Changes from adopted text to adopted text

RemovedArticle 20 – paragraph 1 – point b: (b) the EHR system bears the CE marking of conformity referred to in Article 27 after the conformity assessment procedure has been completed;

RemovedArticle 20 – paragraph 1 – point c: (c) the EHR system is accompanied by the information sheet referred to in Article 25 with clear and complete instructions for use in accessible formats;

RemovedArticle 20 – paragraph 2: 2. Distributors shall ensure that, while an EHR system is under their responsibility, the EHR system is not altered in such a way that its conformity with the essential requirements laid down in Annex II and Article 27a is jeopardised.

RemovedArticle 20 – paragraph 3: 3. Where a distributor considers or has reason to believe that an EHR system is not in conformity with the essential requirements laid down in Annex II and Article 27a, it shall not make the EHR system available on the market, or shall recall it or withdraw it if was already available on the market, until it has been brought into conformity. Furthermore, the distributor shall inform immediately the manufacturer or the importer, as well as the market surveillance authorities of the Member states where the EHR system has been made available on the market, to that effect. Where a distributor considers or has reason to believe that an EHR system presents a risk to the health or safety of natural persons, it shall immediately inform the market surveillance authority of the Member State in which the distributor is established, as well as the manufacturer, the importer and where applicable, the authorised representative.

RemovedArticle 20 – paragraph 4: 4. Distributors shall, further to a reasoned request from a market surveillance authority, provide it with all the information and documentation necessary to demonstrate the conformity of an EHR system. They shall cooperate with that authority, at its request, and with the manufacturer, the importer and, where applicable, with the manufacturer’s authorised representative on any action taken to bring the EHR systems in conformity with the essential requirements laid down in Annex II or to withdraw or recall it.

RemovedArticle 21 – title: Cases in which obligations of manufacturers of an EHR system apply to economic operators

RemovedArticle 21 – paragraph 1: If any economic operator other than the manufacturer makes modifications to the EHR system whilst deploying or using it, which lead to changes in the intended purpose and deployment recommendations for the EHR system as declared by the manufacturer, in any case of any malfunctioning or deterioration in performance quality due to the changes made by the economic operator during deployment or use of the EHR system contrary to the manufacturer’s recommendations for technical deployment of the system or purpose of its use, the economic operator shall be considered a manufacturer for the purposes of this Regulation and shall be subject to the obligations laid down in Article 17.

RemovedChapter III – Section 3 – title: Conformity Assessment

RemovedArticle 23 – paragraph 1 – subparagraph 1: 1. The Commission shall, by means of implementing acts, adopt common specifications in respect of the essential requirements set out in Annex II, including a common template document and a time limit for implementing those common specifications. Where relevant, the common specifications shall take into account the specificities and verify compatibility with sectoral legislation and harmonised standards of medical devices and high risk AI systems referred to in paragraphs 3 and 4 of Article 14, including the state-of-the art standards for health informatics and the European electronic health record exchange format.

RemovedArticle 23 – paragraph 1 – subparagraph 2: 2. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2) after consultation with the EHDS board and the Advisory Forum.

RemovedArticle 23 – paragraph 4 a (new): 4a. Where common specifications have an impact on data protection requirements for EHR systems, they shall be subject to consultation with the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) before their adoption, pursuant to Article 42(2) of Regulation (EU) 2018/1725.

RemovedArticle 23 – paragraph 5: 5. Where common specifications covering interoperability and security requirements of EHR systems affect medical devices or high-risk AI systems falling under other acts, such as Regulations (EU) 2017/745 or […] [AI Act COM/2021/206 final], the adoption of those common specifications shall be preceded by a consultation with the Medical Devices Coordination Group (MDCG) referred to in Article 103 of Regulation (EU) 2017/745 or the European Artificial Intelligence Board referred to in Article 56 of Regulation […] [AI Act COM/2021/206 final], as applicable, as well as the EDPB referred to in Article 68 of Regulation (EU) 2016/679.

