What type of software is to be considered as a medical device according to the CJEU?

In a judgment dated December 7, 2017, the Court of Justice of the European Union (CJEU) recalled the criteria to be applied to determine whether software constitutes a medical device.

According to the findings of the CJEU, software that permits the use of data specific to a patient in particular to detect contraindications, drug interactions and excessive dosages constitutes a medical device, even though it does act directly in or on the human body.

Under this judgment of December 7, 2017[1], the CJEU was asked to determine whether a software application, of which at least one of the functions makes it possible to use patient-specific data for the purposes inter alia of detecting contraindications, drug interactions and excessive dosages, is, in respect of that function, a medical device within the meaning of Directive 93/42[2] on medical devices, even if that software does not act directly in or on the human body.

This request for a preliminary ruling was made in the framework of proceedings initiated by the Syndicat national de l’industrie des technologies médicales (National professional organization of the medical technologies industry or “SNITEM”) and Philips France before the Council of State for the annulment of several provisions of Decree No 2014-1359 of November 14 2014[3] regarding the certification requirement for drug prescription assistance software based on a frame of reference established by the National Health Authority.

SNITEM and Philips France claimed that, insofar as at least some drug prescription assistance software are medical devices as per the terms of Directive 93/42, and bear the CE marking, the certification requirement imposed under French law contradicted Article 4 of said Directive that prohibits Member States from preventing or restricting the placing on the market of devices bearing the CE marking within their territory.

In its judgment, the CJEU set out its analysis by recalling first that a software application constitutes a medical device for the purposes of the Directive “where it satisfies the two cumulative conditions which must be met by any device of that nature, relating respectively to the objective pursued and the action resulting therefrom”.

Regarding the condition relating to the objective pursued, a software application is a medical device in itself when specifically intended by the manufacturer to be used for one or more of the medical purposes set out in the definition of a medical device, i.e. in particular the diagnosis, prevention, monitoring, treatment or alleviation of a disease, and the diagnosis, monitoring, treatment, alleviation of or compensation for an injury or handicap.

In this respect, the CJEU held that a software application that cross-references patient-specific data with the drugs that the doctor is contemplating prescribing “and is thus able to provide the doctor, in an automated manner, with an analysis intended to detect, in particular, possible contraindications, drug interactions and excessive dosages, is used for the purpose of prevention, monitoring, treatment or alleviation of a disease, and therefore pursues a specifically medical objective, making it a medical device”.

On the other hand, according to the judgment of the CJEU, patient medical data archiving or storage software applications, i.e. a software application that “while intended for use in a medical context, has the sole purpose of archiving, collecting and transmitting data”, is not a medical device. Similarly, a software application, the function of which “is limited to indicating to the doctor providing treatment the name of the generic drug associated with the one he plans to prescribe” or software “intended to indicate the contraindications mentioned by the manufacturer of that drug in its instructions for use” does not fall within the scope of application of Directive 93/42.

Regarding the condition relating to the action resulting from the objective pursued, the CJEU recalled that the EU legislature intended to focus, in order to classify a software application as a medical device, on the purpose of its use and not the manner in which the effect it is capable of producing on or in the human body is likely to materialize.

The CJEU thus confirmed in its judgment that in order to be classified as a medical device it does not matter whether the software application acts directly or indirectly on the human body, “the essential point being that its purpose is specifically one of those set out in the definition of a medical device”.

In support of its interpretation, the CJEU expressly referred to the European Commission Guidelines on the qualification and classification of stand-alone software used in healthcare within the regulatory framework of medical devices, Meddev 2.1/6 (the “Guidelines”), the objective of which is to promote a uniform application of the provisions of the Directive within the European Union.

According to the Guidelines, software constitutes a medical device where it is specifically intended by the manufacturer to be used for one of the purposes set out in Article 1(2)(a) of Directive 93/42 and where it is intended to create or modify medical information, “in particular by means of calculation, quantification or comparison of the recorded data against certain references, in order to provide information about a particular patient”.

The Guidelines also specify that software “that does not perform an action on data or performs an action limited to storage, archiving, lossless compression or, finally, simple search, that is to say, in the latter case, software that functions as a digital library and makes it possible to find information from metadata, without modifying or interpreting it” should not be considered a medical device.

The CJEU thus answered the request for a preliminary ruling by concluding that software, of which at least one of the functions makes it possible to use patient-specific data for the purposes inter alia of detecting contraindications, drug interactions and excessive doses, is, in respect of that function, a medical device, within the meaning of Directive 93/42, even if such software does not act directly in or on the human body.

As such, insofar as such software constitutes a medical device, it must, as per Directive 93/42, mandatorily bear the CE marking of conformity when it is placed on the market. Once this marking has been obtained, the product, having regard to that function, may be placed on the market and circulate freely in the European Union without having to undergo any additional procedure, such as a new certification.

In is judgment, the CJEU also addressed the question of medical software comprising several modules, some of which do not meet the definition of the term “medical device”. It confirmed that only the modules falling within the scope of Directive 93/42 are subject to this legislation and must be marked CE. In this respect, the CJEU recalled that it is the responsibility of the manufacturer to identify the limits and interfaces of the different modules which, in the case of modules subject to Directive 93/42, must be clearly identified by the manufacturer and based on the use which will be made of the product. As a result, the manufacturer of such software is required to identify which of the modules constitute medical devices, so that the CE marking can be affixed to those modules only.

It should be noted that the findings of the CJEU are in line with the aspirations of the EU legislator, as set out in new Regulation 2017/745 on medical devices[4]. Indeed, this new Regulation – that entered into force and that will be applicable as from May 26, 2020 – stipulates that “software in its own right, when specifically intended by the manufacturer to be used for one or more of the medical purposes set out in the definition of a medical device, qualifies as a medical device, while software for general purposes, even when used in a healthcare setting, or software intended for life-style and well-being purposes is not a medical device.”[5]

The approach to be adopted with respect to software in the healthcare sector must take into account the changes brought about by this new Regulation, in particular as regard the extension of the notion of medical devices that will include all devices intended to be used for the purpose of “prediction”, and “prognosis” of a disease.

Lastly, to go back to the proceedings pending before the Council of State, this judgment of the CJEU should in principle lead to the annulment of the provisions of Decree of November 14, 2014 that impose a  certification requirement for drug prescription assistance software bearing the CE marking.

While the request for a preliminary ruling referred to the CJEU only addressed drug prescription assistance software, disputes are also expected to be raised in connection with dispensation support software for pharmacies that are likely to incorporate functions falling within the scope of the certification requirement imposed by French law in addition to CE marking.

[1] CJEU, December 7, 2017, case n°C‑329/16

[2] Council Directive 93/42/EEC of June 14, 1993 concerning medical devices

[3] Decree No 2014-1359 of November 14, 2014 published in the Official Journal of the French Republic on November 15, 2014, p. 19255

[4] Regulation (EU) 2017/745 of the European Parliament and of the Council of April 5, 2017 on medical devices

[5] Regulation (EU) 2017/745 of the European Parliament and of the Council of April 5, 2017 on medical devices, paragraph 19