Breach of Medical Device Laws in Europe: Will Your QA/RA SOPs Help Avoid Sanctions for Fraud?

We are often asked what the sanctions are that might be imposed if a CE mark and / or, in Great Britain, the UK CA mark, is applied when the underlying documentation for the medical device or IVD medical device does not support that application of the mark.  In both cases, this will mean that the declaration of conformity of the device with the applicable laws signed by an individual on behalf of a corporate legal manufacturer is also not supported by documents.  Application of a “trust mark” in this situation breaches the regulations under which it is applied and is a serious matter because of the potential to breach the trust placed in the mark for all products.

In this article we consider a recent case in Manchester, England in which a CE mark was applied without the requisite documentation and evidence being in place.  In that case the director of the company received a criminal sentence, and the company is subject to confiscation proceedings and further criminal sanctions yet to be determined.  Both the director and the company were found guilty of fraud based on the false application of CE marks to the devices.  

We also discuss the UK’s Economic Crime and Corporate Transparency Act 2023 (ECCTA) and the steps that medical device manufacturers might take to put themselves in the best position to take advantage of the complete defense to an allegation of “failure to prevent fraud” under the ECCTA as it relates to their regulatory activities and the application of a “trust mark”.

Enforcement

In the EU, enforcement of breaches of the medical device regulations is within the remit of national authorities of each member state. In the UK it is the Medicines and Healthcare Regulatory Authority (MHRA) that is responsible for enforcement action. For CE marked devices sold across the EU and the UK, there is therefore potential for multiple enforcement actions where the breach occurs in devices distributed in several countries. 

Enforcement authorities in the EU impose both criminal and administrative sanctions, from fines to imprisonment.  Sanctions also include debarment of the company from future procurements.  The size of the fines can vary from small sums, but imposed for each non-compliant device, to a single fine of several millions.  Fines can be imposed on manufacturers as a legal entity, but individuals and particularly directors complicit in or wilfully blind to the unlawful activity might also be fined and potentially imprisoned.  Fines are generally, but not always, higher in situations where the risks to human health are greater.

Defining the breach under laws of the EU and UK

Under EU law a “falsified device” means any device with a false presentation of its identity and/ or source and/ or its CE marking certificates or documents relating to CE marking procedures.  But the definition notably does not include “unintentional non-compliance” (1).

Current UK law does not include a definition of “falsified device”, but instead includes a list of provisions, a breach of each of which constitutes a criminal offence (2).  Those provisions include applying a CE mark or UK CA mark where this is not warranted by the underlying documents, so essentially similar to a falsified device under EU law, although without the “unintentional non-compliance” exception.  Instead, it is a defence under UK law to show that “the person took all reasonable steps and exercised all due diligence to avoid commission of the offence”.  These are different tests. 

Interpretation of the EU test, showing that non-compliance was unintended, will depend upon the jurisprudence of the enforcing jurisdiction.  This could mean that a well-meaning but not intentionally negligent person might avoid liability.  In the UK, for the defence to apply, proof of proactivity is required – necessitating some diligence so that a well-meaning but negligent person who is unable to show that they had taken “all reasonable steps” to avoid the breach, would not benefit from the UK defence under the medical device laws. 

A not uncommon situation is one in which a person vaguely understands that the underlying documents do not wholly support the declaration of conformity (or they turn a blind eye to this fact), and they then take no steps to remedy the issue.  In some EU member states, it could be successfully argued that the non-compliance was “unintentional” and thus obtain the benefit of the exemption.  The requirement for proactivity under UK law in the same situation would more likely not afford them the benefit of the defense under UK law.

UK criminal case

In the case against Mr. Harrison and his company Medicina Limited, CE marks had been deliberately and falsely placed on devices used in enteral feeding, and gastrostomy button devices and blunt fill needles. Both Mr Harrison and his company, Medicina Limited were found to have engaged in fraud.  Mr Harrison received a three-year suspended prison sentence, an order to complete 175 hours of community service, ten days of rehabilitation and he has been disqualified from being a company director for eight years.  Medicina Limited is yet to be sentenced.  Confiscation proceedings under the Proceeds of Crime Act have been commenced to recover any available funds from the fraudulent activity. 

How cases roll in the UK

The MHRA, unlike many regulators in continental Europe, works with companies which are endeavoring but failing to be fully compliant, aiming to help those manufacturers to achieve compliance.  Where there is a risk to patients, the MHRA will often require that the device is withdrawn from the market while remediation is undertaken.

Where companies show an intention to comply with regulatory requirements, and comply with the MHRA’s requests, the MHRA has not, to date – where there is not a deliberate intention of noncompliance – pursued criminal action.  In continental Europe enforcement authorities are more likely to move directly to the imposition of fines and other sanctions in the event of a breach of medical device regulations.

