Navigating Regulations for Medical Devices and Diagnostics

by Johanne Hamill

In one of the many regulatory focused sessions of the UK GDP Association Annual Conference in 2025, Johanne Hamill guided delegates through the increasingly complex landscape of medical device and diagnostics compliance. Her presentation provided a clear, structured overview of the regulatory frameworks shaping today’s medical device environment.

About Johanne Hamill

Johanne Hamill is an experienced quality and regulatory professional specialising in medical devices, with extensive knowledge of European and global compliance frameworks and guidelines. As the Strategic Regulatory Affairs and Quality Assurance Leader at Thermo Fisher Scientific, she is known for turning complex regulatory requirements into practical, digestible insights. Johanne regularly supports teams in navigating the stringent expectations of medical device and diagnostics compliance.

Introducing Thermo Fisher Scientific

Thermo Fisher Scientific is a global leader in scientific solutions, providing cutting-edge technologies, analytical instruments, consumables, and services that empower scientists and healthcare professionals worldwide. Serving biotechnology, pharmaceutical, healthcare, academic and industrial markets, the company plays a pivotal role in advancing medical innovation, diagnostics, and research. In the medical device sector, it offers a broad portfolio of diagnostic tools and laboratory technologies, all supported by rigorous quality systems aligned with international regulatory standards.

Johanne began her sessions by providing UK GDP Association Annual Conference delegates with an overview of key medical device and diagnostics regulations.

 

Overview of Medical Device Regulations (MDR)

The Medical Device Regulation prioritises the safety and efficacy of medical devices, ensuring they meet high standards before reaching the market. The regulation imposes stricter requirement for clinical evaluations to validate the performance and safety of medical devices.

Post-marketing surveillance is a key element of the MDR which includes enhanced surveillance measures requirements to monitor device performance and address any concerns once the product has been approved. The regulation aims to increase transparency regarding medical device information, fostering trust among patients and healthcare professionals.

Overview of In Vitro Diagnostic Regulations (IVDR)

The In Vitro Diagnostic Regulations govern medical devices that are used to perform tests on samples such as, blood, tissue or urine, to provide information on a persons health. These regulations ensure that IVDs placed on the market are safe, reliable and perform as intended. The IVDR (EU) 2017/746 is the primary regulatory standard for IVDs in the European Union, replacing the former IVDD. It introduces significantly more stringent requirements across the full lifecycle of IVD products.

It:

·         Improves the safety and performance of IVD products

·         Enhances the traceability and transparency of IVD products

·         Strengthens post-market surveillance to respond more quickly to safety concerns

·         Increases the involvement of Notified Bodies to ensure independent assessment

Johanne explained that the VDR represents a major shift for manufacturers, distributors, and importers. Many devices that previously did not require an external assessment now require involvement from a Notified Body. This results in:

·         Increased compliance workload

·         More detailed documentation

·         Stricter oversight

·         Higher emphasis on continuous monitoring

Johanne stressed the importance of these two regulations in protecting public health by ensuring that medical device and IVDs are safe and effective for consumer and clinical use. The regulations ensure that medical devices and diagnostics meet high quality standards and benefit both healthcare providers and patients. She added that the MDR and IVDR aim to enhance the competitiveness of the EU market, whilst ensuring that innovation is encouraged amongst manufacturers.

Classifications of Devices and their Implications

Johanne informed delegates that product classification is the foundation of both MDR and IVDR. It determines how much oversight, documentation, and evidence a manufacturer must provide and dictates how closely the regulators will scrutinise the device. She went on to provide an overview of device classifications for both MDR and IVDR products:

Medical Devices:

·         Class I – low risk

·         Class IIa/b – medium risk

·         Class III – high risk

More medical devices now fall into higher risk classes.

In Vitro Diagnostics:

·         Class A – lowest risk

·         Class B – low to moderate risk

·         Class C – moderate to high risk

·         Class D - highest risk

 

These classifications:

1. Determine the level of regulatory scrutiny

Higher classifications require:

·         More stringent conformity assessment routes

·         Greater involvement of Notified Bodies

·         More robust clinical/performance evidence

·         Deeper post-market surveillance obligations

2. Dictate whether a Notified Body is required

The higher the classification, the more external oversight is required. Class I medical devices and Class A in vitro diagnostics do not require a Notified Body, but all other classifications do. 

     3. Define the depth of clinical or performance related evidence

For medical devices, higher classifications require:

·         Clinical investigations

·         Post-Market Clinical Follow-up (PMCF)

·         Real-world performance data

For IVDs, higher classifications require:

·         Performance evaluation reports

·         Scientific validity

·         Analytical and clinical performance studies

·         Ongoing performance monitoring 

4. Influence the requirements for Quality Management Systems

The higher the class, the more robust the QMS must be.

