This howtoregulate article analyses how countries with limited regulatory resources could regulate sensitive products, using the example of medical devices. A key component of regulating such sensitive products is recognising certificates and evaluations from stringent jurisdictions, so that scarce government resources can be focussed on other regulatory activities such as customs control and enforcement.

A. International or supra-national framework

I. World Health Organisation: medical devices

1. The World Health Assembly (WHA) Resolution 60.29 on health technologies encourages

Member States to draw up national or regional guidelines for good manufacturing and regulatory practices, to establish surveillance systems and other measures to ensure the quality, safety and efficacy of medical devices and, where appropriate, to participate in international harmonisation.¹

The World Health Organisation (WHO) Global Atlas of Medical Devices 2017 shows that of the 194 Member States 113 have a legal framework for medical devices, no matter how limited their regulation is. The 81 countries that have no medical devices regulation are mostly from the African and Eastern Mediterranean region. In terms of income levels, 84% of high income countries have a legal framework for medical devices and of the low-income countries with data available, 45% have a legal framework for medical devices.² This suggests there is a link between regulatory frameworks and income level, highlighting the importance of smarter regulation where government resources are limited. In many of the low-income countries the market for selling medical devices is limited to the government only and some medical devices are acquired through donations, which raises the issue of the quality of such device.³

2. The WHO has developed a Global Model Regulatory Framework for Medical Devices including in vitro diagnostic medical devices for the purpose of harmonising definitions, specifying attributes of effective and efficient regulation, to form enforceable law. The WHO Model Framework was developed with those countries of limited regulatory resources in mind, who may not have a medical devices regulatory framework but who aspire to establish one. The WHO Model Framework recommends a step-by-step approach starting first with “Basic level controls and enforcement” and then moving onto “Expanded level controls and enforcement”.

3. Another valuable WHO resource, Regulation of medical devices: A step-by-step guide, was produced by the Regional Office for the Eastern Mediterranean based on issues connected with limited regulatory resources in countries in the region (Cyprus, Greece, Lebanon, Syria, Israel, Palestine, Turkey and Egypt). Key elements of a basic medical devices regulation includes:

a) “Pre-market” regulation including: Definition of a medical device; Risk classification; and Essential principles of safety and performance.

b) “Placing on the market” regulation including: Registration of establishments; Listing of medical devices; and Import controls.

c) “Post-market” regulation: Adverse event reporting.

II. European Union

4. Medical devices in the European Union (EU) are regulated by 3 Directives:

• Council Directive 90/385/EEC on Active Implantable Medical Devices (AIMDD) (1990)
• Council Directive 93/42/EEC on Medical Devices (MDD) (1993)
• Council Directive 98/79/EEC on in vitro Diagnostic Medical Devices )IVDMD) (1998)

On April 5 2017, two new regulations on medical devices (Regulation (EU) 2017/745) and in vitro diagnostic medical devices (Regulation (EU) 2017/746) were adopted. They entered into force on 25 May 2017 and will progressively replace the existing Directives. The two new regulations will be fully applicable in May 2020 for medical devices and May 2022 for in vitro medical devices.

III. African Union

5. The African Union (AU) Model Law on Medical Products Regulations was endorsed by the AU Heads of State and Government in January 2016. The aim of the AU Model Law is to guide AU Member States in the enactment or review of national medicines laws, with a view to AU Member States signing and ratifying the AU Model Law. The AU Model Law is consistent with the WHO Model Framework but emphasises the importance of international cooperation, particularly in the region and recognising market authorisation of other jurisdictions in the region and pooling resources.

6. In May 2018, AU Ministers of Health adopted a treaty for the establishment of the African Medicines Agency (AMA). The AMA aims to coordinate and strengthen continental initiatives to harmonise medical products regulation, provide guidance and technical support to improve access to quality, safe and efficacious medical products and health technologies on the continent.⁴ The AMA will work within the existing continental architecture of Regional Economic Communities (RECs) and Regional Health Organisations to support AU Member States. One of the drivers for the establishment of the AMA was that weak regulatory systems had resulted in the circulation of substandard and falsified medical products and health technologies in many AU Member States. The AMA will coordinate the regulatory systems strengthening and harmonisation initiative.

