On 24 June 2021, the U.S. Food and Drug Administration (FDA) issued a draft guidance on Remanufacturing of Medical Devices, which "is intended to help clarify whether activities performed on devices are likely 'remanufacturing.'"
Quick Summary
FDA's draft guidance on the Remanufacturing of Medical Devices sharpens the distinction between remanufacturing and servicing - a distinction that carries significant regulatory weight. This article unpacks what those definitions mean for Unique Device Identification (UDI), when a new device identifier (DI) is required, how refurbishing and repair differ for UDI purposes, and why FDA now treats most software changes as likely remanufacturing. The practical takeaway: document your processes and criteria for every change determination, and revisit your UDI approach to software.
This is another piece of the FDA's journey to clarify various activities undertaken-and their associated regulatory implications-on reusable devices over their useful life. In this draft, the FDA draws distinctions between "remanufacturing" and "servicing."
Remanufacturing vs. Servicing
"Remanufacturing" has significant regulatory implications for the remanufactured device and the organization undertaking that activity (if they have significantly changed the device and it is likely a "new" device).
In contrast, servicing, by definition, "excludes [emphasis added] activities that significantly change the finished device's safety or performance specifications, or intended use." Therefore, servicing usually creates less regulatory burden on the servicing organization.
The line between remanufacturing and servicing is not academic - it determines whether you are placing a "new" device on the market, and with it a cascade of UDI, labeling, and Quality System obligations.
Implications for UDI and DIs
Though the draft guidance does not address Unique Device Identification (UDI) specifically, I think there are some interesting implications worth discussing.
We often struggle to differentiate the UDI implications of remanufacturing, refurbishing, servicing, and repair, and have found that there are two important distinctions that affect UDI. The first is whether the activity (significantly) changes the device, such that a new device identifier (DI) is required (and whose DI should be used). The second is whether the activity constitutes a new act of commercial distribution such that a UDI is required for a device that may not previously have had one. (That is, the device was initially distributed prior to the applicable UDI class compliance date.)
We also need to remember that a new DI is required whenever a "change results in a new version or model" (21 CFR 830.50). This new DI also has other implications for Quality Systems, labeling, and the Global Unique Device Identification Database (GUDID).
Two Questions That Drive Every UDI Determination
- Does the activity significantly change the device? If yes, a new DI is likely required - and you must decide whose DI (which labeler) should be used.
- Does the activity constitute a new act of commercial distribution? If yes, the device must be UDI compliant before it is distributed, even if it never carried a UDI before.
The four activities below map onto these questions differently:
- Remanufacturing - significantly changes the device, so a new DI is likely required.
- Refurbishing - restores to a condition comparable to when new, so typically no new DI, but UDI is required if re-introduced into commercial distribution.
- Servicing (not repair) - does not significantly change the device, but typically involves a new act of commercial distribution, so UDI compliance is required.
- Repair - a type of servicing that returns the device to its current owner, so not a new act of commercial distribution.
With respect to when a new UDI is required, we need to differentiate remanufacturing from both servicing and refurbishing. It seems clear that if a device has been subject to the FDA's definition of remanufacturing ("processing, conditioning, renovating, repackaging, restoring, or any other act done to a finished device that significantly changes [emphasis added] the finished device's performance or safety specifications, or intended use"), then it is a very likely a different (new) device and must be labeled (or more likely relabeled) with a DI that reflects both the organization (labeler) that remanufactured the device and the model/version of this "new" device.
In the draft guidance, the FDA provides a flowchart and other information to help you determine whether the activities performed are "likely remanufacturing." Conversely, though not referenced in this draft guidance, in the 2016 Federal Register Notice on "Refurbishing, Reconditioning, Rebuilding, Remarketing, Remanufacturing, and Servicing of Medical Devices" and the 2018 white paper on "Evaluating Whether Activities are Servicing or Remanufacturing," the FDA provides a working definition of refurbishing, which is to "restore [a] device to a condition of safety and effectiveness that is comparable to when new [emphasis added]."
Based on these distinctions, we typically suggest a new DI for devices undergoing remanufacturing, but not for those undergoing refurbishing, as these devices have not significantly changed (they are, per the definition, the same as when the device was new). However, if the refurbished device is being (re-) introduced into commercial distribution (e.g., provided to a new customer), then the device must be UDI compliant. This does present some challenges if the organization refurbishing the device is not the Original Equipment Manufacturer (OEM). Regardless, it is critical to document both the processes and criteria for making these determinations and the specific results with respect to individual devices.
With respect to servicing, it is clear that, like refurbishing, these activities do NOT significantly change the device and therefore do not likely create a "new" device. However, for purposes of UDI application, we need to differentiate between servicing and repair (in the way that the FDA defines these terms).
