Legal aspects of REACH and the medical devices sector

Legal aspects of REACH and medical devices

©This article was first published in the PLC Cross-border Life Sciences Handbook 2011 and is reproduced with the permission of the publisher, Practical Law Company.

This article sets out some of the main features of EU Regulation 1907/2006 on the Registration, Evaluation, Authorisation and Restriction of Chemicals) (REACH) and how it is likely to affect medical device companies. It also provides an overview of the most significant EU regulatory developments as they apply to the medical devices industry sector.

REACH and the medical devices sector

In our October 2009 article, written for the previous edition of the PLC Cross-border Life Sciences Handbook, we analysed some of the main features of REACH and how they might affect companies manufacturing medical devices and/or placing them on the EU market. These included, in particular, the requirements to register, the substance information exchange forum (SIEF), the consortium and the data sharing rules, the supply chain interactions and the commercial relationships affected by REACH. In the last year a series of regulatory acts have been adopted, or entered into force, which demonstrate how REACH is affecting the medical devices sector.

Scope

REACH makes a distinction between medical devices that are:

• Chemical substances, either on their own or as mixtures. Examples of mixtures include lubricants, dental filling materials, bone cements and so on.
• Articles (that is, objects with a function determined by their shape, surface or design rather than their chemical composition (Article 3.3, REACH)). Examples include blood glucose meters, catheters, contact lenses and so on.

A medical device that qualifies as a substance/mixture is subject to most of the requirements of REACH, including registration (except for the exemptions listed below). However, in practice most medical devices are likely to qualify as articles under REACH.

Articles are not subject to the requirements of REACH unless chemical substances included in them are themselves subject to REACH registration requirements. However, the following, potentially substantial, obligations under REACH can apply to manufacturers and importers of qualifying medical device articles:

• Registration is necessary for substances that are both (Article 7.1, REACH):
• present in articles in quantities totalling over one tonne per producer or importer per year; and
• intended to be released under normal or reasonably foreseeable conditions of use.
• Notification to the European Chemicals Agency (ECHA) is necessary (from 1 June 2011) for substances identified as Substances of Very High Concern (SVHC) listed in the ECHA's Candidate List if they are both (Article 7.1, REACH):
• present in the articles in quantities totalling over one tonne per producer or importer per year; and
• present in the articles above a concentration of 0.1% (weight by weight).
• If the articles contain SVHCs included in the Candidate List in a concentration above 0.1% (weight by weight), information that is available to the supplier allowing safe use of the article (including, as a minimum, the name of the SVHC) must be provided on request and within 45 days to (Article 33, REACH):
• recipients of the articles (that is, any industrial or professional user, or distributor, to whom the article is supplied); and
• consumers.

Exemptions

Medical devices are subject to two types of exemption under REACH:

• Title IV of REACH, concerning the information in the supply chain (including the requirement to communicate information about SVHCs), does not apply to medical devices when (Article 2.6(c), REACH):
• they consist of a mixture (see above); and
• they are invasive or used in direct physical contact with the human body; and
• other EU measures require the classification and labelling of any dangerous substances and/or chemical mixtures they contain.
• Since the majority of medical devices are likely to qualify as an article under REACH, this exemption is unlikely to be relevant in practical terms.
• Where existing and more specific EU medical device legislation (such as Directive 90/385/EEC on active implantable medical devices, Directive 93/42/EEC concerning medical devices or Directive 98/79/EEC on in vitro diagnostic medical devices) applies (Article 60.2, REACH).
• REACH only applies to matters that are not already regulated by relevant sector-specific legislation. Any applicant seeking authorisation to use a substance included in Annex XIV of REACH (listing the substances subject to authorisation) in a medical device, is not required to assess the risks to human health and the environment arising from the use of that substance.

Regulatory updates

As the REACH first registration deadline (30 November 2010) has now passed, the practical implications of REACH for medical device companies are becoming apparent. Registrants in complex supply chains have encountered difficulties in tracking the flow of their products and in collecting the necessary information for preparing the registration dossiers.

In addition, the authorisation requirements, especially the communication obligations for articles containing SVHCs, are proving particularly arduous for certain medical devices supply chains.