B. Pre-market (ex-ante)

1. Good controls at the pre-market stage help to ensure that sensitive products are safe for consumers. Verification is an important pre-market regulatory tool and jurisdictions must be clear about what needs to be verified. The two approaches for verifying conformity is to verify the result, that is the final product, or verify the production, both the actual production process and its quality. For countries with limited regulatory resources verifying production is costly. For example, where a country is a net importer of medical devices, verifying production would incur costs on the government in establishing a system to check conformity and on the producer, and most likely, a cost passed on to the consumer. By choosing to verify the result of a sensitive product this opens the possibility of recognising other countries’ audits, certificates of conformity or assessment reports, particularly those jurisdictions with a well established system of verification.

I. Recognition of foreign certificates and authorisations

The Handbook: How to Regulate? has a useful summary on recognition of foreign certificates and authorisations, the first two paragraphs of which has been reproduced below for ease of reading.

2. The recognition of foreign certificates and approvals can be decided unilaterally or in conjunction with the state whose certificates or approvals shall be recognised. To reduce unnecessary burden for the exporting industry, it can be useful to negotiate with trade partners bilaterally on the recognition of certificates and approvals. The negotiations can lead to formal or informal bilateral agreements.

3. As formal bilateral agreements tie up a lot of resources and are not easy to manage, it is preferable to foresee an empowerment to decide upon the recognition of foreign certificates by regulatory acts. The empowerment should not be limited to the case of mutual recognition. According to theories of free trade, it is advantageous in all cases to recognise foreign certificates and approvals provided that these fulfil the same requirements and are based on an equal or higher level of stringency as the domestic certificates and approvals. Furthermore, if the domestic industry exports more to the third country than vice versa, the domestic industry will profit more from the recognition of the foreign certificates than the industry of the third country. It can substantially reduce costs by applying only for the certificate or the approval of the third country. The only necessary condition is that the certificate or the approval must be based on an assessment that is at least of an equivalent level of stringency as requested by domestic law.

4. Serbia’s Regulation 98/2009 concerning the manner of recognition of foreign documents of conformity and marks of conformity is an example of a broad approach that is resource light and not specific to a regulated sensitive product. Important elements of the regulation include:

• Recognising foreign documents of conformity issued in line with a ratified international agreement signed by the Republic of Serbia, an agreement signed by Serbia is determined by the relevant Ministry (Article 3);
• Article 6 allows for recognition of foreign technical regulations that the economic operator, or its product, is purporting to comply with and which form the basis for which conformity assessment was approved in that foreign jurisdiction;
• All foreign documents are to be translated into Serbian by a certified court translator
• Foreign documents will then be considered by a Commission of a minimum of three members, to include at least one representative of the competent Ministry to which the foreign document concerns, a representative of the Accreditation Board of Serbia and an expert representative for the area regulated by the corresponding Serbian technical regulation (Article 7).
• The Commission is to determine whether (Article 8):
  • the foreign documents refer to requirements equivalent in degree of safety, life and health of humans, protecting animals and plants, environment protection, protection of consumers and other users and protection of property, as regulated by the corresponding Serbian technical regulation; and
  • requirements of the foreign technical regulation which the foreign conformity assessment body shall comply with in order to perform the conformity assessment procedure of product, provide at least the equivalent degree of compliance with requirements as determined in the corresponding Serbian technical regulation for the designated or authorised conformity assessment body.
• Article 11 provides that the decision of the Commission remains valid until the expiry of validity of the foreign document or in the absences of such a date, valid for three years from its date of issue.

An interesting feature of Serbia’s regulation for recognising foreign documents is that it permits foreign technical regulation (translated) to be submitted. This is particularly useful for situations where a jurisdiction may not yet have a regulation in place and provides an opportunity for the competent government authority to consider the standard of the foreign technical regulation. Expanding on Serbia’s model for recognising foreign documents connected with foreign technical regulation, it could be specified that where no national technical regulation exists, prospective registrants should provide at least 2 examples of foreign technical regulation to which the sensitive product conforms. The downside of this approach, is that the domestic market will have inconsistent standards applied to sensitive products. This can be remedied by specifying particular jurisdictions as we will see in the following approaches.

