2. Medical device regulation at EU-level

Current EU regulation on medical devices is largely a response to a series of health scandals, the most significant of which involved breast implants made by French company Poly Implant Prothèse (PIP). In the 2000s, PIP offered breast implants that were significantly cheaper than other options. Concerns about the quality of PIP implants were identified by surgeons as early as 2006 (Lahiri and Waters, Reference Lahiri and Waters2006; Department of Health, 2012a). Despite preliminary enquiries by individual government agencies, no significant action was taken until March 2010, when the French Agence française de sécurité sanitaire des produits de santé (Health Products Security Agency, AFSSAPS) banned the implants.

Investigations into PIP's manufacturing process found that the company was manufacturing implants with industrial grade silicone and had falsified its records to hide the deception (European Commission, 2012). Media reports describe the substance used as a ‘homemade’, untested concoction of silicone, close to that commonly found in mattresses (Sage et al., Reference Sage, Huet and Rosnoblet2012). PIP had been using the low-grade silicone to save money since at least 2001, and approximately 300,000 women in 65 countries received PIP implants between 2001 and the ban in 2010 (although because of poor or non-existent requirements to keep track of those receiving implants through centralized registries, many more people may have been affected).

PIP implants are at greater risk of rupture than those made with medical grade silicone, due to weaker shells, and this risk increases as the implants age. Tests for cytotoxicity and genotoxicity have proven negative (European Commission, 2012) but the implants can cause irritation of the breast tissue, inflammation and acute pain (European Commission, 2013, 2014).

During the investigations, it was discovered that the US Food and Drug Administration (FDA) had inspected PIP's manufacturing facility in La Seyne sur Mer as early as 2000 in connection with saline implants, discovered major aberrations in the manufacturing process and ultimately banned the sale of PIP implants in America (FDA, 2000a, 2000b; Yukhananov, Reference Yukhananov2011). No other state acted definitively until the French ban in 2010. While the French government ultimately recommended prophylactic explantation for approximately 30,000 affected women, the UK maintained that there was no evidence for increased risk of rupture or cancer for the estimated 40,000 affected women in the UK (most of whom had received private, not NHS, care) and advised against routine explantation (MHRA, 2010a, 2010b; Department of Health (UK), 2011a, 2011b).

How did this episode, featuring gross regulatory failure followed by divergent member state actions, happen within what is normally presented as a single European market regulated according to the precautionary principle? The PIP scandal is one of several involving medium- and high-risk medical devices in recent years (e.g., vaginal mesh implants and metal-on-metal hip replacements) where similar failures of governance and patterns of divergent responses by states can be seen (ICIJ, 2018a, 2018b). These patterns point to structural features of the regulatory framework for medical devices in the EU that seem highly conducive to regulatory failure.

A huge range and number of medical devices of various degrees of risk are available across the EU's member states, which makes adopting harmonized rules to regulate them very difficult (Hancher and Sauter, Reference Hancher and Sauter2012). A further challenge when it comes to regulating medical devices is the difficulty of conducting ethical clinical trials prior to commercialization. It is broadly accepted that much of the data on the safety and efficacy of medical devices has to be gathered during the post-market phase of development (McHale, Reference McHale2018).

The EU's solution to medical device regulation stems from the EU's strategy to ‘complete’ its single market (Altenstetter, Reference Altenstetter2008; Hancher and Sauter, Reference Hancher and Sauter2012; Hervey and McHale, Reference Hervey and McHale2015). Beginning in the mid-1980s, member states adopted a strategy consisting of ‘negative integration’, attempting to break down regulatory barriers to trade and free movement of capital across national borders, and ‘positive integration’ where common rules to govern the market would be established. Frequently, however, member states found it very difficult to agree on common rules, particularly in highly technical areas, meaning that EU policymaking was slow and fractious.

As a means to speed up the deregulatory process, a ‘New Approach’ was adopted that gives private rule-makers the responsibility for setting technical standards. Under the New Approach, the EU adopts directives and regulations (‘framework directives’) that contain the ‘essential requirements’ with which products have to comply but not the necessary technical standards. The technical specifications for a product are then laid down in a European harmonized standard by one of several standardization bodies (Neerhof, Reference Neerhof and Rott2019). These technical specifications are voluntary, but if a product is deemed to be in conformity with them, it is automatically assumed to also meet the ‘essential requirements’ set down in EU law [Regulation (EU) No 1025/2012].

EU rules around medical devices were harmonized in the 1990s in a series of New Approach framework directives, with the adoption of the Implantable Medical Devices Directive in 1990, the Medical Devices Directive (MDD) in 1993 and an amendment on IVD devices in 1998. Vigilance, the public reporting of adverse events, was only mandated in 2007 via a modifying directive (Hancher and Sauter, Reference Hancher and Sauter2012).

This regulatory system was and is overseen by the Directorate General (DG, in this case DG GROW) within the European Commission responsible for the smooth functioning of the internal market and supporting enterprise. Responsibility for medical devices was moved to DG GROW under the Juncker Commission but moved back to the health DG (DG SANTE) with the 2019 von der Leyen Commission. This is important because the priorities of the two DGs, and the stakeholders that they engage with, are very different.

In terms of capacity, the Commission maintains only a small staff dedicated to regulating medical devices, with numbers dipping as low as seven full-time equivalent (FTE) staff members in recent years. In contrast, the FDA counts 1700 FTE staff, including medical officers and statisticians (ESC, 2018). This reflects the dominance of private actors and member states in the EU regulatory system as well as ongoing capacity constraints imposed on the Commission.

Behind these staffing numbers, comparison with the US shows that the EU approach is quite different. The regulatory regime for medical devices is more stringent in the United States than in Europe. Like pharmaceuticals, medical devices manufactured in the US are assessed by the FDA for their safety and effectiveness. Manufacturers are required to conduct one or several clinical trials and this procedure can take several years. The evaluation criteria are therefore narrower in the EU than in the US. This implies that higher-risk devices tend to be authorized and commercialized more quickly in Europe than in the United States (Greer et al., Reference Greer, Fahy, Rozenblum, Jarman, Palm, Elliott and Wismar2019).

Rather than assessment by public officials, conformity with EU law on medical devices is assessed by private companies known as Notified Bodies (NBs). NBs are licensed by member states to carry out quality checks and inspections. Products deemed by NBs to conform with the technical specifications can be given a CE (Conformité Européenne) mark, a symbol that declares to the relevant regulatory bodies that the product is marketable and conforms to the requirements of the relevant framework directive. The CE mark acts as a form of ‘passport’, allowing the device to freely circulate in the EU market (Hervey and McHale, Reference Hervey and McHale2015).

Several core elements of the regulatory regime at the EU level – the ‘essential requirements’ for safety, CE marking, clinical evaluation requirements and delegation of authority to NBs – contribute to poor accountability and transparency in the system. First, before medical devices can be sold in the EU, manufacturers must meet the ‘essential requirements’ set out in Annex I (of the 1993 and 2007 Directives). Devices must be designed and manufactured ‘in such a way that, when used under the conditions and for the purposes intended, they will not compromise the clinical condition or safety of patients’ or others. The risks associated with using the device should be ‘acceptable risks when weighed against the benefits to the patients’ and ‘compatible with a high level of protection of health and safety’. Annex I also specifies ‘design and construction requirements’ which focus on specific aspects of the device such as its ‘chemical, physical and biological properties’, or its manufacturing process – this latter aspect must be designed in such way as to ‘eliminate risks of infections and microbial contamination’.

These ‘essential requirements’ (replaced by ‘General Safety and Performance Requirements’ in the 2017 regulations) are important because they are effectively the only health norms that companies were required to consider before bringing their products to market. Assessing the limitations of the European medical devices regulation system, French MPs observed that using essential requirements as health standards significantly weakens agency control over medical devices prior to their commercialization. These generic norms did not capture the diversity of medical devices manufactured in Europe and would therefore apply to a minority of devices while being inoperative standards for the majority. Second, the use of both non-binding and mandatory essential requirements generates legal uncertainty. Finally, the standards barely evolved between 1993 and 2017, despite successive health scandals that revealed their inadequacy. Given the generality and obsolescence of the essential requirements, compliance was not always guaranteed (Assemblée nationale, 2019).

