Chapter III: Identification and traceability of devices, registration of devices and of economic operators, summary of safety and clinical performance, European database on medical devices
Article 25: Identification within the supply chain
1. Distributors and importers shall co-operate with manufacturers or authorised representatives to achieve an appropriate level of traceability of devices.
2. Economic operators shall be able to identify the following to the competent authority, for the period referred to in Article 10(8):
(a) any economic operator to whom they have directly supplied a device;
(b) any economic operator who has directly supplied them with a device;
(c) any health institution or healthcare professional to which they have directly supplied a device.
Article 26: Medical devices nomenclature
To facilitate the functioning of the European database on medical devices (‘Eudamed’) as referred to in Article 33, the Commission shall ensure that an internationally recognised medical devices nomenclature is available free of charge to manufacturers and other natural or legal persons required by this Regulation to use that nomenclature. The Commission shall also endeavour to ensure that that nomenclature is available to other stakeholders free of charge, where reasonably practicable.
Article 27: Unique Device Identification system
1. The Unique Device Identification system (‘UDI system’) described in Part C of Annex VI shall allow the identification and facilitate the traceability of devices, other than custom-made and investigational devices, and shall consist of the following:
(a) production of a UDI that comprises the following:
(i) a UDI device identifier (‘UDI-DI’) specific to a manufacturer and a device, providing access to the information laid down in Part B of Annex VI;
(ii)a UDI production identifier (‘UDI-PI’) that identifies the unit of device production and if applicable the packaged devices, as specified in Part C of Annex VI;
(b) placing of the UDI on the label of the device or on its packaging;
(c) storage of the UDI by economic operators, health institutions and healthcare professionals, in accordance with the conditions laid down in paragraphs 8 and 9 of this Article respectively;
(d) establishment of an electronic system for Unique Device Identification (‘UDI database’) in accordance with Article 28.
2. The Commission shall, by means of implementing acts, designate one or several entities to operate a system for assignment of UDIs pursuant to this Regulation (‘issuing entity’). That entity or those entities shall satisfy all of the following criteria:
(a) the entity is an organisation with legal personality;
(b) its system for the assignment of UDIs is adequate to identify a device throughout its distribution and use in accordance with the requirements of this Regulation;
(c) its system for the assignment of UDIs conforms to the relevant international standards;
(d) the entity gives access to its system for the assignment of UDIs to all interested users in accordance with a set of predetermined and transparent terms and conditions;
(e) the entity undertakes to do the following:
(i) operate its system for the assignment of UDIs for at least 10 years after its designation;
(ii) make available to the Commission and to the Member States, upon request, information concerning its system for the assignment of UDIs;
(iii) remain in compliance with the criteria for designation and the terms of designation. When designating issuing entities, the Commission shall endeavour to ensure that UDI carriers, as defined in Part C of Annex VI, are universally readable regardless of the system used by the issuing entity, with a view to minimising financial and administrative burdens for economic operators and health institutions.
3. Before placing a device, other than a custom-made device, on the market, the manufacturer shall assign to the device and, if applicable, to all higher levels of packaging, a UDI created in compliance with the rules of the issuing entity designated by the Commission in accordance with paragraph 2.
Before a device, other than a custom-made or investigational device, is placed on the market the manufacturer shall ensure that the information referred to in Part B of Annex VI of the device in question are correctly submitted and transferred to the UDI database referred to in Article 28.
4. UDI carriers shall be placed on the label of the device and on all higher levels of packaging. Higher levels of packaging shall not be understood to include shipping containers.
5. The UDI shall be used for reporting serious incidents and field safety corrective actions in accordance with Article 87.
7. As part of the technical documentation referred to in Annex II, the manufacturer shall keep up-to-date a list of all UDIs that it has assigned.
8. Economic operators shall store and keep, preferably by electronic means, the UDI of the devices which they have supplied or with which they have been supplied, if those devices belong to:
- class III implantable devices;
- the devices, categories or groups of devices determined by a measure referred to in point (a) of paragraph 11.
