EU Regulatory Importer Requirements for Medical Device Software (MDSW)

While the MDCG has worked extensively on building up the library of MDR/IVDR guidance documents and a major revision of the EU Blue Guide was published in 2022, one area of regulatory compliance in which formal EU guidance is lacking is MDR/IVDR importer requirements for medical device software (MDSW). Particularly in the case of software placed/made available on the EU market via app or web stores, or cloud-based software hosted on servers located outside the EU.  At present many foreign manufacturers of such MDSW have doubts as to whether they must assign an EU importer. In this article, we provide a brief overview of the importance of understanding EU importer requirements for software companies based outside the EU. 

EU Regulatory Importers Under the MDR / IVDR 

Under the MDR / IVDR, an ‘importer’ is defined as “…any natural or legal person established within the Union that places a device from a third country on the Union market.” While this definition doesn’t generally cause any confusion during the importation of physical goods, due to its relationship with two specific legal terms under the EU regulatory framework, it is not immediately clear whether foreign MDSW manufacturers such as those described in the opening paragraph of this article must assign an EU importer.

The two specific legal terms in question are: 

‘Making Available on the Market’

‘Making available on the market’ which is defined as “…any supply of a device, other than an investigational device, for distribution, consumption or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge.” 

‘Placing on the Market’

‘Placing on the market’ is defined as “…the first making available of a device, other than an investigational device, on the Union market.” 

Foreign Manufacturers Importing into the EU Market

These legal terms were (and continue to be) of significant interest to foreign manufacturers during their transition from ‘legacy’ MDD CE-certified devices to MDR CE-certified devices and according to the EU Blue Guide, placing on the market does not require physical crossing of the border into the EU. 

However, the requirement for an importer to be established in the EU means that web/app stores and servers hosting cloud-based MDSW located outside the EU cannot legally be considered importers. In the scenario, the foreign manufacturer must implement a different strategy to ensure compliance with the MDR/IVDR, which could include working with another EU-based entity that will take on the Importer responsibilities.

A Foreign Manufacturer Software Provider cannot rely upon a UK-based APP Store/Server to be an importer, instead they will need to have an EU-based importer in order to ensure compliance with the MDR/IVDR:

Online Importation / Availability of MDSW 

The EU Blue Guide establishes that EU harmonization legislation does not create legal obligations for end-users which would extend to end-users accessing cloud-based MDSW hosted outside the EU or downloading MDSW from a web/app store located outside the EU. Therefore, according to the EU Blue Guide, end-users cannot be importers. 

COCIR’s 2017 Impact Assessment: Recommendations for Foreign Manufacturers

In 2017, following the publication of the MDR/ IVDR, the European Coordination Committee of the Radiological, Electromedical, and Healthcare IT Industry (COCIR) was among the trade associations assessing the impact of these regulations on the medical device industry. Within this context, in May 2017, COCIR published an impact paper that included an assessment of the impact of importer requirements for foreign manufacturers MDSW placed on the market via online importation/availability. 

This impact paper emphasizes the need for software that falls within the scope of the MDR (i.e. intended to provide information used in the context of any of the medical purposes established under the definition of ‘medical device’ in the MDR) to comply with the requirements of the regulation. This includes companies importing software services in the EU that must have a legal entity established in the EU that meets the importer requirements. 

While this impact paper is not MDCG guidance or other guidance officially released by the EU Commission, it does represent recommendations from relevant EU industry bodies and, in the absence of clear MDCG guidance on this topic, represents a reasonable approach for foreign manufacturers of MDSW to consider. It should also be considered in light of the E-Commerce Directive which establishes the legal framework for electronic commerce in the EU. While the E-Commerce Directive does not establish requirements for different categories of economic operators, it does describe different categories of activities, including hosting activities. 

Risk-based Approach: Assigning an EU Based Legal Entity

In alignment with COCIR recommendations, it is recommended that foreign manufacturers of MDSW placed on the market via the following means adopt a risk-based approach and consider assigning an EU-based legal entity as their EU importer to assume the responsibilities established under Article 13 of the MDR / IVDR:

• • Web or app stores located outside the EU 
  • Web or app stores located inside the EU where the EU legal entity responsible for the store is assigned as the distributor of the device (as the same natural or legal person cannot fulfill the role of importer and distributor for an individual device)  
  • In the case of cloud-based MDSW: 
    • • Servers located outside the EU 
      • Servers located inside the EU where the EU legal entity responsible for the servers is assigned as the distributor of the device (again, as the same natural or legal person cannot fulfill the role of importer and distributor for an individual device) 

EU Regulatory Importer MDSW Requirements with MedEnvoy

This article provides an overview of EU regulatory importer requirements for software companies established in the MDR/IVDR. While the article references the relevant information sources, should you have any questions regarding these requirements or require an EU importer, get in touch. 

Related resources: