EU MDR regulatory readiness for medical devices

The EU MDR is Regulation (EU) 2017/745, applicable since 26 May 2021, with transitional extensions introduced by Regulation (EU) 2023/607 (e.g., staggered deadlines through 2027–2028 for eligible legacy devices and removal of sell-off dates). Oversight is shared: the European Commission (DG SANTE) issues implementing/delegated acts and maintains EUDAMED; Medical Device Coordination Group (MDCG) publishes guidance; Member State Competent Authorities enforce locally; and Notified Bodies (NBs) designated to MDR perform conformity assessments. Key pillars include Annex I General Safety and Performance Requirements (GSPR), Annex II/III Technical Documentation, Annex VIII classification rules, Article 61 and Annex XIV clinical evaluation/PMCF, Articles 83–86 PMS/PSUR, Article 87–92 vigilance, Article 11 Authorized Representative, Articles 13–14 importer/distributor obligations, Article 15 PRRC, and Article 27–31 UDI/EUDAMED. EUDAMED consists of six modules (Actor, UDI/Devices, Certificates/NB, Vigilance, Clinical Investigations, Market Surveillance). As of 2026, Actor and several other modules are operational; full mandatory use will begin after the Commission confirms readiness; until then, national provisions can apply for vigilance and registrations. MDCG guidance (e.g., MDCG 2020-5/6/13 for clinical evaluation, MDCG 2019-16 rev.1 for cybersecurity for medical device software) is influential in NB reviews. Manufacturers outside the EU must mandate an EU Authorized Representative (AR) under Article 11; AR and importers/distributors are economic operators with defined obligations and traceability duties.

Classification follows Annex VIII rules, based on intended purpose and inherent risks: Class I (including Is sterile, Im measuring, Ir reusable surgical instruments), Class IIa, Class IIb, and Class III. Software is typically classified under Rule 11: software providing information for diagnostic/therapeutic decisions is IIa, up-classified to IIb/III when such decisions may cause serious deterioration or death; software for monitoring physiological processes may be IIa/IIb per risk. Other notable rules include Rule 8 (implantables and long-term surgically invasive devices), Rule 9–10 (active therapeutic/diagnostic devices), Rule 19 (nanomaterials), and Rule 21 (substances absorbed/locally dispersed). Borderline cases require careful parsing of definitions, duration of use, and invasiveness; MDCG borderline manuals and NB position papers can guide. Misclassification is a leading cause of NB delays because it drives the conformity route, clinical evidence depth, PMCF expectations, and PSUR cadence. Document a defensible classification rationale, including intended use statements, risk-benefit, and rule-by-rule analysis, and ensure consistency across labelling, IFU, and technical documentation.

Conformity routes depend on class. Class I (non-sterile, non-measuring, non-reusable surgical instruments) may self-declare after compiling Technical Documentation (Annex II/III) and ensuring QMS per Article 10(9). Class Is/Im/Ir and Classes IIa/IIb/III require a Notified Body. Common routes include Annex IX (full QMS assessment with product assessment/sampling), Annex X (type examination) combined with Annex XI (production quality assurance) or with Annex IX Chapter II. Steps typically are: (1) Appoint an EU Authorized Representative (if manufacturer is outside the EU) and obtain SRN via EUDAMED Actor registration; (2) Finalize device intended purpose, classification, and Basic UDI-DI strategy; (3) Select/designate an NB with the right codes and submit application; (4) Compile Technical Documentation (Annex II/III), including: device description, GSPR checklist with evidence, risk management file, verification/validation (bench, biocompatibility, electrical safety/EMC, usability), clinical evaluation (Article 61, Annex XIV; per MDCG 2020-5/6/13), PMS/PMCF plans, UDI assignment, labelling per Annex I §23; (5) Undergo QMS audit and technical review; (6) Address NB findings (CAPA), receive CE certificate (max 5-year validity), issue EU Declaration of Conformity, affix CE mark with NB number, and register in EUDAMED/national databases as applicable. Expect NB surveillance annually and potential unannounced audits (typically at least once in a five-year cycle). Importers and distributors must perform checks (Articles 13–14) including CE mark presence, UDI, language compliance, and traceability. During 2026, transitional provisions (Reg. 2023/607) may apply to eligible legacy devices if preconditions (e.g., NB application/QMS) are met.