9. Health institutions shall store and keep preferably by electronic means the UDI of the devices which they have supplied or with which they have been supplied, if those devices belong to class III implantable devices.
For devices other than class III implantable devices, Member States shall encourage, and may require, health institutions to store and keep, preferably by electronic means, the UDI of the devices with which they have been supplied.
Member States shall encourage, and may require, healthcare professionals to store and keep preferably by electronic means, the UDI of the devices with which they have been supplied with.
10. The Commission is empowered to adopt delegated acts in accordance with Article 115:
(a) amending the list of information set out in Part B of Annex VI in the light of technical progress; and
(b) amending Annex VI in the light of international developments and technical progress in the field of Unique Device Identification.
11. The Commission may, by means of implementing acts, specify the detailed arrangements and the procedural aspects for the UDI system with a view to ensuring its harmonised application in relation to any of the following:
(a) determining the devices, categories or groups of devices to which the obligation laid down in paragraph 8 is to apply;
(b) specifying the data to be included in the UDI-PI of specific devices or device groups;
The implementing acts referred to in the first subparagraph shall be adopted in accordance with the examination procedure referred to in Article 114(3).
12. When adopting the measures referred to in paragraph 11, the Commission shall take into account all of the following:
(b) the risk-based approach;
(c) the cost-effectiveness of the measures;
(d) the convergence of UDI systems developed at international level;
(e) the need to avoid duplications in the UDI system;
(f) the needs of the healthcare systems of the Member States, and where possible, compatibility with other medical device identification systems that are used by stakeholders.
Article 28: UDI database
1. The Commission, after consulting the MDCG shall set up and manage a UDI database to validate, collate, process and make available to the public the information mentioned in Part B of Annex VI.
2. When designing the UDI database, the Commission shall take into account the general principles set out in Section 5 of Part C of Annex VI. The UDI database shall be designed in particular such that no UDI-PIs and no commercially confidential product information can be included therein.
3. The core data elements to be provided to the UDI database, referred to in Part B of Annex VI, shall be accessible to the public free of charge.
4. The technical design of the UDI database shall ensure maximum accessibility to information stored therein, including multi-user access and automatic uploads and downloads of that information. The Commission shall provide for technical and administrative support to manufacturers and other users of the UDI database.
Article 29: Registration of devices
1. Before placing a device, other than a custom-made device, on the market, the manufacturer shall, in accordance with the rules of the issuing entity referred to in Article 27(2), assign a Basic UDI-DI as defined in Part C of Annex VI to the device and shall provide it to the UDI database together with the other core data elements referred to in Part B of Annex VI related to that device.
2. Before placing on the market a system or procedure pack pursuant to Article 22(1) and (3), that is not a custom-made device, the natural or legal person responsible shall assign to the system or procedure pack, in compliance with the rules of the issuing entity, a Basic UDI-DI and shall provide it to the UDI database together with the other core data elements referred to in Part B of Annex VI related to that system or procedure pack.
3. For devices that are the subject of a conformity assessment as referred to in Article 52(3) and in the second and third subparagraphs of Article 52(4), the assignment of a Basic UDI-DI referred to in paragraph 1 of this Article shall be done before the manufacturer applies to a notified body for that assessment.
For the devices referred to in the first subparagraph, the notified body shall include a reference to the Basic UDI-DI on the certificate issued in accordance with point (a) of Section 4 of Chapter I of Annex XII and confirm in Eudamed that the information referred to in Section 2.2 of Part A of Annex VI is correct. After the issuing of the relevant certificate and before placing the device on the market, the manufacturer shall provide the Basic UDI-DI to the UDI database together with the other core data elements referred to in Part B of Annex VI related to that device.
4. Before placing a device on the market, other than a custom-made device, the manufacturer shall enter or if, already provided, verify in Eudamed the information referred to in Section 2 of Part A of Annex VI, with the exception of Section 2.2 thereof, and shall thereafter keep the information updated.
