumination) absorbed by the body, such as

ultrasonic imagers.

• Class IIb devices are also regarded as medium risk, but this class covers

active products therapeutically delivering energy or substances at

potentially hazardous levels. Devices placed in this class include blood

bags, chemicals that clean or disinfect contact lenses, surgically invasive

devices for long-term use, radiological equipment, and condoms and other

contraceptive devices (except for intrauterine devices, which are in Class

III).

• Class III devices are generally regarded as high risk and include products

that are used to diagnose or monitor or that come in contact with the

circulatory or central nervous system, such as vascular grafts. This

category also includes devices that incorporate medicinal products, such

as bone-cement containing an antibiotic.31

Conformity

Assessment Routes

Under the EU system, the classification of a medical device governs the

type of assessment procedure the manufacturer must undertake to

demonstrate that the device conforms to the essential requirements in the

relevant medical device directive. Generally, when an NB must perform

31The EU directive covering active implantable devices does not contain a classification scheme, but

the devices governed by that directive are subject to the same review requirements as MDD Class III

devices.

Page 31 GAO/HEHS-96-65 Medical Device Regulation
Appendix III 

Description of Selected Aspects of

European Union System for Regulating

Medical Devices

aspects of conformity assessment, the manufacturer may choose the

assessment route from two or more options.32

Full Quality Assurance

System Review (Annex II)

This type of review examines every aspect of the manufacturer’s quality

assurance system, covering every phase of the manufacture of a device,

from design through shipping. The phases involved in producing a new

device for the market include a feasibility phase; design phase, which

results in a written definition of the device; design verification, which

involves creating prototypes of the device; mass production; and full

market release. At each of these phases the manufacturer must ensure that

it has defined the requirements for completing that phase and that the

“deliverable” for that phase, such as a product design or a packaged

device, is verified by qualified staff.

A manufacturer choosing the full QA system route for a Class III device is

also required to submit a design dossier for the NB’s review. The dossier

may include specifications and performance data of the product as

claimed; an explanation of how the product meets the essential

requirements for safety; risk analysis, including risk control methods;

electrical/mechanical/chemical constructional data, including drawings;

design verification documents; and, when relevant, clinical investigation

data.

After certifying a manufacturer’s QA system, the NB must carry out periodic

inspections to ensure that the manufacturer is continuing to implement the

QA system. Additionally, the NB may pay unannounced visits to the

manufacturer to check that the quality system is working properly.

Under the full QA assessment route, the NB does not need to conduct

individual reviews of related devices that are produced under the same QA

system. If the NB certifies the manufacturer’s QA system, that certification

covers the related devices. This practice allows the manufacturer to place

a CE mark on and market all of the related devices without going through

an additional conformity assessment review.

Type Examination (Annex

III)

Type examination is a procedure in which the NB ascertains and certifies

that a representative sample of the device being reviewed conforms to the

essential requirements. The NB reviews documentation on the device that

32Annex numbers following the names of the assessment routes refer to the sections of the EU medical

device directives that describe the various conformity assessment routes.

Page 32 GAO/HEHS-96-65 Medical Device Regulation
Appendix III 

Description of Selected Aspects of

European Union System for Regulating

Medical Devices

the manufacturer provides and conducts a product test of the device. The

NB physically tests a prototype of the device to determine whether it meets

certain standards. The documentation reviewed might include

documentation of other product tests. Type examination is always linked

with a QA review limited to the production phase of manufacture. The QA

review is intended to ensure the consistency of product quality. There are

three types of limited QA reviews, as follows.

Product Verification (Annex IV) In this type of review, the NB must individually test every device produced

or test a random sample from every production batch. (This option is also

referred to as batch verification.) Few companies choose this approach

because it is very expensive.

Production Quality Assurance

(Annex V)

Under this type of review, the NB reviews the manufacturer’s QA system for

the production stage of manufacturing devices, including inspection and

QA techniques. The NB must carry out periodic inspections after certifying

the production QA system and can pay unannounced visits to the

manufacturer. Officials who work with the EU system reported to us that

this is the type of production phase quality review that manufacturers

select most often to complement type examination.

Product Quality Assurance

(Annex VI)

The NB reviews and certifies the manufacturer’s system for inspecting and

testing final products in an Annex VI review. The NB must carry out

periodic inspections and can pay unannounced visits to the manufacturer.