CE marking has also been criticized. Devices considered to meet the essential requirements must obtain CE marking before being placed on the market (Directive 93/42/ECC, Article 17.1.). Requesting CE marking is a technical process that can lead to errors. For instance, when requesting a CE marking, a company is required to confirm its device's level of risk classification (I, IIa, IIb or III). This classification has been criticized for involving vaguely-constructed categories and giving too much discretion to firms. CE marking can be missing or can be improperly affixed to medical devices that fall into a different category or to products that are not covered by the 1993 Directive.

Manufacturers must demonstrate conformity through a clinical evaluation, the ‘assessment of clinical data pertaining to a medical device in order to verify’ clinical safety and performance (DG Enterprise and Industry, 2009). But this requirement was optional until 2010, when the 2007 Directive was transposed into national law. The clinical evaluation can be based on either ‘a critical evaluation of the results of all clinical investigations made’ or an evaluation of relevant scientific literature ‘where there is demonstration of equivalence’ between the new device and the device to which the data relates (Directive 93/42/ECC as modified, Annex X).

Under Chapter VI. Article 61 of the new Medical Device Directive, the manufacturer is still responsible for ‘specifying’ and ‘justifying the level of clinical evidence necessary to demonstrate conformity (…)’. This new framework still allows the use of ‘equivalence’, which significantly contributed to the metal hip and surgical mesh design faults that affected British patients (Heneghan, Reference Heneghan2018). In other words, under this legal regime which relies on ‘validation by comparison’, manufacturers do not systematically have to conduct clinical tests. A demonstration of equivalence, however, is of uncertain value if one assumes that there is an incremental improvement – or at least change – in the quality of a newly manufactured device (as opposed to the older device to which it is compared; this goes against the presumption of equivalence). Studies by health researchers have uncovered chains of ‘equivalent’ devices, judged as safe on the grounds of the clinical evidence behind only one or two originating devices – which may have since been taken off the market (Heneghan, Reference Heneghan2018).

A further problem is that NBs are responsible for assessing the quality of the literature reviews conducted by the manufacturer. As noticed by French MPs, NBs' critical appraisal is often questionable as they tend to positively assess reviews they barely read (Assemblée nationale, 2019).

Finally, broad questions have been raised about the delegation of pre-market regulatory authority to NBs. NBs perform calibration, testing, certification and inspection activities. Studies and administrative reports have shown that before the passage of the 2017 Directive, NBs were the only product regulators prior to commercialization, despite exhibiting market behaviours and relying on funding schemes that seemed incompatible with conducting conformity assessment procedures (Directive 93/42/ECC, Art. 11).

Manufacturers are free to choose any NB that has been legally designated to carry out the conformity assessment procedure, while NBs are legally required to be independent from their clients. One means of ensuring NBs' independence is the requirement that staff members declare any potential conflicts of interest (European Union, 2013). Concerns, however, have been raised regarding their lack of independence.

Another source for concern is the fact that NBs evolve in a competitive market, compete against each other and adopt market behaviours, which can go against their fundamental public health role. The 1993 Directive did not formally define NBs' purpose or duties in terms of public health. It is only recently that the European Court of Justice (CJEU) confirmed that NBs were responsible for protecting end users of medical devices.

Indeed, in a key development for PIP breast implant litigation, the CJEU delivered on 16 February 2017 a preliminary ruling in Case C-219/15 Elisabeth Schmitt v TUÜV Rheinland LGA Products GmbH which confirmed ‘that the purpose of the notified body's involvement in the procedure relating to the EC declaration of conformity is to protect the end users of medical devices’. However, the Court sent the question of whether this gives rise to a direct liability to end users firmly back to the national courts. In the wake of this decision, on the case of PIP breast implants, the French Cour de Cassation imposed an ‘obligation of vigilance’ to notified authorities responsible for the certification of implantable medical devices. The Highest Civil Court decided that if NBs find elements suggesting that medical devices are not consistent with the requirement of Directive 93/42/ECC during their monitoring mission, they must take all the necessary measures, check all available documents, identify raw materials and organize unscheduled visits to the manufacturer (Cour de Cassation, 2018).

