Clinical Evaluation Consultation Procedure (CECP) – New Opinion Issued

October 24, 2022

Expert panels on medical devices and in vitro diagnostic devices (Expamed)

What this post covers
This article explains and contextualizes a Clinical Evaluation Consultation Procedure (CECP) opinion issued by the EU Expert Panels (Expamed) on October 2022. We’re not republishing the scientific opinion; instead, we summarize what the panel concluded, why CECP matters for Class III and other high-risk devices, and what practical actions manufacturers and notified bodies (NBs) should consider. Our case study is the publicly available CECP opinion concerning a Class III implant used for reinforcement of abdominal soft tissue in ventral and hiatal hernia repair. We highlight how panels judge the sufficiency of clinical evidence, how benefit–risk is weighed, and how PMCF commitments—including registry follow-up—are used to address residual uncertainty. For the official documents, see the Commission’s expert-panel portal, the master list of CECP opinions, and the PDF of the specific opinion discussed here.

CECP in a nutshell

Under MDR Article 54 and Annex IX, Section 5.1, certain high-risk devices undergo an additional, independent check of the Clinical Evaluation Assessment Report (CEAR) performed by the NB. The expert panel issues a scientific opinion that the NB must consider—especially if the panel finds the level of clinical evidence insufficient or raises concerns about benefit–risk, alignment of evidence with intended purpose and indications, or adequacy of the post-market clinical follow-up (PMCF) plan. If the NB does not adopt the panel’s advice, Annex IX, 5.1(g) requires the NB to justify that decision in its conformity-assessment report.

Scope of the October 2022 opinion

The consultation related to a fully resorbable mesh with a resorbable hydrogel coating, indicated for reinforcement of abdominal soft tissue in ventral and hiatal hernia repair, assessed within the competence area of General and plastic surgery and dentistry (BSI NB 2797; file CECP-2022-000227). These administrative and device-scope details are recorded in the published opinion and its Commission news entry.

What the expert panel decided

The panel concurred with the NB on the appropriateness and sufficiency of the manufacturer’s clinical data and agreed with the NB’s benefit–risk assessment. The opinion notes publication of a new multicentre study adding 84 patients with 24-month follow-up to the dataset and reports no indication of higher recurrence or complication rates compared with established routine techniques. At the same time, the panel emphasized that sample sizes across trials and registries were relatively small and follow-up relatively short, supporting the need for longer-term data.

PMCF expectations and real-world data

The PMCF Plan was considered acceptable. It calls for further clinical-data collection to identify long-term adverse effects, including those related to device–tissue interaction, and for tracking in two quality registries—HerniaMed and ACHQC—to expand the evidence base over the device’s expected lifetime. The panel’s stance illustrates how CECP leverages real-world registries to complement trials and literature when total exposure and follow-up duration are still maturing.

What manufacturers should take from this

Think “totality of evidence.” CECP panels look at the sum of literature, clinical investigations, registries, and the PMCF plan. Smaller cohorts and shorter follow-up aren’t automatic blockers if a credible plan exists to close gaps post-certification, but the plan must be specific about endpoints, timelines, and data sources. For reference, the Commission’s “List of opinions provided under the CECP” shows multiple cases in which panels flagged evidence sufficiency, intended-purpose alignment, or PMCF robustness.
Align intended purpose, indications, and SSCP. Panels will check whether the intended purpose/indications match the evidence presented and whether claims are mirrored in the SSCP and labeling. Divergences often lead to scope restrictions, targeted PMCF, or time-limited certificates. The Commission’s Expert Panels hub outlines the panels’ remit and how their opinions integrate into NB assessments.
Prepare for “justify if you diverge.” If your NB does not fully adopt the panel’s advice, it must justify why in its report (Annex IX, 5.1(g)). Anticipate this by designing evidence and PMCF strategies that are straightforward to adopt—e.g., leveraging recognized registries and clearly defining success metrics and risk signals.

