CE Marking for Medical Devices: Requirements, Process, and Conformity Assessment Under EU MDR

What Is CE Marking for Medical Devices?

CE marking — the letters stand for Conformité Européenne (European Conformity) — is the manufacturer's declaration that a medical device complies with all applicable requirements of the EU Medical Device Regulation (MDR) 2017/745 or the In Vitro Diagnostic Regulation (IVDR) 2017/746. It is not a quality mark awarded by a government agency. It is a legal obligation placed on the manufacturer as the precondition for placing any medical device on the European market.

The CE mark on a medical device tells regulators, healthcare providers, and patients one thing: the manufacturer has completed the applicable conformity assessment procedure, documented it, and takes legal responsibility for the device's safety and performance. Without the CE mark, a medical device cannot be legally sold, distributed, or put into service anywhere in the European Economic Area (EEA) — which includes all 27 EU member states plus Iceland, Liechtenstein, and Norway. Switzerland and Turkey also recognize CE marking under bilateral agreements.

CE Marking vs. CE Certification — An Important Distinction

These terms are often used interchangeably, but they mean different things.

CE marking is the physical symbol affixed to the device, its packaging, and its instructions for use. It is the visible declaration that conformity has been achieved.

CE certification refers specifically to the process of obtaining an EU certificate of conformity from a Notified Body. This certificate is required for Class IIa, IIb, and III medical devices and for Class B, C, and D IVDs. Class I medical devices that are non-sterile, non-measuring, and non-reusable surgical instruments do not require a Notified Body certificate — the manufacturer self-declares conformity and affixes the CE mark directly.

The distinction matters because every CE-marked device bears the CE symbol, but not every CE-marked device has gone through Notified Body certification. A Class I bandage and a Class III cardiac implant both carry the CE mark, but the conformity assessment process behind each is fundamentally different.

Key point: CE marking is always the manufacturer's responsibility. Even when a Notified Body issues a certificate, it is the manufacturer — not the Notified Body — who draws up the EU Declaration of Conformity and affixes the CE mark. The Notified Body assesses; the manufacturer declares.

Who Needs CE Marking?

CE marking is mandatory for every manufacturer placing a medical device or IVD on the EEA market, regardless of where the manufacturer is based. This includes:

• EU-based manufacturers placing devices directly on the market
• Non-EU manufacturers exporting devices to the EU (must appoint an EU Authorized Representative)
• Private label / OEM arrangements where the entity placing the device on the market under its own name assumes manufacturer obligations

The obligation extends across the entire supply chain. While CE marking is the manufacturer's responsibility, importers must verify that CE marking has been properly applied and that the manufacturer's obligations have been met. Distributors must check that the device bears the CE mark and is accompanied by the required documentation. These are not informal expectations — they are legally binding obligations under Articles 13 and 14 of the MDR.

CE marking applies to all device classes without exception: a simple bandage (Class I), a hearing aid (Class IIa), a ventilator (Class IIb), and a coronary stent (Class III) all require CE marking. What differs is the conformity assessment process behind the mark, not whether the mark is required.

Geographic Scope: Where CE Marking Is Required or Recognized

CE marking is legally required for medical devices placed on the market in the European Economic Area (EEA) — the 27 EU member states plus Iceland, Liechtenstein, and Norway. Beyond the EEA, several countries require or recognize CE marking through bilateral agreements or domestic legislation:

Territory	Status	Basis
EU member states (27)	Mandatory	MDR 2017/745, IVDR 2017/746
Iceland, Liechtenstein, Norway	Mandatory	EEA Agreement
Switzerland	Recognized with conditions	Mutual Recognition Agreement (MRA) — note that the MRA for medical devices has not been updated for MDR; Swiss manufacturers must comply with the Swiss Medical Device Ordinance (MedDO), which largely mirrors the MDR
Turkey	Recognized	Turkish Medical Device Regulation aligned with EU MDR; CE marking accepted for market access
Northern Ireland	Mandatory (CE, not UKCA)	Northern Ireland Protocol — remains under EU regulatory jurisdiction for goods
Great Britain	Accepted under transition	MHRA transitional provisions accept CE-marked devices; see UKCA section below
Many Middle East and North African countries	Widely recognized	Some countries (e.g., Saudi Arabia, UAE) accept CE marking as part of their registration pathway, though additional local registration is typically required

This broad geographic recognition makes CE marking under the MDR one of the most valuable regulatory milestones for medical device manufacturers seeking international market access.

Consequences of Non-Compliance

Placing a medical device on the EU market without valid CE marking — or with improperly applied CE marking — constitutes a serious regulatory violation. Consequences include:

• Market prohibition — the device cannot be legally sold, distributed, or put into service in the EEA
• Product seizure and recall — Competent Authorities can order removal of non-compliant devices from the market, including mandatory recalls
• Financial penalties — EU member states set their own penalty frameworks; fines can be substantial and vary by jurisdiction
• Import refusal — customs authorities at EU borders can detain and refuse entry to devices without proper CE marking
• Certificate suspension or withdrawal — the Notified Body can suspend or withdraw certificates if the manufacturer fails to maintain compliance
• Injunctions and criminal sanctions — in severe cases (e.g., fraudulent CE marking, devices causing patient harm), member states may pursue criminal prosecution under national law
• Reputational damage — non-compliance events are published in market surveillance databases and can trigger coordinated EU-wide enforcement actions through the RAPEX/Safety Gate system

Enforcement trend: Competent Authorities across the EU have significantly increased market surveillance activities since the MDR came into effect. Coordinated EU-wide campaigns now target specific device categories for compliance checks, and the European Commission publishes annual market surveillance reports tracking enforcement actions across member states.

Legal Basis: EU MDR and IVDR

CE marking for medical devices is governed by two regulations that replaced the previous directive-based framework:

Regulation	Scope	Replaced	Date of Application
MDR (EU) 2017/745	Medical devices, active implantable medical devices, certain aesthetic devices (Annex XVI)	MDD 93/42/EEC and AIMDD 90/385/EEC	26 May 2021
IVDR (EU) 2017/746	In vitro diagnostic medical devices	IVDD 98/79/EC	26 May 2022

These are EU regulations, not directives. The distinction is significant: regulations are directly applicable in all member states without national transposition. Every manufacturer, in every country, operates under the same text. This eliminates the inconsistencies that plagued the old directive-based system, where member states could — and did — interpret requirements differently.

What Changed from MDD to MDR

The MDR is not an incremental update to the MDD. It is a fundamentally more demanding regulatory framework:

• Expanded scope. The MDR covers devices without a medical purpose (Annex XVI) — certain aesthetic devices like dermal fillers and non-corrective contact lenses — that were outside the MDD's scope.
• Stricter classification rules. The MDR applies 22 classification rules (vs. 18 under the MDD), with notable up-classifications for software (Rule 11), nanomaterial-containing devices, and devices incorporating substances.
• Mandatory clinical evidence for all classes. The MDD allowed some lower-risk devices to rely primarily on literature and bench data. The MDR requires a clinical evaluation for every device, with clinical investigations for implantable and Class III devices unless equivalence to an existing device can be fully demonstrated.
• Enhanced post-market obligations. The MDR introduces mandatory Post-Market Surveillance Plans, Post-Market Clinical Follow-Up (PMCF), Periodic Safety Update Reports (PSURs), and Summary of Safety and Clinical Performance (SSCP) documents.
• Unique Device Identification (UDI). The MDR mandates a comprehensive UDI system, modeled on but not identical to the FDA's UDI framework.
• EUDAMED. A centralized European database for medical devices — covering device registration, certificates, clinical investigations, vigilance, and market surveillance.
• Person Responsible for Regulatory Compliance (PRRC). Every manufacturer must have a designated PRRC with defined qualifications (Article 15).
• Economic operator obligations. Importers and distributors now have explicit regulatory obligations under the MDR, not just manufacturers and Authorized Representatives.