The evolution of the liability of NBs for medical devices is significant. It is, however, the last of a series of incremental measures taken between 2013 and 2017 that aim to ensure better protection of medical device users. In its 2013 regulation, the European Commission noted that the use of ‘more complex devices and production methods…resulted in variations in the level of competence of notified bodies and in different degrees of stringency applied by them’ (European Commission, 2013). The 2013 Regulation tightened the procedure for the designation, surveillance and monitoring of NBs in order to ensure their complete independence. For instance, as noted above, the Regulation requires NBs to be ‘independent of the manufacturer of the product in relation to which it performs conformity assessment activities’ and ‘from any other economic operator having an interest in the product as well as of any competitor of the manufacturer’ (Annex I). An NB's organization must ‘safeguard the independence, objectivity and impartiality of its activities’. Under this new regime, the designating authority of the Member State where the NB is established must assess it in accordance with a check-list covering the items listed in Annex II to the Directive, with criteria ranging from ‘independence and impartiality’ to ‘quality management systems’ and a description of the ‘qualification’ of personnel. The designating authority of the Member States where the NB is established is required to ‘assess an appropriate number of a notified body's reviews of the manufacturer's clinical evaluations’ and to carry out surveillance of onsite assessments and observed audits at regular intervals (Art. 5). The Commission may also investigate cases regarding the competence of an NB or the fulfilment of these requirements (Art. 6).

Following the enactment of this regulation, no fewer than 18 (out of 77) European NBs lost their designation because they did not meet the criteria laid out by the 2013 Regulation (Assemblée nationale, 2019). This drastic reduction in the number of NBs shows the extent to which the pre-2013 legal regime did not ensure their independence, despite their centrality in the medical device regulation process.

3. Market and post-market surveillance in France and the UK

Despite changes that improved the quality of the conformity assessment procedure conducted by NBs, national competent authorities (CAs) are still not involved in pre-market medical device control procedures. The French Drug and Medical Product Agency (ANSM)'s only mission, at this stage, consists of monitoring GMED, France's only NB. Its UK counterpart, the Medicines and Healthcare products Regulatory Agency (MHRA) oversees four NBs.

Once medical devices are placed on the French market, ANSM is responsible for ensuring their safety and compliance with European regulations. The ANSM, which receives and assesses adverse effects reports, can conduct unexpected inspections and take ‘sanitary police’ measures, including suspending, limiting or conditioning the use of a medical device to specific rules when a device causes serious harm to its users (article L.5312-1 of the public health code).

Post-market medical device surveillance (known in French as matériovigilance) relies primarily on the ANSM, but also involves a variety of external actors, including manufacturers, importers, distributors and operators, as well as patients, physicians, pharmacists and local correspondants for matériovigilance. Two recent reports – one by the French audit, evaluation and inspection office for health, social and labour policies (IGAS, 2018), the other by a parliamentary mission (Assemblée nationale, 2019) – identified several issues arising at different stages of the post-market surveillance process, including issues of accountability, poor capacity and a lack of transparency.

In terms of accountability, manufacturers who have knowledge of an incident or a risk of an incident involving their device, which resulted or may result in death or serious deterioration in a patient's condition, are required by the public health code (art. L.5212-2) to report it without delay to the ANSM. A manufacturer who fails to meet these obligations faces a two-year prison sentence and a 150,000-euro fine (art. L.5461-2-1). This legal framework raises two concerns. First, the surveillance process relies heavily on the manufacturer's goodwill. An unscrupulous manufacturer might choose not to report any incident, even if it takes the flawed medical device off the market, because the penalties imposed by the public health code are not dissuasive enough (IGAS, 2018). Second, only the most serious incidents (listed in art. R.5212-2) must be reported to the ANSM. Reporting of other types of incident is optional and therefore often limited, as revealed by the parliamentary report. Finally, when a flawed device is explanted due to safety concerns – as is the case with macro textured breast implants – surgeons are not required to send the explant to the ANSM for further investigation (Assemblée nationale, 2019).