RemovedArticle 23 – paragraph 6: 6. Where common specifications covering interoperability and security requirements of medical devices or high-risk AI systems falling under other acts such as Regulation (EU) 2017/745 or Regulation […] [AI Act COM/2021/206 final], impact EHR systems, the adoption of those common specifications shall be preceded by a consultation with the EHDS Board, especially its subgroup for Chapters II and III of this Regulation, and, where applicable, the EDPB referred to in Article 68 of Regulation (EU) 2016/679.

RemovedArticle 24 – paragraph 1: 1. Manufacturers shall draw up technical documentation before the EHR system is placed on the market or put into service and shall be kept up-to-date.

RemovedArticle 24 – paragraph 2: 2. The technical documentation shall be drawn up in such a way as to demonstrate that the EHR system complies with the essential requirements laid down in Annex II and provide market surveillance authorities with all the necessary information to assess the conformity of the EHR system with those requirements. It shall contain, at a minimum, the elements set out in Annex III. Where the system or any part of it complies with European standards or common specifications, the list of the relevant European standards and common specifications shall also be indicated.

RemovedArticle 24 – paragraph 2 a (new): 2a. To ensure conformity, a single unified template for technical documentation shall be provided by the Commission.

RemovedArticle 24 – paragraph 3: 3. The technical documentation shall be drawn up in the official language of the Member State concerned. Following a reasoned request from the market surveillance authority of a Member State, the manufacturer shall provide a translation of the relevant parts of the technical documentation into the official language of that Member State.

RemovedArticle 25 – paragraph 1: 1. EHR systems shall be accompanied by an information sheet that includes concise, complete, correct and clear information that is relevant, accessible and comprehensible to professional users.

RemovedArticle 25 – paragraph 2 – point a: (a) the identity, registered trade name or registered trademark, and the contact details of the manufacturer including the postal and e-mail address and the telephone number and, where applicable, of its authorised representative;

RemovedArticle 25 – paragraph 2 – subparagraph 1a (new): If the EHR system is not accompanied by the information sheet referred to in this Article and by clear and complete instructions for use in accessible formats for persons with disabilities, the manufacturer of the EHR system concerned, its authorised representative and all other relevant economic operators shall be required to add to the EHR system that information sheet and those instructions for use.

RemovedArticle 26 – paragraph 3: 3. The EU declaration of conformity shall, as a minimum, contain the information set out in Annex IV and shall be translated into one or more official Union languages determined by the Member State(s) in which the EHR system is made available. Manufacturers shall provide a translation of the relevant parts of the technical documentation into the official language of the Member States where they have placed products on the market.

RemovedArticle 26 – paragraph 3 a (new): 3a. Digital EU declarations of conformity shall be made accessible online for the expected lifetime of the EHR system and in any event for at least 10 years after the placing on the market or the putting into service of the EHR system.

RemovedArticle 26 – paragraph 4: 4. By drawing up the EU declaration of conformity the manufacturer) shall assume responsibility for the compliance of the EHR system with the requirements laid down in this Regulation.

RemovedArticle 26 – paragraph 4 a (new): 4a. The Commission is empowered to adopt delegated acts in accordance with Article 67 in order to amend the minimum content of the EU declaration of conformity set out in Annex IV.

RemovedArticle 26 – paragraph 4 b (new): 4b. The Commission shall publish a standard uniformed template for the EU declaration of conformity and make it available in a digital format in all the official Union languages.

RemovedArticle 27 – paragraph 1 a (new): 1a. The CE marking shall be affixed before making the EHR system available on the market.

RemovedArticle 27 – paragraph 2 a (new): 2a. Where EHR systems are subject to other Union law in respect of aspects not covered by this Regulation, which also requires the affixing of the CE marking, the CE marking shall indicate that the systems also fulfil the requirements of that other law.

RemovedArticle 27 – paragraph 2 b (new): 2b. Member States shall build upon existing mechanisms to ensure correct application of the regime governing the CE marking and shall take appropriate action in the event of improper use of that marking.

