This post provides an overview of the papers included in a Symposium in the current issue of Law, Technology, and Humans edited by the Everyday Cyborgs 2.0 team.
In September 2022, we had our first in person Everyday Cyborgs workshop with the theme, “Visions of the Everyday Cyborg”. Participants contributed papers on a range of topics, however, many focused on the challenges presented by emerging medical device technology and a regulatory context in the EU and UK that is in a state of flux. This symposium in Law, Technology, and Humans brings together some of the papers presented at the ‘Visions of the Everyday Cyborg’ workshop.
In this blog post we provide an overview of the papers included in that symposium. These papers cover the failings and findings of the Independent Medicines and Medical Devices Review in the UK; the challenges of regulating for cybersecurity of medical devices; gaps in the regulation of FemTech; issues governing artificial intelligence enabled medical devices (AIeMD); and the problems posed by emerging regenerative medicine such as bioartificial pancreases to current regulation. However, before we delve into these papers, we first go into more detail on our own paper which sets the shifting regulatory context for medical devices in the UK.
UK Regulation Post-Brexit
Back in 2020 and early 2021, the Medicines and Medical Devices Bill (MMD Bill) was making its way through parliament and was to become the first piece of primary legislation in the UK dealing with medical devices. Mainly a skeleton Bill, it provided sweeping delegated powers for the Secretary of State to make changes to the current regulations. The Bill was introduced during an already uncertain period for the UK as it navigated its exit from the EU. Brexit legislation dealing with medical devices had already been passed in late 2019 which ensured that the Medical Devices Regulations 2002 (the principal regulation in this area) continued to have a legal basis post-Brexit and brought in provisions mirroring the new EU Medical Device Regulation 2017/745 (MDR 2017) and In Vitro Diagnostic Regulation 2017/746 (IVDR 2017). However, while Parliament was debating the MMD Bill, the 2020 Regulations were passed removing the mirroring provisions and creating a dual system of regulation between Northern Ireland, which continues to be subject to the EU MDR 2017 and IVDR 2017, and Great Britain (GB: England, Wales and Scotland) which is not subject to the MDR and IVDR.
Our contribution to the symposium, “The Shape of Medical Devices Regulation in the United Kingdom? Brexit and Beyond”, explores the aftermath of this period of flux. We examine the dual system of regulation created between NI and GB and impact of the post-Brexit landscape on for medical devices in NI. We argue that, although one potential positive for manufacturers in NI may be the benefit of having access to both EU markets and GB markets, regulatory divergence between the UK jurisdictions has the potential to exacerbate existing inequalities when it comes to access to (new) medical device technologies.
The paper also explores the Medicines and Medical Devices Act 2021, and the (missed) opportunities during its passing. We argued that the creation of new delegated powers granting the secretary of state the power to make regulations adds further complexity to what is already a complicated and, arguably, opaque regulatory system. Whilst amendments were tabled during the passage of the Bill that would have imposed a duty to consolidate legislation in the future, the final Act simply contains a duty to report on the workings of the Act, including whether consolidation is necessary, 5 years after its passing.
Granting the Secretary of State the power to make further regulations also raises concerns about inadequate scrutiny. Indeed, concerns about inadequate democratic scrutiny dogged the Bill in debate, with both the House of Lords Delegated Powers and Regulatory Reform Committee and the House of Lords Select Committee on the Constitution weighing in to criticise the use of skeleton powers for such broad policy areas. Whilst certain checks were placed on the powers through amendments to the Bill in the Lords, efforts to introduce sunsetting provisions on the powers ultimately failed.
Part of the criticism regarding inadequate scrutiny was linked to the outsized impact that such regulation can have on public health and safety. As we discuss in greater detail in the paper, initially safety was not a prominent priority in the Bill. However, amendments tabled during Parliamentary scrutiny not only provided for the establishment of a Patient Safety Commissioner (PSC) – one of the key recommendations of the Cumberlege Review – but also created a so-called ‘lock on patient safety’. This lock on patient safety requires the Secretary of State to safeguard public health and to only make regulations that impact patient safety where the benefits outweigh the risks. As we argue, the long-term success of these amendments, including the role of the PSC, remains to be seen, but it was a sound improvement on the Bill’s original form.
Finally, the paper examines the proposals in the MHRA’s consultation on the future of medical device regulation in the UK, and the government’s responses. Many of these proposals are more than passingly similar to those introduced in the EU MDR and which were mirrored by the 2019 Regulations before being removed by the 2020 Regulations. Examples include the up-classification of certain devices and tightened essential requirements to be met by devices. Other proposals consciously adopt alternative approaches, such as suggestions that the device identification nomenclature used by the USA and the International Medical Device Forum (IMDF) are adopted, along with various new measures for software (intended mainly to be included as guidance) following the US model; for example, the move towards a total product lifecycle approach to medical devices and the utilisation of predetermined change plans for medical devices software. The result, we argue, is a sort of halfway house between EU alignment, and divergence following new pathways. With the need to attract investment in medical technology, and retain access to innovative treatments and technologies, it is not clear how this pick ’n’ mix approach to regulation will fare now that GB sits outside the larger EU market.
