About the MDR transition deadline, major challenges and pragmatic solutions

Especially in view of the increasingly strict regulatory requirements of the MDR, one of the most common mistakes is to start with the implementation without having a concrete procedure or the know-how about the individual activities and documents.

This not only creates many security gaps and a large number of SOUPs are deployed unplanned, but also an unstructured, untestable architecture and missing documentation. Closing these gaps late in the life cycle requires a lot of effort and often jeopardises the planned release date.

A second mistake is to plan too many features for the first version. This overlap delays the time to market. It is therefore better to start with a key feature and add supplements according to the needs of users and patients.

This possibility is also available for medical products. An iterative process is possible if the significance of new features is clarified in advance from a regulatory perspective.

The third mistake is to underestimate post-market surveillance. Especially in the case of apps, some manufacturers underestimate the effort of platform and SOUP surveillance. This is where it pays off if verification is not automated, but has to be carried out manually each time on a new OS/browser. In addition, there are often no mechanisms for blocking apps, so that once they are available in the apps store, they can no longer be controlled by manufacturers.

The fourth mistake is to neglect cybersecurity, which has become a priority for the Notified Body. It is better to be able to demonstrate an overview of the thought-identified cybersecurity risks in relation to the product and the security concepts integrated in the project.

The assessment of potential risk factors is also part of this. A cybersecurity analysis according to FDA and/or MDCG requirements is a must and should not be missing in any project plan. The determined measures should of course also find their way into the product. So plan enough time for the implementation of the security concepts.