The Risks of Different Risk Classification Systems

A medical device’s risk classification carries a number of regulatory implications, such as whether and what type of clinical studies will be required. The question of which risk class a device falls into is not as readily answered as is often believed, however, a question that becomes even more complicated for devices distributed internationally.


As our regular readers know, the FDA uses a three-class system of risk categorization whereas the European Union (EU) employs a four-class approach, an approach used in most other nations. However, there are entities that have separate risk classification documents for software as a medical device (SaMD), one of the topics that will be covered in the second part of this two-part examination of device classification.


We assume for the purposes of this blog that the risk of software in a medical device (SiMD) will continue to be subsumed in the risk class applied to the parent device, although the reality may ultimately be somewhat different. The FDA had included an update to the 2005 contained software guidance in its guidance agenda for fiscal year 2021, an update that could present a change in this line of thinking on the agency’s part. Where the agency will land on the differential risk question in its rewrite of this guidance is impossible to predict, but we would point out that the risk accorded to a device accessory is not always identical to that of the parent device as seen in the FDA device accessory policy.


Devices that fall into the FDA’s class I risk category are subject to general controls, which are applied to devices in all three classes, such as controls for misbranding and adulteration. Most class II devices are required to comply with special controls that are developed specifically for that device type. The FDA’s series of device classification panels, which are groupings of class II and III devices by medical specialty, provides a comprehensive list of device types and risk classifications. One of the more heavily populated panels is cardiology (Part 870), with each class II entry describing the special controls applied to that device type.


U.S. Leaning Toward Two-Class Framework for IVDs


De novo devices, which are devices that lack a predicate, are nearly always slotted into the class II risk category, although a de novo device may qualify as a class I device. Class III devices reviewed under the PMA (premarket approval) program are approved with a highly specific set of conditions applied to that and similar devices. According to the FDA, there are three scenarios in which the agency will determine that a device is a class III device. These are that the device:


  • Is necessary to support the patient’s/user’s life;
  • Is necessary to sustain the patient’s/user’s life; or
  • Presents a potential risk of illness or injury to the patient/user.


For the time being, the FDA employs the same risk classification framework for in vitro diagnostics as all other medical device types, but that would change with passage of the Verifying Accurate Leading-edge IVCT Development (VALID) Act of 2021. In its current form, the legislation provides definitions for both high- and low-risk tests, to the apparent exclusion of moderate-risk tests. The FDA had proposed a low-risk/high-risk approach in its August 2018 technical assistance to Congress, but this approach would seem to conflict with the FDA’s stated intent to harmonize its regulations with those of other nations, regardless of the origin of this binary approach to risk.


One of the more interesting aspects of the European Union’s approach to risk classification is that it uses an alphabetic approach for IVDs – classes A through D, with D representing the highest risk grouping – while all other devices are subject to a Roman numeral system. Class I is for low-risk devices, while class IIA is for low-to-medium risk devices and class IIB for medium-to-high risk devices. As is the case with the FDA approach, class III devices are high-risk devices.


The Medical Device Coordination Group has published guidance for risk classification for both IVDs and conventional devices, both of which are fairly lengthy documents. It might be noted that the guidance for non-IVD products states in Section 3.2.1 that the highest possible risk classification will be applied to the device even when the device’s design or intended use might seem to suggest a lower risk classification. The passage in question states: “The characteristic or combination of characteristics in accordance with the intended purpose of the device that falls into the highest class determines the class for the device as a whole.”


With the exception of the previous statement, the MDCG guidance for non-IVD devices offers little in the way of overarching principles. The manufacturer is liable for proposing a risk classification based in part on the device category, which in the guidance includes:


  • Non-invasive devices;
  • Invasive devices;
  • Active devices; and
  • Special rules products.


A non-invasive device is unlikely to merit a class III designation unless it is used to process human tissues for reintroduction into the human body. Conversely, an invasive device that is used only transiently may be a class I device, while a device intended to incur direct contact with the heart or the central nervous system is a class III product, regardless of the duration of contact.


Little Detail Offered on When Trials Required


MDCG listed software as an active device in this guidance, which will be deemed a class IIa device when used as a clinical decision support product. When that decision is critical in determining whether the patient will survive or will suffer an “irreversible deterioration of health,” the class III label is applied. 


While the FDA is not entirely clear with regard to when it will require a clinical study for a class II device, the vast majority of class III devices will require a clinical trial, even when a control arm is impracticable. Unfortunately, Annex XIV of the MDR is even more ambiguous on this question. Class III devices will frequently require a clinical trial, but the difference between classes IIa and IIb with regard to clinical evidence requirements is not clarified in any manner whatsoever. One established difference between class III and the other device classes is that the manufacturer must file an annual Summary of Safety and Clinical Performance (SSCP) report. Otherwise, the MDR leaves it up to the sponsor to determine whether and what type of clinical data are needed. This is a particularly awkward situation for small device developers, who may lack the experience needed to anticipate EU clinical trial requirements in the early stages of the device development process.


Next up: risk characteristics of IVDR devices and the software risk question.

Get more of Enzyme

Sign up for the latest updates in your inbox
Ready to level up? Inquire about certification.
info@enzyme.com or

Ready to do more?