Medical laboratories in the crosshairs of the IVDR. What to do?

The EU’s in vitro diagnostic medical device regulation (IVDR) affects many medical laboratories, although the regulation does not define or use the term “medical laboratory.”

Which laboratories are affected? What other laws do the laboratories have to comply with? And how should they ensure compliance with all these requirements? This article provides answers.

1. What are medical laboratories?

a) Definitions

The relevant regulations do not define “medical laboratory” or “diagnostic laboratory.” However, the IVDR and German laws and regulations recognize the term “health institution” – but, unfortunately, do not use it consistently.

The term “medical device” in the latter definition includes IVD.

b) Example

A medical or, more precisely, diagnostic laboratory is usually understood to be a laboratory that offers human diagnostic in vitro tests, regardless of whether it is a stand-alone laboratory or part of a medical care center or a hospital or clinical center.

c) Differentiation

In contrast to the term “medical laboratory,” the term “diagnostic laboratory” avoids confusion with, for example, research laboratories or cardiac catheterization laboratories.

2. Do medical laboratories fall under the IVDR?

There are several cases in which health institutions fall within the scope of IVDR.

a) Manufacturers and operators of in-house IVD

Health institutions that manufacture or operate in-house IVD (IH-IVD) must comply with the requirements of the IVDR.

Many medical laboratories offering a wider range of services provide IH-IVD and, therefore, fall within the scope of the IVDR.

b) Placing on the market

The IVDR sets out a range of requirements to organizations that place IVD on the market. Depending on their composition, this also applies to sampling sets that laboratories provide to their physicians or patients.

c) Distributors

Diagnostic laboratories that distribute IVD (e.g., sample tubes) fall under the definition of distributor according to IVDR with corresponding distributor obligations.

d) CE-IVD operators

Almost all medical laboratories use commercial IVD, i.e. CE-marked IVD. They must also comply with at least one requirement of the IVDR, which requires the UDI of these devices to be recorded (Article 24 (1) c) IVDR).

The IVDR only recognizes “health institutions.” That means that, in addition to medical laboratories, medical practices also fall under the scope of the IVDR if they perform the relevant activities.

3. What requirements must laboratories fulfill?

The requirements listed in this chapter are not exhaustive. Depending on the laboratory activities, further regulatory requirements must be met.

a) IVDR requirements

Laboratories that manufacture and use in-house IVD must comply with the requirements of Article 5(5) . These include in particular:

• Compliance with Annex I, which requires, among other things:
  • Documentation of an intended purpose
  • Implementation of a risk management system
  • Performance evaluation
  • Compliance with the software life cycle
  • Ensuring IT security
  • Safe product design
  • Provision of device information
• Extended QM system according to ISO 15189 + ISO 13485, chapter 7 (excerpts), including the processes for monitoring, reporting, and equivalence analysis
• Regular equivalence analysis
• For class D IVD, additional documentation according to Annex II

For sampling kits, laboratories must comply with the requirements listed in section 3 of this article on sampling kits. Laboratories that purchase and distribute IVD (or medical devices) should comply with the requirements for distributors described in chapter 2 of this further article.

The IVDR requires in Article 24 (1) c) all medical laboratories that use CE-marked IVD to document the UDI on incoming goods and to archive this documentation.

b) Requirements of other European laws

In addition to the IVDR, there are other European regulations. For example, laboratories that work with blood, blood components, tissues, or cells are subject to Regulation (EU) 2024/1938 (SoHO Regulation).

c) Requirements of German laws and ordinances

German laws and ordinances specify the European requirements in more detail or set out independent requirements. These include:

• Medical Device Law Implementation Act (MPDG)
• Medical Device Operator Ordinance (MPBetreibV)
• Medical Device User Reporting and Information Ordinance (MPAVMIV)
• Social Security Code, Fifth Book (SGB5)
• Social Security Code, Seventh Book (SGB7)
• Occupational Safety Act (ASiG)
• Occupational Safety and Health Act (ArbSchG)
• Workplace Ordinance (ArbStättV)
• Hazardous Substances Ordinance (GefStoffV)
• Biological Agents Ordinance (BioStoffV)
• Infection Protection Act (IfSG)
• For genetic diagnostics: Genetic Diagnostics Act (GenDG) and Genetic Engineering Safety Ordinance (GenTSV)
• For the distribution of medical devices or IVD: Medical Devices Distribution Ordinance (MPAV)
• For the collection and use of blood products: Transfusion Act (TFG)

d) Requirements of standards, guidelines, directives etc.

