Legislators are continually changing the regulatory framework for medical devices, as we have seen in Europe with EU Regulation 2017/745 (MDR) and EU Regulation 2017/746 (IVDR). This then raises the question of how to deal with legacy devices. These are the medical devices that manufacturers have legally placed on the market under the old directives and continue to market even though they may not comply with the new regulations.
These regulatory changes happen in the EU, the USA, as well as to international standards, such as IEC 62366-1(IEC usability) or IEC 62304 (software). They also contain provisions for legacy devices.
However, even though the term “legacy device” is used a lot, we still don’t have a (uniform) definition.
This article will explain:
- What “legacy devices” are and how they differ from “’old devices”
- What relaxations the legal requirements provide for legacy devices
- What obligations manufacturers must fulfill in the context of legacy devices
1. Legacy devices from the perspective of the MDR/IVDR
a) Overview of definitions
Although they skirt around the term, for example in the transitional provisions in Art. 120 MDR/Art. 110 IVDR or Recital 95 of the MDR, neither the MDR nor the IVDR define “legacy device.” For example, they refer to “devices placed on the market pursuant to those Directives [MDD/AIMDD].”
This missing definition is provided by the guidance document MDCG 2021-25 (“Regulation (EU) 2017/745 – application of MDR requirements to ‘legacy devices’ and to devices placed on the market prior to 26 May 2021 in accordance with Directives 90/385/EEC or 93/42/EEC”):
Legacy devices should be understood as devices, which, in accordance with Article 120(3) of the MDR, are placed on the market after the MDR’s date of application (DoA) and until 26 May 2024 if certain conditions are fulfilled. Those devices can be:
- devices which are class I devices under Directive 93/42/EEC (MDD), for which an EC declaration of conformity was drawn up prior to 26 May 2021 and for which the conformity assessment procedure under the MDR requires the involvement of a notified body;
- devices covered by a valid EC certificate issued in accordance with Directive 90/385/EEC (AIMDD) or the MDD prior to 26 May 2021.
The date May 26, 2024 mentioned in the MDCG document is no longer correct. We have summarized the detailed transitional periods of the MDR in a separate article.
MDCG 2021-25 differentiates between “legacy devices” and “old devices.” The guidance document defines “old devices” as:
‘Old’ devices are those devices that were placed on the market before 26 May 2021 in accordance with the AIMDD or the MDD or in accordance with the applicable rules before the Directives had entered into force.
Further definitions of “legacy device,” each of which applies in the specific context of the document, can be found in MDCG 2019-5 and MDCG 2020-6.
MDCG 2019-5 (“Registration of legacy devices in EUDAMED”)
This document deals with registration of devices, which can continue to be placed on the market under Directive certificates by virtue of Article 120(3) of Regulation 745/2017 (MDR), and Article 110(3) of Regulation 746/2017 (IVDR) after the relevant MDRs application dates. Those products are, for the purpose of this document, referred to as “legacy devices”.
MDCG 2020-6 (“Regulation (EU) 2017/745: Clinical evidence needed for medical devices previously CE marked under Directives 93/42/EEC or 90/385/EEC”):
‘legacy devices’: this is considered to include all devices previously CE marked under the European Medical Devices Directive 93/42/EEC (MDD) or Active Implantable Medical Devices Directive 90/385/EEC (AIMDD)
b) What is considered a legacy device under the IVDR?
Under the IVDR, a legacy device is a medical device:
- that has not undergone a conformity assessment procedure under the IVDR but
- for which conformity was (or will be) declared under the IVDD before May 26, 2022 and
- that falls into IVDR classes D, C, B or A (sterile)
With the guidance document MDCG 2022-8, the MDCG has also published a special document on IVDR legacy devices. In addition to the term “legacy device,” this document also uses the term “old device.”
According to this guideline, a legacy device is defined as follows:
Legacy devices under the IVDR (hereafter ‘legacy devices’) should be understood as devices referred to in the 2nd or 3rd subparagraph of Article 110(3) IVDR, which are placed on the market or put into service after 26 May 2022 (i.e. the IVDR’s date of application) and until the end of the respective transition period set out in the 2nd or 3rd subparagraph of Article 110(3), if the conditions laid down in the 1st subparagraph of Article 110(3)3 are fulfilled.
Source: MDCG 2022-8
The term “old device” refers to all devices that were placed on the market or put into operation before May 26, 2022, in accordance with the IVDD or national requirements:
‘Old’ devices are those devices that were placed on the market or put into service before 26 May 2022 in accordance with the IVDD or the applicable national rules before the IVDD had become applicable and which are still on the market or in use after 26 May 2022.
Source: MDCG 2022-8
At the end of MDCG 2022-8, the MDCG provides a tabular overview of all IVDR regulations applicable to IVDR legacy devices. Essentially, the IVDR requirements for post-market surveillance and vigilance already apply to legacy devices during the transition period.
