Digital transformation of notified bodies

The digital transformation of notified bodies will transform the medical device ecosystem over the next few years. This article describes

• the impact of this digitalization on notified bodies (processes, staff members, business models)
• the positive and negative implications for medical device manufacturers and other stakeholders, as well as
• possible steps in the digital transformation of notified bodies (transformation process).

1. Drivers of the digital transformation of notified bodies

The period in which notified bodies, as an oligopoly, were allowed to pick and choose customers and determine prices and conditions is coming to an end. This is because the environment has changed significantly in recent years.

Driver 1: Pressure from competition and increasing customer market power

Several large venture capital players have recognized that a dysfunctional multi-billion-dollar market has emerged in Europe. If this dysfunctionality can be eliminated in a scalable way, i.e., with software, it will be eliminated.

The first investments have already been made. Investors have understood that it is preferable to establish future notified bodies not in the DACH region (Germany, Austria, and Switzerland), but in countries focusing on the required regulations, rather than raising unnecessary regulatory, administrative, and technological hurdles.

The unique selling propositions of future competitors are straightforward:

• A fraction of the processing and response time – thanks to digitalization
• Convenience, respectful interaction with personal “stewards”
• Lower costs

Once manufacturers can take advantage of these benefits, especially faster time to market, with a new notified body, they will do so. This will have a snowball effect.

Driver 2: Regulatory framework

The regulatory framework that has provided notified bodies with years of prosperous growth is increasingly turning against them:

• Despite extended transition periods, the MDR boom is coming to an end.
• There is growing resentment in politics about the notified bodies. Some early voices are questioning the concept of privately organized notified bodies. For some devices, the EMA is already reigning in the jurisdiction.
• Products with FDA clearance already receive marketing authorization in countries such as Switzerland. If this example were to set a precedent in the European countries, the demand for notified bodies would suddenly plummet.
• More and more manufacturers are deciding to start with the more predictable approval process in the US market and only then decide whether and when to market their products in Europe as well.

Driver 3: Staff members at notified bodies

Even highly digitized notified bodies cannot do without highly qualified staff. Here, too, the balance is shifting at the expense of the notified bodies:

• A large wave of staff members (the boomers) will retire in the next few years.
• The new generation of staff members has high expectations of their work and its meaningfulness. This does not include bureaucracy, reading thousands of pages of text, tedious searching and copying of content, in general work that can be automated.
• There is a shortage of skilled workers today. In particular, it is difficult to find workers skilled in emerging technologies.

Driver 4: Technological advances

These are precisely the technologies increasingly being applied in medical devices. The breathtaking technological advances, especially in machine learning, dictate that medical device compliance must be assessed orders of magnitude faster and more frequently. However, the processes of many notified bodies are not up to this challenge.

While it is true that these technologies also facilitate the digitalization of existing notified bodies, at the same time new competitors will know how to use them (better?) and will not need to transform legacy structures.

Interim conclusion

Notified bodies must cope with markedly changed underlying conditions. Digitalization is a necessary condition but not sufficient by itself.

2. Impact on notified bodies

This digitalization will affect notified bodies in their entirety:

• Digitalization will change their processes.
• The daily work of notified body staff is undergoing significant change.
• Notified bodies have to adapt their business models.

a) Impact on processes

Digitalization affects both core and support processes, such as:

• Application and contract review
• Conformity assessment, technical documentation review, and auditing
• Certification
• Manufacturer surveillance
• Project implementation / project management
• Management of permanent and freelance staff (onboarding, qualification, authorization)
• Cooperation with authorities
• Integration of testing laboratories
• In-house internal and external audits (e.g., ZLG (Central Authority of the German Federal States for Health Protection in Medicinal Products and Medical Devices))

Notified bodies will need to redesign their processes to facilitate agile medical device development. This requires a high level of integration with the manufacturer systems.

The following two processes will serve as examples for this transformation.

1. Example: Review of technical documentation

The review of the technical documentation will be performed mostly without documents. The manufacturers have transferred the data to the software system via standardized interfaces. There the data have been standardized and redundancy eliminated.