Declaration of Conformity

(Annex VII)

Under this procedure, which is available only for devices in Classes I and

IIa, a manufacturer furnishes a declaration that a device conforms to the

essential requirements and maintains technical documentation that would

permit review of the device.

Assessment

Requirements for

Device Classes

The EU’s MDD specifies which conformity assessment routes each class of

devices may use to demonstrate conformity with the essential

requirements. Figure III.1 illustrates the assessment routes available to

each device class.

Page 33 GAO/HEHS-96-65 Medical Device Regulation
Appendix III 

Description of Selected Aspects of

European Union System for Regulating

Medical Devices

Figure III.1: Conformity Assessment Routes in European Union Medical Devices Directive

Annex II

Medical Devices

Directive Audit by

Notified Body

Annex VII

Medical Devices

Directive Declaration

of Conformity

Sterile

or

Measuring

?

Device

CE Mark

Verification by

Notified Body of

Sterilization/

Measuring Features

Annex II

Medical Devices

Directive Audit by

Notified Body

Annex III Medical

Devices Directive Type

Examination by

Notified Body

Device

CE Mark

Class IIb

Class I

Y

N

Class IIa

Class III

Annex IV Medical

Devices Directive

Product Verification

by Notified Body

Annex VI

Medical Devices

Directive Audit

by Notified Body

Annex V

Medical Devices

Directive Audit

by Notified Body

Annex II

Medical Devices

Directive Audit by

Notified Body

Annex VII

Medical Devices

Directive Declaration

of Conformity

Device

CE Mark

Annex IV Medical

Devices Directive

Product Verification

by Notified Body

Annex VI

Medical Devices

Directive Audit

by Notified Body

Annex V

Medical Devices

Directive Audit

by Notified Body

Annex III Medical

Devices Directive

Type Examination

by Notified Body

Device

CE Mark

Annex IV Medical

Devices Directive

Product Verification

by Notified Body

Product Design

Dossier Examination

by Notified Body

Annex V

Medical Devices

Directive Audit

by Notified Body

(Figure notes on next page)

Page 34 GAO/HEHS-96-65 Medical Device Regulation
Appendix III 

Description of Selected Aspects of

European Union System for Regulating

Medical Devices

Source: Medical Devices Agency, Department of Health, UK.

Class I For Class I products that do not involve measuring devices or sterilization,

manufacturers may simply furnish the declaration of conformity (Annex

VII) and maintain sufficient technical documentation to permit review of

the device. There is no NB review, but the manufacturer must register such

devices with the competent authority in the country of the manufacturer’s

registered place of business. If the device has a measuring function or

must be placed on the market in a sterile condition, the manufacturer is

also subject to one of the assessment routes covering production quality

(Annexes IV, V, or VI). The NB’s review focuses only on the measurement

or sterilization aspect of the device.

Class IIa The manufacturer itself may declare conformity with the essential

requirements covering the design phase and choose one of the assessment

routes covering production quality (Annexes IV, V, or VI). Alternatively,

the manufacturer may undergo the full QA system review (Annex II).

Class IIb The manufacturer may choose either the full QA system review (Annex II),

or type examination (Annex III) plus one of the production quality reviews

(Annexes IV, V, or VI).

Class III The requirements are the same as for Class IIb, with two exceptions. If the

manufacturer chooses the full QA system review (Annex II), it must also

submit a design dossier to the NB. If the manufacturer chooses type

examination (Annex III), it must choose either product verification (Annex

IV) or production quality assurance (Annex V) for the production phase

assessment. Product quality assurance (Annex VI) is not an option for

Class III devices.

The Safeguard Clause The EU’s medical device directives have a safeguard clause that requires

each member state’s competent authority to withdraw from the market

CE-marked devices that the competent authority finds may compromise

patients’ health or safety. The competent authority must immediately

inform the European Commission both that it has taken this action and of

its reasons for withdrawing the device. If the Commission agrees that the

action was justified, it will inform the other member states that the device

Page 35 GAO/HEHS-96-65 Medical Device Regulation
Appendix III 

Description of Selected Aspects of

European Union System for Regulating

Medical Devices

has been withdrawn. If the Commission believes the withdrawal was

unjustified, it informs the competent authority that made the decision and

the device manufacturer of that decision. If a competent authority persists

in banning a CE-marked product from its country’s market, despite the

European Commission’s decision that the device belongs on the market,

the Commission can bring a legal proceeding in the European Court of

Justice. European officials view the safeguard clause as a last resort, not

something to be invoked routinely. If member states could routinely block

the sale of CE-marked devices in their countries, the EU system’s goal of

facilitating EU-wide trade would be undermined.