Article 30: Electronic system for registration of economic operators
1. The Commission, after consulting the MDCG, shall set up and manage an electronic system to create the single registration number referred to in Article 31(2) and to collate and process information that is necessary and proportionate to identify the manufacturer and, where applicable, the authorised representative and the importer. The details regarding the information to be provided to that electronic system by the economic operators are laid down in Section 1 of Part A of Annex VI.
2. Member States may maintain or introduce national provisions on registration of distributors of devices which have been made available on their territory.
3. Within two weeks of placing a device, other than a custom-made device, on the market, importers shall verify that the manufacturer or authorised representative has provided to the electronic system the information referred to in paragraph 1.
Where applicable, importers shall inform the relevant authorised representative or manufacturer if the information referred to in paragraph 1 is not included or is incorrect. Importers shall add their details to the relevant entry/entries.
Article 31: Registration of manufacturers, authorised representatives and importers
1. Before placing a device, other than a custom-made device, on the market, manufacturers, authorised representatives and importers shall, in order to register, submit to the electronic system referred to in Article 30 the information referred to in Section 1 of Part A of Annex VI, provided that they have not already registered in accordance with this Article. In cases where the conformity assessment procedure requires the involvement of a notified body pursuant to Article 52, the information referred to in Section 1 of Part A of Annex VI shall be provided to that electronic system before applying to the notified body.
2. After having verified the data entered pursuant to paragraph 1, the competent authority shall obtain a single registration number (‘SRN’) from the electronic system referred to in Article 30 and issue it to the manufacturer, the authorised representative or the importer.
3. The manufacturer shall use the SRN when applying to a notified body for conformity assessment and for accessing Eudamed in order to fulfil its obligations under Article 29.
4. Within one week of any change occurring in relation to the information referred to in paragraph 1 of this Article, the economic operator shall update the data in the electronic system referred to in Article 30.
5. Not later than one year after submission of the information in accordance with paragraph 1, and every second year thereafter, the economic operator shall confirm the accuracy of the data. In the event of a failure to do so within six months of those deadlines, any Member State may take appropriate corrective measures within its territory until that economic operator complies with that obligation.
6. Without prejudice to the economic operator's responsibility for the data, the competent authority shall verify the confirmed data referred to in Section 1 of Part A of Annex VI.
7. The data entered pursuant to paragraph 1 of this Article in the electronic system referred to in Article 30 shall be accessible to the public.
8. The competent authority may use the data to charge the manufacturer, the authorised representative or the importer a fee pursuant to Article 111.
Article 32: Summary of safety and clinical performance
1. For implantable devices and for class III devices, other than custom-made or investigational devices, the manufacturer shall draw up a summary of safety and clinical performance.
The summary of safety and clinical performance shall be written in a way that is clear to the intended user and, if relevant, to the patient and shall be made available to the public via Eudamed.
The draft of the summary of safety and clinical performance shall be part of the documentation to be submitted to the notified body involved in the conformity assessment pursuant to Article 52 and shall be validated by that body. After its validation, the notified body shall upload the summary to Eudamed. The manufacturer shall mention on the label or instructions for use where the summary is available.
2. The summary of safety and clinical performance shall include at least the following aspects:
(a) the identification of the device and the manufacturer, including the Basic UDI-DI and, if already issued, the SRN;
(b) the intended purpose of the device and any indications, contraindications and target populations;
(c) a description of the device, including a reference to previous generation(s) or variants if such exist, and a description of the differences, as well as, where relevant, a description of any accessories, other devices and products, which are intended to be used in combination with the device;
(d) possible diagnostic or therapeutic alternatives;
(e) reference to any harmonised standards and CS applied;
(f) the summary of clinical evaluation as referred to in Annex XIV, and relevant information on post-market clinical follow-up;
(g) suggested profile and training for users;
(h) information on any residual risks and any undesirable effects, warnings and precautions.
3. The Commission may, by means of implementing acts, set out the form and the presentation of the data elements to be included in the summary of safety and clinical performance. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 114(2).