RemovedArticle 27 a (new): Article 27a / Conformity assessment for EHR systems / 1. In order to certify the conformity of an EHR system with this Regulation, prior to placing an EHR system on the market, the manufacturer, its authorised representative, or any economic operator referred to in Article 21 shall apply for a conformity assessment procedure. / 2. The conformity assessment procedure shall require the notified body to assess: / (a) whether the EHR system is in conformity with the requirements laid down in Annex II; / (b) whether the EHR system is in conformity with the requirements laid down in Regulation (EU) .../... [.. (Cyber Resilience Act COM(2022)454]; / (c) whether the technical documentation is available and complete; / (d) whether the technical design of an EHR system meets the applicable requirements of this Regulation as provided for in an EU type examination procedure laid down in Annex IVa; / The EU type-examination is the part of a conformity assessment procedure in which a notified body examines the technical design of an EHR system and verifies and attests that the technical design of the EHR system meets the applicable requirements of this Regulation. / Only after an Union wide approval has been issued, may the CE marking be affixed, together with an identification number. / 3. Notified bodies shall take into account the specific interests and needs of SMEs when setting the fees for conformity assessment and reduce those fees proportionately to their specific interests and nee…

RemovedArticle 27 aa (new): Article 27aa / General principles of the CE marking / The CE marking shall be subject to the general principles set out in Article 30 of Regulation (EC) No 765/2008.

RemovedArticle 27 b (new): Article 27b / Notification / Member States shall notify the Commission and the other Member States of conformity assessment bodies authorised to carry out conformity assessments in accordance with this Regulation.

RemovedArticle 27 c (new): Article 27c / Notifying authorities / 1. Member States shall designate a notifying authority that shall be responsible for setting up and carrying out the necessary procedures for the assessment and notification of conformity assessment bodies and the monitoring of notified bodies, including compliance with Article 27h. / 2. Member States may decide that the assessment and monitoring referred to in paragraph 1 shall be carried out by a national accreditation body within the meaning of and in accordance with Regulation (EC) No 765/2008. / 3. Where the notifying authority delegates or otherwise entrusts the assessment, notification or monitoring referred to in paragraph 1 of this Article to a body, which is not a governmental entity that body shall be a legal entity and shall comply mutatis mutandis with the requirements laid down in Article 27e. In addition, that body shall have arrangements to cover liabilities arising out of its activities. / 4. The notifying authority shall take full responsibility for the tasks performed by the body referred to in paragraph 3.

RemovedArticle 27 d (new): Article 27d / Requirements relating to notifying authorities / 1. A notifying authority shall be established in such a way that no conflict of interest with conformity assessment bodies occurs. / 2. A notifying authority shall be organised and operated so as to safeguard the objectivity and impartiality of its activities. / 3. A notifying authority shall be organised in such a way that each decision relating to notification of a conformity assessment body is taken by competent persons other than those who carried out the assessment of the EHR system. / 4. A notifying authority shall not offer or provide any activities that conformity assessment bodies perform, or consultancy services on a commercial or competitive basis. / 5. A notifying authority shall safeguard the confidentiality of the information it obtains. / 6. A notifying authority shall have a sufficient number of competent personnel at its disposal for the proper performance of its tasks.

RemovedArticle 27 e (new): Article 27e / Information obligation on notifying authorities / Member States shall inform the Commission of their procedures for the assessment and notification of conformity assessment bodies and the monitoring of notified bodies, and of any changes thereto. The Commission shall make that information publicly available.

RemovedArticle 27 f (new): Article 27f / Requirements relating to notified bodies / 1. For the purposes of notification, a conformity assessment body shall meet the requirements laid down in paragraphs 2 to 11. / 2. A conformity assessment body shall be established under the national law of a Member State and have legal personality. / 3. A conformity assessment body shall be a third-party body independent of the organisation or the EHR system it assesses. / 4. A conformity assessment body, its top-level management and the personnel responsible for carrying out the conformity assessment tasks shall not be the designer, manufacturer, supplier, installer, purchaser, owner, user or maintainer of an EHR system, that they assess, or the representative of any of those parties. A conformity assessment body, its top-level management and the personnel responsible for carrying out the conformity assessment tasks shall not be directly involved in the design, manufacture, marketing, installation, use or maintenance of EHR systems, or represent the parties engaged in those activities. They shall not engage in any activity that may conflict with their independence of judgement or integrity in relation to conformity assessment activities for which they are notified. This shall in particular apply to consultancy services. A conformity assessment body shall ensure that the activities of its subsidiaries or subcontractors do not affect the confidentiality, objectivity or impartiality of its conformity assessment activiti…

