DPP Compliance for Medical Device Manufacturers

Este artículo aún no está disponible en su idioma, por lo que se muestra en inglés.

The Intersection of ESPR and Medical Device Regulation

Medical device manufacturers operate within one of the most heavily regulated product environments in the world. The introduction of Digital Product Passports under the ESPR framework creates a new layer of transparency requirements that must be carefully integrated with existing obligations under the Medical Devices Regulation (EU 2017/745) and the In Vitro Diagnostic Regulation (EU 2017/746).

The good news for medical device manufacturers is that the sector already possesses sophisticated traceability and documentation systems. The Unique Device Identification (UDI) system, electronic Instructions for Use (eIFU), and technical documentation requirements under MDR have already established many of the data management capabilities that DPPs demand. The challenge lies in extending these systems to capture environmental and sustainability data that has not historically been a regulatory focus for medical devices.

medical device DPP at a Glance

Aspect	Detail
Primary regulations	Medical Devices Regulation 2017/745 (MDR), IVDR 2017/746, ESPR Regulation 2024/1781
UDI requirements	Unique Device Identification under MDR, in force since 2021
EUDAMED database	EU database for medical devices, central existing infrastructure
Medical device DPP	Coordinated with existing UDI and EUDAMED data, timing under discussion
EU DPP Registry online	Open since 20 July 2026
Data carrier	UDI carrier plus QR code linking to DPP
Notified body involvement	Most medical devices require notified body conformity assessment
Geographic scope	All medical devices placed on EU market

Understanding the fundamentals of Digital Product Passports is essential before exploring their specific application to medical devices. While the core DPP concepts apply universally, the medical device sector requires careful consideration of patient safety, clinical performance, and regulatory classification alongside environmental objectives.

Which Medical Devices Fall Under ESPR Scope

The ESPR's scope regarding medical devices requires careful analysis. The regulation explicitly states that it applies without prejudice to existing Union harmonisation legislation, meaning that ESPR requirements must not conflict with medical device safety and performance requirements. However, this does not exempt medical devices from environmental transparency obligations where such obligations do not compromise the device's primary function.

The most likely initial DPP requirements for medical devices will focus on:

• Single-use devices and their packaging, particularly high-volume disposable devices such as syringes, gloves, and wound dressings
• Electronic medical devices including diagnostic equipment, patient monitors, and imaging systems
• Surgical instruments and reusable devices requiring sterilisation
• Medical device packaging, which falls directly within the ESPR packaging provisions
• Batteries and electronic components within medical devices, covered by existing battery regulation DPP requirements

Implantable devices and life-critical equipment may receive specific exemptions or modified requirements where DPP obligations could compromise patient safety. Manufacturers should monitor the development of delegated acts closely and participate in industry consultations to ensure that medical device-specific considerations are adequately reflected in the final regulations.

UDI Integration with Digital Product Passports

The Unique Device Identification system provides a natural foundation for medical device DPPs. UDI already assigns each device a globally unique identifier linked to a database record (EUDAMED in the EU) containing essential device information. Extending this system to incorporate DPP data represents a logical evolution rather than a fundamental redesign.

The UDI-DI (Device Identifier) component identifies the device model and manufacturer, whilst the UDI-PI (Production Identifier) captures lot or batch number, serial number, manufacturing date, and expiry date. DPP data fields can be associated with either the DI level (for information common to all units of a device model) or the PI level (for batch or unit-specific data such as sterilisation records or material lot traceability).

Key integration considerations include ensuring that the DPP data carrier (typically a QR code or data matrix) can coexist with or incorporate the existing UDI barcode. Space constraints on medical device labelling are already significant, and adding a separate DPP identifier may not be feasible for small devices. The European Commission is exploring options for a single data carrier that serves both UDI and DPP purposes, which would significantly simplify labelling requirements.

Manufacturers should engage with their GS1 or HIBCC issuing agencies to understand how DPP identifiers will relate to existing UDI structures. Early alignment will prevent costly relabelling exercises and ensure smooth integration of environmental data into existing device traceability systems.

Material Disclosure and Biocompatibility Data

Medical device DPPs must capture material composition data that serves both environmental transparency and clinical safety objectives. Unlike consumer products where material disclosure focuses primarily on recyclability and substance of concern identification, medical device material data must also address biocompatibility, sterilisation compatibility, and clinical performance implications.

