Are there still software medical devices in risk class I according to MDR? Are risk class I software products really being withdrawn from the market by regulatory authorities? Which federal state do I have to go to so that I can remain on the market with my class I software? As more and more rumors have been circulating recently that it is no longer possible to obtain approval for software medical devices under risk class I, we would like to shed some light on the situation with this article. This article is primarily aimed at manufacturers of medical device software that pose little or no risk. This includes, for example, training apps that are used autonomously by patients and that cannot cause any harm to the patient.
Table of contents
- Risk classes of the MDR
- Analysis of data from different federal states
- Current developments
- Dealing with uncertainty in the risk class
- Why we urgently need risk class I in the EU
- Conclusion
Risk classes for medical devices under the MDR
As we have already described the risk classes of the MDR in detail in our software classification guide, we would like to keep it brief at this point:
- The MDR essentially distinguishes between risk classes I, IIa, IIb and III for software
- The decisive factor in determining the risk class of a product is its intended purpose
If you would like to find out more about the risk classification of software medical devices, the following guidelines from us will help you:
- Qualification of software medical devices – Guidelines: Is your app a medical device?
- Classification of software medical devices – guide: Which risk class do you fall into?
The approval of products in risk class I is much more resource-efficient and quicker compared to higher-class products. Many manufacturers therefore ask themselves whether their product is a class I or IIa product. You can find out why this is the case in the next chapter.
Risk class I or IIa – Why is this important?
Why is the distinction between class I and IIa so important? And why is there so much discussion about it? Risk class I products differ significantly from higher-class products. Class I products …
- do not require a certificate from a notified body for market approval,
- can enter the market without delay (caused by an audit) and do not have to bear the costs of a notified body,
- are only subject to unannounced inspections by the respective supervisory authority of the federal state. These are significantly less costly than certification by a notified body (risk class IIa and higher) and are not subject to a fee.
To illustrate this even better, we would like to show you some empirical values here. A class IIa product means compared to class I:
- Delay in market approval by 6-18 months (duration of the conformity assessment procedure of a notified body and issuance of the CE certificate)
- Costs of up to 6-digit euro amounts for the conformity assessment procedure and certification of the QMS
- Obligation to notify significant changes and further testing by the notified body for product changes after approval
How long it takes to successfully complete a conformity assessment procedure is highly individual and depends on various factors. In any case, this is another unknown factor that is difficult to take into account when planning your product. The distinction between risk class I and IIa is therefore in many cases really decisive for the existence of products and entire companies. Class I is therefore particularly interesting for start-ups that are dependent on rapid market approval and only have limited resources.
MDR – Rule 11 – Clear boundary between class I and IIa?
The answer to whether your software or app can fall into risk class I can be found in the Medical Device Regulation (MDR) – Rule 11.
Quote from MDR 6.3 Rule 11 (abbreviated):
Software intended to provide information used to make decisions for diagnostic or therapeutic purposes is in class IIa,
[…]
All other software is assigned to class I.
Many manufacturers are asking themselves this question:
-
- What is information that is used to make decisions for diagnostic and therapeutic purposes?
- Who can “use” such information to make diagnostic or therapeutic decisions?
- Can an app that only provides a patient with training modules and knowledge influence therapy or diagnostics at all?
- Is the recommendation to do a certain exercise already a therapeutic decision?
Surprise: There are various ways of interpreting this Rule 11. This is because the BfArM, notified bodies and manufacturers do not agree on this. There is a lot of room for interpretation, which is why there are always discussions and rumors. We would therefore like to describe the 2 most important interpretations of this Rule 11 here.
Interpretation 1: All software provides information that influences therapy or diagnostics
According to this interpretation, an app for patients also provides information for decisions on the treatment or diagnosis of diseases. The patient would treat or diagnose themselves and therefore sentence 1 from rule 11 would apply. Strictly speaking, with this interpretation, there is no class I standalone software, as software by definition always generates an output (information) based on an input. An exception would be, for example, an app that displays exactly the same content to every user without any individualization. However, this raises the question of whether it is a medical device at all (see also our guide “Is your app a medical device?”).
Interpretation 2: Only healthcare professionals can make therapeutic or diagnostic decisions
This is the manufacturer-friendly interpretation of Rule 11, according to which a training app that is only used by patients would fall into risk class I. The reasoning: A layperson is not in a position to make therapeutic or diagnostic decisions. Sentence 1 of Rule 11 therefore does not apply – information is not used to make decisions for diagnostic or therapeutic purposes. Note: However, the situation is different for products that also involve healthcare professionals in their use and provide supporting information (e.g. via a web dashboard). This was decided, for example, by the Hanseatic Higher Regional Court in the case of Dermanostic. In this case, a competitor initiated legal proceedings against Dermanostic. The court then ruled that Dermanostic was a class IIa product and not a class I product. You can read more about this here.
So whose interpretation counts?