Why the Transition Happened

The previous directive-based system — the MDD (93/42/EEC) and AIMDD (90/385/EEC) — served Europe for over two decades, but structural weaknesses accumulated to the point where reform was unavoidable:

• The PIP breast implant scandal exposed how a manufacturer could use fraudulent materials while passing Notified Body audits. Roughly 400,000 women worldwide received implants filled with industrial-grade silicone rather than medical-grade silicone.
• Metal-on-metal hip implant failures demonstrated that some high-risk implantable devices reached market with insufficient clinical evidence under the MDD's relatively permissive requirements.
• Inconsistent Notified Body oversight allowed manufacturers to "shop" for the most accommodating NB across member states, since each national Competent Authority applied different levels of scrutiny in designation and monitoring.
• No centralized database meant that traceability, incident tracking, and certificate monitoring were fragmented across national systems with no pan-European visibility.

The MDR and IVDR were designed to address all of these weaknesses. Whether the cure is proportionate to the disease is debated — many manufacturers and industry associations argue the MDR is overly burdensome — but the direction of travel is clear: more evidence, more oversight, more transparency.

Device Classification Under EU MDR

Classification is the single most consequential decision in your CE marking strategy. It determines whether you need a Notified Body, which conformity assessment route applies, what clinical evidence is required, and what post-market obligations you carry. Getting classification wrong means building your entire regulatory submission on the wrong foundation.

The MDR uses a risk-based classification system with four classes, determined by applying 22 rules in Annex VIII:

Class	Risk Level	Examples	Notified Body Required?
Class I	Lowest	Stethoscopes, bandages, hospital beds, tongue depressors, non-invasive examination gloves	No (self-declaration) — unless sterile (Is), measuring (Im), or reusable surgical (Ir)
Class IIa	Low-medium	Hearing aids, dental crowns, ultrasound diagnostic equipment, blood transfusion sets, surgical clamps	Yes
Class IIb	Medium-high	Ventilators, intensive care monitoring equipment, condoms, X-ray machines, surgical lasers, joint replacement implants (some)	Yes
Class III	Highest	Cardiac pacemakers, coronary stents, hip implants, breast implants, drug-eluting devices, total artificial hearts	Yes

Classification Rules at a Glance

Rule Group	Rules	Device Types
Non-invasive devices	Rules 1–4	Wound dressings, collection devices, fluid channeling devices, devices modifying biological/chemical composition
Invasive devices	Rules 5–8	Body orifice devices, surgically invasive devices (transient, short-term, long-term), implantable devices
Active devices	Rules 9–13	Therapeutic devices, diagnostic devices, devices administering/exchanging energy, software, active devices with diagnostic function
Special rules	Rules 14–22	Contraceptives, disinfectants, devices with human/animal tissues, nanomaterials, substance-administering devices

Rule 11: Software Classification

Rule 11 deserves special attention because it has caused the most up-classifications from the MDD to the MDR. Under Rule 11, standalone software (Software as a Medical Device, or SaMD) is classified based on the clinical impact of the information it provides:

• Class III — if the decision could cause death or irreversible deterioration of health
• Class IIb — if the decision could cause serious deterioration of health or a surgical intervention
• Class IIa — all other diagnostic/therapeutic decision software
• Class I — software for informational purposes that does not drive clinical decisions

Many software manufacturers who were Class I under the MDD found themselves reclassified to Class IIa or IIb under the MDR, requiring Notified Body involvement for the first time.

December 2025 update: The European Commission's December 2025 proposal to simplify the MDR includes amendments to Rule 11 that would potentially allow a broader range of medical device software to fall under Class I, reducing the Notified Body burden. This proposal is currently going through the ordinary legislative process and is not expected to become binding until late 2026 at the earliest.

Class I Subclasses

Not all Class I devices are equal. The MDR defines subclasses that trigger limited Notified Body involvement:

Subclass	Description	Notified Body Scope
Class I (standard)	Non-sterile, non-measuring, non-reusable surgical	None — self-declaration
Class Is	Devices supplied in a sterile condition	NB assesses sterile manufacturing aspects
Class Im	Devices with a measuring function	NB assesses metrological aspects
Class Ir	Reusable surgical instruments	NB assesses reprocessing aspects

For these subclasses, the Notified Body reviews only the specific regulated characteristic — not the entire technical documentation. But the manufacturer still needs to engage a Notified Body, which means selection, application, and audit scheduling.

Conformity Assessment Routes by Device Class

Article 52 of the MDR defines which conformity assessment procedures apply to each device class. The available routes involve three annexes:

• Annex IX — Conformity assessment based on a quality management system (QMS) and assessment of technical documentation
• Annex X — Conformity assessment based on type examination
• Annex XI — Conformity assessment based on product conformity verification

MDR Conformity Assessment Options

Device Class	Available Routes	What the Notified Body Does
Class I (non-sterile, non-measuring, non-reusable surgical)	Self-declaration per Article 19. Maintain technical documentation per Annexes II and III.	None.
Class Is / Im / Ir	Self-declaration + Notified Body involvement for specific aspects under relevant sections of Annex IX or XI.	Reviews only sterile manufacturing, measuring function, or reprocessing aspects.
Class IIa	Option 1: Annex IX, Chapters I and III (QMS + technical documentation sampling). Option 2: Annex XI, Section 10 (product verification on a sampling basis).	Full QMS audit. Technical documentation reviewed on a representative sampling basis.
Class IIb	Option 1: Annex IX, Chapters I and II (QMS + full technical documentation assessment). Option 2: Annex X + Annex XI, Part A (type examination + production quality assurance). Option 3: Annex X + Annex XI, Part B (type examination + product verification).	Full QMS audit + full technical documentation review for at least one device per generic device group.
Class III	Option 1: Annex IX, Chapters I and II (QMS + individual technical documentation assessment for each device). Option 2: Annex X + Annex XI, Part A (type examination + production quality assurance).	Full QMS audit + individual technical documentation review for every device. Scrutiny procedure applies for implantable devices (Article 54).

Annex IX — The Most Common Route

The vast majority of manufacturers choose Annex IX because it combines QMS assessment and technical documentation review in a single, integrated process. Under Annex IX:

1. The Notified Body audits the manufacturer's quality management system (Chapter I)
2. The Notified Body assesses the technical documentation (Chapter II for Class IIb and III; Chapter III for Class IIa on a sampling basis)
3. If both assessments are satisfactory, the NB issues two certificates: one for the QMS and one for the technical documentation

This is the most efficient route for manufacturers with an established QMS because it avoids the fragmented approach of combining Annex X (type examination) with Annex XI (product verification).

For Class IIa devices under Annex IX, the Notified Body reviews technical documentation on a sampling basis — it selects representative devices from each generic device group rather than reviewing every device individually. For Class IIb and III, the technical documentation review is more comprehensive: at least one device per generic device group for Class IIb, and every individual device for Class III.

The practical implication: if you have a portfolio of related Class IIa devices (e.g., several variants of a surgical instrument), the NB may initially review only one or two representative devices. But it can request additional documentation for any device in the group at any time during surveillance.

Annex X — Type Examination

Annex X involves submitting a representative sample (a "type") of the device to the Notified Body for examination. The NB evaluates the technical documentation, verifies that the type was manufactured in accordance with it, and issues an EU type-examination certificate. This route is less common because it must be combined with either Annex XI Part A or Part B for production control.

Annex XI — Product Conformity Verification

Annex XI covers two approaches: Part A (production quality assurance) requires the manufacturer to have a QMS for production, and the NB audits it. Part B (product verification) means the NB examines and tests each product or a statistical sample against the type described in the Annex X certificate.

The Scrutiny Procedure (Article 54)

For Class III implantable devices and certain Class IIb active devices that administer or remove a medicinal product, the MDR introduces an additional oversight layer. After the Notified Body completes its assessment and is satisfied, it must notify the relevant Competent Authority and provide the clinical evaluation assessment report. The Competent Authority — and in some cases, EU expert panels — can review and comment on the assessment before a certificate is issued.

This scrutiny procedure can add several months to the certification timeline and is unique to the MDR.

Step-by-Step CE Marking Process

Here is the structured process to obtain CE marking for a medical device under the MDR. The steps are presented in logical sequence, though several can run in parallel.

Step 1: Identify the Applicable Regulatory Framework

Determine whether your device falls under EU MDR 2017/745 (medical devices) or EU IVDR 2017/746 (in vitro diagnostics). Review the scope and exclusions in Article 1 of each regulation. Some products — such as custom-made devices, devices for clinical investigation, or devices manufactured and used within a single health institution — have modified requirements.

Step 2: Classify Your Device

Apply the 22 classification rules in Annex VIII of the MDR (or the 7 rules in IVDR Annex VIII for IVDs). Classification is based on the device's intended purpose, invasiveness, duration of contact, active/non-active nature, and whether it incorporates substances, tissues, or nanomaterials.

If there is ambiguity — and there often is, particularly for combination products and software — engage your Notified Body or Competent Authority early. The classification decision drives everything downstream.

Step 3: Appoint a Person Responsible for Regulatory Compliance (PRRC)

Under Article 15, every manufacturer must have at least one PRRC within the organization. The PRRC must possess:

• A formal qualification in law, medicine, pharmacy, engineering, or another relevant scientific discipline, plus at least one year of professional experience in regulatory affairs or QMS for medical devices, or
• Four years of professional experience in regulatory affairs or QMS for medical devices

The PRRC is responsible for ensuring that technical documentation and the Declaration of Conformity are drawn up and maintained, that PMS obligations are fulfilled, that reporting obligations are met, and — for investigational devices — that the required statements are issued.

Small and micro enterprises may use an external PRRC, but the person must be permanently and continuously at their disposal under a written agreement.

Step 4: Implement a Quality Management System

The MDR requires manufacturers to establish, document, implement, maintain, and keep up to date a quality management system (Article 10(9)). While the MDR does not explicitly mandate ISO 13485 certification, ISO 13485:2016 is the harmonized standard that virtually all Notified Bodies use as the benchmark for QMS assessment under Annex IX and Annex XI.

Your QMS must cover:

• Regulatory strategy and procedures for compliance
• Device design and development (design controls)
• Risk management (per ISO 14971:2019)
• Manufacturing, production controls, and process validation
• Supplier management and outsourced processes
• Post-market surveillance and vigilance
• Complaint handling and CAPA
• Document and record control
• Management responsibility and resource management

Practical reality: If you are pursuing CE marking for Class IIa or higher, ISO 13485 certification is effectively mandatory in practice. Every major Notified Body expects it, and the MDR's QMS requirements in Annex IX map closely to ISO 13485 clauses. Building your QMS without ISO 13485 as the backbone is possible in theory but inadvisable in practice. See our ISO 13485 Certification Guide for a detailed walkthrough.

Step 5: Manage Your Suppliers

The MDR requires manufacturers to have documented procedures for evaluating, selecting, monitoring, and re-evaluating suppliers whose products or services affect device quality, safety, or regulatory conformity. This is not optional — supplier management is part of the QMS that Notified Bodies audit.

Key supplier management requirements include:

• Risk-based supplier qualification — evaluate suppliers based on criticality to device quality (a critical component supplier requires more rigorous qualification than an office supplies vendor)
• Quality agreements — written agreements with critical suppliers specifying quality requirements, regulatory obligations, change notification requirements, and access for audits
• Ongoing performance monitoring — track nonconformances, delivery performance, and audit outcomes
• Change management — significant supplier changes (e.g., switching a contract manufacturer for a critical production step) may require Notified Body notification and updates to technical documentation

Notified Body focus area: Supplier management is one of the most frequently cited nonconformity areas during NB audits. Common findings include missing quality agreements with critical suppliers, failure to monitor supplier performance, and insufficient risk assessment when changing suppliers.

Step 6: Implement Risk Management

Develop a risk management system aligned with ISO 14971:2019. The system must span the entire product lifecycle — from initial concept through post-market surveillance. It is not a one-time exercise performed during design and then filed away.

Your risk management file must include:

• Risk management plan
• Hazard identification and analysis
• Risk estimation and evaluation
• Risk control measures (inherent safety by design, protective measures, information for safety)
• Evaluation of overall residual risk and benefit-risk analysis
• Production and post-production risk monitoring

The MDR's General Safety and Performance Requirements (Annex I, Chapter I) establish that the manufacturer must reduce risks as far as possible without adversely affecting the benefit-risk ratio. This means you must demonstrate that no further risk reduction is practicable — a higher bar than simply meeting an arbitrary acceptance threshold. For more detail, see our ISO 14971 Risk Management Guide.

Step 7: Prepare Technical Documentation

Technical documentation is the evidentiary backbone of your CE marking. It must demonstrate conformity with the General Safety and Performance Requirements (GSPR) in Annex I and meet the content requirements defined in Annex II and Annex III.

Annex II: Technical Documentation Content

Section	Content Required
1. Device description and specification	Intended purpose, patient population, intended users, contraindications, principles of operation, device variants and accessories, materials in contact with patients, description of each component
2. Information supplied by manufacturer	Labels, instructions for use (IFU), packaging design and materials
3. Design and manufacturing information	Manufacturing processes and sites, critical suppliers, in-process controls, process validation (especially sterilization), environmental conditions
4. GSPR checklist	A line-by-line mapping of each applicable General Safety and Performance Requirement to the standards applied and evidence demonstrating conformity
5. Benefit-risk analysis and risk management	Complete risk management file per ISO 14971, including benefit-risk determination
6. Product verification and validation	Pre-clinical data, bench testing, biocompatibility (ISO 10993), electrical safety (IEC 60601 series), EMC, software verification/validation (IEC 62304), usability (IEC 62366), clinical evaluation data

Annex III: Post-Market Surveillance Documentation

Annex III defines requirements for the PMS plan and the post-market surveillance report (or PSUR for Class IIa, IIb, and III devices). This is a living document, not a static filing. It must describe systematic processes for collecting and analyzing post-market data, methods for trend identification, FSCA procedures, and integration with the risk management system and clinical evaluation updates.

Audit insight: Notified Bodies consistently identify the GSPR checklist as one of the most common weak points in technical documentation. Vague references like "see risk management file" are no longer acceptable. Each line item must trace to a specific document, section, and version. A well-constructed GSPR checklist maps directly to test reports, risk analyses, clinical data, and applicable standards with pinpoint precision.

Step 8: Conduct a Clinical Evaluation

Every medical device — regardless of class — requires a clinical evaluation under Article 61 and Annex XIV of the MDR. The clinical evaluation must demonstrate that the device achieves its intended clinical benefit(s) and has an acceptable benefit-risk profile.

The clinical evaluation process includes:

1. Define the scope — the device, its intended purpose, the target patient population, and the clinical claims
2. Identify relevant data — literature search, clinical investigation data, post-market data, data from equivalent devices
3. Appraise the data — assess the scientific validity, relevance, and contribution of each data source
4. Analyze the data — determine whether sufficient clinical evidence exists to demonstrate safety, performance, and clinical benefit
5. Document the findings — compile a Clinical Evaluation Report (CER)

For Class III and implantable devices, clinical investigations are generally required unless the manufacturer can demonstrate equivalence to a device for which sufficient clinical data already exists. Demonstrating equivalence under the MDR is significantly more difficult than under the MDD — the manufacturer must have a contract with or full access to the technical documentation of the comparator device (Article 61(5)).

