Clinical Investigation Submission Spain AEMPS: What You Need to Know About the Updated Process

Understanding how to complete a clinical investigation submission in Spain with the AEMPS is essential for manufacturers and sponsors working under the EU MDR. Although the MDR brought greater harmonization across Europe, Spain maintains several national provisions that every sponsor must follow. Below is a clear, SEO‑optimized overview to help you navigate the updated process introduced on January 30, 2023.

How Clinical Investigations Are Regulated in Spain

Clinical investigations in Spain are governed by long‑standing national laws:

  • Royal Decree 1591/2009 on medical devices
  • Royal Decree 1616/2009 on active implantable devices
  • Circular Nº 07/2004, which sets out ethical and methodological requirements similar to those used for medicinal product studies

Together, these regulations define how to obtain administrative approval and what documents sponsors must provide.


Key Stakeholders in a Clinical Investigation Submission in Spain (AEMPS)

Three main stakeholders are involved in every submission:

1. AEMPS (Spanish Competent Authority)

Reviews and authorizes the clinical investigation submission in Spain.

2. CEIMs (Ethics Committees)

Issue a favorable or negative ethical opinion for studies involving human subjects.

3. Clinical Sites (“Centros de investigación”)

Conduct the Clinical Investigation Plan (CIP) according to MDR and ISO 14155.

Updated AEMPS Submission Process Under the EU MDR

Since May 26, 2021, the MDR imposed stricter rules for clinical investigations. These requirements are mainly defined in:

  • Article 70 (submission obligations for experimental devices)
  • Annex XV, Chapter II (application content and documentation)

Previously, Spain used Circular Nº 07/2004, including templates such as:

  • Annex B – application form
  • Annex 1 – manufacturer’s essential requirements declaration
  • Annex 2 – sponsor’s declaration

As of January 30, 2023, the AEMPS updated all annexes to match MDR requirements.

New AEMPS Annexes for Clinical Investigation Submissions

Annex A – MDR Submission Requirements

This annex explains all documentation needed for an MDR‑compliant clinical investigation submission in Spain AEMPS.

Annex B – Substantial Modification Requirements

Covers modifications following MDCG 2021‑28.

Annex C – Updated Application Form

Aligned with Annex XV Chapter 2.1 and includes new fields such as:

  • Clinical Evaluation Plan reference
  • Details on medicinal substances, human/animal tissues
  • Identification of the Notified Body (if applicable)
  • Confirmation of AEMPS–CEIM communication
  • Manufacturer’s declaration on GSPRs (excluding aspects under investigation)
  • Use of the term “Supervisor” instead of “Monitor”

Annex D – Updated Manufacturer GSPR Declaration

Now aligned with Annex XV Chapter 4.1.

Important Requirements for AEMPS Clinical Investigation Submissions

The updated process highlights several national expectations:

Site Director Agreement Required

In addition to AEMPS approval and CEIM opinion, the site director must sign a contract authorizing the clinical investigation.

Accepted Languages

  • English accepted: Investigator’s Brochure (IB) and Clinical Investigation Plan (CIP).
  • Spanish required: CIP summary, Patient Information Sheet, Informed Consent, Instructions for Use, labeling, and all authorization request forms.

Safety Reporting

Must follow MDCG 2020‑10/2 Rev 1 safety reporting procedures.

Submission Pathways for Clinical Investigations in Spain

Spain offers different submission pathways depending on the study type:

1. Full AEMPS Submission

Required for:

  • Premarket clinical investigations with non‑CE‑marked devices
  • CE‑marked devices used outside their intended purpose (MDR Article 74.2)

2. Notification via NEOPS

Used for PMCF studies with CE‑marked devices used within intended purpose but deviating from standard practice.

3. No Authorization or Notification

For observational PMCF studies fully aligned with CE‑marked intended use.

4. Consultation With AEMPS

For studies under MDR Article 82 involving non‑CE‑marked or off‑label CE‑marked devices, but not intended to support CE marking.

How MDx Supports Your Clinical Investigation Submission in Spain (AEMPS)

MDx CRO provides end‑to‑end support for sponsors navigating the updated Spanish submission pathway. Our services include:

  • Clinical & regulatory strategy
  • Medical writing
  • GSPR checklist creation
  • Notified Body application support
  • Design of IB and CIP aligned with MDR & ISO 14155
  • Ethics Committee submissions
  • AEMPS clinical investigation submissions
  • Site qualification, activation, monitoring & management
  • PMCF and Article 82 studies

Our experts guide you through every stage (from planning to submission to study execution) ensuring full compliance with MDR and Spanish national requirements.

Industry Insights & Regulatory Updates

The Impact of the IVDR and MDCG 2023-1 on LDTs

On May 26, 2022 the new Regulation (EU) 2017/746 on in vitro diagnostic medical devices (IVDR) has become fully applicable with major consequences not only for manufacturers of IVDs but also for all diagnostic laboratories, particularly those that manufacture in-house IVDs (often called laboratory developed tests or LDTs).