RemovedArticle 27 g(new): Article 27g / Presumption of conformity of notified bodies / Where a conformity assessment body demonstrates its conformity with the criteria laid down in the relevant harmonised standards the references of which have been published in the Official Journal of the European Union, it shall be presumed to comply with the requirements set out in Article 27g in so far as the applicable harmonised standards cover those requirements.

RemovedArticle 27 h (new): Article 27h / Use of subcontractors and subsidiaries by notified bodies / 1. Where a notified body subcontracts specific tasks connected with conformity assessment or has recourse to a subsidiary, it shall ensure that the subcontractor or the subsidiary meets the requirements set out in Article 27f and shall inform the notifying authority accordingly. / 2. A notified body shall take full responsibility for the tasks performed by subcontractors or subsidiaries wherever those are established. / 3. Activities may be subcontracted or carried out by a subsidiary only with the agreement of the client. / 4. A notified body shall keep at the disposal of the notifying authority the relevant documents concerning the assessment of the qualifications of the subcontractor or the subsidiary and the work carried out by them under Annex IVa.

RemovedArticle 27 i (new): Article 27i / Application for notification / 1. A conformity assessment body shall submit an application for notification to the notifying authority of the Member State in which it is established. / 2. The application for notification shall be accompanied by a description of the conformity assessment activities, of the conformity assessment procedures set out in Annex IVa as well as by an accreditation certificate, where one exists, issued by a national accreditation body attesting that the conformity assessment body fulfils the requirements laid down in Article 27f. / 3. Where the conformity assessment body concerned cannot provide an accreditation certificate as referred to in paragraph 2, it shall provide the notifying authority with all the documentary evidence necessary for the verification, recognition and regular monitoring of its compliance with the requirements laid down in Article 27f.

RemovedArticle 27 j (new): Article 27j / Notification procedure / 1. A notifying authority shall notify only conformity assessment bodies which have satisfied the requirements laid down in Article 27f. / 2. The notifying authority shall send a notification to the Commission and the other Member States of each conformity assessment body referred to in paragraph 1, using the electronic notification tool developed and managed by the Commission. / 3. The notification referred to in paragraph 2 shall include the following: / (a) full details of the conformity assessment activities to be performed; / (b) the relevant attestation of competence. / 4. Where a notification is not based on an accreditation certificate referred to in Article 27i(2), the notifying authority shall provide the Commission and the other Member States with documentary evidence which attests to the conformity assessment body's competence and the arrangements in place to ensure that that body will be monitored regularly and will continue to satisfy the requirements laid down in Article 27f. / 5. The conformity assessment body concerned may perform the activities of a notified body only where no objections are raised by the Commission or the other Member States within two weeks of the validation of the notification where it includes an accreditation certificate referred to in Article 27i(2), or within two months of the notification where it includes documentary evidence referred to in paragraph 4 of this Article. / Only such a body shall b…

RemovedArticle 27 k (new): Article 27k / Identification numbers and lists of notified bodies / 1. The Commission shall assign an identification number to a notified body. It shall assign a single such number even where the body is notified under several Union acts. / 2. The Commission shall make publicly available the list of notified bodies including the identification numbers that have been assigned to them and the conformity assessment activities for which they have been notified. The Commission shall ensure that the list is kept up to date.