The MHRA does though have other potential avenues available to it under the Medicines and Medical Devices Act 2021, which is to impose “civil sanctions”, equivalent to administrative fines on the continent. Those civil sanctions include “monetary penalties” in the event of a breach of any enforcement notice, but the MHRA has not yet implemented this civil sanctions regime.  The MHRA has recently said that they plan to do so “in the near future” (expected 2027) (3).

Application of to reality: fraud

The Harrison/ Medicina Limited case illustrates that the act of adding a CE mark when the underlying documentation is not supportive, if done knowingly (and in this case, intentionally), additionally constitutes a fraudulent act under UK law.  In the ongoing UK case, action is being taken under the Proceeds of Crime Act to recoup some of profits of that activity. 

Economic Crime and Corporate Transparency Act 2023 and medical devices

The matter occurred before the relevant provisions of the Economic Crime and Corporate Transparency Act 2023 (ECCTA) were in force.  This Act adds another potential layer of enforcement action in the UK on the same facts. Section 199 of the ECCTA includes the corporate offence of a “failure to prevent fraud” which benefits (directly or indirectly) the company.  The offence is also made out if an employee commits a fraud offence intending to benefit the company (including the acts of a subsidiary of a parent undertaking).  These provisions have been in force since 1 September 2025.

Fraud is defined in the Fraud Act 2006.  The applicable offence in relation to the false application of a CE or UK CA mark under the Fraud Act 2006 is found in section 2 which sets out the crime of “fraud by false representation”.  For fraud to be found under this section, it requires that a person “dishonestly makes a false representation” “to make a gain for himself or another” or “to cause loss to another or to expose another to a risk of loss” and for that false representation to be:

• as to fact or law;

• express or implied; and

• false, meaning it is:

  • untrue or misleading; and

  • the person making it knows that it is, or might be, untrue or misleading.

On the facts of the Harrison/ Medicina case, or indeed the scenario of an employee signing-off a declaration of conformity knowing that the declaration they are making is not true, or being aware after its signature, that the declaration is no longer true, which then means that the application of the CE/ UKCA mark to the devices becomes a false indication of compliance with the applicable laws, breaching the implied representation of such compliance. This is misleading to purchasers and users, benefitting the company via profitable sales.  Depending on the nature of the non-compliance, the company could also cause a loss or a risk of loss to users of the device. 

For the criminal offence of fraud to be made out, it is necessary to show “dishonesty”, which is based on a two-limb common law test (4):

• subjective test: ascertain the actual knowledge or belief of the individual or defendant as to the facts;

• objective test: ascertain whether the individual or defendant acted dishonestly according to the objective standers of ordinary decent people.

A jury faced with patients injured by a medical device for which a trust mark was applied without the supporting documents and in the face of evidence of “knowledge” of the defendant might be minded to decide that an “ordinary decent person” would not have continued to add the mark and sell the products based on that information.

Defence under the ECCTA

It is a complete defence under the ECCTA (5) if at the time of the fraud offence, the body had in place at the relevant time, “procedures as it was reasonable in all the circumstances to expect the body to have in place”.  These procedures are defined as “procedures designed to prevent persons associated with the body from committing fraud offences”.  Medical device companies should have in place standard operating procedures (“SOPs”) to ensure that:

• any potential for device documentation not to meet legal requirements is promptly brought to the attention of management; and

• that management and their QA/ RA teams are properly trained and equipped to review, consider and address such failures.

In addition, reporting these serious failures based on new information to the appropriate authorities as required under applicable medical device laws and, if necessary, ceasing to place the product on the market in the interim could also mean that, no “dishonest intention” might be proven for the historic sales, and the fraud offence would also then be avoided in relation to subsequent sales.

Conclusion

There are several mechanisms in the UK pursuant to which applying a CE or UKCA mark to a medical device or IVD medical device might be sanctioned.  These include:

• criminal offences under the UK Medical Devices Regulations 2002;

• in the future (likely 2027) civil sanctions under the Medicines and Medical Devices Act 2021;

• fraud under the Fraud Act 2006; and

• for companies a “failure to prevent fraud” under the ECCTA.

Medical device companies are used to having in place codes, policies and procedures for anti-bribery offences, particularly relevant to be able to claim the UK Bribery Act 2010 defense of “adequate procedures”.  The potential for liability under the ECCTA for “failure to prevent fraud”, and the complete defence under that legislation of “reasonable procedures” means that similar defensive actions are worthwhile in the QA/ RA teams.

Medical device companies would be well advised to have in place policies and procedures designed to ensure that CE or UKCA marks are not applied to medical devices in breach of the underlying medical device laws, and that there are effective reporting mechanisms should this be discovered.  Thereafter, companies should have the means to make prompt decisions to bring any such activity rapidly to an end.

Subscribe to Ropes & Gray Viewpoints by topic here.