Although an exemption exists and not all requirements of the IVDR are applicable to LDT IVDs, that exemption is only applicable if several conditions are met as we will discuss later in this blog.With the implementation of the IVDR, EU laboratories, particularly those that manufacture in-house IVDs, are required to comply with EU legislation for the first time, and the workload to meet those requirements is significant.It is also important to note that the discussion of IVDR LDTs is limited to European health institutions.

LDTs manufactured outside the EU, for example, by CLIA-certified US laboratories or other non-EU commercial laboratories, are not eligible for the IVDR LDT/in-house exemption neither they can fulfil the conditions set out in article 5(5) of the IVDR. If these companies provide testing on EU patients through institutions outside of the EU, their IVD tests should be in full compliance with the IVDR by now (including conformity assessment with a Notified Body) which sees scrutiny rise to a completely different level than what they are used to.

The only exception is if there was a signed declaration of conformity for a specific test under the IVD directive (IVDD) prior to the 26th of May 2022, which could have granted that test additional transition time based on the IVDR progressive roll-out that is currently in place. This is unusual because non-EU LDTs were not covered by the previous IVDD, and most companies providing these tests in Europe should now be fully compliant with the IVDR.

Article 6 of the IVDR (distance sales) regulates such commercial activities and states that commercial laboratories operating outside of the EU but providing testing to EU citizens must fully comply with the IVDR.

The impact of IVDR, ISO 15189:2022 changes, and the publication of MDCG 2023-1

In this blog we will examine key topics such as:

  • What conditions must be met in order to continue manufacturing in-house/LDT IVDs in the EU?
  • Changes in the new ISO 15189:2022 standard
  • MDCG 2023-1 Guidance on the Health Institution Exemption under Article 5(5) of the IVDR, which was recently published.
  • What steps should IVDR LDT manufacturers take right now?
  • How can MDx assist?

Conditions for IVDR LDTs and their deadlines

Under the IVDR, IVDs can be manufactured and used within EU health institutions (in-house devices) on a non-industrial scale to address specific target patient group needs, or when there isn’t an equivalent CE-marked IVD on the market.

It is important to note that each EU member state has the right to restrict the use of such devices and therefore we are likely to see differences being applied on a EU level when it comes to restrictions on in-house devices.

However, the following main conditions must still be met for the exemption to apply:

Condition #1 – No transfer of devices [IVDR article 5(5)a]

IVDs such as reagents and control materials may not be distributed to other legal entities. Material distribution for external quality assessment is an exception (see IVDR Art. 1(3)). Documents such as protocols/standard operating procedures (SOPs) may also be distributed because they are not devices. Furthermore, there are no restrictions on testing samples obtained from external sources. As a result, reference hospitals can continue to analyse samples from hospitals that are unable to perform the test in question, as long as it is not done on an industrial scale.

Timeline: in-house IVDs cannot be transferred to other legal entities from 26 May 2022

Condition #2 –  Compliance with EN ISO 15189 [article 5(5)b, c]

Diagnostic laboratories that use in-house IVDs must comply with the EN ISO 15189 standard (recently updated to the 2022 version), which specifies quality and competence requirements in medical laboratories. Accreditation is not strictly necessary unless your member state requires it, but it is good to be aware that external audits are a solid foundation for improving a QMS. A QMS established in accordance with ISO 15189 has generally been acceptable amongst the medical laboratory community, however MDCG 2023-1 confirms that compliance to EN ISO 15189 alone is not sufficient for the manufacture of in-house IVDs. The QMS should extend to other areas that are necessary for IVDR compliance, including for example risk management and manufacturing, by making use of appropriate standards particularly if they are harmonised to the IVDR. MDCG 2023-1 suggests that elements of ISO 13485 (medical devices) and ISO 14791 (risk management) should be incorporated in the QMS. In-house test manufacturers will need to determine the best way to comply with ISO 15189 and the IVDR requirements in Annex I concurrently.

Timeline: compliance with ISO 15189 is required by 26 May 2024

What is ISO 15189:2022?

ISO 15189:2022 specifies quality and competence requirements for medical laboratories. ISO 15189 is applicable not only to medical laboratories developing management systems and assessing their competence, but also to users, regulatory authorities, and accreditation bodies confirming or recognizing the competence of medical laboratories.

ISO 15189:2022 vs 2012: main changes!

Because of the alignment with ISO/IEC 17025:2017-General Requirements For The Competence Of Testing And Calibration Laboratories, the management requirements are now at the end of the document.
– Added requirements for point-of-care testing (POCT) (based on ISO 22870:2016) which is a new addition to the standard’s scope.
– A stronger emphasis on risk management: requires laboratory managers to establish, implement and maintain risk management processes and evaluate their effectiveness; and extends risk measures by requiring safeguards that can prevent unintended adjustments of laboratory equipment.
– New terms & definitions: e.g. In vitro diagnostic medical device (IVD), external quality assessment, trueness/measurement trueness and others.

Condition #3 –  Justification of use and unmet needs [Article 5(5) d]

The use of CE-IVDs is the default option under the IVDR. Only when no equivalent CE-IVD is available, or when an equivalent CE-IVD cannot meet the specific needs of a target patient group at the appropriate level of performance, is the use of in-house IVDs permitted. This implies that IVDR LDTs can be used when they perform better, i.e. when their use benefits patient safety and health. A written statement justifying the manufacture, modification, and use of in-house IVDs should be available for review by the national competent authority, which oversees the enforcement the IVDR and judges the justification’s validity.