The system has already performed the search for information as well as all basic checks, e.g., completeness and consistency, and plausibility checks, such as:

• Are there key performance characteristics not addressed by the risk analysis?
• Does the information in the intended use, such as the physical environment (pollution, power supply, altitude above sea level, temperature ranges), match the information in the “60601 file”, for example, IP class and dimensioning of creepage distances?
• Has risk management examined the hazard-related use scenarios?
• Does a safety class C software system have a detailed architecture?
• Are the literature references in the clinical evaluation correct? Has the manufacturer considered all literature relevant to the device class?

The review algorithms automatically take into account the respective valid versions of the (harmonized) standards and associated transition periods.

The reviewers thus have largely verified documentation at their disposal. In case of queries, they communicate directly within the system and directly at the point of the information in question, so that it leaves no doubt about the object of the documentation.

With the help of the system, the reviewers generate deficiency reports at the push of a button or forward the file for further processing, e.g., to the certification body.

2. Example: Project management

Many tedious and time-consuming project management tasks are completely or partially eliminated:

• Capacity checks
• Finding and assuring the authorizing of reviewers
• Appointment scheduling: For example, customers can book appointments themselves, which the system identifies, and the notified body confirms.
• Project planning: The system learns from device class, the manufacturer, and the history to estimate the overhead and can account for interdependencies of activities and authorizations.
• Escalation in case of missed deadlines (manufacturers and notified bodies)
• Rescheduling in case of delays

Both manufacturers and notified bodies would have transparency of the project’s progress at all times and would know who and what is impeding progress. In case of a dispute, which is then less likely, the project history is documented.

b) Impact on staff

Tasks are eliminated

Automation eliminates many tasks, especially when reviewing technical documentation and quality management systems:

• Search for information (in documents, external databases, communication history)
• Review documents for completeness, consistency, and plausibility
• Much of the communication such as asking for and requesting documentation
• Work on n/a sections
• Large parts of report writing
• Assessments and documentation also in preparation for own audits
• Project management, scheduling, escalations, finding authorized experts
• Standard communication with authorities and authority databases

This should make obsolete many bureaucratic tasks with little economic value and restore the focus on the meaningfulness of one’s own actions.

Systems should be designed in such a way that they are perceived as support and not as a “new boss.” For example, technical documentation reviewers should select (rather than be assigned) projects that the system identifies as appropriate for them.

Tasks will change

Digitalization is transforming the tasks:

• Borderline cases that are not (yet) mapped by the software or for which its rules must be overwritten will have to be handled more frequently.
• Staff members can more easily guide customers through the entire process and act like a hospital case manager. This strengthens customer collaboration.
• Staff members will act more like solution teams and choose tasks from a pool.
• They will accompany smaller product changes more often as customer products make greater use of software and as their own systems allow for regular iterations.
• For their work, the system automatically provides the experts with necessary contextual information on technologies, medical basics and procedures, and other products, which promotes their own competence building and allows more profound decisions.

Staff members should be aware that the systems provide transparency about the work being done.

New tasks will evolve

Staff members at notified bodies can specialize in tasks that did not previously exist or did not exist to this extent:

• IT systems improvement
  • Continued evolution of the systems, e.g., their algorithms
  • Customizing the systems (comparable with Salesforce)
  • System validation
• Data analysis
  • Performance and conformity of own organization
  • Fraud prevention (some manufacturers will try to outsmart the system)
  • Identification of cross-product risk factors (manufacturer, class of device, technology, medical domain, etc.)
• Management and development of new business models

New professional opportunities will arise

New opportunities are arising for staff members of notified bodies:

• Harmonization makes it easier for them to change jobs:
  • Permanent staff members <=> freelancers’ choice of notified body (therefore, corporate culture becomes more important)
  • Notified body <=> manufacturer (since they also work with the systems)
• The new tasks lead to new career paths beyond auditor, lead auditor, group, and department manager.

Conclusion

For staff members of notified bodies, digitalization offers many advantages: More meaningful assignments, a wider range of tasks, and new career opportunities.

On the other hand, it becomes more difficult for people who close their minds to any change.

c) Impact on business models

Digitalization will also transform the business models of notified bodies:

• Product (the range of services)
• Price (new price models)
• Place (offering and type of distribution of the service)
• Promotion
• Process (see above)
• People

Again, two examples will serve to illustrate the transformation.