Regulatory Failures, Cybersecurity, and Emerging Technology
The other contributions to the symposium each pick up on the challenges facing medical device regulation in the UK and EU. First Sonia Macleod takes a look at the findings and recommendations of the Independent Medicines and Medical Devices Review – also known as the Cumberlege Review. This Review was established in response to the heart-rending and traumatic experiences of those who were given sodium valproate (for the treatment of epilepsy) during pregnancy, hormone pregnancy tests, and pelvic mesh. Each intervention caused irreparable health consequences, compounded by an often disbelief or dismissiveness of healthcare professionals and a lack of clear avenues for feedback or complaints. Focussing on the findings in relation to pelvic mesh, Sonia explores the uncovered institutional and systemic failings, drawing on her own experiences as a lead researcher on the Review.
Moving to more technical matters two of the contributions address the challenges of regulating for cybersecurity of medical devices in the EU. Elisabetta Biasin and colleagues, examine the medical device cybersecurity requirements in existing EU regulation such as the EU MDR, General Data Protection Regulation, and Cybersecurity Act. In turn they look at the forthcoming AI Act, European Health Data Space Regulation, and Data Act which also contain provisions of relevance for cybersecurity. Highlighting the existing overlaps between the different pieces of EU legislation, they go on to argue that many of the provisions in the proposed legislation, while comprehensive, inadequately account for (or integrate) with existing legislation. In light of these findings, they make a series of recommendations for improvement.
Kaspar Ludvigsen also focuses on cybersecurity, comparing approaches to regulation of cybersecurity for medical devices between the UK, EU, and USA. He then identifies three ways in which cybersecurity regulation influences the medical device ecosystem. Building on this, he goes on to outline and recommend four principles for cybersecurity that could be carried forward in future regulation. These are: technological specificity, circumvention protection, genuine privacy, and security by design.
Finally, three contributors look at emerging technologies and the challenges they pose for regulation. Catriona MacMillan focuses on FemTech, specifically period tracking and fertility apps. She argues that there is a danger that UK regulations may fail to capture these kinds of apps. Some users of period tracking and fertility apps use them as a form of contraception, identifying the fertile period of a menstrual cycle in which unprotected sex should be avoided. However, the problem, as she highlights, is that these apps don’t always provide an accurate reading. As a result, users might have unwanted pregnancies, a serious consequence for many. The central problem is that manufacturers can avoid regulation by stating that the intended purpose of the device is not medical (and so fall outside the definition of ‘medical device’ in the regulations) and, hence, not subject to medical device regulations. This leaves users open to unregulated devices that may nevertheless pose serious risks (of unwanted pregnancy). To this end, she recommends a rethink of this regulatory gap.
Phoebe Li and colleagues examine the difficulties of regulating artificial intelligence enabled medical devices (AIeMD). In their paper, they draw on stakeholder interviews to explore the UK and EU regulatory contexts and identify commonly perceived challenges. The benefits of AIeMD are that they can learn and adapt from feedback from their environment meaning that they can improve over time. The challenge is that current regulations are ill suited to this process of constant adaptation. In their paper Li and colleagues look at recent attempts to adapt laws to this new technology, with a focus on the UK.
Finally, Antonia Cronin and Rebecca Thom set out the issues facing the regulation of emerging regenerative medical technologies such as the bioartifical pancreas. Such devices combine cellular therapy with medical devices. Focusing on the regulatory landscape in the EU, they argue that the hybridity of these technologies poses problems for the current regulatory landscape. For example, they have the potential to fall under both the EU Regulation on Advanced Therapy Medicinal Products and medical device regulations, making it unclear under which they are regulated. They argue that regulators should respond to this challenge by conceiving of and developing the existing regulatory framework in such a way that the novel products are treated as single entities.
In summary, each of the contributions in this symposium touches on the challenges of regulating an area in which technology is developing quickly and addressing how the regulatory regime is changing to account for this. With regulatory change still very much on the agenda in both the UK and the EU, and the universal dilemmas caused by emerging technologies, the symposium’s contributions mark a much-needed map of what is still uncertain terrain.
Written by: Laura Downey
Funding: Work on this was generously supported by a Wellcome Trust Investigator Award in Humanities and Social Sciences 2019-2025 (Grant No: 212507/Z/18/Z)