One of the most pressing issues is what constitutes an appropriate justification for unmet need. MDCG 2023-1 provides some further clarity that the justification can be based on technical, biological or clinical aspects of the device “e.g. different intended purpose, different clinical conditions, different patient group, different conditions of use, different principles of operation, different approved specimen materials, different critical performance characteristics or different critical technical specifications”. To establish that an equivalent CE marked device does not exist, MDCG 2023-1 recommends that medical laboratories implement a process to examine the market, for example by consulting EUDAMED, the European database on medical devices or other processes. Furthermore, the justification should be reviewed on a regular basis.

Timeline: 26 May 2028 for the justification to be fully available in the health institution documentation. Please note that the competent authority may submit requests for information already from 26 May 2024.

Condition #4 – Public declaration and GSPR compliance [article 5(5)f]

One of the other conditions to continue manufacturing in-house devices is that the health institution prepares a public declaration with the name and address of the manufacturing health institution, the details of the IVD LDT and confirmation that the device meets the GSPRs set out in Annex I of the IVDR. Where a GSPR is not met in full an appropriate justification is required. This is best addressed by means of a GSPR checklist that should be prepared for the in-house device.

Annex A of MDCG 2023-1  provides a template for this public declaration.

Timeline: public declarations will need to be available by 26 May 2024

Condition #5 – Additional requirements for class D IVDR LDTs [article 5(5) g,h]

The requirements for class D tests are more stringent than those for classes A-C tests. More information on the manufacturing, design, and performance of IVDR LDTs is needed. This means that the GSPR for class D tests should be met and documented in greater detail, largely aligned with that produced for CE-IVDs, i.e. in accordance with Annex II’s technical documentation requirements. For example, there should be documentation that demonstrates how the analytical and clinical performance data support the intended purpose of the in-house device.

Timeline: 26 May 2024

Condition #6 – Clinical experience gained [article 5(5) i]

The experience gained from clinical use of the device should be used by the health institution to review the device performance and to take all necessary corrective actions. The strategy for the evaluation of the use of the in-house IVD should be aligned with post-market surveillance requirements and a documented procedure should be in place.

Timeline: processes to review clinical experience gained should be implemented by 26 May 2024

5 actions laboratory test developers must take right now.

  1. Review the IVDR and establish the appropriate regulatory framework for your unique circumstances:
    Health institutions based in Europe can make use of article 5(5) in the IVDR to continue manufacturing IVDR LDTs under certain conditions.Laboratories that provide testing on European patients but are based outside of the EU (article 6 distance sales), are not granted an in-house exemption and therefore must meet the IVDR in full if they wish to continue to provide testing on EU specimens.
  2. Review assay portfolio and identify which are in-house IVDs vs CE-IVDs
    For health institutions based in the EU: review the possible classification of your in-house IVDs against Annex VIII (Classification rules) of the IVDR. In-house tests that fall in class D will have stricter requirements to fulfil.
  3. Ensure all conditions have been met for your laboratory to continue manufacturing in-house IVDs
    As of May 2022, devices can no longer be transferred to other legal entities. This is likely to be interpreted differently from member state of member state, depending on how healthcare systems are organised in a particular country. You may seek to clarify your circumstances with your national competent authority.Familiarise with the deadlines for each in-house test condition that applies. For example some requirements have applied in May 2022 (e.g. prohibition to transfer devices to another legal entity), whereas others will become applicable from May 2024 (e.g. ISO 15189 implementation) or May 2028 (e.g. written justification for unmet needs of specific target patient groups).Where relevant, ensure that you have documented evidence to support your obligations under article 5(5).
  4. Implement a suitable quality management system
    ISO 15189:2022 has recently been published and has introduced several changes when compared to ISO 15189:2012. However, regulators continue to believe that this standard is insufficient to address the manufacture of in-house IVDs. As a minimum, your quality management system will need to be supplemented with additional controls from other key medical device standards such as ISO 14971 and ISO 13485.
  5. Conduct a review of your IVDR LDTs against the general safety and performance requirements (GSPR) in Annex I of the IVDR
    The health institution is legally responsible for the public declaration on the in-house IVD and therefore should complete a full review of all relevant GSPRs and ensure that a justification is readily available for any GSPRs that are not met in full.

How can MDx help with your IVDR LDTs?

MDx CRO is a leading quality, regulatory and contract research consulting company dedicated to the medical device and diagnostic sectors.

With the introduction of the IVDR, the requirements for in-house devices and laboratory developed tests (LDTs) have grown significantly. Whether you are a health institution in the EU or a commercial laboratory outside of the EU, our MedTech team can assist you in developing a compliance strategy and will be with you every step of the way.