For IVDs, the equivalent requirement is a Performance Evaluation under IVDR Annex XIII, documented in a Performance Evaluation Report (PER).

Equivalence Under the MDR

One of the most significant changes from the MDD to the MDR is how equivalence is handled. Under the MDD, manufacturers could claim equivalence to another manufacturer's device based on publicly available information. Under the MDR (Article 61(5)), if you claim equivalence to a device made by another manufacturer, you must have a contract with that manufacturer giving you access to their technical documentation and clinical data. Without that contract, you cannot rely on equivalence and must generate your own clinical data — which may require a clinical investigation.

This change has had enormous practical impact, particularly for manufacturers of well-established technologies who previously relied on literature-based clinical evaluations referencing competitor devices.

Post-Market Clinical Follow-Up (PMCF)

The clinical evaluation is not a one-time exercise. Every manufacturer must plan and conduct PMCF activities to proactively collect and evaluate clinical data throughout the device lifecycle. PMCF may involve:

• Post-market clinical investigations (PMCF studies)
• Systematic literature reviews and surveillance
• Analysis of registries and real-world evidence databases
• Surveys or structured feedback from users and patients

The PMCF plan must be included in the technical documentation and is reviewed by the Notified Body. The PMCF evaluation report feeds back into the clinical evaluation, risk management, and PSUR. For Class III and implantable devices, the PMCF plan and findings are particularly scrutinized.

See our Clinical Evaluation Report Guide for detailed coverage.

Step 9: Appoint an EU Authorized Representative (If Outside the EU)

Non-EU manufacturers must designate an EU Authorized Representative per Article 11 of the MDR. The Authorized Representative:

• Acts as the legal liaison between the manufacturer and EU Competent Authorities
• Verifies that the Declaration of Conformity and technical documentation exist
• Cooperates with Competent Authorities in incident investigations
• Must be identified on the device label (Annex I, Section 23.2(d))

The relationship must be formalized in a written mandate that explicitly defines responsibilities for UDI compliance, EUDAMED registration, documentation access, and incident reporting.

Step 10: Select and Engage a Notified Body

For all devices except standard Class I (and Class A IVDs), you must engage a Notified Body designated under the MDR. This step is critical and should begin early — Notified Body capacity is a genuine constraint.

How to Select a Notified Body

1. Check designation scope. Not every Notified Body is designated for every device type. Verify in the NANDO database that the NB is designated for the specific MDR Annex and device codes covering your product.
2. Assess capacity and lead times. Ask for realistic timelines. As of early 2026, initial application-to-certificate timelines of 13–18 months are common for higher-risk devices.
3. Evaluate expertise. Some NBs have deeper expertise in specific therapeutic areas (cardiovascular, orthopedic, software, etc.). Technical expertise in your device domain matters.
4. Consider geographic presence. If you have manufacturing sites in multiple countries, an NB with local auditors can reduce travel costs and scheduling complexity.
5. Request a detailed cost breakdown. Under the European Commission's proposed implementing regulation on Notified Bodies (2025), NBs will be expected to provide standardized quotation inputs and detailed cost breakdowns. Even before this becomes mandatory, request transparency on application fees, audit day rates, annual surveillance fees, and supplementary review fees.

Current Capacity Challenges

As of March 2026, the number of MDR-designated Notified Bodies remains limited compared to the MDD era, when over 50 NBs were active. The convergence of MDR transition deadlines — particularly the December 2027 and December 2028 deadlines for legacy device recertification — is creating a significant bottleneck.

The European Commission has responded with a proposed implementing regulation that would impose standardized timelines on Notified Bodies: 30 days for application review, 120 days for QMS audits, 90 days for product verification, and 15 days to issue certificates. Whether these timelines become binding depends on the legislative process.

Strategic advice: Do not wait until your technical documentation is "perfect" before engaging a Notified Body. Start the conversation early, understand their review process and documentation expectations, and submit your application while finalizing outstanding elements. Manufacturers who delay Notified Body engagement until everything is complete often find themselves at the back of an 18-month queue.

Step 11: Complete the Conformity Assessment

Once you have engaged a Notified Body, the conformity assessment process typically follows this sequence:

1. Application submission — submit your QMS documentation, technical documentation, and clinical evaluation data
2. Preliminary document review — the NB reviews completeness and may request additional information
3. QMS audit (Stage 1) — a document-based review of your QMS to assess readiness for a full audit
4. QMS audit (Stage 2) — an on-site audit of your QMS implementation, typically covering design controls, risk management, production, CAPA, PMS, and supplier management
5. Technical documentation assessment — the NB reviews your technical file, GSPR checklist, clinical evaluation, risk management file, and design verification/validation data
6. Resolution of nonconformities — address any nonconformities identified during the audit or documentation review
7. Certificate issuance — if the NB is satisfied, it issues an EU QMS certificate and an EU technical documentation assessment certificate (under Annex IX)

For Class III implantable devices, the scrutiny procedure (Article 54) adds a step where the Competent Authority and potentially EU expert panels can review the NB's assessment before certification.

Step 12: Draw Up the EU Declaration of Conformity

After successful conformity assessment, the manufacturer draws up the EU Declaration of Conformity per Annex IV of the MDR. This is a legally binding document in which the manufacturer declares full compliance with applicable GSPRs and the relevant regulation.

The Declaration of Conformity must include:

• Manufacturer name and address (and Authorized Representative, if applicable)
• A statement that the declaration is issued under the sole responsibility of the manufacturer
• The Basic UDI-DI and product identification
• The product risk class and applicable classification rule(s)
• A statement of conformity with the MDR and any other applicable EU legislation
• References to harmonized standards and common specifications applied
• The Notified Body name, number, and certificate reference (if applicable)
• Place, date, and signature of an authorized person (e.g., the PRRC)

The Declaration of Conformity must be kept for at least 10 years after the last device covered by it has been placed on the market.

Step 13: Assign UDI and Register in EUDAMED

Before placing the device on the market, assign a Unique Device Identifier:

• UDI-DI (Device Identifier) — a fixed code identifying the manufacturer and the specific device model/variant
• UDI-PI (Production Identifier) — a variable code identifying the specific production unit (lot number, serial number, expiration date)
• Basic UDI-DI — the primary identifier used in EUDAMED, the Declaration of Conformity, and NB certificates

The UDI must appear on the device label and packaging in both human-readable and machine-readable (AIDC) formats.

EUDAMED Status and Deadlines

On 27 November 2025, the European Commission published a decision confirming that four EUDAMED modules are fully functional, triggering a six-month countdown. From 28 May 2026, the following modules are mandatory:

Module	What It Covers
Actor Registration	Registration of manufacturers, Authorized Representatives, importers
UDI/Device Registration	Registration of device data and UDI-DIs
Notified Bodies and Certificates	Publication of NB certificates and their status
Market Surveillance	Competent Authority market surveillance activities

Key registration deadlines:

• New MDR/IVDR devices placed on the market from 28 May 2026 must be registered before market placement
• Legacy devices (placed under MDD/AIMDD/IVDD) must be registered in EUDAMED by 28 November 2026
• Certificates issued before 28 May 2026 must be uploaded by 28 May 2027

The remaining modules — Vigilance and Clinical Investigations/Performance Studies — are expected to become mandatory after 2026.

Step 14: Affix the CE Mark

After completing all conformity assessment procedures and drawing up the Declaration of Conformity, affix the CE marking to the device. Per Article 20:

• The CE mark must be affixed visibly, legibly, and indelibly to the device or its sterile packaging, and on the instructions for use and outer packaging
• If a Notified Body was involved, the CE mark must be followed by the four-digit identification number of the NB (e.g., CE 0123)
• The CE mark must comply with the proportional format specified in Annex V — minimum height of 5mm unless otherwise justified
• The CE mark must be affixed before the device is placed on the market

Improper CE marking — including affixing the mark without completing the conformity assessment, using incorrect proportions, or omitting the NB number — constitutes a regulatory violation and can trigger enforcement actions.

Step 15: Establish Post-Market Surveillance and Vigilance

CE marking is not the finish line. The MDR imposes substantial post-market obligations that continue for the entire lifecycle of the device.

Post-Market Surveillance (PMS):

• Maintain a PMS system as part of your QMS (Article 83)
• Implement a PMS plan for each device
• Systematically collect and analyze data on device safety and performance from customers, users, adverse event databases, literature, and other sources
• Prepare a PMS Report (Class I) or Periodic Safety Update Report — PSUR (Class IIa, IIb, III) at defined intervals
• Conduct Post-Market Clinical Follow-Up (PMCF) to proactively collect clinical data

Vigilance:

• Report serious incidents to Competent Authorities within specified timelines (Article 87): 15 days for serious incidents, 2 days for serious public health threats, 10 days for trend reporting
• Implement Field Safety Corrective Actions (FSCAs) when necessary
• Submit Field Safety Notices to affected users

Summary of Safety and Clinical Performance (SSCP):

• Required for implantable devices and Class III devices (except custom-made and investigational devices)
• Publicly available document summarizing safety and performance data intended for patients and healthcare professionals
• Must be validated by the Notified Body and uploaded to EUDAMED
• Written in a language that is clearly understandable to the intended user

PMS Reporting Obligations by Class:

Device Class	Report Type	Frequency	Submitted To
Class I	Post-Market Surveillance Report (PMSR)	Updated when necessary	Available to Competent Authority on request
Class IIa	Periodic Safety Update Report (PSUR)	At least every 2 years	Notified Body (via EUDAMED when operational)
Class IIb	PSUR	At least annually	Notified Body (via EUDAMED when operational)
Class III	PSUR	At least annually	Notified Body and Competent Authority (via EUDAMED when operational)

Enforcement reality: Competent Authorities across the EU are increasing their market surveillance activities. This includes proactive inspections, review of incident reports and trend data, and coordinated EU-wide surveillance campaigns. Post-market obligations are no longer a theoretical requirement — they are actively monitored and enforced.

For detailed coverage, see our Post-Market Surveillance Guide.

Change Management After CE Marking

CE marking is not a static achievement. Medical devices evolve — manufacturers improve designs, change components, switch suppliers, update software, and expand intended purposes. Each change must be evaluated for its impact on regulatory compliance.

When Changes Require Notified Body Notification

Under the MDR, manufacturers must inform their Notified Body of any planned substantial changes to the device, its intended purpose, or the quality management system. The NB determines whether the change requires:

• A supplementary assessment of the technical documentation
• An updated or new certificate
• A special audit to verify the change implementation

Changes that are typically considered substantial include:

• Changes to the device's intended purpose, target patient population, or clinical claims
• Changes to materials in contact with the patient or the body
• Changes to the sterilization method or manufacturing process for a sterile device
• Major software revisions that alter clinical functionality or risk profile
• Changes to the manufacturing site or critical manufacturing processes
• Addition of a new device variant outside the scope of the current technical documentation assessment

Change Control Process

Step	Action	Documentation Required
1. Identify the change	Document the proposed change and its rationale	Change request form
2. Assess impact	Evaluate the impact on safety, performance, GSPR compliance, risk analysis, clinical evaluation, and labeling	Impact assessment report
3. Classify the change	Determine whether the change is substantial (requires NB notification) or non-substantial (internal documentation update)	Classification justification
4. Implement the change	Execute the change through design controls, verification, and validation as appropriate	Updated design history file, V&V reports
5. Update documentation	Revise technical documentation, risk management file, clinical evaluation, labeling, and GSPR checklist as needed	Updated technical documentation
6. Notify NB (if applicable)	Submit change notification with supporting documentation to the Notified Body	NB notification package
7. Update DoC and EUDAMED	Revise the Declaration of Conformity and update EUDAMED registration if device data has changed	Updated DoC, EUDAMED records

Common mistake: Manufacturers sometimes implement changes incrementally — each individually minor — without assessing their cumulative impact. The Notified Body evaluates the device as a whole, and multiple minor changes can collectively constitute a substantial change that should have been notified.

Device Discontinuation and End-of-Lifecycle Obligations

When a manufacturer decides to discontinue a medical device, the regulatory obligations do not end on the date of last production. The MDR imposes ongoing obligations that extend well beyond the device's final market placement.

Article 10a Notification Requirements

Under Article 10a of the MDR (introduced by Regulation (EU) 2024/1860), manufacturers must notify Competent Authorities and downstream economic operators (Authorized Representatives, importers, distributors) at least six months before discontinuing supply of a device, if the interruption could pose a serious risk to patient health or public health. This advance notice is intended to allow healthcare systems to identify alternative devices and manage supply transitions.

Post-Discontinuation Obligations

Obligation	Duration	Details
Document retention	10 years after last device placed on market (standard devices); 15 years for implantable devices	Retain complete technical documentation, EU Declarations of Conformity, NB certificates, PMS data, and clinical evaluation reports
Servicing and support	For the claimed device lifetime	Maintain capability to provide replacement parts, technical support, and field safety corrective actions for devices still in use
Vigilance reporting	For the claimed device lifetime	Continue to accept and assess complaints, report serious incidents, and implement FSCAs for devices still in service
PMS data collection	For the claimed device lifetime	Continue monitoring safety and performance data from devices still in use
EUDAMED updates	At time of discontinuation	Update device registration status in EUDAMED to reflect discontinuation
Notified Body notification	At time of discontinuation	Inform the NB of the discontinuation decision; the NB may adjust surveillance activities accordingly

End-of-Life Checklist

1. Establish and document the final date of market placement — this date triggers retention periods
2. Notify Competent Authorities and economic operators per Article 10a if discontinuation poses patient health risks
3. Inform the Notified Body of the discontinuation
4. Communicate discontinuation timeline to customers and distributors with adequate lead time
5. Archive all technical documentation, DoC, NB certificates, and PMS records in a retrievable format
6. Maintain servicing and complaint-handling capability for the claimed device lifetime
7. Continue vigilance obligations — accepting incident reports and implementing FSCAs as needed
8. Update EUDAMED registration to reflect discontinued status

Practical consideration: Manufacturers sometimes underestimate end-of-lifecycle costs. Maintaining vigilance, complaint handling, and document retention for 10–15 years after the last device is sold requires ongoing resources. Budget for these obligations when planning the device lifecycle — not as an afterthought when discontinuation is already underway.

General Safety and Performance Requirements (GSPR)

Annex I of the MDR contains 23 General Safety and Performance Requirements — the successor to the MDD's "Essential Requirements." These requirements form the substantive safety and performance standard that every medical device must meet.

GSPR Structure

Chapter	Coverage	Key Requirements
Chapter I: General Requirements (1–9)	Overarching safety and performance principles	Risk management approach, devices shall achieve intended performance, minimize risks, demonstrate acceptable benefit-risk ratio
Chapter II: Design and Manufacture (10–22)	Specific technical requirements	Chemical/physical/biological properties, infection control, devices with measuring function, radiation, electronic programmable systems (software), active devices, mechanical properties, devices connected to energy sources
Chapter III: Information with the Device (23)	Labeling and instructions for use	Label content, IFU content, language requirements, UDI carrier placement

The GSPR Checklist

Every manufacturer must produce a GSPR checklist that maps each of the 23 requirements and their sub-requirements to:

• Whether the requirement applies to the specific device
• The harmonized standard(s) or common specification(s) used to demonstrate conformity
• The specific evidence (test reports, risk management file sections, clinical data)

This checklist is a cornerstone of your technical documentation and is subject to detailed scrutiny by Notified Bodies.

Practical GSPR Compliance Tips

1. Start with applicability. Not all 23 GSPRs apply to every device. A software-only device has no mechanical requirements (GSPR 12). A non-sterile device has no sterilization requirements (GSPR 11.1). Document why each non-applicable requirement does not apply.

2. Map to harmonized standards. Where a harmonized standard covers a GSPR, reference it explicitly. Using a harmonized standard confers a presumption of conformity for the requirements it covers — this is the strongest evidence you can present.

3. Where no harmonized standard exists, reference Common Specifications (where available), other recognized standards, or direct evidence (test reports, analyses, clinical data). Document your rationale.

4. Be specific in your evidence references. Instead of "See risk management file," write "See Risk Management File v3.2, Section 4.3, Hazard Analysis Table, Hazards H-012 through H-018, mitigated by design controls documented in Design History File DHF-001, Section 7.2."

5. Treat the GSPR checklist as a living document. It must be updated whenever the technical documentation changes — new test data, updated risk analysis, revised clinical evaluation, changes to standards applied.

Technical Documentation Deep Dive

Key Harmonized Standards

Harmonized standards under the MDR are developed by CEN and CENELEC. When their references are published in the Official Journal of the EU, using those standards confers a presumption of conformity with the GSPR requirements they cover. This does not mean compliance is automatic — it means the Notified Body and Competent Authority will accept that the relevant GSPR is addressed if the standard is fully applied.

Key harmonized standards for medical devices include:

Standard	Scope
EN ISO 13485:2016	Quality management systems for medical devices
EN ISO 14971:2019	Application of risk management to medical devices
EN IEC 60601-1 (and collateral/particular standards)	Medical electrical equipment — safety and essential performance
EN IEC 62304:2006+A1:2015	Medical device software — software lifecycle processes
EN IEC 62366-1:2015+A1:2020	Medical devices — usability engineering
EN ISO 10993 series	Biological evaluation of medical devices
EN ISO 11135	Sterilization — ethylene oxide
EN ISO 11137 series	Sterilization — radiation
EN ISO 11607 series	Packaging for terminally sterilized medical devices
EN ISO 15223-1	Symbols for medical device labeling
EN ISO 20417	Information to be supplied by the manufacturer

The European Commission continued expanding the list of harmonized standards through 2025, including Implementing Decisions (EU) 2025/681 and (EU) 2025/2078, which added standards covering surgical clothing, medical face masks, sterilizers, and medical gloves.

Important: Not all ISO standards used in the medical device industry are harmonized under the MDR. For example, ISO 14971:2019 is harmonized, but the EU has published a harmonized version (EN ISO 14971:2019) with a specific EU Annex (Annex ZA) that maps to MDR requirements. Always verify you are using the correct European harmonized version, not just the ISO version.

CE Marking for Medical Device Software (MDSW)

Medical device software — often called MDSW (Medical Device Software) or SaMD (Software as a Medical Device) — faces unique CE marking challenges under the MDR. The MDR treats standalone software as an active medical device, which has significant implications for classification, conformity assessment, and the applicable standards.

Software Classification Under Rule 11

As discussed in the classification section above, Rule 11 classifies software based on the clinical impact of the information it provides. This rule caused the most up-classifications from the MDD to the MDR. Under the MDD, most standalone software was classified as Class I. Under the MDR, the majority of clinical decision-support software is classified as Class IIa or higher, requiring Notified Body involvement for the first time.

The MDCG 2019-11 guidance document provides a decision flowchart for determining whether software qualifies as a medical device, and MDCG 2020-13 provides guidance on clinical evaluation of medical device software.

Software-Specific Standards and Requirements

Software manufacturers must comply with several standards that do not apply to traditional hardware devices:

Standard / Requirement	Scope	Key Obligations
EN IEC 62304:2006+A1:2015	Software lifecycle processes	Software development planning, requirements analysis, architectural design, unit implementation, integration testing, system testing, release, and maintenance — all documented with traceability
EN IEC 62366-1:2015+A1:2020	Usability engineering	User interface design, formative evaluations, summative usability testing — critical for software where use errors can lead to clinical harm
EN ISO 14971:2019	Risk management	Software-specific hazards including data integrity, algorithmic errors, cybersecurity vulnerabilities, interoperability failures
IEC 82304-1:2016	Health software product safety	Requirements for health software products not embedded in a medical device — covers software lifecycle, security, and data handling
MDCG 2019-16	Cybersecurity guidance	Pre-market cybersecurity risk assessment, secure design principles, vulnerability management, incident response, and post-market cybersecurity monitoring

Cybersecurity Requirements

Cybersecurity is a critical aspect of CE marking for connected and software-based medical devices. The MDR's General Safety and Performance Requirements (Annex I, Sections 17.2 and 17.4) require manufacturers to address IT security risks, including risks from unauthorized access, and to design devices with cybersecurity principles appropriate to the state of the art.

Key cybersecurity obligations for CE marking include:

• Secure by design — implement security controls during design and development, not as an afterthought
• Risk-based approach — conduct a cybersecurity threat modeling exercise as part of the risk management process, identifying threats such as data breaches, ransomware, unauthorized device control, and data integrity attacks
• Software Bill of Materials (SBOM) — maintain a current SBOM listing all software components, libraries, and dependencies, enabling vulnerability tracking and patch management
• Update and patch management — establish processes for delivering security updates throughout the device lifecycle, including validation of patches before deployment
• Post-market cybersecurity monitoring — actively monitor for newly discovered vulnerabilities in software components and assess their impact on device safety and performance
• Incident response — define procedures for responding to cybersecurity incidents that may affect device safety

Regulatory convergence: The Radio Equipment Directive (RED) delegated regulation on cybersecurity (applicable from August 2025) and the EU Cyber Resilience Act (CRA) also impose cybersecurity requirements on connected devices. Medical devices are excluded from the CRA's scope where the MDR applies, but manufacturers must carefully assess which legislation governs their specific device, particularly for devices with dual-use components.

AI/ML-Enabled Medical Devices

Medical devices incorporating artificial intelligence or machine learning face additional CE marking considerations:

• Classification impact — AI/ML algorithms that provide diagnostic or therapeutic recommendations are classified under Rule 11 and typically fall into Class IIa or higher
• AI Act overlap — the EU AI Act (Regulation (EU) 2024/1689) classifies medical device AI systems as "high-risk" AI, requiring conformity assessment under both the MDR and the AI Act. The conformity assessment under the MDR is considered to satisfy the AI Act requirements when both are performed by the same Notified Body
• Continuous learning algorithms — devices that continuously learn or adapt post-deployment raise questions about "significant change" thresholds and may require pre-determined change control plans (PCCPs) that define the boundaries within which the algorithm can evolve without triggering a new conformity assessment
• Clinical evaluation challenges — demonstrating clinical performance of AI/ML algorithms requires addressing dataset representativeness, algorithmic bias, performance degradation over time, and real-world validation beyond training data

Notified Bodies Under EU MDR

Role and Designation

Notified Bodies are independent conformity assessment organizations designated by EU member states under the MDR to perform conformity assessments. They are listed in the NANDO (New Approach Notified and Designated Organisations) database maintained by the European Commission.

