Corrective action is action undertaken in relation to products on the market with the intention of removing the potential for harm or non-conformity, and to reduce the risk from unsafe products.
Regulations impose strict requirements on economic operators regarding:
- actions they must take to identify the need for corrective action
- deadlines they must meet for notifying incidents and potential corrective action to the relevant authorities
- ensuring and monitoring the effectiveness of the corrective action.
These requirements differ across product categories, with medical devices, medicines and cosmetics being specifically regulated, and other wellness products falling under general consumer product regulations. Having robust systems in place to ensure a business is aware of its obligations should the need for corrective action arise is essential to minimise any harm and potential for claims, reduce the risk of non-compliance, and potentially reduce the scale and disruptiveness of corrective action for a business. This article sets out a summary of the key dos and don’ts for preparing for and managing corrective action in the life sciences sector.
Do: have an effective vigilance system in place
The regulations governing medical devices, medicines, cosmetics and general consumer products all require manufacturers placing such products on the market in the UK to have in place systems for recording and reviewing complaints, to ensure the need for corrective action is identified.
Manufacturers should ensure that any information received about a product issue is fully investigated by competent personnel to ensure that corrective action is taken as early as possible if necessary. This will help to minimise regulatory and financial exposure.
Do: investigate thoroughly to understand the risk
To determine the appropriate action to prevent risks to patients or consumers, manufacturers must investigate the facts to assess the level of risk presented by the product, and must be prepared to present their findings to regulators. It is important that the risk level is determined accurately in line with the legislative definitions and guidance, since the risk level determines the notification requirements, deadlines for action and other measures required by legislation (see the table below). Getting this wrong, ie down-classifying a medical device issue as a non-reportable 'incident' rather than a reportable 'serious incident', and failing to meet the more stringent requirements for serious incidents as a consequence, would be a breach of the legislation that might result in criminal sanctions.
Examples of corrective action which may be appropriate include:
- Issuing new or updated instructions for use.
- Giving advice about the follow-up of patients, users or others.
- Modifying the product (including software update).
- Calibration updates for in vitro diagnostic medical devices.
- Quarantining and/or destroying the product.
- Recalling or withdrawing the product from the market.
Some regulators require witness evidence that certain corrective actions have been carried out, such as the destruction and/or refurbishment of products.
Do: ensure traceability
Manufacturers implement measures to ensure the traceability of products, for example to show when products left the warehouse, and to whom the products were sent. Some safety issues may only affect a particular batch of products, and being able to trace where these products are would narrow the number of products requiring corrective action. As a consequence, the costs of corrective action may be lower and the business disruption less.
Do: review contractual provisions with distributors
Manufacturers should ensure there are appropriate provisions in contracts with distributors to ensure distributors:
- maintain appropriate levels of traceability
- refer complaints to the manufacturer, and provide enough information to enable the manufacturer to investigate where required
- co-operate in corrective action, including recalls.
At a practical level, manufacturers should make sure they have up-to-date contact details for, and know who best to speak to, when dealing with third parties within the supply chain. This can avoid significant delays, which can affect the overall timeline for corrective action (for which time is of the essence).
Do: have standard operating procedures and staff training to ensure regulatory deadlines are met
The regulations prescribe deadlines for notifying authorities and taking corrective action. These deadlines differ depending on the product type and the severity of the issue identified.
Manufacturers must have clear internal procedures which set out timelines that staff must work to avoid being in breach of regulations, particularly as for some product types the clock starts from when anyone within the business becomes aware of the issue. In addition, manufacturers should carry out mock recalls to test the robustness of the corrective action standard operating procedures (SOPs).
