In September, the European Commission issued a recommendation on the audits and assessments performed by notified bodies, conformity assessment organizations that have been notified by the European Commission under the EU medical device directives. "Although a recommendation is gently phrased as a request to member states, it can be seen as soft legislation, with a significant legal status," write Gert Bos and Françoise Schlemmer of notified body association Team-NB in a recent article in Clinica. So, why should you be concerned? Well, as a supplier to a medical device manufacturer marketing products in Europe, you could be on the list for one of those surprise visits.

Here is what the recommendation says:

"To verify the day-to-day compliance with legal obligations, notified bodies should, in addition to the initial surveillance or renewal audits, visit the manufacturer or, if this is likely to ensure more efficient control, one of its subcontractors in charge of processes which are essential for ensuring compliance with legal requirements ("critical subcontractor") or a supplier of crucial components or of the entire devices (both: "crucial supplier") without prior notice ("unannounced audits")."

While this is not new—unannounced visits are authorized under the current EU medical device regulations—it is "newish," insofar as unannounced visits were not enthusiastically implemented in the past, writes Erik Vollebregt, a founding partner of life sciences law firm Axon Lawyers in the Netherlands, on his blog, medicaldeviceslegal.com. That all changed with the Pip implant scandal.

As you may recall, French company Poly Implant Prothèse (Pip) manufactured breast implants using industrial rather than medical-grade silicone for several years. Notified body TÜV Rheinland eventually discovered the subterfuge, but only after hundreds of thousands of women had received the implants. Pip fooled the auditors simply by hiding the noncompliant silicone when they made their announced visits. (Since then, a French court has found TÜV Rheinland to be partly responsible by allowing itself to fooled so easily by Pip staff. The notified body is appealing the ruling.)

The public uproar led European authorities to demand stricter regulatory oversight. The medical device regulation that was passed by the European Parliament in October and is now being negotiated with EU governments includes tougher monitoring provisions, including more stringent unannounced inspection requirements.

Henceforth, notified bodies will be required to carry out unannounced audits at least once every third year—more frequently under some circumstances—and these could just as easily affect suppliers as manufacturers. The recommendation states:

"Notified bodies may, instead of or in addition to visiting the manufacturer, visit one of the premises of the manufacturer's critical subcontractors or crucial suppliers if this is likely to ensure more efficient control. This applies in particular if the main part of the design development, manufacturing, testing or another crucial process is located with the subcontractor or supplier."

As Vollebregt notes in his blog post on the Commission's recommendation, "all of this is already in effect." He cautions medical device manufacturers to get their "act together now before you or anyone in your supply chain receives the first audit and it's Confusion Everywhere, as we sometimes refer to the CE mark."

You may not consider yourself a critical subcontractor or crucial supplier (even if your marketing material hints otherwise), but it seems like a good idea to at least initiate a discussion with your customer about your possible exposure sooner rather than later.

Oh, and if you have the good fortune to be under the age of 40, you might not have gotten the reference to Uncle Ernie and Auntie Jin. Here's some help: 

— Norbert Sparrow