5. Australia’s approach to recognising foreign certificates depends on the regulated sensitive product. In terms of medical devices, Australia permits the use of market authorisation evidence ONLY from comparable overseas regulators / assessment bodies for medical devices, specifically:

• Certificates issued by certain Notified Bodies designated by the medical device regulators of European member states, under the medical device regulatory frameworks of the EU (Medical devices directives, Medical Device Regulation, or IVD Regulation);⁵
• Decisions of the United States Food and Drug Administration (FDA);
• Approvals and licences issued by Health Canada;
• Pre-market approvals from Japan (issued by the Ministry of Health, Labour and Welfare (MHLW), Pharmaceutical and Medical Devices Agency (PMDA) or Registered Certified Body (RCB), whatever is applicable); and
• Certificates and reports issued under the Medical Device Single Audit Program (MDSAP).⁶

There is no suggestion that market authorisation in the jurisdictions listed will be an automatic Australian market authorisation but highlights that these jurisdictions are credible evidence of quality and conformity. Australia’s approach to recognising foreign authorisations requires a jurisdiction to already have a regulation for which it could be compared to another jurisdiction’s regulation. This approach is more suited to jurisdictions with a mature system of regulation for which there are benefits in getting sensitive products to market quicker by recognising authorisations of comparable jurisdictions.

6. Additional examples of recognition of foreign certificates can be found in the Handbook: How to Regulate? at page 101.

7. The WHO encourages jurisdictions with limited regulatory resources to rely on other jurisdictions’ regulatory evaluation.⁷ Through reliance, countries avoid spending limited resources unnecessarily by avoiding duplication of effort in pre- and post-market evaluation of medical devices. Reliance has to be stated by law. An example of reliance expressly provided for in law is Saudi Arabia’s Medical Devices Interim Regulation which provides that:

To obtain marketing authorisation, medical devices shall comply with the relevant regulatory requirements applicable in one or more of the jurisdictions of Australia, Canada, Japan, the USA and the EU/EFTA, and additionally with provisions specific to the Kingdom of Saudi Arabia concerning labelling and conditions of supply and/or use.⁸

The Saudi example accepts in whole the regulatory evaluation of conformity from these listed jurisdictions. It is also possible to accept only a part of the regulatory evaluation of other jurisdictions such as the audits, lab testing or assessment reports. Ultimately the decision to grant local marketing rights for that medical device remains a national decision.

8. To further strengthen the regulation it could include other information the national regulatory authority shall take into account, such as: quality management system certificates, evaluation reports, compliance statements of the manufacturer and responsibilities of manufacturers and importers.

9. Saudi Arabia has a separate regulation for the national provisions and requirements for medical devices, which outlines specifications for electrical safety, standard for home health care, medical gases, electromagnetic capability and labelling and packaging.⁹ Saudi Arabia’s Interim Regulation has been in place since 2008 and governs the regulation of medical devices until the law of medical devices is in place. It is unknown when the final law will be completed but for the mean time this interim solution appears to work well for Saudi Arabia.

10. Qatar also operates a similar system of reliance but this system is still under development and not as mature as the Saudi Arabian model.¹⁰

II. Online automation

11. Any form of automation that can be introduced into the regulatory framework reaps significant benefits in terms of processing and review of registration. Although the upfront cost of online automation can be expensive the ongoing costs are minimal and would most likely require less human resources for processing of registrations which can be a significant ongoing cost for the limited resourced jurisdiction. In low-income countries, particular development partners could be approached to assist in funding such a system.

12. Saudi Arabia’s electronic system for medical devices registration is a good example of a jurisdiction with a basic medical devices regulatory framework, that relies on medical devices complying with another jurisdiction´s regulation for obtaining market authorisation. Saudi Arabia requires medical devices to comply with one or more of the following jurisdictions medical devices regulations, the EU, USA, Canada, Australia and Japan and has developed detailed guidance for each of the jurisdictions that correspond with the online system.¹¹

13. Australia’s medical devices registration is also online and is an example of a more complex system.¹² The US FDA also manages all its medical devices registration online.¹³

14. The AU harmonisation project and the AMA could look at what efficiencies could be gained by online automation for the RECs on a similar basis as that done in the US. The AU recognises eight RECs, the:

• Arab Maghreb Union (UMA)
• Common Market for Eastern and Southern Africa (COMESA)
• Community of Sahel–Saharan States (CEN–SAD)
• East African Community (EAC)
• Economic Community of Central African States (ECCAS)
• Economic Community of West African States (ECOWAS)
• Intergovernmental Authority on Development (IGAD)
• Southern African Development Community (SADC).