Page 36 GAO/HEHS-96-65 Medical Device Regulation
Appendix IV 

Comments From the Food and Drug

Administration

Page 37 GAO/HEHS-96-65 Medical Device Regulation
Appendix IV 

Comments From the Food and Drug

Administration

Page 38 GAO/HEHS-96-65 Medical Device Regulation
Appendix IV 

Comments From the Food and Drug

Administration

Now on p. 3.

Now on p. 3.

Now on p. 3.

Page 39 GAO/HEHS-96-65 Medical Device Regulation
Appendix IV 

Comments From the Food and Drug

Administration

Now on p. 4.

Now on p. 5.

Now on p. 6.

See footnote 9.

See footnote 9.

Now on p. 7.

Page 40 GAO/HEHS-96-65 Medical Device Regulation
Appendix IV 

Comments From the Food and Drug

Administration

Now on p. 8.

Now on p. 8.

See footnote 17.

Now on p. 11.

Now on p. 12.

Page 41 GAO/HEHS-96-65 Medical Device Regulation
Appendix IV 

Comments From the Food and Drug

Administration

Now on p. 13.

Now on p. 13.

Now on p. 13.

Now on p. 13.

Now on p. 14.

Now on p. 15.

See footnote 5.

Now on p. 25.

Page 42 GAO/HEHS-96-65 Medical Device Regulation
Appendix IV 

Comments From the Food and Drug

Administration

Now on p. 25.

See footnote 24.

Now on p. 26.

Now on p. 26.

Now on p. 26.

Now on p. 27.

Page 43 GAO/HEHS-96-65 Medical Device Regulation
Appendix IV 

Comments From the Food and Drug

Administration

See footnote 25.

Now on p. 27.

Now on p. 27.

Now on p. 28.

Now on p. 28.

Now on p. 28.

Now on p. 29.

Now on p. 29.

Page 44 GAO/HEHS-96-65 Medical Device Regulation
Appendix IV 

Comments From the Food and Drug

Administration

Now on p. 30.

Now on p. 30.

Now on p. 30.

Page 45 GAO/HEHS-96-65 Medical Device Regulation
Appendix IV 

Comments From the Food and Drug

Administration

Page 46 GAO/HEHS-96-65 Medical Device Regulation
Appendix IV 

Comments From the Food and Drug

Administration

Page 47 GAO/HEHS-96-65 Medical Device Regulation
Related GAO Products

Medical Devices: FDA Review Time (GAO/PEMD-96-2, Oct. 30, 1995).

FDA Drug Approval: Review Time Has Decreased in Recent Years

(GAO/PEMD-96-1, Oct. 20, 1995).

Medical Technology: Quality Assurance Systems and Global Markets

(GAO/PEMD-93-15, Aug. 18, 1993).

Medical Technology: Implementing the Good Manufacturing Practices

Regulation (GAO/T-PEMD-92-6, Mar. 25, 1992).

Medical Technology: Quality Assurance Needs Stronger Management

Emphasis and Higher Priority (GAO/PEMD-92-10, Feb. 13, 1992).

Medical Devices: FDA’s 510(k) Operations Could Be Improved

(GAO/PEMD-88-14, Aug. 17, 1988).

(108230) Page 48 GAO/HEHS-96-65 Medical Device Regulation
Ordering Information

The first copy of each GAO report and testimony is free.

Additional copies are $2 each. Orders should be sent to the

following address, accompanied by a check or money order

made out to the Superintendent of Documents, when

necessary. VISA and MasterCard credit cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address

are discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 6015

Gaithersburg, MD 20884-6015

or visit:

Room 1100

700 4th St. NW (corner of 4th and G Sts. NW)

U.S. General Accounting Office

Washington, DC

Orders may also be placed by calling (202) 512-6000 

or by using fax number (301) 258-4066, or TDD (301) 413-0006.

Each day, GAO issues a list of newly available reports and

testimony. To receive facsimile copies of the daily list or any

list from the past 30 days, please call (202) 512-6000 using a

touchtone phone. A recorded menu will provide information on

how to obtain these lists.

For information on how to access GAO reports on the INTERNET,

send an e-mail message with "info" in the body to:

info@www.gao.gov

PRINTED ON RECYCLED PAPER
United States

General Accounting Office

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Correction Requested

Bulk Rate

Postage & Fees Paid

GAO

Permit No. G100