Our IVDR Laboratory services have been tailored for the needs of in-house test developers and include:

  • Regulatory strategy: includes classification review, intended purpose review, technical documentation needs assessment, and a strategic assessment of regulatory needs with a focus on reducing the compliance burden.
  • Creation of QMS procedures to meet the requirements of the in-house test environment whilst meeting EU IVDR requirements.
  • Assessment of all conditions in article 5(5)
  • Gap assessment of your QMS system
  • Medical writing
  • Creation of technical documentation to support Class D in-house IVDs
  • Creation and completion of GSPR checklists
  • Support with notified body applications
  • Support with competent authority requests
  • ISO 14971:2019 gap analysis and implementation
  • ISO 13485:2016 gap analysis and implementation
  • ISO 15189:2022 gap analysis and implementation

Please reach out today for a consultation with our team of IVDR LDTs experts.

Written by:
Carlos Galamba

Carlos Galamba

CEO

Senior regulatory leader and former BSI IVDR reviewer with deep experience in CE marking high-risk IVDs, companion diagnostics, and IVDR implementation.
Industry Insights & Regulatory Updates

WHO Guidance for Digital Health (Nov 2022): Monitoring the Implementation of Digital Health

Digital health shifted from a “nice‑to‑have” to a system imperative during COVID‑19. The World Health Organization (WHO) responded with a global strategy to help countries scale digital health safely and equitably, and in November 2022 it published “Monitoring the implementation of digital health: an overview of selected national and international methodologies.” For product leaders and regulatory teams in digital health, this document is not a “how to regulate” playbook; it is a measurement playbook that shows what to track, how to compare progress across countries, and where the evidence gaps still are. The report underpins the WHO Global Strategy on Digital Health 2020–2025, which calls for consistent monitoring so decisions are driven by comparable, high‑quality data. See the WHO monitoring overview and strategy documents for scope and context. (WHO Europe, 2022; WHO Global Strategy 2020–2025).

What the WHO November 2022 guidance actually covers

The guidance reviews national and international indicator frameworks used to monitor digital health maturity—spanning governance, adoption, use, data infrastructure and re‑use—and explains why internationally agreed indicators are still limited. It also synthesizes lessons from country case studies to show how monitoring feeds into policy and investment choices. In short, it tells decision‑makers what to measure so they can assess whether digital health is improving access, quality, safety and system performance. (WHO Europe, 2022).

What it does not cover: medical‑device regulatory pathways

Manufacturers should note the distinction: the WHO monitoring overview does not set device‑specific regulatory expectations for Software as a Medical Device (SaMD) or AI/ML devices. For those, regulators align through IMDRF documents such as SaMD Key Definitions and the Good Machine Learning Practice (GMLP) guiding principles, which inform how agencies approach AI/ML medical devices across the product lifecycle. (IMDRF SaMD Key Definitions; IMDRF GMLP N88:2025).

Why monitoring matters to digital health manufacturers

For companies planning EU or multi‑country scale‑up, what gets measured gets adopted. Payers and ministries increasingly look for comparable indicators to benchmark telehealth, citizen EHR access, data interoperability and equity. WHO’s analysis highlights that while monitoring has improved since the pandemic, evidence systems still struggle to keep pace with rapid innovation—especially around governance, health‑data reuse and system‑wide interoperability. (WHO Europe, 2022).

Four monitoring domains manufacturers should build into their go‑to‑market plans

Telehealth effectiveness and sustainability. Post‑pandemic, OECD countries expanded telemedicine at speed, but sustainability requires data on quality, access, outcomes and financial impact. OECD’s work outlines leading practices and shows where countries are meeting the mark—and where they are not—providing a lens manufacturers can use to frame clinical and economic value arguments. (OECD, 2024; see also OECD Working Paper 116).

Citizen access to health data. The European Commission’s Digital Decade monitoring includes a composite eHealth indicator tracking citizens’ online access to electronic health records—what data are accessible, through which technologies, and with what population coverage—helping companies anticipate variability in user activation and integration demands. (European Commission, 2024).

Equity and digital‑health literacy. WHO’s European Health Information Gateway now hosts indicators and country profiles covering telehealth, mHealth, literacy and big‑data analytics. If your product depends on remote access or self‑management, plan for measurable equity outcomes and the ability to disaggregate performance across priority groups. (WHO/Europe indicators).

Interoperability and data reuse. WHO stresses that monitoring must capture technical and operational readiness to share and reuse health data, not just app counts or user numbers. Local integration, standardized vocabularies, and data‑provenance controls are increasingly pre‑conditions for public procurement and reimbursement. (WHO Europe, 2022).

Regional benchmarks you can leverage in evidence plans

The Nordic eHealth Research Network, backed by the Nordic Council of Ministers, maintains one of the world’s most mature indicator sets for digital health—useful as a benchmark for adoption, service quality and outcomes when planning pilots in Europe’s most advanced markets. The latest 2025 benchmarking report and earlier methodology publications show how indicators evolved to support policy and procurement decisions. (Nordic Council of Ministers, 2025; background methodology: DiVA portal).

What this means for your product, evidence and market access strategy

Manufacturers that align product telemetry and study designs with the indicators policymakers actually track shorten the distance from pilot to scaled deployment. WHO’s monitoring agenda and the EU’s digital‑policy metrics translate directly into product requirements: demonstrable quality and safety at scale, equitable reach across populations, integration into national data spaces, and transparent reporting on usage and outcomes. If your solution overlaps with regulated functions (decision support, diagnosis, triage), pair this monitoring strategy with IMDRF and local regulatory guidance for SaMD/AI so that clinical evidence, change control and post‑market monitoring satisfy both policy and regulatory expectations.