Why this opinion matters beyond hernia repair

Although device-specific, the October 24, 2022 case neatly shows how CECP functions as a calibrated check on high-risk devices: validate benefit–risk for the intended purpose, acknowledge dataset limits, and enforce structured PMCF to address residual uncertainty. For sponsors approaching CECP, this is a model of how to present fit-for-purpose clinical evaluation, align claims with evidence, and build PMCF that uses registries and longer-term outcomes to demonstrate continued performance and safety.

See the official CECP opinion (PDF) and the Commission’s news entry for the canonical record.

Industry Insights & Regulatory Updates

Advanced digital health technology showcasing human body and medical device integration for MedTech innovation.

EU AI Act and Medical Devices: What SaMD Developers Need to Know (2026)

EU MDR 2017/745 for Dental Devices: Complete Guide (2026)

FDA QMSR: How the 2026 Regulation Shift Transforms MDSAP Audits and FDA Compliance Inspections

IVDR Annex XIV clinical performance study a complete guide

IVDR Annex XIV Performance Studies for Companion Diagnostics: A Step-by-Step Guide 2026

MDR Annex XVI: Regulating Products Without an Intended Medical Purpose Under the MDR

Draft of Principles and Practices for Software Bill of Material for Medical Device Cybersecurity

August 23, 2022

Connected medical devices increasingly share third-party and open-source components. A single vulnerability in a widely used library can ripple across vendors and product lines—making Software Bills of Materials (SBOMs) essential for transparency, risk assessment, and incident response across the total product lifecycle. The International Medical Device Regulators Forum (IMDRF) formalized this with its final guidance, “Principles and Practices for Software Bill of Materials for Medical Device Cybersecurity (N73)”, which describes what an SBOM is, how to generate and maintain it, and how healthcare delivery organizations should consume it.

What an SBOM is—and why devices need one

The U.S. National Telecommunications and Information Administration (NTIA) defines an SBOM as a structured inventory of software components and their metadata—the “ingredients list” of a product. This transparency helps manufacturers and operators quickly identify exposure when new vulnerabilities (e.g., in a dependency) are disclosed, and it enables repeatable vulnerability and patch management processes.

IMDRF’s SBOM guidance (N73) dovetails with earlier IMDRF N60 lifecycle cybersecurity practices, positioning SBOMs as part of customer security documentation and post-market risk management. For device makers, that means SBOMs aren’t a one-time deliverable but a maintained asset that evolves with software updates, configurations, and component end-of-support.

Where regulators are today (and what they expect)

In the U.S., the FDA’s final cybersecurity guidance (2025 update) integrates SBOM expectations into quality system and premarket documentation, alongside processes for vulnerability handling, threat modeling, and update mechanisms. The FDA’s public Cybersecurity FAQs also explain how statutory changes (section 524B) affect submissions and postmarket obligations. Manufacturers should expect reviewers to look for SBOM content that’s actionable (e.g., component versions, known vulnerabilities, support status) and kept current throughout the device lifecycle.

Beyond healthcare, CISA’s 2024 framing for software component transparency shows how SBOM data is converging toward interoperable formats and exchange models—useful for scaling supplier management and incident response across complex portfolios and hospital networks.

Practical SBOM essentials for medical-device teams

Per IMDRF N73, an effective medical-device SBOM should clearly identify each component (and transitive dependency), the supplier, version, and unique identifiers, along with relationships and license data. It must also be consumable by customers: documentation should explain how the SBOM is accessed, how frequently it is updated, and how customers can map vulnerabilities to affected configurations. Manufacturers should align SBOM scope and format with their post-market cybersecurity processes so that vulnerability intake (e.g., from CISA/NVD) triggers internal triage, risk evaluation, and—when needed—field actions.

SBOMs for AI/ML and ML-enabled devices (MLMD)

AI-driven devices and machine learning-enabled medical devices (MLMD) depend on extensive software stacks plus data pipelines. While model artifacts aren’t “software components” in the classic sense, the IMDRF MLMD terminology (N67) and broader cybersecurity guidance support the same principle: maintain transparent, version-controlled inventories of the components your safety depends on—frameworks, libraries, runtimes, and security-relevant configs—so you can evaluate and communicate risk when dependencies change. Pair your SBOM with rigorous change control for models and data to preserve safety and performance.