Crucially, EU member state measures concerning non-compliance with REACH are now known, showing important discrepancies in the type and level of fines adopted in each member state.

Registration issues for registrants in complex supply chains

REACH applies only to EU-based manufacturers, importers or distributors of substances (as such, or in mixtures or articles). However, REACH still affects non-EU based manufacturers.

In order to sell REACH-compliant products in the EU, non-EU based companies are encouraged to address REACH directly to assist their customers and importers in the EU. In practice, a manufacturer based outside the EU may consider appointing an Only Representative (OR) established in one of the EU member states to fulfil the obligations placed on importers of their products by REACH. The OR then deals with the obligations under REACH and the manufacturer, although based outside the EU, is able to sell REACH-compliant products to its EU customers and assist them throughout the regulatory process.

To comply with the obligations placed on importers by REACH (mainly to submit a complete registration dossier), the OR must provide the ECHA with specific information, including the tonnage of substances imported into the EU and their uses. In practice, the OR must work in co-operation with the EU importers of substances (as such, or in mixtures or articles) to collect such information.

While this model may work relatively well in simple supply chains where the OR knows the identity of the EU importers who then have access to all the necessary information, this process is likely to become extremely difficult in complex supply chains, perhaps composed of three or more companies, some of which may be located outside the EU. In these situations, the upstream non-EU manufacturer may not know whether the substances supplied to another non-EU entity will ultimately be exported to the EU, or in what quantities and for which uses the imports will occur. In addition, this kind of information, as well as the identity of the EU importers, may be confidential. For example, a distributor or a formulator of substances manufactured outside the EU may have an interest in not disclosing the identity of its customers to its supplier, which could be its direct competitor. Indeed, should the customers of a distributor in the EU know the identity of the manufacturer, they may try to bypass their distributor and have a direct relationship with the manufacturer.

While REACH does not provide any guidance on how to address such complex, although quite common, issues, EU competition law rules require any actor in the supply chain to avoid any disclosure of confidential business information, such as lists of customers, prices, volumes and so on. This is even more important in the chemical sector, which is often described as a mature market where any loss of competition would raise serious problems and in which there have been several high profile prosecutions of cartels in recent years (such as those following recent investigations in the rubber, feed phosphate and hydrogen peroxide sectors).

To avoid any such disclosure of confidential information while ensuring compliance with REACH, some of the largest non-EU manufacturers have implemented new business models that involve the appointment of a trustee and the creation of ad-hoc software to track the origin of substances exported to the EU. In practice, the trustee, which is appointed by the OR, operates as an interface between three parties:

• The non-EU manufacturer's OR.
• The non-EU manufacturer's direct customers.
• The non-EU manufacturer's indirect customers (that is, its direct customers' customers).

The trustee collects information from the OR on the identity of the substances manufactured outside the EU and from direct or indirect customers on their identity and the quantities of the substances exported to the EU. The main goal of the trustee's work is to provide the OR, in an anonymous and aggregate manner, with the information that is necessary for the purpose of submitting a complete registration dossier under REACH.

The trustee's task is a very difficult one. In some cases, EU importers import the same substance from different suppliers and the various supply chains may not be very clear. In such a situation, the trustee must establish both:

• Whether the substances registered by the OR are the same as those imported into the EU.
• In what percentage the substances are present in the products (which may be mixtures) imported into the EU, compared to the same substances supplied by different parties (which may, in turn, be based within or outside the EU).

This second assessment is important to avoid companies that have not registered their substances under REACH receiving any opportunity of a free benefit arising from others' registration.

Authorisation

In the last 12 months a number of SVHCs have been included in the ECHA Candidate List, which now lists 38 substances. The identification of SVHCs and their inclusion in the Candidate List is the first step in the authorisation procedure aimed at establishing a list of substances that cannot be placed on the EU market except where authorised by the European Commission (Commission). The list will be included in Annex XIV of REACH.

Although Annex XIV of REACH is currently empty, the simple identification of a substance as an SVHC and its inclusion in the Candidate List is the first step towards inclusion in Annex XIV and entails some legal obligations for companies marketing that SVHC.