How MDx CRO helps digital health manufacturers turn monitoring into market traction

MDx CRO works with digital health and SaMD teams to translate monitoring frameworks into actionable study endpoints, KPIs and regulatory‑ready evidence. We map your product to WHO and EU indicator sets, design real‑world evaluation that demonstrates equitable access and clinical impact, and align your documentation with IMDRF principles when your software meets the definition of a medical device. Explore our support for Clinical Research and Regulatory Affairs, or contact us to scope a country‑by‑country expansion plan.

Industry Insights & Regulatory Updates

Understanding MDCG 2020-10 Rev 1: Safety Reporting in Medical Device

In light of the forthcoming Medical Device Regulation (MDR) and the delay in the complete functionality of the electronic system referenced in Article 73 (EUDAMED), the MDCG 2020-10 Rev 1 provides essential guidance. With Eudamed not being ready on the MDR’s effective date, the guidelines under MDCG 2020-10 Rev 1 become instrumental in outlining the processes for safety reporting in clinical research.

Key Points from MDCG 2020-10 Rev 1:

  • Safety Reporting Modalities: The document thoroughly describes the reporting modalities for Serious Adverse Events (SAEs) and offers a summary tabulation reporting format.
  • Adherence to Regulations: It emphasizes that medical device safety reporting during clinical studies must be consistent with the guidelines in Article 80 of Regulation (EU) 2017/745, also known as the Medical Device Regulation (MDR).

For a clinical investigation involving medical technology, utilizing the electronic system as stipulated in MDR Article 73 means the sponsor must promptly share the following with every Member State involved:

  • Any SAE that can be directly or potentially linked to the investigational device, comparator, or the procedure.
  • Any device defect that could have escalated to a serious adverse event under different circumstances.
  • Further details on any aforementioned event.

The timeframe set for reporting these adverse events varies based on the severity of the incident. While the clinical trial sponsor might initially provide an incomplete report, it’s crucial to follow up with a detailed one to maintain timely reporting.

The guidance not only covers the basic safety reporting protocols but also delves deeper into the post-market clinical follow-up (PMCF) investigations for CE-marked MedTech products. Here, the guidelines laid out in MDR Articles 87 to 90 play a pivotal role.

Safety Reporting in PMCF Clinical Investigations

It’s noteworthy that while the vigilance measures outlined in the aforementioned articles are applicable to PMCF clinical studies, the MDCG 2020-10 Revision 1 remains relevant. This is primarily because the reporting of significant adverse events linked to previous investigational devices should align with the reporting prerequisites mentioned in EU MDR 2017/745 Article 80.

The guidance document provides an essential roadmap for Safety reporting SOPs, Safety reporting plans, and Clinical Investigation plans. This is invaluable for MedTech Manufacturers, sponsors, and CROs involved in clinical research activities with medical devices.

FAQs about MDCG 2020-10 Rev 1

  • What events need reporting? Report all SAEs and suspected unexpected serious adverse device effects (SUSADEs).
  • What’s the reporting timeframe? Report SAEs within 15 days and SUSADEs within 7 days post the sponsor’s awareness.
  • What should a safety report include? Details about the sponsor, investigator, device, event date, event description, outcome, and other pertinent data.

For more comprehensive insights on safety reporting for medical devices, delve into the MDCG 2020-10 Rev 1 guidance document.

Industry Insights & Regulatory Updates

Clinical Evaluation Consultation Procedure (CECP) – New Opinion Issued

Expert panels on medical devices and in vitro diagnostic devices (Expamed)

What this post covers
This article explains and contextualizes a Clinical Evaluation Consultation Procedure (CECP) opinion issued by the EU Expert Panels (Expamed) on October 2022. We’re not republishing the scientific opinion; instead, we summarize what the panel concluded, why CECP matters for Class III and other high-risk devices, and what practical actions manufacturers and notified bodies (NBs) should consider. Our case study is the publicly available CECP opinion concerning a Class III implant used for reinforcement of abdominal soft tissue in ventral and hiatal hernia repair. We highlight how panels judge the sufficiency of clinical evidence, how benefit–risk is weighed, and how PMCF commitments—including registry follow-up—are used to address residual uncertainty. For the official documents, see the Commission’s expert-panel portal, the master list of CECP opinions, and the PDF of the specific opinion discussed here. 

CECP in a nutshell

Under MDR Article 54 and Annex IX, Section 5.1, certain high-risk devices undergo an additional, independent check of the Clinical Evaluation Assessment Report (CEAR) performed by the NB. The expert panel issues a scientific opinion that the NB must consider—especially if the panel finds the level of clinical evidence insufficient or raises concerns about benefit–risk, alignment of evidence with intended purpose and indications, or adequacy of the post-market clinical follow-up (PMCF) plan. If the NB does not adopt the panel’s advice, Annex IX, 5.1(g) requires the NB to justify that decision in its conformity-assessment report. 