RemovedArticle 27 l (new): Article 27l / Changes to notification / 1. Where a notifying authority has ascertained or has been informed that a notified body no longer meets the requirements laid down in Article 27f, or that it is failing to fulfil its obligations as set out in Article 27n, the notifying authority shall restrict, suspend or withdraw the notification, as appropriate, depending on the seriousness of the failure to meet those requirements or fulfil those obligations. It shall immediately inform the Commission and the other Member States accordingly. / 2. In the event of restriction, suspension or withdrawal of notification, or where the notified body has ceased its activity, the notifying authority shall take appropriate steps to ensure that the files of that body are either processed by another notified body or kept available for the responsible notifying and market surveillance authorities at their request.

RemovedArticle 27 m (new): Article 27m / Challenge of the competence of notified bodies / 1. The Commission shall investigate all cases where it has doubts, or a doubt is brought to its attention, regarding the competence of a notified body or the continued fulfilment by a notified body of the requirements and responsibilities to which it is subject. / 2. The notifying authority shall provide the Commission, on request, with all information relating to the basis for the notification or the maintenance of the competence of the notified body concerned. / 3. The Commission shall ensure that all sensitive information obtained in the course of its investigations is treated confidentially. / 4. Where the Commission ascertains that a notified body does not meet or no longer meets the requirements for its notification, it shall adopt an implementing act requesting the notifying authority to take the necessary corrective measures, including the withdrawal of the notification if necessary. / That implementing act shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

RemovedArticle 27 n (new): Article 27n / Operational obligations of notified bodies / 1. A notified body shall carry out conformity assessments in accordance with the conformity assessment procedures set out in Article 27a. / 2. A notified body shall perform its activities in a proportionate manner, avoiding an unnecessary burden for economic operators, and taking due account of the size of an undertaking, the structure of the undertaking, the degree of complexity of the EHR system in question. In so doing, the notified body shall nevertheless respect the degree of rigour and the level of protection required for the compliance of the EHR system with the requirements of this Regulation. / 3. Where a notified body finds that the harmonised standards or common specifications referred in this Regulation have not been met by a manufacturer, it shall require the manufacturer to take appropriate corrective actions and shall not issue an EU type-examination certificate. / 4. Where, in the course of the monitoring of conformity following the issuance of a certificate of conformity or the adoption of an approval decision, a notified body finds that an EHR system no longer complies, it shall require the manufacturer to take appropriate corrective measures and shall suspend or withdraw the certificate of conformity or the approval decision, if necessary. / Where corrective measures are not taken or do not have the required effect, the notified body shall restrict, suspend or withdraw any certificates of conformity…

RemovedArticle 27 o (new): Article 27o / Appeals against decisions of notified bodies / A notified body shall ensure that a transparent and accessible appeals procedure against its decisions is available.

RemovedArticle 27 p (new): Article 27p / Information obligation on notified bodies / 1. A notified body shall inform the notifying authority of the following: / (a) any refusal, restriction, suspension or withdrawal of a certificate of conformity or approval decision; / (b) any circumstances affecting the scope of, or the conditions for, its notification; / (c) any request for information which it has received from market surveillance authorities regarding its conformity assessment activities; / (d) upon request, any conformity assessment activities performed within the scope of its notification and any other activity performed, including cross-border activities and subcontracting.

RemovedArticle 27 q (new): Article 27q / Coordination of notified bodies / The Commission shall ensure that appropriate coordination and cooperation between notified bodies are put in place and properly operated in the form of a sectoral group of notified bodies. / Notified bodies shall participate in the work of that group, directly or by means of designated representatives.

RemovedArticle 27 r (new): Article 27r / Exchange of experience / The Commission shall provide for the organisation of exchange of experience between the Member States' national authorities responsible for notification policy.

RemovedArticle 28 – paragraph 2: 2. Member States shall designate the market surveillance authority or authorities responsible for the implementation of this Chapter. They shall entrust their market surveillance authorities with the necessary powers, financial resources, equipment, technical expertise, adequate staffing, and knowledge necessary for the proper performance of their tasks pursuant to this Regulation. Member States shall communicate the identity of the market surveillance authorities to the Commission which shall publish a list of those authorities.