Once incidents are reported to the ANSM, they are assessed by a single individual. The assessor's work is rarely supervised by superiors and relies primarily on his or her expertise. As noted by the IGAS, ‘the absence of a second order of control and systematic hierarchical supervision, combined with the strong degree of discretion left to the assessor, creates a likelihood that risks associated with medical devices will go undetected, and therefore will not be properly addressed’ (IGAS, 2018). Moreover, the ANSM does not have the capacity to treat incident reports in a timely manner. The duration between an incident and its reporting often exceeds the regulatory three-month period. The ANSM has 60 days by law to compile a report concerning any major incident, but in practice frequently exceeds this limit. On average, the adoption of corrective measures following an incident can take between 21 and 215 days (with an average of 95 days), regardless of the incident's severity. In 2017, ANSM's assessors treated 17,142 reports, including 12,467 that required further investigation. They treated on average 300 reports simultaneously, which according to the Inspection's report prevented them from conducting thorough analysis (IGAS, 2018).

The ANSM also has poor relationships with its local correspondants, designated professionals working in public or private hospitals, or patient association members, responsible for reporting medical devices flaws to the ANSM (art. R.5212-12). In its October 2018 report, the IGAS observes that ‘the ANSM's list of 3193 CLMV [local correspondants] is not regularly updated, and about 80% of its contacts are listed in error. This level of imprecision reflects an underestimation of the importance of local actors, which are nonetheless indispensable in the early detection of matériovigilance signals, as well as in the follow-up measures put in place by agencies and manufacturers’ (IGAS, 2018). European institutions play a limited role and rarely share matériovigilance information with national authorities (IGAS, 2018).

In terms of transparency, there is a lack of publicly available information about flawed devices. Since March 2017, health professionals and patients can report adverse incidents online. An online database, MRveille, compiles incident reports from 2016 onwards. But unlike its American counterpart, the Manufacturer and User Facility Device Experience, MRVeille is not accessible to the public.

France has at least implemented measures to tackle conflicts of interest in the regulation of medical devices, through a series of recent laws, e.g., Loi 2011-2012 of 29 December 2011, adopted in the wake of the Mediator scandal, when an improperly prescribed weight loss drug led to deaths. Public officials must now make a public declaration of interests (Article. L.1451-1 of the public health code). They cannot work with an entity with which they have links of interests and may not be offered or promised benefits in kind or cash by companies marketing products subject to the ANSM's control, such as drugs and medical devices. As for health professionals, article L.1453-3 of the public health code, introduced by Ordonnance n°2017-49 of 19 January 2017, imposes an ‘anti-gifts’ logic (logique anti-cadeaux), which prohibits benefits in kind or cash to health professionals and medical students. Based on pre-existing norms related to pharmaceutical drugs, article 58 of the 2018 Social Security Financing Act introduced the principle of a ‘charter of the medical examination’ for medical devices, codified in Article L. 162-17-9 of the Social Security Code, whose aim is to better regulate commercial and promotional practices that could hinder the quality of care or lead to unjustified expenditure for health insurance (Assemblée nationale, 2019).

In the UK, the MHRA has the authority to oversee the sales of medical devices. The MHRA is an Executive Agency that carries out key regulatory functions on behalf of the UK Department of Health and Social Care. The core EU directives governing medical devices are transposed into UK law via the Medical Devices Regulations (2002). The MHRA has the authority to withdraw substandard devices from the market, suspend their production, prosecute manufacturers, issue alerts and warnings to medical professionals and the public, and require manufacturers to make labelling changes.

As in France, reviews of the regulatory regime for medical devices have been conducted in recent years (House of Commons Health Committee, 2012; House of Commons Science and Technology Committee, 2012; Department of Health, 2012a, 2012b, 2012c, 2012d).