Scope of the October 2022 opinion

The consultation related to a fully resorbable mesh with a resorbable hydrogel coating, indicated for reinforcement of abdominal soft tissue in ventral and hiatal hernia repair, assessed within the competence area of General and plastic surgery and dentistry (BSI NB 2797; file CECP-2022-000227). These administrative and device-scope details are recorded in the published opinion and its Commission news entry. 

What the expert panel decided

The panel concurred with the NB on the appropriateness and sufficiency of the manufacturer’s clinical data and agreed with the NB’s benefit–risk assessment. The opinion notes publication of a new multicentre study adding 84 patients with 24-month follow-up to the dataset and reports no indication of higher recurrence or complication rates compared with established routine techniques. At the same time, the panel emphasized that sample sizes across trials and registries were relatively small and follow-up relatively short, supporting the need for longer-term data. 

PMCF expectations and real-world data

The PMCF Plan was considered acceptable. It calls for further clinical-data collection to identify long-term adverse effects, including those related to device–tissue interaction, and for tracking in two quality registries—HerniaMed and ACHQC—to expand the evidence base over the device’s expected lifetime. The panel’s stance illustrates how CECP leverages real-world registries to complement trials and literature when total exposure and follow-up duration are still maturing. 

What manufacturers should take from this

  • Think “totality of evidence.” CECP panels look at the sum of literature, clinical investigations, registries, and the PMCF plan. Smaller cohorts and shorter follow-up aren’t automatic blockers if a credible plan exists to close gaps post-certification, but the plan must be specific about endpoints, timelines, and data sources. For reference, the Commission’s “List of opinions provided under the CECP” shows multiple cases in which panels flagged evidence sufficiency, intended-purpose alignment, or PMCF robustness. 
  • Align intended purpose, indications, and SSCP. Panels will check whether the intended purpose/indications match the evidence presented and whether claims are mirrored in the SSCP and labeling. Divergences often lead to scope restrictions, targeted PMCF, or time-limited certificates. The Commission’s Expert Panels hub outlines the panels’ remit and how their opinions integrate into NB assessments.
  • Prepare for “justify if you diverge.” If your NB does not fully adopt the panel’s advice, it must justify why in its report (Annex IX, 5.1(g)). Anticipate this by designing evidence and PMCF strategies that are straightforward to adopt—e.g., leveraging recognized registries and clearly defining success metrics and risk signals. 

Why this opinion matters beyond hernia repair

Although device-specific, the October 24, 2022 case neatly shows how CECP functions as a calibrated check on high-risk devices: validate benefit–risk for the intended purpose, acknowledge dataset limits, and enforce structured PMCF to address residual uncertainty. For sponsors approaching CECP, this is a model of how to present fit-for-purpose clinical evaluation, align claims with evidence, and build PMCF that uses registries and longer-term outcomes to demonstrate continued performance and safety.

See the official CECP opinion (PDF) and the Commission’s news entry for the canonical record.

Industry Insights & Regulatory Updates

Draft of Principles and Practices for Software Bill of Material for Medical Device Cybersecurity

Connected medical devices increasingly share third-party and open-source components. A single vulnerability in a widely used library can ripple across vendors and product lines—making Software Bills of Materials (SBOMs) essential for transparency, risk assessment, and incident response across the total product lifecycle. The International Medical Device Regulators Forum (IMDRF) formalized this with its final guidance, Principles and Practices for Software Bill of Materials for Medical Device Cybersecurity (N73), which describes what an SBOM is, how to generate and maintain it, and how healthcare delivery organizations should consume it.

What an SBOM is—and why devices need one

The U.S. National Telecommunications and Information Administration (NTIA) defines an SBOM as a structured inventory of software components and their metadata—the “ingredients list” of a product. This transparency helps manufacturers and operators quickly identify exposure when new vulnerabilities (e.g., in a dependency) are disclosed, and it enables repeatable vulnerability and patch management processes.

IMDRF’s SBOM guidance (N73) dovetails with earlier IMDRF N60 lifecycle cybersecurity practices, positioning SBOMs as part of customer security documentation and post-market risk management. For device makers, that means SBOMs aren’t a one-time deliverable but a maintained asset that evolves with software updates, configurations, and component end-of-support.

Where regulators are today (and what they expect)

In the U.S., the FDA’s final cybersecurity guidance (2025 update) integrates SBOM expectations into quality system and premarket documentation, alongside processes for vulnerability handling, threat modeling, and update mechanisms. The FDA’s public Cybersecurity FAQs also explain how statutory changes (section 524B) affect submissions and postmarket obligations. Manufacturers should expect reviewers to look for SBOM content that’s actionable (e.g., component versions, known vulnerabilities, support status) and kept current throughout the device lifecycle.

Beyond healthcare, CISA’s 2024 framing for software component transparency shows how SBOM data is converging toward interoperable formats and exchange models—useful for scaling supplier management and incident response across complex portfolios and hospital networks.

Practical SBOM essentials for medical-device teams

Per IMDRF N73, an effective medical-device SBOM should clearly identify each component (and transitive dependency), the supplier, version, and unique identifiers, along with relationships and license data. It must also be consumable by customers: documentation should explain how the SBOM is accessed, how frequently it is updated, and how customers can map vulnerabilities to affected configurations. Manufacturers should align SBOM scope and format with their post-market cybersecurity processes so that vulnerability intake (e.g., from CISA/NVD) triggers internal triage, risk evaluation, and—when needed—field actions.

