Legislators are continually changing the regulatory framework for medical devices, as we have seen in Europe with EU Regulation 2017/745 (MDR) and EU Regulation 2017/746 (IVDR). This then raises the question of how to deal with legacy devices. These are the medical devices that manufacturers have legally placed on the market under the old regulations and continue to market even though they may not comply with the new regulations.
These regulatory changes happen in the EU, the USA, as well as to international standards, such as IEC 62366-1(IEC usability) or IEC 62304 (software).
However, even though the term “legacy device” is used a lot, we still don’t have a (uniform) definition.
This article will explain:
Although they skirt around the term, for example in the transitional provisions in Art. 120 MDR/Art. 110 IVDR or Recital 95 of the MDR, neither the MDR nor the IVDR define “legacy device.” For example, they refer to “devices placed on the market pursuant to those Directives [MDD/AIMDD].”
This missing definition is provided by the guidance document MDCG 2021-25 (“Regulation (EU) 2017/745 – application of MDR requirements to ‘legacy devices’ and to devices placed on the market prior to 26 May 2021 in accordance with Directives 90/385/EEC or 93/42/EEC”):
Legacy devices should be understood as devices, which, in accordance with Article 120(3) of the MDR, are placed on the market after the MDR’s date of application (DoA) and until 26 May 2024 if certain conditions are fulfilled. Those devices can be:
MDCG 2021-25 differentiates between “legacy devices” and “’old’ devices.” The guidance document defines ‘old’ devices as:
‘Old’ devices are those devices that were placed on the market before 26 May 2021 in accordance with the AIMDD or the MDD or in accordance with the applicable rules before the Directives had entered into force.
We have summarized the detailed transition periods of the MDR for you in a separate article.
Under the IVDR, a legacy device is a medical device:
that falls into IVDR classes D, C, B or A (sterile)
We have summarized the detailed transition periods of the IVDR for you in a separate article.
Some relaxations of the regulations will apply for legacy devices during the transitional period (for MDR legacy devices, up to May 2024 at the latest, and for IVDR legacy devices, up to 2027 at the latest).
Even during the transitional periods, legacy devices must comply with some of the requirements of the MDR/IVDR.
The MDCG does not consider most of the MDR regulations to be applicable to legacy devices. However, MDCG 2021-25 does include some exceptions. These are listed in the table below, which is taken from MDCG 2021-25:
MDR requirement | Application to ‘legacy devices’ |
Art. 10(10), (12)-(15) | YES (nota bene: ‘conformity with the requirements of this Regulation’ shall mean for ‘legacy devices’ conformity with the MDD or AIMDD and the additional requirements in accordance with Article 120(3) MDR) |
Art. 11(3)(c)-(g) | YES (nota bene: ‘conformity with the requirements of this Regulation’ shall mean for ‘legacy devices’ conformity with the MDD or AIMDD and the additional requirements in accordance with Article 120(3) MDR) |
Art. 11(7) | YES |
Art. 13(2), 2nd subparagraph, (4), (6)-(8), (10) | YES (nota bene: ‘conformity with the requirements of this Regulation’ shall mean for ‘legacy devices’ conformity with the MDD or AIMDD and the additional requirements in accordance with Article 120(3) MDR) |
Art. 14(2), last subparagraph, (4)-(6) | YES (nota bene: ‘conformity with the requirements of this Regulation’ shall mean for ‘legacy devices’ conformity with the MDD or AIMDD and the additional requirements in accordance with Article 120(3) MDR) |
Art. 15 | NO |
Art. 16(3) and (4) | NO |
Art. 18 | NO (without prejudice to national rules on implant cards applicable to ‘legacy devices’) |
Art. 22 | YES for system or procedure packs combining ‘legacy devices’ and MDR devices |
Art. 25 | NO (without prejudice to traceability requirements in the supply chain applicable to ‘legacy devices’ in accordance with other rules such as on market surveillance of goods or the General Product Safety Directive) |
Art. 27 | NO (See in this respect also MDCG2019-5 on registration of legacy devices in Eudamed) |
Art. 29 – registration of devices | In principle YES, but in the absence of EUDAMED’s full functionality, specific transitional provisions apply in accordance with Art. 122, 123(3)(d)(e) MDR10 |
Art. 31 – registration of economic operators | In principle YES, but in the absence of EUDAMED’s full functionality, specific transitional provisions apply in accordance with Art. 122, 123(3)(d)(e) MDR11 |
Art. 32 | NO |
Art. 83, 84 – PMS system and PMS plan | YES (with exception of requirements that relate to non-applicable obligations, e.g. Art. 83(3)(d) – SSCP; no requirement for a full revision of the technical documentation in accordance with Annexes II and III) |