How SBOMs reduce time to action

When a widely used component is found vulnerable, organizations that maintain current, machine-parsable SBOMs can immediately answer: Where do we run this? Which devices are impacted? What versions are affected? That shortens the path from disclosure to containment, patching, or compensating controls—reducing patient and business risk. FDA reviewers, hospital security teams, and incident-response coordinators increasingly expect this level of traceability.

Bottom line for digital-health manufacturers

Treat the SBOM as a first-class safety artifact: build it as you build your software, keep it up to date, make it accessible to customers, and wire it into vulnerability management and field-action playbooks. Align content and exchange formats with IMDRF N73 and be prepared to show how SBOMs underpin your premarket claims and postmarket responsiveness.

If you’re planning or executing a submission, MDx CRO can map your current secure-development and post-market processes to the latest expectations, align SBOM tooling and content to IMDRF/FDA, and integrate SBOM handling into your PMS and incident-response procedures.

Industry Insights & Regulatory Updates

EU AI Act and Medical Devices: What SaMD Developers Need to Know (2026)

EU MDR 2017/745 for Dental Devices: Complete Guide (2026)

FDA QMSR: How the 2026 Regulation Shift Transforms MDSAP Audits and FDA Compliance Inspections

IVDR Annex XIV Performance Studies for Companion Diagnostics: A Step-by-Step Guide 2026

MDR Annex XVI: Regulating Products Without an Intended Medical Purpose Under the MDR

IMDRF Machine Learning-enabled Medical Devices: Key Terms and Definitions

June 3, 2022

The International Medical Device Regulators Forum (IMDRF) has published Machine Learning-enabled Medical Devices: Key Terms and Definitions (IMDRF/AIMD WG/N67, Edition 1). This foundational guidance establishes a common vocabulary for artificial intelligence (AI) and machine learning (ML) in the medical device sector. Its purpose is to create uniform expectations and understanding, improve patient safety, inspire innovation, and encourage access to breakthroughs in healthcare technology.

Artificial intelligence is broadly defined as the use of algorithms or models to perform tasks, make decisions, or generate predictions. Within AI, machine learning is a subset where models are trained on data, enabling them to learn patterns without explicit rule-based programming. The IMDRF document situates these concepts within a regulatory and clinical context, ensuring clarity when applied to medical devices.

One of the key goals of the guidance is to reduce confusion across jurisdictions. Manufacturers, regulators, and clinicians may use different terms for the same concepts, such as “model,” “training,” or “retraining.” This lack of alignment can complicate regulatory submissions and reviews. The IMDRF’s definitions create a standard set of terms that can be consistently referenced across regulatory frameworks and development programs.

In February 2025, IMDRF released Good Machine Learning Practice (GMLP), which builds on the definitions in N67 by providing ten guiding principles for the development, validation, and monitoring of ML-enabled devices. The link between the two documents is crucial: N67 defines the language, while GMLP sets expectations for practice across the product lifecycle.

Key Terms and Their Impact

The N67 guidance defines terms such as “model,” “training set,” “test set,” “drift,” “bias,” “retraining,” “locked model,” and “continuous learning.” These definitions are not academic—they directly influence how safety risks are assessed, how validation studies are structured, and how regulatory change control is applied. For instance, a locked model is one that does not evolve after deployment, while a continuous learning model adapts over time, requiring additional oversight and safeguards.

Understanding drift and bias is particularly important. Drift refers to performance degradation when the underlying data distribution changes, while bias indicates systematic error or unequal performance across patient subgroups. The IMDRF document clarifies these terms to support manufacturers in identifying when retraining or remediation is required to maintain safety and performance.

Why Uniform Definitions Matter

A harmonized vocabulary enhances regulatory predictability and cross-border alignment. With common definitions, manufacturers can prepare more consistent submissions, and regulators can apply more transparent and standardized review processes. It also helps notified bodies, standards committees, and audit organizations maintain consistent evaluation criteria.

Clear definitions are equally important for clinicians and patients. When a device is described as “continuously learning,” stakeholders need to understand the precise boundaries of its adaptation. This clarity reduces risks of misinterpretation that could compromise patient safety or compliance.

Integration with Regulatory Practice

The IMDRF’s N67 definitions are now referenced in the GMLP principles adopted by multiple regulators, including those in the U.S., UK, EU, and Canada. This reinforces the importance of shared terminology as the basis for regulatory policy. Together, N67 and GMLP create a roadmap for the development and oversight of AI/ML-enabled devices, from design and testing to monitoring and lifecycle management.

Implications for Developers

Manufacturers must integrate IMDRF definitions into their development practices from the outset. Risk management plans, validation strategies, and change-control procedures should explicitly reflect terms such as drift, retraining, and continuous learning. Clinical performance evaluation must be designed using clearly defined training and test sets, while monitoring strategies must track performance shifts aligned with N67 definitions.

Failure to align with this common vocabulary can lead to misinterpretation, regulatory delays, or gaps in safety oversight. By embedding these terms into development and documentation, companies can demonstrate compliance and strengthen the credibility of their devices.

Conclusion

The IMDRF’s Machine Learning-enabled Medical Devices: Key Terms and Definitions guidance represents a milestone in harmonizing global understanding of AI/ML in healthcare. By defining key terms such as model, drift, and retraining, it lays the foundation for safe innovation and regulatory clarity. Together with the GMLP framework, it provides a roadmap for developers and regulators alike as AI-enabled healthcare technologies continue to evolve.

If your team is developing an ML-enabled device and needs support in aligning with IMDRF definitions and regulatory expectations, contact MDx CRO to discuss how we can guide your strategy from concept to approval.

Industry Insights & Regulatory Updates

EU AI Act and Medical Devices: What SaMD Developers Need to Know (2026)

EU MDR 2017/745 for Dental Devices: Complete Guide (2026)

FDA QMSR: How the 2026 Regulation Shift Transforms MDSAP Audits and FDA Compliance Inspections

IVDR Annex XIV Performance Studies for Companion Diagnostics: A Step-by-Step Guide 2026

MDR Annex XVI: Regulating Products Without an Intended Medical Purpose Under the MDR

Companion Diagnostics in Precision Medicine: Driving Targeted Therapies

November 27, 2021

Precision medicine is transforming healthcare by tailoring treatments to the unique characteristics of each patient. At the core of this transformation are companion diagnostics (CDx), innovative tools that identify biomarkers to determine which patients will benefit from specific therapies and who may be at risk of adverse effects. Far from being a niche, CDx has become a driving force behind the approval and success of targeted treatments.

Between 2015 and 2019, approximately 65% of EMA and FDA drug approvals involved a biomarker, highlighting just how central biomarker-driven strategies have become to modern drug development (EMA | FDA Drug Approvals). Biomarkers are not just supportive; they are often decisive in shaping regulatory pathways and patient outcomes. For oncology in particular, the integration of CDx has redefined standards of care.

Today, the FDA has approved 44 companion diagnostics, many of them linked to therapies in oncology (FDA Companion Diagnostics). Among these, non-small cell lung cancer (NSCLC) and colorectal cancer represent the largest categories, reflecting both the high global disease burden and the rapid progress in targeted oncology drugs. These CDx tests help clinicians select therapies based on mutations such as EGFR, ALK, KRAS, or BRAF, directly connecting molecular profiles to treatment decisions.

Implications for pharma

The implications of these numbers are significant. For pharmaceutical companies, co-developing a therapy and its companion diagnostic has become the new normal, especially in oncology, immunology, and rare diseases. Regulatory bodies such as the FDA and EMA increasingly expect biomarker strategies to be integrated from the earliest stages of clinical development, not treated as afterthoughts. For patients, CDx represents a more hopeful and personalized pathway — ensuring that the right drug reaches the right individual at the right time.

Developing and validating a companion diagnostic, however, is complex. It requires robust clinical evidence, alignment with both drug and diagnostic regulatory frameworks, and careful planning of multi-country trials. Under the EU In Vitro Diagnostic Regulation (IVDR), CDx is classified as Class C with mandatory notified body involvement, underscoring the high standards for evidence and compliance required in Europe.At MDx CRO, we work with pharmaceutical and diagnostic partners to integrate CDx into precision medicine programs. From regulatory strategy and clinical trial design to biomarker validation and post-market surveillance, we provide the expertise needed to bring these critical tools from concept to approval. Our experience spans oncology, infectious disease, and immunology, giving us a strong foundation to support the next generation of biomarker-driven therapies.