·         Full ISO 13845 QMS expected for almost all MDs and IVDs

·         Class III MDs and Class C/D IVDs required additional:

o   Design and development controls

o   Supplier management

o   More rigorous risk management

5.   Impact labelling, device identification, and registration

Higher classes require more detailed instructions, warnings, and traceability steps, including, as Johanne pointed out to delegates, unique device identification, and EUDAMED registration.

6.   Drive post-market surveillance and vigilance obligations

Higher classification products are subject to more frequent periodic safety update reports, tighter vigilance reporting times, and greater expectations for proactive monitoring.

7.   Influence supply chain responsibilities

The classification determines the distribution controls required Johanne clarified that this includes whether specialised storage and transport conditions apply, and the level of verification required before release.

Johanne went on to say that all of the above points can impact wholesale distributors.

 

Obligations of Wholesalers and Distributors 

Johanne explained that wholesalers and distributors play a critical role in ensuring that only safe, compliant devices reach the end user. Their responsibilities sit between the manufacturer and the customer, and they must demonstrate compliance at every step of the supply chain. Wholesalers and distributors are required to ensure that products they supply meet MDR and IVDR standards before they are distributed.

They must:

·         Ensure that only compliant devices enter the supply chain:

o   Check the device carries a valid CE mark

o   Perform incoming goods inspection including falsification checks

o   Confirm the device is approved for the correct risk class

o   Check product packaging has the name and address of the manufacturer

o   Confirm that the manufacture is registered in EUDAMED (as applicable)

o   Verify that the device is not subject to any recalls or safety alerts

o   Ensure that a distribution or supply agreement is in place

·         Store according to manufacturer’s requirements, and:

o   Maintain appropriate environmental conditions

o   Monitor and record storage conditions

o   Protect devices from damage, contamination, and tampering

·         Maintain full traceability records, including:

o   Records of products received

o   UDI information

o   Batch numbers

o   Supplier details

o   Storage locations within their facilities

·         Have stock control and segregation measures in place

·         Implement robust quality management processes, including:

o   Standard operating procedures

o   Training for staff

o   Risk assessments

o   Internal audits

o   Vigilance reporting processes

·         Only supply to approved customers who are legally permitted to purchase MDs/IVDRs:

o   Registered healthcare providers

o   Pharmacies

o   Hospitals

o   Other authorised distributors

o   Other organisations legally permitted to handle such devices

·         Have full traceability of final destination of devices supplied

·         Handle complaints and safety information accordingly:

o   Log all complaints

o   Inform manufacturer of any:

§  Adverse events or reactions

§  Product quality issues

§  Device malfunctions

·         Have procedures in place to effectively handle a product recall or field safety notification

·         Ensure product integrity during transport by ensuring storage conditions are maintained throughout the journey, products are protected from temperature excursions, contamination or theft, and use validated shipping methods where required.

Johanne reminded delegates that maintaining thorough documentation is essential to demonstrate compliance and support traceability in the distribution process.

 

Understanding the Role of Person Responsible for Regulatory Compliance (PRRC) 

Johanne explained that in order to wholesale and distribute devices, an organisation must have a PRRC person in place. The PRRC is the Person Responsible for Regulatory Compliance, a mandatory role under the regulations.

The PRRC acts as a liaison between the company and the regulatory authorities. They are legally responsible for ensuring compliance with the MDR and IVDR regulations within the organisation in which they work. In addition, they oversee clinical evaluations and post-market surveillance activities. They also provide training and awareness among staff regarding compliance.

In summary, the PRRC is the person who ensures that the organisation meets all MDR and IVDR requirements across technical documentation, quality management, vigilance, surveillance, and product release. They must be competed, well-qualified, and have sustained oversight of the quality management system.

Johanne’s session succeeded in breaking down and often-intimidating regulatory landscape and provided attendees with clear, actionable guidance they could take back to their organisations.

 

Registering for the 2026 Conference

There are discounted tickets available for UK GDP Association members, members can save £100 when attending both conference days. However, our commitment to low-cost, high-value educational content means that conference tickets will still be the best value whether you chose to join as members or not.

Membership is only £29 +VAT per individual, per year, and offers reduced costs on consulting, training and conference tickets. If you buy tickets for both conference days, there is an even greater discount. Costs for non-members is just £224.50 +VAT per day, a fraction of the cost of other industry events!

In addition, on the evening of Tuesday 16th June, we will be hosting an evening event of dinner, networking, and even some of Dave’s infamous karaoke, for just £49 +VAT per person. This is a fundraising dinner in aid of the MVA Society.

Please see here for more information on the conference and to book your conference and evening dinner tickets.

We are very much looking forward to seeing you all at the conference!