Article 33: European database on medical devices
1. The Commission, after consulting the MDCG, shall set up, maintain and manage the European database on medical devices (‘Eudamed’) for the following purposes:
(a) to enable the public to be adequately informed about devices placed on the market, the corresponding certificates issued by notified bodies and about the relevant economic operators;
(b) to enable unique identification of devices within the internal market and to facilitate their traceability;
(c) to enable the public to be adequately informed about clinical investigations and to enable sponsors of clinical investigations to comply with obligations under Articles 62 to 80, Article 82, and any acts adopted pursuant to Article 81;
(e) to enable the competent authorities of the Member States and the Commission to carry out their tasks relating to this Regulation on a well-informed basis and to enhance the cooperation between them.
2. Eudamed shall include the following electronic systems:
(a) the electronic system for registration of devices referred to in Article 29(4);
(b) the UDI-database referred to in Article 28;
(c) the electronic system on registration of economic operators referred to in Article 30;
(d) the electronic system on notified bodies and on certificates referred to in Article 57;
(e) the electronic system on clinical investigations referred to in Article 73;
(f) the electronic system on vigilance and post-market surveillance referred to in Article 92;
(g) the electronic system on market surveillance referred to in Article 100.
3. When designing Eudamed the Commission shall give due consideration to compatibility with national databases and national web-interfaces to allow for import and export of data.
4. The data shall be entered into Eudamed by the Member States, notified bodies, economic operators and sponsors as specified in the provisions on the electronic systems referred to in paragraph 2. The Commission shall provide for technical and administrative support to users of Eudamed.
5. All the information collated and processed by Eudamed shall be accessible to the Member States and to the Commission. The information shall be accessible to notified bodies, economic operators, sponsors and the public to the extent specified in the provisions on the electronic systems referred to in paragraph 2.
The Commission shall ensure that public parts of Eudamed are presented in a user-friendly and easily-searchable format.
6. Eudamed shall contain personal data only insofar as necessary for the electronic systems referred to in paragraph 2 of this Article to collate and process information in accordance with this Regulation. Personal data shall be kept in a form which permits identification of data subjects for periods no longer than those referred to in Article 10(8).
7. The Commission and the Member States shall ensure that data subjects may effectively exercise their rights to information, of access, to rectification and to object in accordance with Regulation (EC) No 45/2001 and Directive 95/46/EC, respectively. They shall also ensure that data subjects may effectively exercise the right of access to data relating to them, and the right to have inaccurate or incomplete data corrected and erased. Within their respective responsibilities, the Commission and the Member States shall ensure that inaccurate and unlawfully processed data are deleted, in accordance with the applicable legislation. Corrections and deletions shall be carried out as soon as possible, but no later than 60 days after a request is made by a data subject.
8. The Commission shall, by means of implementing acts, lay down the detailed arrangements necessary for the setting up and maintenance of Eudamed. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 114(3). When adopting those implementing acts, the Commission shall ensure that, as far as possible, the system is developed in such a way as to avoid having to enter the same information twice within the same module or in different modules of the system.
9. In relation to its responsibilities under this Article and the processing of personal data involved therein, the Commission shall be considered to be the controller of Eudamed and its electronic systems.
Article 34: Functionality of Eudamed
1. The Commission shall, in collaboration with the MDCG, draw up the functional specifications for Eudamed. The Commission shall draw up a plan for the implementation of those specifications by 26 May 2018. That plan shall seek to ensure that Eudamed is fully functional at a date that allows the Commission to publish the notice referred to in paragraph 3 of this Article by 25 March 2020 and that all other relevant deadlines laid down in Article 123 of this Regulation and in Article 113 of Regulation (EU) 2017/746 are met.
2. The Commission shall, on the basis of an independent audit report, inform the MDCG when it has verified that Eudamed has achieved full functionality and Eudamed meets the functional specifications drawn up pursuant to paragraph 1.
3. The Commission shall, after consultation with the MDCG and when it is satisfied that the conditions referred to in paragraph 2 have been fulfilled, publish a notice to that effect in the Official Journal of the European Union.