The substances of concern requirements under ESPR intersect significantly with existing medical device material restrictions. Medical devices already face stringent requirements regarding substances such as phthalates (particularly DEHP in PVC medical devices), bisphenol A, carcinogenic or mutagenic substances, and endocrine disruptors. DPPs provide an opportunity to consolidate this compliance data with broader environmental substance disclosure.

• Complete material composition listing for all device components and packaging
• Biocompatibility test results and ISO 10993 compliance status for patient-contact materials
• Sterilisation method compatibility data (EtO, gamma, steam, e-beam)
• Latex natural rubber content declaration (critical allergen information)
• DEHP and alternative plasticiser content for PVC-containing devices
• Heavy metal content in electronic components
• Conflict mineral declarations for devices containing tin, tantalum, tungsten, or gold
• Recycled content percentage and material origin traceability

The dual-purpose nature of medical device material data, serving both patient safety and environmental transparency, makes robust data management systems essential. DPP platforms for medical devices must be capable of presenting appropriate information to different audiences: clinical staff need biocompatibility data, whilst waste handlers need recycling information, and regulators need both.

Sterilisation, Shelf Life, and Lifecycle Data

Sterile medical devices carry additional DPP data requirements related to sterilisation processes and shelf life management. The sterilisation method affects both the device's environmental footprint (ethylene oxide sterilisation, for instance, involves hazardous substance management) and its end-of-life handling (irradiated materials may have different recycling characteristics).

DPP data for sterile devices should include the sterilisation method and validation status, sterilisation date and lot identification, sterile barrier system material composition, and shelf life determination based on accelerated ageing studies. This information supports both regulatory compliance and environmental impact assessment.

For reusable medical devices, the DPP must capture reprocessing cycle data, how many sterilisation cycles the device can withstand, recommended reprocessing parameters, and end-of-life criteria. This lifecycle data is essential for assessing the true environmental impact of reusable versus single-use alternatives, a comparison that is becoming increasingly important in healthcare sustainability strategies.

The material traceability capabilities of DPPs are particularly valuable in the medical device context, where post-market surveillance and field safety corrective actions require rapid identification of affected device lots. By linking material lot data to finished device traceability, DPPs can accelerate safety investigations and reduce the scope of recalls when issues are identified.

Electronic Medical Devices and E-Waste Considerations

Electronic medical devices, from simple blood glucose monitors to complex MRI scanners, face specific DPP requirements related to electronic waste management, battery content, and energy efficiency. These devices sit at the intersection of ESPR, the WEEE Directive, the Battery Regulation, and the MDR, creating a particularly dense regulatory landscape.

DPPs for electronic medical devices must document the presence and type of batteries, including information required under the EU Battery Regulation's own DPP provisions. The carbon footprint of electronic medical devices should encompass the full lifecycle including manufacturing energy, use-phase electricity consumption, and end-of-life processing. For devices with long operational lifetimes, hospital equipment may be used for 10-15 years, the use-phase energy consumption often dominates the total environmental footprint.

• Battery type, capacity, and expected cycle life
• Energy efficiency rating and annual energy consumption estimate
• Critical raw material content (rare earth elements, cobalt, lithium)
• Disassembly instructions for repair and end-of-life component recovery
• Software update policy and expected software support lifetime
• WEEE category classification and producer registration details
• Hazardous substance content declarations under RoHS

The repairability and upgradeability of electronic medical devices is a growing focus under ESPR. DPPs should include information about the availability of spare parts, the feasibility of software updates to extend device functionality, and modular design features that enable component-level replacement rather than whole-device disposal.

Data Security and Patient Privacy Considerations

Medical device DPPs must be designed with robust data security and privacy protections that reflect the sensitivity of healthcare-adjacent information. While DPPs themselves should not contain patient-identifiable data, the association between a medical device and its DPP could potentially be linked to patient records, particularly for implantable devices and home-use equipment.

Manufacturers must ensure that DPP access controls distinguish between publicly accessible environmental and sustainability data and restricted information such as detailed manufacturing specifications or clinical performance data. Multi-tier access architectures, where different stakeholders see different levels of detail, are essential for medical device DPPs.

Cybersecurity requirements for connected medical devices, already addressed under MDR and the EU Cybersecurity Act, extend to DPP data systems. If the DPP is accessible via a connected device's digital interface, the security of that interface must be assessed as part of the device's overall cybersecurity risk management. This includes protection against DPP data tampering, which could have safety implications if it misleads users about device materials or sterilisation status.

