Software as a medical device
For software to qualify as a medical device, the question of whether or not it has direct action in or on the human body is not relevant. The sole decisive factors are its intended use and its functionality.
According to Art. 1 (2) (a) of Directive 93/42/EEC, articles or software which are intended by the manufacturer to be used for medical purposes and whose principal intended action is achieved in or on the human body are regarded as medical devices. The European Court of Justice (ECJ) has now made a judgement as to whether or not said action in or on the body is a sine qua non for classification as a medical device, answering in the negative with its judgement of 7 December 2017 – C329/16.
The subject of the adjudication concerned was a software that provided assistance in the prescription of medicines. It used patients' data to assist the doctor in deciding against or in favour of prescribing certain medication, for example by detecting contraindication, interaction between medicines or overdosage.
The ECJ based its ruling on the wording of Art. 1 (2) (a) of the directive. According to that article, it is the use intended by the manufacturer that is definitive for classification as a medical device. Using that yardstick, the software pursues a specifically medical purpose in assisting in the prescription of medicines. The ECJ, however, also made it clear that this does not apply to just any software intended for deployment in the health sector. The software must also have a medical functionality that goes beyond the intended use. In other words, it must utilise data for a medical purpose. That is the case if data are recorded or modified, or if calculations, quantifications and comparisons are made. The ECJ draws the line between this medical functionality and that of mere storage software. If a software only archives, gathers or transmits data, it is a mere database. If it does not have any impact on the data or interpret them, it has no medical bearing. In these cases it is not a medical device within the meaning of the directive.
The ECJ notes that in the classification of software as a medical device the EU legislators aimed to concentrate on the intended use of the software. This makes it easier for manufacturers to assess whether or not their software is to be categorised as a medical device. That sounds simple, but it can entail risks. On the one hand, the ECJ points out that the directive does not apply if the software is designed for general purposes. But heed must also be paid to the fact that the manufacturers are responsible for providing evidence of the intended use of the software. If it becomes clear that it will be deployed in a medical context, the applicability of the directive must be examined very carefully.
Software in accordance with the Medical Device Regulation (MDR)
Also according to the MDR, which has been in force since May 2017 and is due to supersede Directive 93/42/EEC after a transitional period of three years, software which serves to predict or prognosticate diseases is deemed to be a medical device. That makes the definition in the MDR even clearer. Software continues to be classifiable as an active medical device, but it can also be an accessory. According to the new Classification Rule 11, software designed with the aim of providing information which is, in turn, used in making decisions that relate to diagnosis or treatment, comes under Class IIa. If it is capable of directly or indirectly causing death or irreversible severe health impairments, it is to be classified in Risk Class III; if it can cause serious health impairments or operations, Class IIb applies.
However, the MDR also states that software which controls or influences another medical device comes in the same class as that medical device, and that so-called stand-alone software is to be placed in a separate class.
Recommendation for action
Software manufacturers must be aware that medical software can under certain circumstances be classified as a medical device. The sole decisive factor is the use intended by the manufacturer. in future manufacturers will have to design their software in such a way that it complies with the MDR and pay heed to the classification rules in order to avoid liability risks.
[8 May 2018]