Example 1: Product

Digitalization offers new opportunities for notified bodies in the design of their products/services:

• Service levels
  They can offer different service levels to their customers: From largely “self-service” to “we do it all for you.” This is akin to assistance with a tax return, ranging from a tax-saving program that you use without outside help, to a tax accountant to whom you hand over your shoebox of jumbled receipts. While notified bodies are not authorized to provide advice directly, they should be allowed to assist in filling out application forms.
• Real-time certification
  The service levels can also represent almost any speed up to real-time certification. Why not issue and send the certificate immediately after a successful audit and a prior successful review of the technical documentation?
  A certification body performing reviews that can be done in advance or directly during the audit should not be the reason for weeks, sometimes even months, of delay.
• Service for the FDA
  Since only the algorithm needs to be adapted somewhat, notified bodies can use the software to provide reproducible services for other authorities such as the FDA.
• Auctioning of offers and orders
  The software provides a multilateral platform on which notified bodies can “auction” offers and orders. External auditors and reviewers can bid, as can consulting firms helping to eliminate nonconformities. Medical device manufacturers outbid each other to book slots.
• Selling anonymized data
  The EU Commission, academia, and consulting companies are all likely to be interested in the data, which is generated in large quantities and in a structured and thus easily analyzable form.

Example 2: Price

This leads directly to the next aspect of business models–prices.

Notified bodies have the opportunity to determine these prices even dynamically and automatically depending on:

• Product class
• Required expertise
• Speed, urgency, and adherence to deadlines
• Own capacities and availabilities
• Manufacturer size
• Number of products of the manufacturer
• Frequency of product conformity audits

Digitalization facilitates new payment models, irrespective of the prices:

• SaaS (subscription fee, by the way, not only for manufacturers but possibly also for freelancers and consulting companies)
• Transaction-based fees for each audit performed by a freelance auditor
• Usage-based fees, e.g., per approval, per product, possibly with tiered prices
• User-based contributions

It would be useful to lower the ordering hurdles by means of point systems, which would simplify both purchasing from the manufacturer and sales by the notified body.

As always with digitalization, it is expected that customers will benefit from a price reduction.

3. Impact on other stakeholders

a) Impact on manufacturers

Better service, more offers

The digitalization of notified bodies will make many manufacturer dreams come true:

• Lower prices
  Prices will fall.
• Shorter time to market
  They will get their products to market substantially faster because “approval times” will collapse.
• Increasing usability
  Usability becomes markedly better: Instead of filling out endless Word forms, up-to-date software guides them through application processes and the compilation of technical documentation.
• Less in-house effort
  In-house effort will decline, especially for the review and compilation of documentation for various target markets, authorities, and notified bodies.
• Easier change of notified bodies
  Changing notified bodies becomes easier because the software “homogenizes” the processes at notified bodies and allows interoperability. Both ensure that notified bodies retain customers by providing better services.
• More suitable services
  Notified bodies will offer a broader and thus more appropriate range of services (see above).
• Greater transparency and planning reliability
  Manufacturers benefit from greater transparency and planning reliability across all processes. The system displays open tasks, approval status, and nonconformities in real time.

Requirements

Manufacturers need to drive their own digitalization in order to benefit from these advantages. After all, it is of little use to generate documents with existing processes that the systems of the notified bodies cannot process fully automatically.

Instead, manufacturers are faced with the task of transforming their own system landscape and ensuring end-to-end digitalization. Only in this way will integration with the notified body systems be successful.

This digital transformation is also necessary to detect nonconformities in (near) real time as well. This in turn is the prerequisite for accelerating development and approval cycles.

b) Impact on healthcare market

The healthcare market, and thus patients, will also benefit from the digitalization of notified bodies:

• Innovative medical devices reach the market faster because notified bodies’ processes are faster.
• Devices can be improved more quickly because digitalization facilitates agile development and conformity assessment.
• Device costs can decrease thanks to the lesser regulatory burden on manufacturers and notified bodies.
• Device safety will increase because, on the one hand, review steps will be automated and thus no longer forgotten and, on the other hand, because the reviews will systematically take into account external data (competitor products, regulatory reports, clinical literature).

c) Impact on lawmakers

The availability of structured data provides lawmakers with a high level of transparency they can use to improve laws, in particular to specifically address risks and lower unnecessary hurdles. This will become essential, especially in the evaluation of MDR and any future improvement.

Once a model for the regulatory system is available, planned legislative changes can be simulated based on this data.