In 2012, the Department of Health (DH) undertook a review of the MHRA's actions during the PIP scandal to determine whether the MHRA had acted appropriately, and if they could have reasonably prevented or alleviated the distress of the scandal earlier. The investigation found that the MHRA had acted appropriately, and in as timely a matter as it could, using scientifically-rigorous expert advice. The investigation concluded that, while the MHRA and DH should work to ‘provide a stronger assurance for patients and the public that the device regulatory system is working to safeguard their health’, the blame for the scandal rested squarely on the PIP manufacturer and that there was nothing fundamentally unsound about the current system (Department of Health, 2012b). This review is a cause for concern, as it focussed largely on the agency's reaction to the scandal after the fact and not the deficiencies in the system that allowed harmful products to be on the market for such a long time.

Other reviews have not been so kind, highlighting several features of the UK's regulatory system that contribute to poor outcomes. As in France, conflicts of interest exist, but resolving them has not been a concern of successive governments. Once a medical device has been placed in the UK market, the manufacturer is responsible for monitoring the product and reporting serious adverse incidents to the MHRA. But the MHRA is funded by a combination of government funding and fees paid by pharmaceutical firms, device manufacturers and blood banks. Fees are due for a variety of actions carried out by the agency, including issuing a license, carrying out an inspection and registering clinical investigations (MHRA, 2018). This funding model automatically reframes the relationship between industry and regulator, making the agency somewhat dependent upon its clients.

Addressing conflicts of interest has not been part of the UK government's agenda. Under-secretary of State for Health and Social Care, Jackie Doyle-Price, noted in a parliamentary debate that ‘it is fair to say that perhaps in the past regulation has focused excessively on what is in the commercial interests of businesses to maintain competition, rather than having patient safety at its heart’ (Doyle-Price, Reference Doyle-Price2019). Despite this recognition, the UK government is not recommending changes to the fundamental accountability structures of the current regulatory regime and has no incentive to do so.

Second, concerns have been raised about the lack of engagement of medical professionals and patients in the regulatory process. As in France, the MHRA has been criticized multiple times for failing to communicate with surgeons and patients outside of the NHS system. An example of this is the MHRA's ‘Yellow Card Scheme’, an online reporting scheme where patients and medical professionals can notify the agency about adverse health events relating to medical devices. The Yellow Card scheme has been criticized for being relatively low profile, with many patients and medical professionals unaware that the scheme exists. Little information is available on how the agency uses the yellow card data it collects to conduct post-market surveillance. Furthermore, there seems to be a lack of clarity as to the obligations of medical professionals to report adverse events, with practice mediated through guidance from professional associations.

A related problem is the lack of accurate, comprehensive data to support post-market surveillance. This is likely a consequence of the inability or unwillingness of the government to hold medical providers and supply chain actors to account. There is currently no national, mandatory registry in the UK that covers all high-risk medical devices or all implants, although some device-specific registries exist. We know that voluntary registry, one that does not mandate the inclusion of all data for both public and privately funded patients, is not likely to provide good enough data. A voluntary registry set up by the DH to monitor breast implants simply did not garner enough participation to make the data usable and was abandoned by the department after only a few years.

We also know that a properly constructed register can work well and make a difference in policy and health outcomes. The UK's National Joint Registry, containing information about hip, knee, ankle, elbow and shoulder replacements carried out in England, Wales and Northern Ireland, was set up in 2003. Reporting for NHS organizations (but not private organizations) became mandatory in 2011 (National Joint Registry, 2019). Data from the NJR was a significant asset in managing the fallout from the recent metal-on-metal hip replacement scandal. The gender politics of successfully registering joint replacements but not breast implants or vaginal mesh were noted by female members of parliament (House of Commons, 2018).

In October 2016, the DH made a second attempt to establish a breast implants registry. The Breast and Cosmetic Implant Registry does not require patient consent before data is included in the registry. Although it is mandatory for NHS-funded patient data to be placed in the registry, privately funded patient data is merely requested. As of 2018, the registry held data from 109 NHS and 166 private organizations relating to 20,095 patients (excluding Scotland) (NHS Digital, 2018).

