The new rule consolidates the standards for notification and registration procedures, establishes risk classifications and also changes the nomenclature from “medical product” to “medical device”; for software, it simplifies the process of notification and registration of products
Recently, the RDC No. 777/2023, which, together with the RDC No. 751/2022, updates the rules for the regulation of medical devices in Brazil. The resolutions revoke RDC No. 185/2001, the main regulatory framework for the registration of medical products with the National Health Surveillance Agency (ANVISA). The update responds to the challenges that new technologies represented for the agency, especially since the previous standard was drawn up almost 20 years ago and was out of line with the current demands of the sector. In addition, there was a need to make the rules internationally compatible.
“Many changes have taken place in the healthcare sector and in technological development in recent years. This has a much greater impact when we talk about healthcare products,” highlights Teresa de Souza Dias Gutierrez, a lawyer working in the area of healthcare regulation.
The new rule consolidates the standards for notification and registration procedures, establishes risk classifications and also changes the nomenclature from “medical product” to “medical device”. Although it is related to health products in general, new definitions have been included, such as software as a medical device (software as a medical device – SaMD) and nanomaterial, as well as improvements to previous definitions. It is worth noting that the definition of SaMD, in RDC 751/2022, is much more detailed than that presented in RDC 657/2022, which provides for the regularization of SaMD.
According to the current resolution, SaMD is a product or application intended for one or more purposes indicated in the definition of medical device, which performs its functions without being part of the hardware of a medical device. It can be executed on a general purpose computing platform (non-medical purpose); including hardware and software resources (operating system, processing hardware, storage, database, display devices, input devices, programming language, etc.).
Furthermore, software is not considered SaMD if its purpose is to control the hardware of a medical device. It may also interact or be used in combination (e.g. as a module) with other products, including other medical devices. It is also important to note that mobile applications (apps) that meet the definition are considered SaMD.
The rules and risk classifications are based on the risk classification proposed in the European Community, outlined in Regulation (EU) MDR 2017/745. Thus, another important new feature brought by RDC 751/2022 is the specific guidance outlined in Rule 11. Previously, software had to follow the more general rules (9 and 10), related to so-called active products that needed some source of energy to function.
For Luiz Gustavo Henrique Augusto, a lawyer who also works in the health regulation sector, “This classification did not consider the particularities of the software at the time of its registration and ended up creating a great difficulty, since there were requirements for submitting documentation. The specific risk classification, although more detailed, in a way simplifies the regularization of a product that is in classes I or II”.
With the changes, any SaMD belongs to class I, except in cases where, for example, it is intended to provide information used for decision-making for therapeutic or diagnostic purposes, becoming class II. When such decisions cause death or irreversible deterioration of a person's health, the software is class IV. Resources intended to monitor physiological processes are also exceptions. Going further, when they monitor vital physiological parameters that result in immediate danger to the patient, they enter risk classification III.
“Since March 1, 2023, when the new RDC came into force, holders of medical device registration or notification must observe the provisions of this new standard, which means that possible changes in the risk classification must be verified”, adds Douglas Campanha, a lawyer who also works in the area of health regulation.
This verification, using the health reclassification protocol, must take place within 365 days from the date the standard comes into effect. Depending on the new risk classification given to the software, the notification regime may change to registration or vice versa.
“This alignment with international standards positions Brazil in a favorable position in relation to other countries. It becomes easier, for example, to register a product developed here abroad or vice versa. This entire process provides clarity and security for both those who develop solutions and for patients,” concludes Campanha.