Under the MDR, Notified Body designation involves a significantly more rigorous process than under the MDD:

• Joint assessments — designation assessments involve teams from the designating member state's Competent Authority, the European Commission, and assessors from at least two other member states
• Stricter competence requirements — NBs must demonstrate they have sufficient qualified personnel with clinical, technical, and regulatory expertise for the device types they assess
• Unannounced audits — the MDR authorizes Notified Bodies to conduct unannounced audits of manufacturers
• Ongoing monitoring — designating authorities and the Commission regularly monitor NB performance

Selecting a Notified Body: Practical Considerations

Factor	What to Evaluate
Designation scope	Verify in NANDO that the NB covers your device type and the conformity assessment annexes you plan to use
Therapeutic area expertise	An NB experienced in cardiovascular devices may not have the same depth in ophthalmic or dental devices
Current lead times	Ask for realistic application-to-certificate timelines — as of 2026, 13–18 months is typical for Class IIb/III
Geographic coverage	NBs with auditors near your manufacturing sites reduce scheduling and travel friction
Communication quality	Responsiveness, clarity of questions, and willingness to provide pre-submission guidance vary significantly between NBs
Cost transparency	Request itemized quotes covering application fees, audit day rates, annual surveillance, documentation review fees
Certificate portfolio	An NB with experience in your specific device category will have more relevant benchmarks and expectations

Notified Body Certificates

Under the MDR, Notified Bodies can issue several types of certificates:

Certificate	Basis	Content
EU QMS certificate	Annex IX, Chapter I	Confirms the manufacturer's QMS meets MDR requirements
EU technical documentation assessment certificate	Annex IX, Chapter II	Confirms the technical documentation for specific device(s) meets MDR requirements
EU type-examination certificate	Annex X	Confirms a device type meets the requirements of Annex II (technical documentation)

All MDR certificates have a maximum validity of five years and are subject to annual surveillance audits. At the end of the five-year period, a full re-certification audit is required.

Additionally, the MDR adds two certificate types not present under the MDD: the EU quality assurance certificate (Annex XI, Part A) and the EU product verification certificate (Annex XI, Part B), which are used when manufacturers choose the Annex X + Annex XI conformity assessment route.

Surveillance Audit Cycle

Once a certificate is issued, the Notified Body maintains an ongoing audit cycle throughout the certificate's five-year validity:

Audit Type	Frequency	Purpose
Planned surveillance audit	At least annually	Verify continued QMS compliance, review PMS/vigilance data, assess changes to devices or processes, sample technical documentation
Unannounced audit	At least once per certification cycle (can occur more frequently)	Verify QMS implementation in normal operating conditions without preparation time — typically includes inspection of production, incoming goods, and warehouse areas
Re-certification audit	At end of five-year cycle	Full reassessment of QMS and technical documentation, equivalent to the initial certification process

Unannounced audits are a significant change from the MDD. The Notified Body can arrive at a manufacturer's facility without prior notice and inspect any aspect of the QMS, production processes, and technical documentation. Manufacturers should ensure their facilities and processes are audit-ready at all times — not just during planned audit windows.

December 2025 proposal: The European Commission's December 2025 simplification proposal includes removing the five-year cap on NB certificate validity. If adopted, certificates would remain valid as long as the manufacturer maintains compliance and passes surveillance audits. This change is designed to reduce the recertification burden on both manufacturers and Notified Bodies.

What to Expect During a Notified Body Audit

Understanding the NB audit process helps manufacturers prepare effectively:

Stage 1 Audit (Document Review):

• Review of QMS documentation for completeness and adequacy
• Assessment of organizational structure, management responsibilities, and resource allocation
• Evaluation of the manufacturer's understanding of regulatory requirements
• Identification of areas requiring focus during the Stage 2 audit
• Typically conducted off-site (though some NBs may require a brief site visit)

Stage 2 Audit (On-Site Assessment):

• Verification that QMS processes described in documentation are actually implemented
• Review of design and development records (design history files) for representative devices
• Assessment of production controls, process validations, and environmental monitoring
• Evaluation of complaint handling, CAPA, and PMS processes — with evidence of closed-loop effectiveness
• Review of supplier management records, quality agreements, and supplier audit reports
• Assessment of training records and personnel competency
• Review of management review meeting outputs and follow-up actions
• Sampling of device records to verify traceability from raw materials through distribution

Common Nonconformity Categories:

Category	Typical Findings
Design controls	Incomplete design transfer documentation, missing traceability between design inputs and outputs
CAPA	Corrective actions that address symptoms rather than root causes, no evidence of effectiveness verification
Supplier management	Missing quality agreements, no incoming inspection records, no periodic re-evaluation
PMS/Vigilance	PMS plan not implemented, no evidence of proactive data collection, incomplete trend analysis
Document control	Obsolete documents in use, missing revision histories, unapproved changes
Risk management	Risk management file not updated with post-market data, residual risk evaluation incomplete

Nonconformities are classified as major or minor. Major nonconformities must be resolved — with objective evidence — before a certificate can be issued. Minor nonconformities require a corrective action plan with defined timelines.

EU Authorized Representative Requirements

Non-EU manufacturers must appoint an EU Authorized Representative per Article 11 before placing devices on the EU market. The Authorized Representative must be established in the EU and must be identified on the device label.

Authorized Representative Obligations

Obligation	MDR Reference
Verify that the Declaration of Conformity and technical documentation have been drawn up	Article 11(3)(a)
Keep a copy of the technical documentation, DoC, and certificates available for Competent Authorities	Article 11(3)(b)
Cooperate with Competent Authorities in investigations and corrective actions	Article 11(3)(c)
Inform the manufacturer immediately of complaints and reports of incidents	Article 11(3)(d)
Terminate the mandate if the manufacturer acts contrary to its obligations	Article 11(3)(e)

The Authorized Representative relationship must be formalized in a written mandate specifying responsibilities for UDI compliance, EUDAMED registration, incident reporting, and documentation access.

Declaration of Conformity

The EU Declaration of Conformity (DoC) is the manufacturer's formal, legally binding statement that the device conforms to all applicable requirements. It is prepared per Annex IV of the MDR.

Required Content

• Manufacturer name, registered address, and SRN (Single Registration Number)
• Authorized Representative details (if applicable)
• Statement that the declaration is issued under the manufacturer's sole responsibility
• Basic UDI-DI and product identification allowing traceability
• Device risk class and applicable classification rule(s)
• Statement of conformity with the MDR (and any other applicable EU legislation — e.g., REACH, RoHS)
• References to harmonized standards, common specifications, or other technical specifications used
• Notified Body name, identification number, and certificate reference(s) where applicable
• Place, date, and authorized signature (typically the PRRC)

The DoC must be continuously updated and kept available for at least 10 years after the last device was placed on the market. It must be provided to Competent Authorities upon request and may also need to accompany the device or be accessible via a URL on the label.

Common Declaration of Conformity Mistakes

• Listing the wrong classification rule. If your device is classified under Rule 11 but your DoC references Rule 9, your declaration is incorrect — even if the class is the same.
• Outdated NB certificate references. When NB certificates are renewed or supplemented, the DoC must be updated to reference the current certificate.
• Missing Basic UDI-DI. The MDR requires the Basic UDI-DI on the DoC. This is a new requirement that did not exist under the MDD.
• Unsigned or undated documents. A DoC without a valid signature and date is not legally binding.
• Failing to cover all applicable EU legislation. If your device also falls under REACH, RoHS, or other EU directives, the DoC should reference compliance with those regulations as well.

Template tip: The European Commission has published guidance (MDCG documents) on the content and format of the Declaration of Conformity. Use these as your starting point, not a competitor's DoC template. Each manufacturer's DoC must accurately reflect their specific device, classification, conformity assessment route, and applicable standards.

Labeling and Instructions for Use (IFU) Requirements

Labeling is a GSPR requirement (Annex I, Section 23) and a frequent source of nonconformities during Notified Body reviews and Competent Authority market surveillance. The MDR introduces requirements that go beyond the MDD.