Article 10(9) requires a QMS covering all MDR processes: strategy for compliance, post-market surveillance, clinical evaluation plans/reports, UDI, handling of CAPA and vigilance, supplier control, and change management. Harmonized EN ISO 13485:2016+A11:2021 provides presumption of conformity for many QMS elements, but MDR adds requirements: PRRC appointment (Article 15); economic operator controls (Articles 11, 13, 14); PMS/PMCF (Articles 83–86, Annex XIV Part B); SSCP for class III and implantables (Article 32); and documented GSPR compliance (Annex I). Risk management must follow EN ISO 14971:2019+A11:2021 and integrate usability (IEC 62366-1) and, for software, IEC 62304 lifecycle plus MDCG 2019-16 rev.1 cybersecurity expectations. Manufacturers should maintain DHF/DMR/DHR-like constructs to ensure end-to-end traceability from design inputs to production records and field performance. Internal audits, management review, and competence/training must reflect MDR scope, including language/label processes and vigilance roles. MDSAP can streamline multi-market surveillance but does not replace MDR NB audits.

Under Articles 27–31 and Annex VI Part C, assign a Basic UDI-DI (referenced on the DoC/CE certificates) and a device-level UDI-DI with production identifiers (UDI-PI). Issuing entities designated by the Commission include GS1, HIBCC, ICCBBA, and IFA GmbH. Place the UDI carrier (AIDC/HRI) on the label and all higher packaging levels; apply direct marking for reusable devices, unless an exception applies. Register devices and UDIs in EUDAMED’s UDI/Devices module where required/available; until full EUDAMED is mandatory, some Member States maintain national databases. Labels/IFU must comply with Annex I §23: CE mark, NB number (if applicable), manufacturer and EU AR details (when outside EU), UDI, warnings, sterile state, lot/serial, and symbols per harmonized standards. Importers must add their name and address on the device or packaging. Language: provide label/IFU translations required by each Member State where the device is marketed; importers/distributors must verify language compliance, and any translations/relabelling activities must be controlled and traceable. For implantables and class III, the SSCP must be prepared and uploaded for public access in EUDAMED.

PMS is proactive (Articles 83–86): establish a PMS plan (Annex III) coordinating complaint handling, literature review, registries, and CAPA triggers. Class I requires a PMS Report (Article 85); Class IIa/IIb/III require a PSUR (Article 86): at least annually for IIb/III and at least every two years for IIa; make PSURs available to NBs (and via EUDAMED where applicable). PMCF (Annex XIV Part B) refines clinical evidence in real-world use; its findings feed the Clinical Evaluation Report (CER). Vigilance: report serious incidents and field safety corrective actions (FSCA) to Competent Authorities via EUDAMED (module availability permitting) within 2 days for public health threats, 10 days for death/unanticipated serious deterioration, and 15 days for others; issue Field Safety Notices (FSN) to users. Trend reporting is required when significant increase in non-serious incidents or expected adverse events is detected. Importers/distributors must forward complaints and vigilance information upstream promptly and cooperate in FSCA execution. Maintain SSCP updates for implantables/Class III. Robust signal detection, benefit–risk re-evaluation, and CAPA closure evidence are central in NB surveillance.

Days 0–30: Establish governance. Confirm intended purpose and Annex VIII classification; appoint EU Authorized Representative (if outside EU) and secure SRN via EUDAMED Actor module. Select NB (verify MDR codes/scope), request application slots, and agree on timelines. Draft Basic UDI-DI strategy. Launch MDR gap assessment against Article 10(9), Annex I GSPR, Annex II/III; map existing ISO 13485/14971 artifacts; define missing testing (bench/biocomp/EMC/usability/software). Days 31–60: Build the Technical Documentation backbone: device description, GSPR checklist with evidence plan, risk management plan/report, verification/validation protocols, Clinical Evaluation Plan (per MDCG 2020-5/6/13), PMCF plan (Annex XIV-B), PMS plan (Annex III), labelling/IFU drafts with language strategy, economic operator controls (AR/importer/distributor). Days 61–90: Execute testing and close gaps; finalize CER drafts, UDI assignment and label artworks; prepare SSCP draft (if applicable). Update QMS procedures for vigilance, PSUR, translations, and supplier controls; train personnel; perform internal audit. Days 91–120: Lock Annex II/III files; complete DoC template; compile NB application dossier including QMS scope and product evidence; confirm NB sampling plan (Annex IX 2.3) for multi-variant families. Days 121–150: Address pre-assessment questions; remediate findings via CAPA; prepare on-site audit logistics; ensure importer/distributor verification procedures are live. Days 151–180: Submit final responses; rehearse audit; verify EUDAMED/national registrations plan; freeze release documentation and CE marking implementation plan.