The General Data Protection Regulation (GDPR) may also apply to certain DPP implementations, particularly where device serial numbers or DPP access logs could be correlated with individual users. Manufacturers should conduct data protection impact assessments for their DPP systems and ensure that privacy-by-design principles are incorporated from the outset.

Practical Steps for Medical Device DPP Implementation

Medical device manufacturers should begin DPP preparation by leveraging their existing regulatory documentation systems. The technical documentation required under MDR already contains much of the material composition, manufacturing process, and supply chain data that DPPs require. The primary gap is typically environmental impact data, carbon footprint calculations, recyclability assessments, and circular economy metrics.

• Audit existing MDR technical documentation and UDI data against anticipated DPP requirements
• Identify environmental data gaps and commission lifecycle assessments for key product lines
• Evaluate DPP platform options that offer integration with existing quality management and regulatory information systems
• Develop supplier communication templates requesting environmental data in standardised formats
• Create pilot DPPs for representative devices from each risk class and product category
• Establish governance processes for DPP data accuracy, version control, and post-market updating

The practical guide to creating your first Digital Product Passport provides a technology-agnostic framework that medical device manufacturers can adapt to their specific needs. Given the regulatory complexity of the sector, manufacturers may also wish to engage specialist consultants who understand both MDR compliance and ESPR requirements.

Ultimately, the medical device industry's deep experience with regulatory documentation, traceability, and quality management positions it well for DPP adoption. The sector's challenge is not one of fundamental capability but of scope extension, broadening existing data management systems to encompass environmental and sustainability dimensions that will increasingly define market access and competitive positioning.

10-Step Action Plan for Medical Device Manufacturers

1. Confirm MDR UDI compliance. Unique Device Identification is the foundation. Without correct UDIs, DPP integration fails.
2. Audit EUDAMED submissions. EUDAMED holds existing device data. The DPP draws on and extends this data.
3. Engage notified body on conformity assessment. Most medical devices require notified body involvement. DPP-related changes to technical documentation flow through them.
4. Document material composition. Particularly for implantable, single-use, and electronic devices, material composition is a DPP data point.
5. Document substance compliance. REACH SVHCs, biocompatibility, sterilisation residuals. The DPP records compliance status.
6. Plan for combined UDI and DPP carriers. UDI carriers and DPP QR codes coexist on labelling. Design the physical placement carefully.
7. Engage component and material suppliers. Particularly for implants and electronics, supplier data quality is the gating factor.
8. Choose a DPP hosting model. Medical device hosting needs strong audit trails, change control, and persistence for the regulated lifetime of the device.
9. Pilot on one device family. Choose a device class with clean existing UDI and EUDAMED data, build the full DPP, test the workflow.
10. Train sales, clinical, and service teams. Clinical users, distributors, and service teams all interact with DPP data. Training is part of the launch.

Frequently Asked Questions

When does the medical device DPP become mandatory?

Medical devices sit at the intersection of MDR/IVDR and ESPR. Coordination between EUDAMED, UDI, and ESPR DPP is under discussion. Specific dates depend on Commission decisions.

What data must a medical device DPP contain?

UDI plus material composition, sterilisation method, single-use vs reusable classification, substance compliance, end-of-life routing, and reprocessing information where applicable.

How does the DPP relate to UDI?

UDI is the foundation. The DPP integrates UDI-linked data with broader sustainability and substance information.

How does this relate to EUDAMED?

EUDAMED holds existing device data. The DPP draws on EUDAMED and adds the broader ESPR data fields. Integration is a Commission priority.

What about implantable devices?

Implants have unique persistence requirements. The DPP must remain accessible for the operational life of the implant plus a post-explant period.

What about reprocessed single-use devices?

Reprocessed single-use devices are a regulated category. The DPP records reprocessing history and remaining-use limits.

Do non-EU medical device manufacturers need to comply?

Yes. All medical devices placed on the EU market require DPPs regardless of manufacturing location. The MDR Authorised Representative requirement extends to DPP responsibility.

How does the DPP support post-market surveillance?

PMS already feeds EUDAMED. The DPP extends this with consumer-accessible data and richer technical data for repair, servicing, and end-of-life.