In addition to national laws and regulations, medical laboratories are subject to many other regulations, guidelines, directives and standards. These include:

• Directive of the German Medical Association for quality assurance of laboratory medical examinations (Rili-BÄK)
• Technical rules for hazardous substances – laboratories (TRGS 526)
• Technical rules for biological agents – protective measures for activities with biological agents in laboratories (TRBA 100)
• Regulations and information from the German Social Accident Insurance (DGUV)

The state of the art is described, among other things, in standards and EU guidelines:

• MDCG guidelines and MEDDEV of the EU
• The Borderline Manual of the EU
• The requirements of the Clinical and Laboratory Standards Institute (CLSI)
• The documents of the Notified Body Operations Group (NBOG)
• ISO 15190 (safety requirements for medical laboratories)
• ISO 22367 (risk management in medical laboratories)
• ISO 62304 (life cycle processes for medical device software)
• EN 62353 ( recurrent test and test after repair of medical electrical equipment)

Some chambers and working groups have also published guidelines and directives:

• Guidelines of the Association of the Scientific Medical Societies in Germany (AWMF)
• Directives and guidelines of the German Medical Association (BÄK)
• Guidelines of the Genetic Diagnostics Commission (GEKO)

Further requirements apply to special medical laboratories:

• In pathology: ISO 17020

4. What should affected laboratories do?

Step 1: Determine regulatory requirements and transition periods

The first step should be to identify all relevant regulatory requirements. The list in the previous chapter should be helpful for this.

Laboratories already have to comply with most of the legal requirements. Almost all of the IVDR transition periods have now expired.

One exception is Article 5 (5) d), which prohibits in-house IVD if there are equivalent CE-IVD with the same or better performance. This period does not end until December 31, 2030.

Step 2: Perform gap analysis

Since laboratories are already under regulatory oversight, they comply with most regulatory requirements. A gap analysis identifies the requirements that are not yet met and defines measures to close these gaps.

Step 3: Establish systems and processes

These measures include expanding and improving systems (particularly the quality management system) and defining and establishing the necessary processes for this purpose.

These processes include, for example:

• Development of in-house IVD
• Performance evaluation of IVD
• Risk management
• Continuous monitoring of processes and devices
• Corrective and preventive actions (CAPA)
• Reporting (vigilance)

Step 4: Establishing device conformity

In accordance with these internal specifications, medical laboratories can develop their devices in compliance with the law or restore and permanently ensure the conformity of already developed in-house devices.

This process results in documents such as technical documentation and records such as test reports.

Step 5: Monitoring processes and devices

The last step continues: As long as IVD are used in patient care, they are subject to legal requirements, particularly the IVDR, the MPBetreibV, and the MPAMIV. These require

• continuous monitoring of the devices (and processes),
• preparation of monitoring documentation,
• initiating corrective and preventive actions as needed, and
• reporting to the authorities (vigilance).

5. Conclusion and summary

The times when medical laboratories were subject to less strict requirements than medical device manufacturers are over, at least since the IVDR came into force.

The high importance of medical laboratories for reliable diagnostics and therapy justifies precise regulation. However, this regulation is not always precise, sometimes excessive, and poorly coordinated. That makes it difficult to develop and use their own laboratory tests, especially for smaller laboratories. But the big laboratories are also challenged and should get to work immediately to identify and comply with the requirements, both initially and on an ongoing basis.

In addition, the high requirements, especially in the area of rare diseases and under-represented patient target groups such as children, are often difficult for laboratories to meet. Exemptions are urgently needed here to counteract the already worsening care.