SBOMs for AI/ML and ML-enabled devices (MLMD)

AI-driven devices and machine learning-enabled medical devices (MLMD) depend on extensive software stacks plus data pipelines. While model artifacts aren’t “software components” in the classic sense, the IMDRF MLMD terminology (N67) and broader cybersecurity guidance support the same principle: maintain transparent, version-controlled inventories of the components your safety depends on—frameworks, libraries, runtimes, and security-relevant configs—so you can evaluate and communicate risk when dependencies change. Pair your SBOM with rigorous change control for models and data to preserve safety and performance.

How SBOMs reduce time to action

When a widely used component is found vulnerable, organizations that maintain current, machine-parsable SBOMs can immediately answer: Where do we run this? Which devices are impacted? What versions are affected? That shortens the path from disclosure to containment, patching, or compensating controls—reducing patient and business risk. FDA reviewers, hospital security teams, and incident-response coordinators increasingly expect this level of traceability.

Bottom line for digital-health manufacturers

Treat the SBOM as a first-class safety artifact: build it as you build your software, keep it up to date, make it accessible to customers, and wire it into vulnerability management and field-action playbooks. Align content and exchange formats with IMDRF N73 and be prepared to show how SBOMs underpin your premarket claims and postmarket responsiveness.

If you’re planning or executing a submission, MDx CRO can map your current secure-development and post-market processes to the latest expectations, align SBOM tooling and content to IMDRF/FDA, and integrate SBOM handling into your PMS and incident-response procedures.

Industry Insights & Regulatory Updates

IMDRF Machine Learning-enabled Medical Devices: Key Terms and Definitions

The International Medical Device Regulators Forum (IMDRF) has published Machine Learning-enabled Medical Devices: Key Terms and Definitions (IMDRF/AIMD WG/N67, Edition 1). This foundational guidance establishes a common vocabulary for artificial intelligence (AI) and machine learning (ML) in the medical device sector. Its purpose is to create uniform expectations and understanding, improve patient safety, inspire innovation, and encourage access to breakthroughs in healthcare technology.

Artificial intelligence is broadly defined as the use of algorithms or models to perform tasks, make decisions, or generate predictions. Within AI, machine learning is a subset where models are trained on data, enabling them to learn patterns without explicit rule-based programming. The IMDRF document situates these concepts within a regulatory and clinical context, ensuring clarity when applied to medical devices.

One of the key goals of the guidance is to reduce confusion across jurisdictions. Manufacturers, regulators, and clinicians may use different terms for the same concepts, such as “model,” “training,” or “retraining.” This lack of alignment can complicate regulatory submissions and reviews. The IMDRF’s definitions create a standard set of terms that can be consistently referenced across regulatory frameworks and development programs.

In February 2025, IMDRF released Good Machine Learning Practice (GMLP), which builds on the definitions in N67 by providing ten guiding principles for the development, validation, and monitoring of ML-enabled devices. The link between the two documents is crucial: N67 defines the language, while GMLP sets expectations for practice across the product lifecycle.

Key Terms and Their Impact

The N67 guidance defines terms such as “model,” “training set,” “test set,” “drift,” “bias,” “retraining,” “locked model,” and “continuous learning.” These definitions are not academic—they directly influence how safety risks are assessed, how validation studies are structured, and how regulatory change control is applied. For instance, a locked model is one that does not evolve after deployment, while a continuous learning model adapts over time, requiring additional oversight and safeguards.

Understanding drift and bias is particularly important. Drift refers to performance degradation when the underlying data distribution changes, while bias indicates systematic error or unequal performance across patient subgroups. The IMDRF document clarifies these terms to support manufacturers in identifying when retraining or remediation is required to maintain safety and performance.

Why Uniform Definitions Matter

A harmonized vocabulary enhances regulatory predictability and cross-border alignment. With common definitions, manufacturers can prepare more consistent submissions, and regulators can apply more transparent and standardized review processes. It also helps notified bodies, standards committees, and audit organizations maintain consistent evaluation criteria.

Clear definitions are equally important for clinicians and patients. When a device is described as “continuously learning,” stakeholders need to understand the precise boundaries of its adaptation. This clarity reduces risks of misinterpretation that could compromise patient safety or compliance.

Integration with Regulatory Practice

The IMDRF’s N67 definitions are now referenced in the GMLP principles adopted by multiple regulators, including those in the U.S., UK, EU, and Canada. This reinforces the importance of shared terminology as the basis for regulatory policy. Together, N67 and GMLP create a roadmap for the development and oversight of AI/ML-enabled devices, from design and testing to monitoring and lifecycle management.

Implications for Developers

Manufacturers must integrate IMDRF definitions into their development practices from the outset. Risk management plans, validation strategies, and change-control procedures should explicitly reflect terms such as drift, retraining, and continuous learning. Clinical performance evaluation must be designed using clearly defined training and test sets, while monitoring strategies must track performance shifts aligned with N67 definitions.

Failure to align with this common vocabulary can lead to misinterpretation, regulatory delays, or gaps in safety oversight. By embedding these terms into development and documentation, companies can demonstrate compliance and strengthen the credibility of their devices.