Future outlook

Companion diagnostics have moved from a specialized innovation to a central pillar of precision medicine. With over 40 FDA-approved CDx today and biomarker involvement in the majority of new drug approvals, the trend is clear: the future of medicine will increasingly depend on diagnostics and therapeutics working hand in hand. The challenge for innovators is not whether to pursue CDx, but how to design the right strategy to meet scientific, regulatory, and clinical demands.

If you are developing a targeted therapy or considering a companion diagnostic program, contact MDx CRO to learn how we can help accelerate your path to approval and ensure your innovations reach the patients who need them most.

Industry Insights & Regulatory Updates

EU AI Act and Medical Devices: What SaMD Developers Need to Know (2026)

EU MDR 2017/745 for Dental Devices: Complete Guide (2026)

FDA QMSR: How the 2026 Regulation Shift Transforms MDSAP Audits and FDA Compliance Inspections

IVDR Annex XIV Performance Studies for Companion Diagnostics: A Step-by-Step Guide 2026

MDR Annex XVI: Regulating Products Without an Intended Medical Purpose Under the MDR

AI & SaMD: Driving a New Era in Medical Innovation

November 27, 2021

In the rapidly evolving world of MedTech, the convergence of Artificial Intelligence (AI) and Software as a Medical Device (SaMD) is revolutionizing how healthcare solutions are designed, delivered, and regulated. At MDx CRO, we help developers of AI-powered SaMD navigate complex clinical and regulatory pathways with confidence and precision.

Why It Matters:

AI-based diagnostic tools, decision support systems, and therapeutic algorithms promise faster, more accurate patient care. But these innovative technologies bring unique regulatory, clinical, and usability challenges—especially under evolving standards like EU MDR and IVDR.

Our Expertise in Action:

At MDx, we support companies from prototype to post-market, offering:

Clinical Strategy & Study Design tailored to AI validation
Regulatory Roadmapping including software classification, performance evaluation, and CE/FDA submissions
Risk Management & Documentation in line with ISO 14971, IEC 62304, and GSPR
Usability Engineering & Human Factors Testing compliant with IEC 62366 and FDA expectations

Post-Market Surveillance (PMS) & PMCF/PMPF Plans for ongoing risk-benefit monitoring

Expertise that Makes a Difference:

Our team has guided software developers through the toughest regulatory transitions and supported numerous Class IIa and Class III SaMD products in gaining CE marking and UKCA certification. With MDx, you don’t just check the regulatory boxes—you build a credible, compliant path to market success.

The Future is Software-Defined

Whether you’re developing AI-based diagnostic tools, clinical decision support systems, or digital therapeutics, MDx CRO is your trusted partner in SaMD innovation. We combine deep technical insight with real-world regulatory experience to help you bring safe, effective, and compliant digital solutions to market—faster.

Let’s talk about your next SaMD project.

Contact us today for a free consultation.

Industry Insights & Regulatory Updates

Advanced medical technician operating critical care equipment in a hospital setting to accelerate innovations in MedTech.

IVD Software Development: How to Bring IVD Software to Market in 8 Steps

Advanced medical technology and digital health monitoring for MedTech innovation and patient care.

Understanding the MDCG 2023-4 Guidance on Medical Device Software and Hardware Combinations

High-quality image of a person interacting with digital certification and approval icons on a laptop, emphasizing MedTech innovation, compliance, and accelerated medical technology solutions.

SaMD Compliance Guide: Navigating Regulations for Software as a Medical Device

Secure login interface on a laptop showing username and password fields with a digital lock icon.

Position Paper on Cyber Security: What EU Notified Bodies Expect from Medical Device Manufacturers

Digital health technology showcasing medical documentation, charts, and patient data on a sleek laptop screen for MedTech innovation.

Draft of Principles and Practices for Software Bill of Material for Medical Device Cybersecurity