C. Placing on the market

1. Registration of establishments and listing of medical devices is a core part of a basic medical device regulation. Saudi Arabia operates a simple system that requires, as part of the medical device registration process, information for registration purposes (Article 13 of Chapter 4 Registration and Listing Requirements). Where the manufacturer of the medical device is not established in Saudi Arabia it must have an authorised representative established in Saudi Arabia (Article 11). Article 8 of the Saudi Interim Regulation contains the listing requirements for medical devices.

2. The other important aspect of a basic medical device regulation is import control, particularly for those jurisdictions that opt for a reliance system in pre- and post-market regulation.

I. Import controls

3. Since a high proportion of medical devices are imported (60-90% in low and middle income countries), the focus of regulatory measures should therefore be on import controls and oversight of distribution channels).¹⁴ Regulating for import controls for sensitive goods can be tricky because it involves different government agencies, different institutional cultures and different regulations that could be a result of ad hoc creations. Often import controls, particularly in jurisdictions with limited regulatory resources, involve more than one agency of control, who enforces many regulations simultaneously, generally without coordination and in an inconsistent manner. Therefore when it comes to regulating for the import control of sensitive goods such as medical devices the responsible agency, for example the Ministry of Health should coordinate with the responsible customs agency to determine the best empowerments and enforcement measures to be regulated for.

4. The Organisation for Economic Development suggests an approach of “one risk, one inspectorate” model, which would require considerable institutional changes.¹⁵ Another approach requiring less institutional change would be to establish clear administrative arrangements to improve coordination, ensure information is shared and inspections are not duplicated. Generally, most jurisdictions would need to foresee some import controls for a range of sensitive products such as medical devices, food, nuclear products and technical and infrastructure/construction products. Clearly, the customs agency cannot have expertise in the range of sensitive products that arrive in the jurisdiction and so expertise from the relevant ministry is required during such inspections. It might be feasible for a re-organisation in the customs agency along thematic lines (food and non-food, including medical devices merged into a single inspectorate for example). The aim of any re-organisation should be to avoid duplication between the customs agency and in the case of medical devices, the Ministry of Health or a specialised agency, improve coordination and focus and to re-allocate resources. The customs agency should rather undertake simple, easy checks such as regarding the correct labelling, and inform the Ministry of Health or the specialised agency on findings, thus becoming the prolonged arm. In any case of doubt, the Ministry of Health or the specialised agency should have the right to decide.

5. In 2013, WHO launched the Global Surveillance and Monitoring System to encourage countries to report incidents of substandard and falsified medical products in a structured and systematic format, to help develop a more accurate and validated assessment of the problem.¹⁶ The system:

• provides technical support in emergencies, links incidents between countries and regions, and issues WHO medical product alerts; and

• gathers a validated body of evidence to more accurately demonstrate the scope, scale and harm caused by substandard and falsified medical products and identify the vulnerabilities, weaknesses and trends.

This WHO system is an example of where information sharing and good administrative arrangements between the Ministry of Health and the customs agency could use such data systematically in their import controls.

6. Although jurisdictions with limited regulatory resources are constrained in the technologies they can purchase they could find ways to leverage existing smart phone technology. In Africa, a region of high concentration of jurisdictions without medical devices regulation, three quarters of the population have a SIM connection.¹⁷ Although mobile subscriber penetration is behind the global average of 66% at 44% it is growing, and with mobile internet being the only way some regions in Africa can access the internet, this opens up solutions for technology in the customs process for sensitive goods. Regulation of sensitive products would need to foresee how privacy in using electronic and automated systems could be protected as well as the cyber security aspects. The howtoregulate article on Cybersecurity: regulating the virtual world contains goods example of regulation in this area.

7. Jurisdictions could make arrangements with medical devices manufacturers to assist in the customs inspection process by using track and trace mechanisms so that where medical devices are manufactured and packaged a check at that point could be coordinated with that jurisdiction in a mutual assistance arrangement. If that sending jurisdiction also uses that medical device the receiving jurisdiction could provide post-market surveillance information to that sending jurisdiction.