Process digitalization also lays the foundation for agile, iterative-incremental approval processes, such as those already being implemented by the FDA.

The transformation of laws into algorithms is the first step toward Regulation as Code.

4. Transformation process

a) Differences between new and existing notified bodies

The digital transformation of notified bodies is a transformation process that never stops. The existing notified bodies must carry out this transformation such that they do not lose their conformity and performance. New notified bodies are spared this transformation. They start with digitalized processes from the get-go.

b) Dimensions of transformation

Notified bodies can use multiple dimensions as they progressively undergo digital transformation:

Dimension 1: Selection and sequence of processes to be digitized

Notified bodies can choose with which processes and subprocesses they start their digitalization. For example, they could start with application submission and automated application review and continue with automation of technical documentation review.

It is also possible to digitize only subprocesses in a first step, such as reporting within the technical documentation review.

Dimension 2: Depth of digitalization

Johner Institute employs a multi-stage model to quantify the degree of digitalization:

Level	Definition	Examples
0	No IT support	Paper forms
1	Electronic processing of unstructured data	Completed PDF; emails
2	Rudimentary workflow support	Automation of emails; scripts for searching in unstructured forms
3	Acquisition of structured data	Use of relational databases to capture all surveillance results; capture intended use based on a defined data model; support of searches and filters
4	Complete automation of tasks via algorithms on the structured data	Automated consistency check of technical documentation; calculation of a risk score for manufacturers and devices
5	Strategic support, e.g., through data analyses and predictive models	Continuous dynamic assessments and forecasts

In this model, digital transformation can work its way up from Level 0 to Level 5.

Dimension 3: Products

Notified bodies have the option to start with the example of a very limited class of devices, e.g., only with software as a medical device or only with reusable surgical instruments.

Dimension 4: Software maturity level

Most objects of digitalization go through several stages of maturity, from proof of concept through a prototype and beta version to commercially viable business-critical software.

c) Stakeholder requirements

An indispensable prerequisite for transformation is the systematic identification of stakeholder requirements:

• Regulatory requirements
  In this highly regulated area, this type of requirement is particularly germane.
• Domain-specific requirements
  Domain-specific requirements, i.e., requirements for the work results, derive from the regulatory requirements and internal specifications. These provide the direct input, especially for the algorithms, e.g., the review logic.
• Organizational requirements
  As with domain-specific requirements, regulatory requirements and internal specifications (e.g., SOPs) are drivers of organizational requirements, although not all of these result in system requirements.
• User requirements
  To ensure the usability of the devices, it is essential to methodically identify user requirements because these cannot be obtained directly. The unique feature here is that the user requirements must be identified for the target state, not the actual state. This would otherwise cement suboptimal processes in place.

d) Best practices for the digital transformation of notified bodies

Some best practices will help notified bodies navigate digital transformation successfully, i.e., on time, on budget, and with the expected results.

• Creating a clear vision
  This article can be used to provide that vision, including offers and business models.
• Involving the team
  Digital transformation requires good change management. Caveats must be heard and considered. Often, progressive staff members help try things out and reassure the rest of the team that they will succeed.
• Involving customers and vendors
  Many digitalization projects fail because they do not involve customers and suppliers (in this case, freelance auditors, and reviewers). Systematic customer research and digitalization together with customers willing to experiment help identify and address actual requirements at an early stage.
• Developing a roadmap
  The transformation can be broken down into small, manageable projects based on the above dimensions. Roadmaps should define specifically for each notified body which small cubes from the multidimensional cube should be addressed and in which order, in order to identify and manage risks as early as possible.

5. Conclusion and summary

The regulatory system has provided good years for notified bodies. But as shown in the first section, it is not just the regulatory framework that is changing. Changes are happening at an exponential rate, not unlike in AI. Slow changes at the beginning routinely lead to misconceptions about the rate of future change.

As a result of these changes, notified bodies must adapt their processes and business models to ensure their own competitiveness and meet the requirements of their customers. Their already established structures are not always an advantage compared to newly established notified bodies.

The digital transformation of notified bodies is more than just a digitalization. It is the prerequisite to continuously exploit this competitiveness and the new opportunities (e.g., business models).

The digital transformation of notified bodies is, as the name implicates, a transformation process that will fundamentally change existing processes, the existing system landscape and, most importantly, daily work – for the better. Notified bodies should seize this opportunity.