We have summarized the detailed transition periods of the IVDR for you in a separate article.
c) Relaxations
Some relaxations of the regulations will apply for legacy devices during the transitional period:
- Legacy devices may remain on the market after date of application of the MDR (May 26, 2021) and of the IVDR (May 26, 2022).
- If certain conditions are met, they may continue to be placed on the market after the date of application of the MDR/IVDR.
- If certain conditions are met, they may continue to be put into service after the date of application of the MDR/IVDR.
- Proof of conformity according to the new regulations (MDR/IVDR) does not have to be provided for legacy devices until the end of the transitional periods.
- UDI assignment is not necessary but is allowed.
You can find the exact deadlines in our articles on the MDR and the IVDR.
d) Obligations
Even during the transitional periods, legacy devices must comply with some of the requirements of the MDR/IVDR.
- Post-Market Surveillance (PMS)
MDCG 2021-25 states that this includes Post-Market Surveillance reports (PMS reports) and Periodic Safety Update Reports (PSURs) for legacy devices as well - Vigilance
- Registration of the device and economic operator in EUDAMED
Our article, MDCG 2020-6: Requirements for clinical data for legacy devices, explains the extent to which manufacturers should collect clinical data for the subsequent conformity assessment procedure during the transition period.
e) Overview of MDR regulations that apply to legacy devices
The MDCG does not consider most of the MDR regulations to be applicable to legacy devices. However, MDCG 2021-25 does include some exceptions. These are listed in the table below, which is taken from MDCG 2021-25:
| MDR requirement | Application to “legacy devices“ |
| Art. 10(10), (12)-(15) | YES (nota bene: “conformity with the requirements of this Regulation” shall mean for “legacy devices” conformity with the MDD or AIMDD and the additional requirements in accordance with Article 120(3) MDR) |
| Art. 11(3)(c)-(g) | YES (nota bene: “conformity with the requirements of this Regulation” shall mean for “legacy devices” conformity with the MDD or AIMDD and the additional requirements in accordance with Article 120(3) MDR) |
| Art. 11(7) | YES |
| Art. 13(2), 2nd subparagraph, (4), (6)-(8), (10) | YES (nota bene: “conformity with the requirements of this Regulation” shall mean for “legacy devices” conformity with the MDD or AIMDD and the additional requirements in accordance with Article 120(3) MDR) |
| Art. 14(2), last subparagraph, (4)-(6) | YES (nota bene: “conformity with the requirements of this Regulation” shall mean for “legacy devices” conformity with the MDD or AIMDD and the additional requirements in accordance with Article 120(3) MDR) |
| Art. 15 | NO |
| Art. 16(3) and (4) | NO |
| Art. 18 | NO (without prejudice to national rules on implant cards applicable to “legacy devices”) |
| Art. 22 | YES for system or procedure packs combining “legacy devices” and MDR devices |
| Art. 25 | NO (without prejudice to traceability requirements in the supply chain applicable to “legacy devices” in accordance with other rules such as on market surveillance of goods or the General Product Safety Directive) |
| Art. 27 | NO (see in this respect also MDCG 2019-5 on registration of legacy devices in EUDAMED) |
| Art. 29 – registration of devices | In principle YES, but in the absence of EUDAMED’s full functionality, specific transitional provisions apply in accordance with Art. 122, 123(3)(d)(e) MDR10 |
| Art. 31 – registration of economic operators | In principle YES, but in the absence of EUDAMED’s full functionality, specific transitional provisions apply in accordance with Art. 122, 123(3)(d)(e) MDR11 |
| Art. 32 | NO |
| Art. 83, 84 – PMS system and PMS plan | YES (with exception of requirements that relate to non-applicable obligations, e.g. Art. 83(3)(d) – SSCP; no requirement for a full revision of the technical documentation in accordance with Annexes II and III) |
| Art. 85 – PMS report (class I devices) | YES (classification of devices in class I follows classification rules of the MDD, i.e. Art. 85 applies to class I “legacy devices” despite the fact that those devices might be in a higher class under the MDR) |
| Art. 86 – PSUR (class IIa, IIb and III devices) | YES (manufacturers shall draw up and update PSURs; to be taken into consideration by notified body designated under AIMDD/MDD in the framework of surveillance audits, see further explanations above in the text) |
| Art. 87 – reporting of serious incidents | YES |
| Art. 88 – trend reporting | YES (trend reporting was already part of the vigilance system established under the MDD/AIMDD) |
| Art. 89 – analysis of serious incidents and FSCA | YES |
| Art. 90 – analysis of vigilance data | YES |
| Art. 91 – implementing acts | YES |
| Art. 92 – EUDAMED vigilance module | In principle YES, but in the absence of EUDAMED’s full functionality, specific transitional provisions apply in accordance with Art. 122, 123(3)(d)(e) MDR12 |
| Art. 93 – market surveillance activities | YES |
| Art. 94 – evaluation of non-compliances | YES (nota bene: “conformity with the requirements of this Regulation” shall mean for “legacy devices” conformity with the MDD or AIMDD and the additional requirements in accordance with Article 120(3) MDR) |
| Art. 95, 96, 97 – devices presenting an unacceptable risk; evaluation of national measures; other non-compliance | YES (nota bene: “conformity with the requirements of this Regulation” shall mean for “legacy devices” conformity with the MDD or AIMDD and the additional requirements in accordance with Article 120(3) MDR) |
| Art. 98 – preventive health protection measures | YES |
| Art. 99 – good administrative practice | YES |
| Art. 100 | YES |
2. Legacy devices from the perspective of the FDA
While the FDA uses the term “legacy device,” it does not provide a definition of the term. It is not used in part 800 of CFR Title 21, which is the part that contains the requirements for medical devices. Instead, the FDA uses the concept of “legacy devices” in specific contexts.