One of the immediately applicable requirements affecting suppliers of medical devices is the duty to communicate information about the presence of SVHCs in articles (Article 33, REACH) (see above, REACH and the medical devices sector: Scope). To comply with the requirements of Article 33 of REACH, any supplier, distributor or retailer of medical devices must be either informed about the presence of SVHCs, or able to find this information within 45 days of a request by a consumer.

Compliance with this obligation has proven to be extremely difficult in practice, especially in complex supply chains, where EU-based distributors of articles, such as medical devices, are not necessarily aware of the presence of SVHCs in their products. Very often, suppliers of articles underestimate their obligations under REACH, relying on the perception that pure chemical manufacturers are the only commercial actors it concerns. It is also possible that the information provided by their suppliers is incomplete or incorrect, thereby exposing the importer of articles to possible sanctions for placing products that are not compliant with REACH on the market.

A practical example is the case of medical devices containing the substance Bis (2-ethylhexyl)phthalate (DEHP). DEHP is one of the four phthalates included in the Candidate List. Phthalates are typically and widely used as plasticisers, generally to increase the flexibility of certain plastics, such as products based on Polyvinyl Chloride (PVC). Due to its particular chemical characteristics, DEHP-plasticised PVC is a widely used material in the medical device industry. Bags for intravenous solutions and blood and urine bags are among the medical devices that usually contain DEHP-plasticised PVC. EU manufacturers, importers or distributors of these medical devices are subject to the requirements of Article 33 of REACH. Suppliers of medical devices containing DEHP must provide their recipients with information on the presence of DEHP and on the safe use of medical devices containing it. Retailers of these medical devices must therefore be able to respond within 45 days to customers' queries concerning the presence of DEHP.

A recent study conducted by the non-governmental organisation (NGO) European Environmental Bureau (EEB) has demonstrated that only a few of the largest European retailers (including Carrefour, Tesco and Media Markt) and their suppliers are able to comply with the duty to communicate information under REACH. The EEB's report (see website) has shown that the presence of phthalates in a range of everyday consumer products, including shoes, pencil cases, erasers, earphones and bath toys has been widely ignored by the suppliers of such articles.

Member state sanctions for non-compliance

Non-compliance with the provisions of REACH, including the duty to communicate information, can result in heavy administrative or even criminal sanctions. REACH gives member state authorities responsibility for adopting sanctions for REACH infringements.

A recent study commissioned by the Directorate General for the Environment of the Commission (see website) focused on the penalties in each member state for non-compliance. The study concluded that both the methods of enforcement and the choice of the enforcement regimes vary dramatically from one member state to another. While common law countries have mainly adopted criminal sanctions, and Nordic countries have adopted coercive measures, a large number of the remaining countries have adopted measures combining administrative and criminal sanctions.

The size of the potential fines also vary greatly. In Belgium, for example, serious offences can lead to a maximum of eight years imprisonment and to fines reaching EUR55 million (as at 1 November 2010, US$1 was about EUR0.7), whereas the maximum fines are set below EUR1,000 in Cyprus, Greece and Latvia. In the UK, the administrative fines are potentially unlimited, while in Italy they will not exceed EUR150,000 and in France EUR375,000. Overall, the study has identified a lack of harmonisation among EU member states, which may be addressed by the Commission and by the ECHA at a later stage. EU manufacturers and importers of medical devices may also be subject to fines in several member states simultaneously for the same product where it is available in different countries.

Product recalls

In addition to imposing penalties for non-compliance calculated on the basis of the seriousness of the infringement, member state authorities can impose corrective measures, including a product recall. A product recall may be needed, for example, where the presence of a chemical substance in an article is dangerous for human health.

A voluntary guide to carrying out corrective actions, including recalls, has been recently adopted and has received the support of the Commission (see website). The guide provides practical advice on the immediate actions that must be taken by product manufacturers and distributors if a product is recognised as unsafe. These actions include:

• The identification of the hazard and its potential impact on the consumers.
• An estimation of the level of risk posed, based on the evaluation of both the severity and the probability of a possible injury.
• A decision on the necessity of an intervention.
• The establishment of an overall risk analysis (serious, moderate or low) for that particular product.

As a general rule, the Commission's published guidance provides that the decision as to whether a product must be considered unsafe, and as to what corrective action is appropriate, is based on a self assessment conducted by the responsible entity.