This lack of publicly-available data is not just limited to patient registries. The MHRA does not make public information about the number of recalled devices, risk of harms to patients or the premarket approval process. Manufacturers and NBs hold this data, but both are exempt from Freedom of Information requests. Researchers attempting to collect this data found that some organizations were uncontactable, others declined to participate, and were told by NBs that the information was confidential, who cited ‘restrictions’ in the EU's medical device laws as their reason for non-disclosure (Heneghan et al., Reference Heneghan, Thompson, Billingsley and Cohen2011).

Overall, political discourse around medical device scandals in the UK is infused with the rhetoric of patient safety. The minor policy changes that have occurred in this space focus on creating a system that is more responsive to patients and more inclusive of patients' groups. In 2018, the former Secretary of State for Health and Social Care Jeremy Hunt launched an independent review of medicines and medical device safety in connection with three specific scandals, including one relating to vaginal mesh implants. In calling for the review, Hunt acknowledged that the NHS response to affected patients ‘has not always been good enough’ (Hunt, Reference Hunt2018). A three-year review of the regulation of vaginal mesh conducted by the NHS did not actually look at the safety of the devices themselves. For this reason, the final report was considered so substandard by patient groups that patient representatives resigned from the review committee prior to the report's release (House of Commons, 2018).

Further complications derive from the chaos around the UK's potential exit from the EU, or ‘Brexit’. When the UK leaves the EU, medical devices will still be regulated under the standards currently transposed into UK law. A statutory instrument would then transpose all the core elements of the 2017 EU MDR and IVDR, which would enter into force on the same timetable as in the EU (MHRA, 2017, Medical Devices (Amendment etc.) (EU Exit) Regulations, 2019). The UK is currently seeking to maintain continuity on medical device regulations after its exit from the EU (Fahy et. al. Reference Fahy, Hervey, Dayan, Flear, Galsworthy, Greer, Jarman and McKee2020). But at some future date, the UK may choose to deviate from EU standards. The regulation of breast implants seems a likely case where there will be pressure for the UK to deviate from EU rules (McHale, Reference McHale2018).

4. The EU's revised medical devices regulation

In 2017 (17 years after PIP first began to use unapproved silicone in their implants and seven years after the French government banned their use), the EU passed two new laws intended to address deficiencies in medical device regulation (European Union, 2017a, 2017b). The Medical Device Regulation (MDR) and the In Vitro Diagnostic Medical Device Regulation (IVDR) entered into force in May 2017, replacing the three previous directives. As in previous law on medical devices, the recitals claim that they will ensure ‘a high level of health while supporting innovation’. Importantly, the scope of the new regulations extends to non-medical cosmetic devices – e.g., coloured contact lenses or dermal fillers – which have been connected to health concerns in recent years.

The new regulations do not take the obvious path of altering the regulatory regime by centralizing authority in a single agency, however (McHale, Reference McHale2018). Although the Commission originally proposed a more centralized system closer to that embodied by the European Medicines Agency or FDA, public consultations made clear that this would not be accepted by industry or NBs (Hervey and McHale, Reference Hervey and McHale2015). In deference to industry, the regulations are being phased in slowly – by May 2021 and 2022 respectively, with the transition period extending to 2027 for some components and the COVID-19 pandemic extending deadlines. But devices can already be placed on the market under the new regulations if they fully comply with the requirements.

To what extent are the key governance problems regarding the EU's medical device regulation, described in the previous sections, addressed in the new regulations? Only some of the weaknesses of the regulatory system are addressed by the new regime, and some failures are only partially addressed. This reflects the limited levers of power available to the EU where member states' domestic bureaucracies are concerned, strong opposition to change from industry stakeholders and some member states expressed during the legislative process, and capacity constraints at both EU and member state levels.

First, the new regulations contain several measures designed to increase the transparency of the system through the collation of key supply chain data. The regulations expand the EU's existing centralized database (Eudamed) to collect new data on vigilance, market surveillance and post-market surveillance in a form that will be interoperable with centrally-held clinical trials data on pharmaceuticals (McHale, Reference McHale2018). The regulations also require the creation of a central register of supply chain operators and NBs as well as the central collation of serious incident reports, corrective field actions and clinical investigations. To improve product traceability, supply chain actors will have to assign Unique Device Identifiers (UDIs) to devices and verify they are present at key links in the supply chain.