RemovedArticle 28 – paragraph 2 a (new): 2a. Staff of market surveillance authorities shall have no direct or indirect economic, financial or personal conflicts of interest that might be considered prejudicial to their independence and, in particular, they shall not be in a situation that may, directly or indirectly, affect the impartiality of their professional conduct.

RemovedArticle 28 – paragraph 2 b (new): 2b. Pursuant to paragraph 2 of this Article, Member States shall determine and publish the selection procedure for market surveillance authorities. They shall ensure that the procedure is transparent and does not allow for conflicts of interest.

RemovedArticle 28 – paragraph 4 a (new): 4a. Market surveillance authorities shall immediately inform notified bodies about manufacturers of EHR systems that no longer comply with the requirements on the declaration of conformity.

RemovedArticle 28 – paragraph 4 b (new): 4b. When a manufacturer or, pursuant to Article 21, another economic operator fails to cooperate with market surveillance authorities or if the information and documentation provided is incomplete or incorrect, market surveillance authorities shall take all appropriate measures to prohibit or restrict the relevant EHR system from being available on the market until the manufacturer cooperates or provides complete and correct information, or to withdraw it from the market or to recall.

RemovedArticle 29 – paragraph 1: 1. Where a market surveillance authority of one Member State has a reason to believe that an EHR system presents a risk to the health, safety or rights of natural persons, to the protection of personal data it shall carry out an evaluation in relation to the EHR system concerned covering all relevant requirements laid down in this regulation. Its authorised representatives and all other relevant economic operators shall cooperate as necessary with the market surveillance authorities for that purpose and take all appropriate measures to ensure that the EHR system concerned no longer presents that risk when placed on the market to withdraw the EHR system from the market or to recall it within a reasonable period. / The market surveillance authorities shall inform the relevant notified body accordingly.

RemovedArticle 29 – paragraph 1 a (new): 1a. Where the market surveillance authorities consider that non-compliance is not restricted to their national territory, they shall inform the Commission and the other Member States of the results of the evaluation and of the actions which they have required the economic operator to take.

RemovedArticle 29 – paragraph 1 b (new): 1b. Where a market surveillance authority considers or has reason to believe that an EHR system has caused damage to the health or safety of natural persons or to other aspects of public interest protection, it shall immediately provide information and documentation, as applicable, to the affected person or user and, as appropriate, other third parties affected by the damage caused to the person or user, without prejudice to data protection rules.

RemovedArticle 29 – paragraph 3: 3. The market surveillance authority, or, where applicable, the supervisory authority under Regulation (EU) 2016/679, shall immediately inform the Commission and the market surveillance authorities, or, if applicable, the supervisory authorities under Regulation (EU) 2016/679, of other Member States of the measures ordered pursuant to paragraph 1. That information shall include all available details, in particular the data necessary for the identification of the EHR system concerned, the origin and the supply chain of the EHR system, the nature of the risk involved and the nature and duration of the national measures taken.

RemovedArticle 29 – paragraph 3 a (new): 3a. Where a finding of a market surveillance authority, or a serious incident it is informed of, concerns personal data protection, the market surveillance authority shall immediately inform and cooperate with the relevant supervisory authorities under Regulation (EU) 2016/679.

RemovedArticle 29 – paragraph 4 – subparagraph 1: Manufacturers of EHR systems placed on the market shall report any serious incident involving an EHR system to the market surveillance authorities, or, in cases involving personal data, the supervisory authorities under Regulation (EU) 2016/679 of the Member States where such serious incident occurred and the corrective actions taken or envisaged by the manufacturer.

RemovedArticle 29 – paragraph 4 – subparagraph 2: Such notification shall be made, without prejudice to incident notification requirements under Directive (EU) 2016/1148, immediately after the manufacturer has established a causal link between the EHR system and the serious incident or the reasonable likelihood of such a link, and, in any event, not later than 7 days after the manufacturer becomes aware of the serious incident involving the EHR system.

RemovedArticle 29 – paragraph 5: 5. The authorities referred to in paragraph 4 shall inform the other authorities, without delay, of the serious incident and the corrective action taken or envisaged by the manufacturer or required of it to minimise the risk of recurrence of the serious incident.