Art. 85 – PMS report (class I devices) | YES (classification of devices in class I follows classification rules of the MDD, i.e. Art. 85 applies to class I ‘legacy devices’ despite the fact that those devices might be in a higher class under the MDR) |
Art. 86 – PSUR (class IIa, IIb and III devices) | YES (manufacturers shall draw up and update PSURs; to be taken into consideration by notified body designated under AIMDD/MDD in the framework of surveillance audits, see further explanations above in the text) |
Art. 87 – reporting of serious incidents | YES |
Art. 88 – trend reporting | YES (trend reporting was already part of the vigilance system established under the MDD/AIMDD) |
Art. 89 – analysis of serious incidents and FSCA | YES |
Art. 90 – analysis of vigilance data | YES |
Art. 91 – implementing acts | YES |
Art. 92 – EUDAMED vigilance module | In principle YES, but in the absence of EUDAMED’s full functionality, specific transitional provisions apply in accordance with Art. 122, 123(3)(d)(e) MDR12 |
While the FDA uses the term “legacy device,” it does not provide a definition of the term. It is not used in part 800 of CFR Title 21, which is the part that contains the requirements for medical devices. Instead, the FDA uses the concept of “legacy devices” in specific contexts.
The paper “Strengthening Cybersecurity Practices Associated with Servicing of Medical Devices: Challenges and Opportunities” defines legacy devices as:
“For the purposes of this document, legacy devices are those that cannot be reasonably protected against currently cybersecurity threats.”
In this area, the extent to which legacy devices already on the market have to comply with cybersecurity standards is still being discussed.
Manufacturers must comply with the cybersecurity requirements for all devices they place on the market. Even those that already have FDA clearance.
The FDA also discusses the concept of legacy devices in the context of assigning UDIs to devices that came onto the market before the new labeling requirements. There are some relaxations for these devices. As a result, legacy labels may continue to be used until 2023.
In addition, the USA has (or had) the concept of grandfathering. This meant that devices that were placed on the market before the enactment of the Medical Device Amendments to the Food, Drug, and Cosmetic Act of 1976 were allowed to stay on the market even if they did not meet the stipulated requirements. Since 2012 these devices have been re-classified and must, in principle, meet the normal safety standards.
Amendment I of the IEC 62304 defines legacy software as
Software (part of a medical device or standalone software) that was placed on the market in accordance with the legal requirements in force at the time but that no longer meets today's requirements (especially IEC 62304).
“At the time” refers to March 2015, the date of application of the current version of IEC 62304.
“Medical device software which was legally placed on the market and is still marketed today but for which there is insufficient objective evidence that it was developed in compliance with the current version of this standard.”
Source: IEC 62304 (3.36)
Certain relaxations apply for legacy software according to IEC 62304. As a result, legacy software only essentially has to meet the requirements that applied to it when it was placed on the market. The exception is risk management, which IEC 62304 also requires of legacy devices.
Legacy software, by definition, refers to the “medical device software” as a whole, i.e., the complete software system. If the relaxations of IEC 62304 don’t help, manufacturers can consider encapsulating part of their software and declaring it software of unknown provenance (SOUP).
Find out more about software of unknown provenance (SOUP)
IEC 62366-1 establishes requirements for processes that can be used to ensure the usability of medical devices. Devices that were placed on the market before the standard was published can be considered legacy devices.
These devices are treated as user interfaces of unknown provenance (UOUPs). They are regulated in Annex K of IEC 62366:2006 or Annex C of IEC 62366-1:2015 (latest version).
They include:
A shortened usability engineering process – in which, above all, the risks of associated with the usability of the component have to be evaluated – applies to UOUPs. The manufacturer must also draw on information already available from the market.
In this context, IEC 62366-1:2015 offers the option of skipping the formative and summative evaluations and the description of the use scenarios, but the use specification must always be defined.
Every new amendment to an existing regulation creates new legacy devices. The people making these amendments are well aware of this. That is why there are almost always transitional provisions. However, because each regulation has a different understanding of what constitutes a “legacy device,” manufacturers should pay very close attention to the applicable transitional provisions. This will allow them to make the best use of these periods and make any adjustments necessary.