By definition, repair is a "type of servicing that ... returns the device to the current owner of the device [emphasis added]." Because of this, we have NOT considered the return of repaired devices to the existing owner to be a new act of commercial distribution. Conversely, servicing, which is not repair, typically involves a new act of commercial distribution (a device which is being "held or offered for sale") because the device is being provided to a new customer.
Therefore, if the serviced device is not currently UDI complaint, it must be made UDI compliant before being distributed. Again, this may present some challenges if the organization servicing the device is not the OEM, and these processes and outputs should be well documented.
FDA's View on Software
More interesting, however, is the FDA's view on software. In the draft guidance, the FDA specifically distinguishes software changes from other activities and states that most software changes are likely remanufacturing "because of their impact on a product's software architecture, software requirements specifications, unresolved anomalies, and other key characteristics."
To help clarify, the FDA lists various software-related activities "that are likely not [emphasis added] remanufacturing because they generally do not significantly change the performance or safety specifications of the [software] device." These include, but are not limited to:
- Installing cybersecurity updates that are authorized by the OEM
- Performing data backup and recovery operations
- Accessing diagnostic and repair information
Conversely, the FDA states that "other activities involving changes to software are likely to significantly [emphasis added] change a device's performance or safety specifications, such that the activity is likely remanufacturing."
Software changes deserve extra scrutiny. Because FDA now treats most software changes as likely remanufacturing, the safety and integrity of those changes - and the records behind them - matter more than ever. OEM-authorized cybersecurity updates may not trigger a new DI, but they still demand disciplined controls. Pairing a strong life sciences cybersecurity posture with rigorous data integrity practices keeps your software change decisions defensible and your GUDID records trustworthy.
As above, when a software change is considered remanufacturing, a new DI will likely be required. Previously, we had relied on the discussion of major (new DI) vs. minor (new Production Identifier [PI]) software changes from section 10.6 of the 2013 IMDRF UDI Guidance to steer our discussion of new DI requirements for software (which is very similar to the requirements in the European Union [EU] Medical Devices Regulation/In-vitro Diagnostics Regulation [MDR/IVDR]).
We will need to revise our UDI approach to software to incorporate the FDA's new thinking. Validating those software changes - and proving they did not silently cross into remanufacturing - calls for a modern, risk-based approach grounded in Computer Software Assurance (CSA) and supported by sound validation lifecycle management.
How USDM Can Help
From design to post market, managing change to your medical device is critical. A seemingly small process deviation or change to a component can cause major problems such as product quality issues, patient safety, data loss, and possible regulatory actions or recalls. Our Medical Device division helps you bring your products to market faster, monitor your products in the field, and handle post-market surveillance while addressing a variety of regulatory challenges unique to the Medical Device industry.
USDM offers comprehensive services to help navigate a complex regulatory landscape, including compliance and quality strategy and execution, audits and assessments, remediation, validation and qualification, global product identification and much more.
FAQ: Remanufacturing, UDI, and Software Changes
What is the difference between remanufacturing and servicing under FDA's draft guidance?
Remanufacturing is any act done to a finished device that significantly changes its performance or safety specifications, or intended use - which likely makes it a "new" device with significant regulatory implications. Servicing, by definition, excludes activities that significantly change the device's safety or performance specifications or intended use, so it usually creates less regulatory burden on the servicing organization.
When is a new device identifier (DI) required?
A new DI is required whenever a change results in a new version or model (21 CFR 830.50). In practice, this means devices undergoing remanufacturing typically need a new DI, while refurbished devices generally do not - because, by definition, they have not significantly changed and are restored to a condition comparable to when new.
How does FDA treat software changes?
FDA states that most software changes are likely remanufacturing because of their impact on software architecture, software requirements specifications, unresolved anomalies, and other key characteristics. Some activities - such as installing OEM-authorized cybersecurity updates, performing data backup and recovery, and accessing diagnostic and repair information - are likely not remanufacturing because they generally do not significantly change the device's performance or safety specifications.
Does repairing a device trigger a new UDI?
Repair is a type of servicing that returns the device to its current owner, so it is not considered a new act of commercial distribution and does not, on its own, trigger a new UDI. Servicing that is not repair, however, typically involves providing the device to a new customer - a new act of commercial distribution - which means the device must be UDI compliant before distribution.
What should organizations document?
It is critical to document both the processes and criteria used to make remanufacturing, refurbishing, servicing, and repair determinations, and the specific results for individual devices. This is especially important when the organization performing the activity is not the Original Equipment Manufacturer (OEM).
Get Expert Help With Device Change and UDI Compliance
Whether you are drawing the line between remanufacturing and servicing, assigning new DIs, or rethinking your UDI approach to software, USDM's medical device and regulatory experts can help you build defensible, well-documented change-control processes. Contact us for solutions specific to your organization.
Additional Resources
Webinar: EU MDR Date of Application Readiness
White paper: The Direct Marking of Medical Devices in the U.S. and Europe
Blog: The Evolving Global Medical Device Data Imperative