Staff should also receive regular training to ensure they are aware of the requirements. Staff should know who will take on what responsibilities in the event of corrective action so that plans can be implemented quickly.
|
Product type
|
Lower risk
|
Higher risk
|
|
Medical devices
|
'Non-serious incidents'
|
'Serious incidents'
-
In addition to the UK responsible person and approved body (if applicable), the Medical Devices Regulations 2002 (MDR 2002) require the manufacturer to also notify the MHRA through an initial serious incident report within 15 days of becoming aware of the serious incident. This timeline is reduced to two days for serious public health threats, and 10 days if there is a risk of death or unanticipated serious deterioration in the state of health. Similar to the above, it would make sense to maintain a list of the contact details for each national regulator for the countries in which you place products on the market.
-
Before taking any field safety corrective action in relation to a device, the manufacturer must: (i) produce a risk assessment of the proposed action and (ii) submit to the MHRA an initial report of the proposed field safety corrective action and a proposed field safety notice. In urgent situations, the manufacturer may take field safety corrective action and circulate the field safety notice to customers before submission to the MHRA.
The MDR 2002 has recently been amended by the Medical Devices (Post-market Surveillance Requirements) (Amendment) (Great Britain) Regulations 2024. The amended regulations set out what manufacturers must include in the field safety notice: the devices involved and UDIs, the reasons for the field safety corrective action and reference to the risks to any person, and all actions that users must take in response to the field safety notice.
|
|
Medicines
|
The defect risk classification will determine the recall or notification that must be carried out.
|
The Human Medicines Regulations 2012 require the manufacturer to inform the licensing authority immediately upon becoming aware of any defect which could result in a recall. This notification must be made before commencing any recall.
|
|
Cosmetics
|
The responsible person must immediately take necessary corrective action in relation to non-conforming products.
|
The retained Regulation (EC) No 1223 on Cosmetic Products requires the responsible person to immediately inform the Office for Product Safety & Standards where a product presents a risk to human health. The retained Regulation (EC) No 1223 on Cosmetic Products requires the responsible person to immediately inform the Office for Product Safety & Standards where a product presents a risk to human health.
The responsible person and distributors must notify the Office for Product Safety & Standards immediately of 'serious undesirable effects'.
|
|
Consumer products
|
Producers and distributors are required to notify the relevant enforcement authority when they become aware that a product.
|
In the event of a 'serious risk', the General Product Safety Regulations 2005 require that the notification must contain additional information, including on traceability and a full description of the risk.
|
Do: establish internal communication lines
Manufacturers should identify the key internal stakeholders and establish lines of communication between these individuals to ensure that information is exchanged quickly and that confidentiality and legal privilege is maintained. Key stakeholders will likely include members of the quality, regulatory, legal, and PR/communications teams.
Do: maintain accurate and up-to-date records during a recall
Manufacturers should maintain accurate and up-to-date records to monitor the effectiveness of a recall and also compliance. This includes all communications with distributors, suppliers, and regulators. Manufacturers may wish to leverage technology to assist with this task.
Do: ensure consistency in managing global recall
Except where adaptations are required to meet local regulatory and reporting requirements, manufacturers should ensure that the SOP is applied consistently across different jurisdictions to ensure a seamless global response to the issue.
Manufacturers should consider appointing legal counsel across the different jurisdictions in which the products are placed on the market to work with key internal stakeholders in the event of the recall. This resulting global response team can work together to co-ordinate, manage, and monitor the effectiveness of a global recall across multiple jurisdictions.
Do: establish a clear communications strategy
Manufacturers should establish and maintain a clear communications strategy with customers, to protect their brand and reputation in the event of taking corrective action. Legal and PR/communications teams should be involved in this.
Don't: play down risk
In communications to the field about a product safety issue, manufacturers should avoid using words such as 'voluntary', 'precautionary', or 'possible', which could detract from the seriousness of the risk being communicated.
Don't: make admissions or claims as to defect
Manufacturers should avoid using the word 'defect' or 'defective' in its internal communications, communications with regulators, and communications to patients, customers or consumers. This would otherwise be an admission of liability under the Consumer Protection Act 1987.
