Opportunities and Risks in the Monitoring of Medical Product Supply Chains

published on 25 October 2023 | reading time approx. 5 minutes

Medical products are generally the result of complex international supply and goods chains before they are manufactured, distributed, purchased and used by German companies or other healthcare providers such as hospitals and care facilities.

• Applicability »

• Regulatory content »

• Risks »

• Opportunities »

With the German Supply Chain Due Diligence Act (“Lieferkettensorgfaltspflichtengesetzes” – LkSG) – also known as the "Supply Chain Act" (“Lieferkettengesetz“) for short – coming into force on 1 January 2023, the question arises in the medical products industry to what extent supply chains should be monitored and controlled. This issue is gaining enormous importance, especially due to the European Supply Chain Directive planned for this year, which will create a uniform regulation for all EU member states.

Therefore, the following article examines the regulations of the German Supply Chain Act and its impact on the actors of the medical products sector as well as healthcare.

Applicability

The regulations of the Supply Chain Act apply to all companies, irrespective of their legal form, which have their head office, principal place of business, administrative headquarters or registered office in Germany and generally employ at least 3,000 employees in Germany. This also includes employees seconded abroad.

Companies whose head office is located abroad but which have a branch office in Germany and employ at least 3,000 employees in the domestic market must also observe the Supply Chain Act.

The German medical technology sector is especially dominated by medium-sized companies (Lieferkettengesetz: Was Deutschland fordert und was die EU vorbereitet; Zahlen, Fakten & Publikationen.). These were not yet affected by the requirements of the Supply Chain Act. However, as of 1 January 2024, companies with more than 1,000 employees will also have to fulfil the requirements of the Supply Chain Act, so that the monitoring of supply chains will also become an important issue in these companies.

Regulatory content

The aim of the Supply Chain Act is to ensure that companies take responsibility for fulfilling human rights and safeguarding environmental concerns along their supply chains. In this way, human rights or environment-related risks should be avoided or minimized, and violations of human rights-related or environment-related obligations should be stopped.  

In order to enforce the latter, the Supply Chain Act constitutes several due diligence obligations.  

For example, companies must:

• set up a risk management system, for instance by appointing a human rights officer (§ 4 para.   1 LkSG),
• conduct regular risk analyses (§ 5 LkSG),
• carry out preventive measures in its own business area and toward direct suppliers (§ 6 LkSG),
• set up complaint procedures (§ 8 LkSG)
• and implement due diligence concerning risks at indirect suppliers (§ 9 LkSG).

The scope of the due diligence obligations is determined by the definition of the term "supply chain", which is interpreted broadly. It means "the service produced by a company and covers all steps that are necessary in Germany and abroad for the manufacture of a product or the provision of a service, such as the transport or intermediate storage of goods" (RegE BT-Drucksache 19/28649 dated 19 April 2021, p. 40).

These obligations must be complied with in the company's own business area, but also guaranteed for the actions of a direct business partner in the supply chain as well as other indirect suppliers. The company's own business area includes each activity of the company to achieve the company's objective (Hopt/Leyens, 42nd edition 2023, LkSG § 2 margin no. 11). Therefore, as a result, all areas that affect the company's business activities and objectives are relevant.

For example, when treating a patient using certain medical devices – such as a cardiac catheter – clinic operators must select suppliers based on human rights and environmental aspects within the scope of their purchasing activities and, if necessary, contractually ensure the supplier's compliance with human and environmental rights (§ 6 para. 4 no. 1 - no. 2 LkSG). Direct suppliers of the clinics in the sense of the LkSG are companies that supply medical products, semi-finished products, product parts or raw materials and with whom a direct contractual relationship exists. The risk analysis required by the LkSG must be carried out regularly for direct suppliers. In contrast, indirect suppliers – i.e. those with whom there is no contractual relationship – are subject to an ad hoc risk analysis obligation.
 
However, the LkSG does not only affect the area of services provided by the hospitals themselves. If a hospital uses a service – such as building cleaning and the running of a canteen – its providers must also be examined and evaluated as part of a risk analysis (Urband/Wollin, Das Krankenhaus, 12.2022, 1144-1147 (1146).

Risks

Violation of the duties of due diligence according to the LkSG does not cause any civil liability (§ 3 para. 3 LkSG). According to the German government's draft bill, the law establishes a "duty of effort" and "no duty to succeed or guarantee liability" (RegE BT-Drucksache 19/28649 dated April 19, 2021, p. 2). Companies "only" have to prove that they have implemented the due diligence requirements provided for by law. In contrast, they do not have to guarantee that human rights or environmental obligations are not violated in their supply chains (RegE BT-Drucksache 19/28649 vom 19.04.2021, p. 41).

The Federal Office of Economics and Export Control (Bundesamt für Wirtschaft und Ausfuhrkontrolle) checks whether the Supply Chain Act is being complied with and enforced (§ 19 LkSG). If companies fail to fulfil their due diligence obligations set out under the LkSG, sanctions in the form of fines will follow (cf. § 24 LkSG). A fine up to 800,000 euros can be imposed on natural persons. A violation by a legal person or association of persons with an average annual turnover of more than 400 million euros can be sanctioned by a fine of up to 2 percent of the average annual turnover. Consequently, a fine of up to EUR 8 million could be imposed on a turnover of EUR 400 million.

Another challenge for companies in the medical device and medical technology industry is the application of additional regulations that are intended to ensure the quality and safety of products. These include, for example, the provisions of ISO 13485 and the European Medical Device Regulation (MDR) as well as the German Medical Device Law Implementation Act (Medizinprodukte-Durchführungsgesetz, MPDG). The MDR, for example, requires risk assessment and analysis, as well as supply chain monitoring. Companies must ensure that all suppliers involved in the production of medical devices meet the requirements of the MDR.

Opportunities

The Supply Chain Act does not lay down rigid rules on how companies should fulfil their due diligence obligations. Rather, they are given wide latitude in implementation.

The compliance of due diligence is limited to what is individually possible and reasonable for the respective company (RegE BT-Drucksache 19/28649 dated 19.4.2021, p. 41; Hopt/Leyens, 42nd edition 2023, LkSG § 3 margin no.  2). Reasonableness depends on various criteria, such as the type and scope of business activity, the company's ability to influence the direct perpetrator of a human rights or environmental risk, the severity of the violation that can typically be expected, and the nature of the company's contribution to the human rights or environmental risk (cf. § 3 para. 2 LkSG).

To implement a process that creates the introduction and enforcement of the measures required under the LkSG, “compliance” will gain enormous importance in the company. Every company in the healthcare and medical technology sector will be encouraged to strengthen and expand its compliance department. This will intensify the awareness of human rights and environmental concerns of the employees within the company.  

In addition, a company becomes more attractive to potential new employees and customers if it makes a serious effort to ensure that certain standards are fulfilled in its choice of suppliers.

At the same time, companies – especially those whose business activities are characterized by a complex and multi-layered supply chain – have the opportunity to drive forward internal digitization in order, for example, to simplify and accelerate the obligation to conduct risk analysis constituted by the LkSG.

Even if the enforcement of due diligence obligations in a company initially causes an enormous amount of work as well as high costs, its overall competitiveness will be strengthened in the long term.

Fulfilling all the regulatory requirements, which apply in particular to medical devices, within the company itself, complying with them and monitoring them for the entire supply chain is a major challenge. Enforcing the due diligence requirements of the LkSG involves immense effort and expense. In the long term, however, the competitiveness of German companies in the medical device industry and the healthcare sector will increase – especially considering the adoption of a European Supply Chain Directive.