D. Post-market (ex-post)

1. Post-market verification is important for ensuring that products conform to the pre-market verified type and do not trigger disproportionate, unjustified side-effects. Information was limited on how reviewed jurisdictions in this howtoregulate article executed post-market regulatory mechanisms such as market surveillance and vigilance. Therefore the following information is based on publicly available information about what regulations jurisdictions reviewed had.

I. Market surveillance and vigilance

2. The US has a comprehensive site for medical device reporting (MDR) which obliges manufacturers, importers and device user facilities to report certain device-related adverse events and product problems to the US Food and Drug Administration (FDA).¹⁸ It also has MedWatch, an online voluntary medical device reporting site to encourage healthcare professionals, patients, caregivers and consumers to submit voluntary reports of significant adverse events. Freedom of information requests can also be made in writing or online to the US FDA about any medical device report.

3. The US FDA has an open database (Manufacturer and User Facility Device Experience-MAUDE) that contains mandatory reports filed by manufacturers and importers from August 1996 to present, all mandatory user facility reports from 1991 to present, and voluntary reports filed after June 1993. The MAUDE database houses MDRs submitted to the FDA by mandatory reporters (manufacturers, importers and device user facilities) and voluntary reporters such as health care professionals, patients and consumers. The US FDA acknowledges that this passive surveillance system has limitations, including the potential submission of incomplete, inaccurate, untimely, unverified, or biased data. In addition, the incidence or prevalence of an event cannot be determined from this reporting system alone due to potential under-reporting of events and lack of information about frequency of device use. Because of this, MDRs comprise only one of the FDA’s several important post-market surveillance data sources.

4. Saudi Arabia maintains a web-based National Centre for Medical Device Reporting, which fulfils the following purposes (Article 32):

• Improve protection of the health and safety of patients, users and others.
• Disseminate relevant device related information which may reduce the likelihood of, or prevent repetition of adverse events, or alleviate consequences of such repetition.
• Execute a key aspect of the SFDA’s post-market activities.
• Encourage collaboration between manufacturers and health care facilities to identify and investigate adverse events associated with medical devices and take appropriate action.
• Encourage the reporting of adverse events by medical device institutions and users, manufacturers, authorised representatives and organisations involved in supplying medical devices to the Saudi Arabia.
• Provide a database of information on the safety and performance of medical devices that is suitable for the exchange of adverse events information with other Regulatory Authorities.

The Saudi Arabian regulation provides that all parties involved in the regulation of medical devices are bound to observe confidentiality (Article 38). However, confidentiality does not affect the obligation of the Saudi regulator and any designated conformity assessment body to exchange information among themselves or to disseminate warnings or guidance that assist in safeguarding public health (Article 38 sub paragraphs B. and C.).

5. Given that the Saudi medical devices registration process relies on market authorisation in either the EU, Australia, Japan, US or Canada, it is not clear from the regulation of the Saudi regulators website whether there were formal arrangements with these jurisdictions once a medical device adverse event was received. Noting that the US FDA has medical device reports online the Saudi authorities have empowerments to search such resources itself but what would be far more effective is to make a direct arrangement with the jurisdictions that the medical device regulation relies on. In the example of the Saudi Interim Regulation, it expressly relies on authorisation from the EU, Australia, Japan, Canada and the US, given that these jurisdictions would certainly have domestic medical device manufacturers, bilateral arrangements could be made such that in return for timely market authorisation such states would share adverse reports of such medical devices once received.

6. The International Consortium of Investigative Journalists (ICIJ) released in November 2018 an online database called the International Medical Devices Database (IMDD). The IMDD contains information on more than 90,000 Recalls, Safety Alerts and Field Safety Notices about medical devices distributed worldwide. The information connects with medical device companies and their subsidiaries. The ICIJ investigation discovered that fewer than 20 percent of the countries in the world had public data online permitting citizens to find medical device safety alerts and recalls. The initial November 25, 2018 data release included data from 11 countries. On December 19, 2018 more than 5,900 records from two more countries were added to the database. On February 27, 2019 more than 16,000 records from five more countries were also incorporated to the database. This free database should prove an invaluable source of information for the resource limited regulator’s market surveillance obligations.