a) Cybersecurity
The paper “Strengthening Cybersecurity Practices Associated with Servicing of Medical Devices: Challenges and Opportunities” defines legacy devices as:
“For the purposes of this document, legacy devices are those that cannot be reasonably protected against currently cybersecurity threats.”
FDA June 2021
In this area, the extent to which legacy devices already on the market have to comply with cybersecurity standards is still being discussed.
The term “legacy device” is defined differently in the context of IT security. Here, there is also the concept of “transitional health software”.
Manufacturers must comply with the cybersecurity requirements for all devices they place on the market. Even those that already have FDA clearance.
b) UDI
The FDA also discusses the concept of legacy devices in the context of assigning UDIs to devices that came onto the market before the new labeling requirements. There are some relaxations for these devices. As a result, legacy labels may continue to be used until 2023.
c) Grandfathering
In addition, the USA has (or had) the concept of grandfathering. This meant that devices that were placed on the market before the enactment of the Medical Device Amendments to the Food, Drug, and Cosmetic Act of 1976 were allowed to stay on the market even if they did not meet the stipulated requirements. Since 2012 these devices have been re-classified and must, in principle, meet the normal safety standards.
3. Legacy software from the perspective of the IEC 62304
a) Definition
Amendment I of the IEC 62304 defines legacy software as
Software (part of a medical device or standalone software) that was placed on the market in accordance with the legal requirements in force at the time but that no longer meets today’s requirements (especially IEC 62304).
“At the time” refers to March 2015, the date of application of the current version of IEC 62304.
“Medical device software which was legally placed on the market and is still marketed today but for which there is insufficient objective evidence that it was developed in compliance with the current version of this standard.”
Source: IEC 62304 (3.36)
Please refer to the article on legacy devices in the context of IT security.
b) Relaxations & obligations
Certain relaxations apply for legacy software according to IEC 62304. As a result, legacy software only essentially has to meet the requirements that applied to it when it was placed on the market. The exception is risk management, which IEC 62304 also requires of legacy devices.
c) Tip: declare part of the software as SOUP
Legacy software, by definition, refers to the “medical device software” as a whole, i.e., the complete software system. If the relaxations of IEC 62304 don’t help, manufacturers can consider encapsulating part of their software and declaring it Software of Unknown Provenance (SOUP).
Find out more about Software of Unknown Provenance (SOUP)
4. Legacy user interfaces from the perspective of IEC 62366-1
a) Definitions
IEC 62366-1 establishes requirements for processes that can be used to ensure the usability of medical devices. Devices that were placed on the market before the standard was published can be considered legacy devices.
These devices are treated as User Interfaces of Unknown Provenance (UOUP). They are regulated in Annex K of IEC 62366:2006 or Annex C of IEC 62366-1:2015 (latest version).
They include:
- UI that are already on the market and that were not developed using the process according to IEC 62366-1
- UI that only have minor modifications and that were not originally developed according to IEC 62366-1
- UI that contains a commercially available component that was not developed according to IEC 62366-1. An example would be a computer mouse.
b) Relaxations & obligations
A shortened usability engineering process – in which, above all, the risks of associated with the usability of the component have to be evaluated – applies to UOUPs. The manufacturer must also draw on information already available from the market.
In this context, IEC 62366-1:2015 offers the option of skipping the formative and summative evaluations and the description of the use scenarios, but the use specification must always be defined.
5. Conclusion
Every new amendment to an existing regulation creates new legacy devices. The people making these amendments are well aware of this. That is why there are almost always transitional provisions. However, because each regulation has a different understanding of what constitutes a “legacy device,” manufacturers should pay very close attention to the applicable transitional provisions. This will allow them to make the best use of these periods and make any adjustments necessary.
The Johner Institute will gladly help you with any questions about your legacy medical devices. For more information, please get in touch with us for a free expert consultation.
Change history
- 2023-11-27: References to the new article on IT security for legacy devices added
- 2023-02-24: Under 1c) reference to the current transition periods
- 2022-05-27: Notes on MDCG 2022-8 added under 1b)
- 2022-03-04: Under 1d) note on MDCG 2022-4 and PSUR added