In terms of greater transparency for patients, implant recipients must now receive ‘implant cards’ that provide them with key information, which is a direct response to the PIP implant scandal, where many women were unsure if they had received a PIP implant.

If these elements come to fruition, the resulting data could improve the system significantly. There is a real chance that some components will not be implemented, however. A centralized, interoperable database of data from 28 member states is technically and politically difficult to construct in practice. Registries also get old quickly and require ongoing resources to keep them up-to-date. The quality and coverage of the database will depend extensively on whether supply chain operators provide true and accurate information. In the event that key transparency improvements such as an enhanced Eudamed do not come to fruition, the previous law remains the default standard (Heneghan, Reference Heneghan2018).

In terms of accountability, the ‘double delegation’ of authority to NBs and then to supply chain actors remains largely intact, although the new regulations do attempt to tighten up requirements at each level. At EU-level, the Commission has the ability to investigate when an NB does not appear to be fulfilling its function. At national level, the regulations confirm that CAs can conduct short-notice or unannounced inspections and that NBs must submit documentation to CAs upon request, and that NB assessments of manufacturers' documentation ‘should’ be evaluated by CAs.

Following on from the Commission's Implementing Regulation in 2013, the new regulations outline in greater detail the duties of NBs, but leave enforcement up to member states. Annex VIII to the MDR lays out additional ‘requirements to be met by notified bodies’, such as the ‘permanent availability of personnel with relevant clinical expertise’ (3.2.4), whose required qualifications are listed over the next three pages and other changes that are likely to reduce the number of designated bodies in the EU, possibly delaying conformity assessments.

In terms of supply chain actors, manufacturers gain additional responsibilities to provide evidence prior to market authorization and collect and retain evidence about device performance in the post-market phase. Class III (high risk) device manufacturers will be required to publish periodic safety and clinical summaries. In a direct response to the breast implants scandal, where PIP went bankrupt before victims could claim compensation, manufacturers must plan for potential financial liability.

The regulations also create a Medical Device Coordination Group (MDCG) composed of relevant experts (which should not have interests in medical device industry). Due to capacity constraints, however, the group has voluntary membership, and its advice is non-binding. This sows doubt as to whether the MDCG will be truly effective or sustainable in the longer term (McHale, Reference McHale2018). Despite these measures intended to improve the evidence base for regulating medical devices, the ability to introduce a device to the market on the basis of equivalence remains a key feature of the system.

The reforms also do nothing to address capacity issues, which could have a detrimental effect on implementing the changes. The Commission may have the authority to carry out investigations where patterns of non-compliance seem to be emerging, but unless it gains additional capacity to do so, very little is likely to change. As shown in the previous section, member states also lack the capacity to adequately scrutinize the actions of NBs, and NBs lack capacity to scrutinize supply chain actors.

Taken together, the regulations maintain, or at best only marginally improve, a dangerous situation. Accountability is key to ensuring regulatory compliance in complex systems. Unless public bodies hold clear authority to monitor the medical device market and can be held to account when their citizens' health is put at risk, they have weak incentives to investigate potential malpractice within the industry or invest in the day-to-day capacity necessary to conduct adequate surveillance of NBs. Unless NBs are adequately held to account by public bodies, they have little incentive to adequately oversee supply chain actors or invest in the day-to-day capacity necessary to conduct adequate surveillance. Unless supply chain actors are held to account by NBs, they have little incentive to ensure that their products are safe. The most prominent mechanism for accountability in the EU remains the European Court System. But as the PIP case shows, legal redress is slow, expensive, inaccessible to some and only able to compensate in the wake of a scandal rather than prevent it from happening.

In summary, the new regime runs the risk of simultaneously failing to protect a high level of human health by maintaining weak lines of accountability, increasing the regulatory burden for manufacturers and regulators, and doing nothing expand capacity to conduct investigations. Supply chain actors, NBs, CAs and the EU are all required by elements of the regulations to collect better data, create new systems and change their behaviours in ways which imply the commitment of additional resources.