Conclusion

The IMDRF’s Machine Learning-enabled Medical Devices: Key Terms and Definitions guidance represents a milestone in harmonizing global understanding of AI/ML in healthcare. By defining key terms such as model, drift, and retraining, it lays the foundation for safe innovation and regulatory clarity. Together with the GMLP framework, it provides a roadmap for developers and regulators alike as AI-enabled healthcare technologies continue to evolve.

If your team is developing an ML-enabled device and needs support in aligning with IMDRF definitions and regulatory expectations, contact MDx CRO to discuss how we can guide your strategy from concept to approval.

Industry Insights & Regulatory Updates

Companion Diagnostics in Precision Medicine: Driving Targeted Therapies

Precision medicine is transforming healthcare by tailoring treatments to the unique characteristics of each patient. At the core of this transformation are companion diagnostics (CDx), innovative tools that identify biomarkers to determine which patients will benefit from specific therapies and who may be at risk of adverse effects. Far from being a niche, CDx has become a driving force behind the approval and success of targeted treatments.

Between 2015 and 2019, approximately 65% of EMA and FDA drug approvals involved a biomarker, highlighting just how central biomarker-driven strategies have become to modern drug development (EMA | FDA Drug Approvals). Biomarkers are not just supportive; they are often decisive in shaping regulatory pathways and patient outcomes. For oncology in particular, the integration of CDx has redefined standards of care.

Today, the FDA has approved 44 companion diagnostics, many of them linked to therapies in oncology (FDA Companion Diagnostics). Among these, non-small cell lung cancer (NSCLC) and colorectal cancer represent the largest categories, reflecting both the high global disease burden and the rapid progress in targeted oncology drugs. These CDx tests help clinicians select therapies based on mutations such as EGFR, ALK, KRAS, or BRAF, directly connecting molecular profiles to treatment decisions.

Implications for pharma

The implications of these numbers are significant. For pharmaceutical companies, co-developing a therapy and its companion diagnostic has become the new normal, especially in oncology, immunology, and rare diseases. Regulatory bodies such as the FDA and EMA increasingly expect biomarker strategies to be integrated from the earliest stages of clinical development, not treated as afterthoughts. For patients, CDx represents a more hopeful and personalized pathway — ensuring that the right drug reaches the right individual at the right time.

Developing and validating a companion diagnostic, however, is complex. It requires robust clinical evidence, alignment with both drug and diagnostic regulatory frameworks, and careful planning of multi-country trials. Under the EU In Vitro Diagnostic Regulation (IVDR), CDx is classified as Class C with mandatory notified body involvement, underscoring the high standards for evidence and compliance required in Europe.At MDx CRO, we work with pharmaceutical and diagnostic partners to integrate CDx into precision medicine programs. From regulatory strategy and clinical trial design to biomarker validation and post-market surveillance, we provide the expertise needed to bring these critical tools from concept to approval. Our experience spans oncology, infectious disease, and immunology, giving us a strong foundation to support the next generation of biomarker-driven therapies.

Future outlook

Companion diagnostics have moved from a specialized innovation to a central pillar of precision medicine. With over 40 FDA-approved CDx today and biomarker involvement in the majority of new drug approvals, the trend is clear: the future of medicine will increasingly depend on diagnostics and therapeutics working hand in hand. The challenge for innovators is not whether to pursue CDx, but how to design the right strategy to meet scientific, regulatory, and clinical demands.

If you are developing a targeted therapy or considering a companion diagnostic program, contact MDx CRO to learn how we can help accelerate your path to approval and ensure your innovations reach the patients who need them most.

 

Industry Insights & Regulatory Updates

AI & SaMD: Driving a New Era in Medical Innovation

In the rapidly evolving world of MedTech, the convergence of Artificial Intelligence (AI) and Software as a Medical Device (SaMD) is revolutionizing how healthcare solutions are designed, delivered, and regulated. At MDx CRO, we help developers of AI-powered SaMD navigate complex clinical and regulatory pathways with confidence and precision.

Why It Matters:

AI-based diagnostic tools, decision support systems, and therapeutic algorithms promise faster, more accurate patient care. But these innovative technologies bring unique regulatory, clinical, and usability challenges—especially under evolving standards like EU MDR and IVDR.

Our Expertise in Action:

At MDx, we support companies from prototype to post-market, offering:

Post-Market Surveillance (PMS) & PMCF/PMPF Plans for ongoing risk-benefit monitoring

Expertise that Makes a Difference:

Our team has guided software developers through the toughest regulatory transitions and supported numerous Class IIa and Class III SaMD products in gaining CE marking and UKCA certification. With MDx, you don’t just check the regulatory boxes—you build a credible, compliant path to market success.

The Future is Software-Defined

Whether you’re developing AI-based diagnostic tools, clinical decision support systems, or digital therapeutics, MDx CRO is your trusted partner in SaMD innovation. We combine deep technical insight with real-world regulatory experience to help you bring safe, effective, and compliant digital solutions to market—faster.

Let’s talk about your next SaMD project.

Contact us today for a free consultation.

Industry Insights & Regulatory Updates