E. Enforcement

1. Understandably much of the basic medical devices regulation reviewed did not provide for a broad range of enforcement beyond the competent regulatory authority. In the jurisdictions with mature medical devices regulation many actors were empowered to monitor the quality of medical devices. For example in the EU importers, distributors, Authorised Representatives of the manufacturers and “responsible persons” are in charge of certain verifications and thus ensure the enforcement of manufacturers’ obligations.¹⁹ Voluntary surveillance by third parties could be a useful enforcement mechanism for resource constrained jurisdictions noting the difficulties in achieving high intensity surveillance, particularly in sectors where there are many actors. Entrusted public utility associations, other associations or simply competitors can fill in the gap. They may exert intense surveillance in their own interests provided they have a powerful tool to enforce legal compliance. One way to achieve this is to give them the right to sue at court, which can be useful if middle- to high-income countries but probably more difficult in low-income countries. A less radical step might consist in giving legal or natural persons the right to complain to and to alert authorities in a centralised procedure. The considerable workload triggered by these complaints has to be weighed against the compliance favouring effect, unless some automated solution can be found to streamline complaints.

2. Please see the Handbook: How to regulate? about how to create other empowerments to enforce sensitive products regulation but also the two-part empowerments articles: Empowerments (Part I): typology and Empowerments (Part II): checklist. Other useful empowerments that lend itself to the resource constrained jurisdiction:

• Sanctions and penalties, including: penalties for natural persons, financial sanctions for legal persons: direct sanctions and indirect sanctions like banning from receiving subsidies, public naming and shaming and withdrawing membership.

• Enforcement with the help of non-designated parties, including: establishing a complaints; alert or whistle-blowing portals or specific communication channels; and communicating with third parties to obtain further evidence and details.

• Investigations and data, see full list at Empowerments (Part II): checklist.

• Cooperation, including exchange of data with other jurisdictions or with international organisations, see full list at Empowerments (Part II): checklist as all are applicable in alcohol enforcement.

3. The WHO estimates that in some countries 80% of health-care equipment (including medical devices) is donated or funded by international donors or foreign governments, and of these, only 10-30% of such equipment becomes operational in developing countries.²⁰ Donations often circumvent the regulatory framework or the selection and procurement systems of the recipient country where such regulatory systems exist, no matter how limited. If donated medical devices become burdensome for low- and medium-income countries because of poor medical devices governance and weak technical capacity and poor supply chain management, imagine the situation for medical devices that are deemed unsafe in stringent medical devices jurisdictions such as the US and Australia but continue to be sold in countries with less stringent regulation.

4. Countries with stringent medical devices regulation could cooperate on enforcement with those jurisdictions that rely on their evaluations such as Saudi Arabia, such as identifying and communicating when medical devices become unsafe. Saudi Arabia rely’s on medical devices meeting the regulatory requirements in either Australia, Canada, Japan, the USA and the EU/EFTA but no published linkages between these jurisdictions for informing when medical devices becomes unsafe could be found. These stringent jurisdictions work on a regulatory system based on confidentiality between the medical device applicant and the regulatory authority but there should be a limit to confidentiality when a medical device has been deemed unsafe. It could be a number of weeks from the time with a medical device becomes unsafe and is reported to the applicant and then withdrawn. As such a mechanism could be developed that includes informing directly countries such as Saudi Arabia that a medical device has been deemed unsafe so that preventative action can be taken. This would require countries to inform stringent jurisdictions that it has given market authorisation to a medical device applicant based on their regulatory evaluation. Bilateral cooperation should be laid out in the regulation so that medical device applicants are aware that should their device be deemed unsafe that it would also be information passed onto those jurisdictions that have given market authorisation for the same device for which there is an arrangement in place to notify. This would prevent non-conforming products from being “dumped” in another jurisdiction that is unaware that the product has been deemed unsafe.

5. There may be value in a broader consideration at the multilateral level that when sensitive products, such as medical devices, are deemed unsafe, particularly if the non-conformity could harm a patient or consumer, that all countries with that particular product be notified. This would require agreement at the multilateral level to global publication of where sensitive products are marketed so that timely notification could be passed on.

This article was written by Valerie Thomas, on behalf of the Regulatory Institute, Brussels and Lisbon.