We can see that different stakeholders have different views:
-
- BfArM
- State supervisory authority
- Notified body
- Manufacturer
- Court
If you decide to go down the risk class I product route, it is primarily your own opinion (manufacturer) that is relevant, but of course also the opinion of your state supervisory authority. This authority is primarily responsible for monitoring manufacturers in your region. Of course, the decision of the courts also counts if there is a legal dispute (e.g. between you and a competitor) – see Dermanostic. The assessment of notified bodies is particularly important if you are aiming for risk class IIa or higher. For products in risk class I, these are not involved at all. The BfArM mainly has an indirect influence on the risk classification. As it is the federal authority, the BfArM can also exert influence on the state supervisory authorities and, for example, issue recommendations that state authorities may follow.
Conclusion – is class I still possible?
Yes, approval of software medical devices in risk class I is still possible. However, this is highly dependent on your state supervisory authority. Under certain circumstances, it may be worth relocating your company’s headquarters to federal states whose supervisory authorities are “Class I-friendly”. Alternatively, there is another exciting model that we offer. You can commission us as an external distributor to bring your medical device to market. We offer this service for software-based medical devices and DiGA: More information Feel free to contact us if you need an external distributor for your app or other standalone software.
Current developments in the context of the MDR
Some supervisory authorities could become stricter in the future. For political reasons, we will not go into details in this article, but we are open to an exchange with manufacturers. The situation remains diffuse and there is no legal certainty for manufacturers when they register their product under class I.
It remains to be hoped that at some point there will be a new guidance document (or adapted version) from the MDCG that will bring more clarity here. A fundamental ruling by the European Court of Justice would probably provide the most certainty, but it is impossible to predict if and when this will happen.
Dealing with uncertainty in the risk class
How can I be sure that my risk class is correct? There is never absolute legal certainty on this subject. In principle, a higher classification is always “safer”, but also much more complex and expensive. However, as many companies do not want to or cannot afford such a procedure, we would like to show you a few options that you have as a manufacturer of a class I product.
- Read the MDCG Guidance documents (especially MDCG 2019-11).
- Look at similar products on the market that are approved under MDR. In particular, you should consider products from manufacturers for which your supervisory authority is also responsible.
- Get expert advice. There are many consultants who have been involved in the approval of many Class I medical devices. In many cases, this experience can be transferred to your product. Feel free to contact us if you need support.
- Obtain a legal opinion. This is issued by a lawyer and can support your arguments before a supervisory authority, but also in court. It creates additional persuasive power. Please note, however, that such an expert opinion cannot provide absolute legal certainty. Contact us if you are interested in an expert opinion. We will be happy to put you in touch with a lawyer who is familiar with the subject.
What happens if I register my product under risk class I even though I am unsure?
In principle, you can of course do this. It is the manufacturer’s responsibility to classify their products properly. BUT be aware that this can be a business risk. Some of these risks are:
| Scenario | Hazard | Damage |
| The product really does harbor risks in use | A patient could injure themselves | Legal consequences, reputational damage |
| A competitor initiates legal proceedings against you | The court decides that you must classify your product higher | Product must be withdrawn from the market or classified higher |
| A regulator reviews your product and disagrees with the risk classification | The supervisory authority disagrees with the risk class of your product | Product must be withdrawn from the market or classified higher |
Why we urgently need risk class I in the EU
There are countless innovative software products with medical use cases that pose hardly any risks to patients (e.g. training apps to reduce anxiety). Access to such products has been promoted enormously in recent years (e.g. through the introduction of DiGA) and thousands of patients use such products effectively every day to improve their state of health. This not only relieves the burden on patients, but also on the entire healthcare system. In our view, the effort required for approval under risk class IIa is disproportionate to the usually very low risks posed by patient-focused lay products. Moreover, such products often come from the start-up environment, which usually has to make do with limited resources. Over-regulation (and to put it harshly – making class I software impossible) nips such innovations in the bud. Small companies simply cannot afford to go through a conformity assessment procedure with a notified body – neither in terms of time nor money. This is not only bad for Germany as a business location, as manufacturers relocate to other countries, but ultimately also a political obstacle to better patient care. We therefore urgently need to be able to continue to develop and approve risk class I software.
Conclusion on risk class I according to MDR
After all the rumors and discussions, the question remains: “Are there still standalone software medical devices in risk class I?”
Although the situation remains vague after a lot of research and numerous discussions in our environment, some insights can be gained:
-
- Regulatory authorities, notified bodies and manufacturers interpret the MDR differently, which is why there is still no clear consensus regarding risk class I for software.
- Our healthcare system – and patients in particular – benefit enormously from products in risk class I. A higher risk class significantly reduces the attractiveness of developing and approving such products. For many companies, the associated costs are either too high or simply too risky.
- We assume that it will be decided in the coming months and years to what extent risk class I software will still exist. We are keeping a constant eye on developments and will update this article if there are any new findings. Subscribe to our newsletter to stay up to date.
We at QuickBird Medical are of the opinion that risk class I software products are a must. The risks posed by such products are negligible, but have a huge impact on improving patient care. Contact us if you are planning to realize a software medical product. We develop regulated apps, web applications and other medical software on a contract basis for other companies.