In addition, Directive 2001/95/EC on general product safety requires producers and distributors of unsafe articles to immediately inform member state authorities about the presence of a given risk and the actions to be taken. The Commission has developed an online notification form (called "business application") that allows the submission of detailed information on the nature of the product, the type of hazard, and so on directly to the competent member state authorities. The Commission's Decision 2004/905/EC laying down guidelines for the notification of dangerous consumer products to the competent authorities provides useful guidance on how to submit the form.

RoHS Directive

One of the most discussed regulatory updates in the past few months concerns the recasting of Directive 2002/95/EC on the restriction of the use of certain hazardous substances in electrical and electronic equipment (RoHS Directive). This has attracted interest for a number of reasons, the most significant of which include the proposals to adopt a new list of prohibited substances and to extend its scope to medical devices.

The current RoHS Directive

The current RoHS Directive prohibits the marketing of electrical and electronic equipment (EEE) containing four heavy metals (lead, mercury, cadmium and hexavalent chromium) and two flame retardants (polybrominated biphenyls (PBB) and polybrominated diphenyl ethers (PBDE)). The ban entered into force in July 2006 and concerned various categories of EEE, including:

• Large and small household appliances.
• IT and telecommunication equipment.
• Consumer and lighting equipment.
• Electrical and electronic tools.
• Toys.
• Automatic dispensers.

Medical devices containing EEEs are currently out of the scope of the RoHS.

Recast of the RoHS Directive

In December 2008 the Commission proposed revisions to the RoHS Directive aimed at developing a better regulatory environment. Some of the major changes proposed by the Commission were:

• The inclusion in the scope of RoHS of two additional categories of EEE:
• medical devices; and
• monitoring and control instruments.
• The adaptation of the list of restricted substances.
• Increasing convergence with other relevant EU legislation, particularly REACH.

Following months of intense negotiations, on 24 November 2010 the European Parliament adopted its first position on the new RoHS Directive. Among the amendments introduced by the European Parliament, two are particularly relevant for the medical devices industry:

• The new RoHS Directive will apply only to medical devices placed on the market three years after its entry into force. Therefore, if the new RoHS Directive is adopted as expected by 2013-2014, the extension of its scope to medical devices would take effect in 2017.
• There will be a periodic review of the Annexes to the RoHS, which include the list of restricted substances, to take into account, among other things, Annexes XIV and XVII of REACH listing substances that are restricted or subject to authorisation under REACH. In particular, the European Parliament has suggested considering as a priority the risk to human health and the environment arising from the use of four substances currently included in the REACH Candidate List:
• Hexabromocyclododecane (HBCDD);
• Bis (2-ethylhexyl) phthalate (DEHP);
• Butyl benzyl phthalate (BBP);
• Dibutylphthalate (DBP).

It is likely that the new RoHS will also become a CE Directive. EEE will in future bear the CE logo, as is currently the case for products such as toys, personal protective equipment or weighing instruments. By affixing the CE marking on EEE, the manufacturer takes the responsibility of guaranteeing that its product is in conformity with the essential requirements set out by the applicable EU legislation.

This does not mean that an EEE bearing the CE marking will have been checked by any authority or body for its compliance with RoHS. The responsibility for such compliance will remain with the manufacturer. Therefore, contractual arrangements will be required between non-EU manufacturers, who are responsible for proving that products bearing the CE marking comply with relevant EU directives, and EU importers, who are subject to enforcement actions by member state authorities.

Conclusion

The past 12 months have been crucial in revealing the extent of the impact of REACH on the EU medical devices industry. While pure chemical manufacturers or importers have already invested important resources in setting up REACH compliance programmes, many EU manufacturers or distributors of articles (including medical devices) continue to overlook the challenges presented by REACH.

Although REACH imposed only a limited number of requirements on article manufacturers and distributors, anyone who is unable to benefit from the exemption (including manufacturers/distributors within the medical devices industry) is subject to those requirements and runs the risk of serious penalties if these requirements are not met. The Commission is currently conducting a stakeholder consultation concerning scoping issues, which will likely include implications for medical device manufacturers, importers and distributors.

For further information, please contact Olivier Lantres, Alison Dennis or Claudio Mereu.