Device Label Requirements

The device label must include (where applicable):

• Device name or trade name
• Information strictly necessary for the user to identify the device, its contents, and the manufacturer
• Manufacturer name and registered address (and Authorized Representative, if applicable)
• An indication that the device is a medical device (unless obvious from its appearance)
• The CE mark, followed by the NB number if applicable
• The UDI carrier in both human-readable and AIDC (machine-readable) format
• Lot number or serial number, preceded by "LOT" or "SN"
• Date of manufacture and expiration date (where applicable)
• Storage and handling conditions
• Any specific warnings or precautions
• If sterile, the word "STERILE" and the sterilization method
• Indication of single use (where applicable)

Instructions for Use (IFU)

Every device must be accompanied by an IFU unless the device can be used safely and as intended without such instructions (e.g., certain simple Class I devices). The IFU must be written in the official language(s) of the member state(s) where the device is made available. This is a practical challenge for manufacturers distributing across multiple EU member states — each with their own official language(s).

The IFU must include, among other things:

• The device's intended purpose and intended user profile
• Contraindications, warnings, and precautions
• Expected performance characteristics
• Installation, setup, and use instructions
• Maintenance and calibration information
• Information on residual risks and side effects
• Any required accessories and consumables

Language requirement: Article 10(11) requires that information supplied with the device be in the language(s) determined by the member state where the device is made available. For a manufacturer selling across the EU, this can mean translating labels and IFUs into 20+ languages. Translation management is a significant operational and cost consideration that is often underestimated.

CE Marking for Legacy Devices — MDR Transition Timeline

The transition from the MDD/AIMDD to the MDR has been extended multiple times due to Notified Body capacity constraints and pandemic-related delays. The current transition deadlines are established by Regulation (EU) 2023/607 and Regulation (EU) 2024/1860.

Current MDR Transition Deadlines

Device Category	Deadline	Condition
Class III custom-made implantable devices	26 May 2026	Must have MDR certificate or conformity assessment application submitted
Class III and Class IIb implantable devices	31 December 2027	Must have submitted application to a Notified Body by 26 May 2026, and have a signed written agreement with a NB
Class IIb (non-implantable), Class IIa, Class Is/Im/Ir	31 December 2028	Same conditions as above
Class I (up-classified under MDR)	31 December 2028	Devices that were Class I under MDD but require NB under MDR

Conditions for Continued Placement

To benefit from these extended deadlines, legacy devices must meet all of the following conditions:

• The device must have been lawfully placed on the EU market before 26 May 2021 based on a valid MDD/AIMDD certificate
• The device must continue to comply with the applicable directive
• There must be no significant changes in the device's design or intended purpose
• The manufacturer must have applied to a Notified Body for MDR conformity assessment before the applicable deadline
• The device must meet MDR requirements for PMS, market surveillance, vigilance, and registration of economic operators and devices

Critical warning: If a legacy device does not meet all of these conditions, it cannot benefit from extended transition deadlines. It must achieve full MDR compliance immediately. Manufacturers should verify their eligibility carefully — particularly the requirement that there be no significant changes to the device's design or intended purpose.

Practical Transition Challenges

The transition from MDD to MDR has been one of the most disruptive regulatory shifts in the medical device industry's history:

1. Notified Body re-designation. Under the MDR, every NB had to be re-designated through a rigorous joint assessment process. This reduced the number of active NBs significantly, creating a capacity shortfall that persists today.

2. Up-classification of existing devices. Many devices that were Class I under the MDD are now Class IIa or higher under the MDR (particularly software, devices with nanomaterials, and certain substance-administering devices). These manufacturers must engage a Notified Body for the first time.

3. Clinical evidence gaps. Devices that were CE-marked under the MDD with minimal clinical data now need to demonstrate clinical evidence that meets MDR standards. For legacy devices with long market histories but limited clinical investigation data, this is a substantial undertaking.

4. "Significant change" ambiguity. The transition provisions require that there be "no significant changes in the design or intended purpose" of a legacy device. What constitutes a "significant change" is not always clear, and manufacturers must apply conservative judgment. MDCG guidance documents provide some interpretation, but borderline cases remain.

5. Resource competition. Notified Bodies must process both new MDR applications and legacy device transitions simultaneously, while also maintaining surveillance of existing certificates. This creates resource competition that further extends timelines.

IVDR Transition Deadlines

Device Category	Application Deadline
Class D IVDs	26 May 2025 (passed)
Class C IVDs	26 May 2026
Class B and Class A sterile IVDs	26 May 2027

CE Marking vs. UKCA vs. Other International Marks

Following Brexit, the UK introduced its own conformity marking system. Other major markets have their own requirements. Here is how they compare:

Aspect	CE Marking (EU)	UKCA Marking (UK)	FDA Clearance/Approval (US)	TGA Registration (Australia)
Legal basis	MDR 2017/745, IVDR 2017/746	UK MDR 2002 (as amended)	FD&C Act, 21 CFR	Therapeutic Goods Act 1989
Territory	EEA (EU + Iceland, Liechtenstein, Norway)	Great Britain (England, Scotland, Wales)	United States	Australia
Regulatory body	Competent Authorities of member states	MHRA	FDA	TGA
Conformity assessment	Notified Body (for Class IIa+)	UK Approved Body (for higher-risk)	FDA review (510(k), PMA, De Novo)	TGA assessment (depending on class)
Classification	I, IIa, IIb, III (22 rules)	Mirrors EU classes (currently)	I, II, III (risk-based panels)	I, IIa, IIb, III, AIMD (mirrors EU)
QMS standard	ISO 13485 (harmonized)	ISO 13485 (recognized)	21 CFR 820 (QMSR, aligned with ISO 13485)	ISO 13485 (required)
Clinical evidence	Clinical Evaluation (Annex XIV)	Clinical evaluation (mirrors MDR)	Clinical data per pathway	Clinical evidence per classification
UDI	Mandatory (EUDAMED)	Planned (MHRA UDI database)	Mandatory (GUDID)	Planned
Mark on device	CE (+ NB number if applicable)	UKCA	None (510(k)/PMA number referenced)	ARTG number

CE Marking and UKCA: Current Status

As of early 2026, CE-marked medical devices continue to be accepted in Great Britain under transitional provisions. The MHRA has consulted on the indefinite recognition of CE marking for medical devices in Great Britain, which — if adopted — would eliminate the need for separate UKCA certification for devices already CE-marked under the MDR.

Manufacturers targeting both the EU and UK markets should monitor this closely. If indefinite CE recognition is adopted, maintaining CE marking alone would provide access to both markets. If it is not adopted, dual conformity assessment (CE + UKCA through separate bodies) will be required.

Northern Ireland note: Northern Ireland remains under EU regulatory jurisdiction for medical devices. CE marking — not UKCA — is required. Devices placed on the Northern Ireland market from Great Britain may require the UKNI marking in addition to CE.

Costs and Timelines: Realistic Estimates

CE marking costs vary enormously depending on device classification, complexity, the manufacturer's regulatory maturity, and Notified Body selection. The following estimates reflect industry benchmarks as of 2026.

Cost Estimates by Device Class

Cost Category	Class I (Self-Declared)	Class IIa	Class IIb	Class III
QMS development and ISO 13485 certification	$15,000–$50,000	$25,000–$80,000	$40,000–$120,000	$50,000–$150,000
Technical documentation preparation	$5,000–$15,000	$20,000–$60,000	$40,000–$100,000	$60,000–$200,000
Clinical evaluation / investigation	$5,000–$15,000 (literature-based)	$15,000–$50,000	$30,000–$150,000	$50,000–$500,000+
Notified Body fees (application + initial audit)	N/A (or $3,000–$8,000 for Is/Im/Ir)	$15,000–$40,000	$25,000–$60,000	$40,000–$100,000+
Notified Body annual surveillance	N/A	$8,000–$20,000/year	$12,000–$30,000/year	$15,000–$40,000/year
EU Authorized Representative	$3,000–$10,000/year	$5,000–$15,000/year	$5,000–$15,000/year	$8,000–$20,000/year
Regulatory consulting	$5,000–$20,000	$15,000–$50,000	$25,000–$100,000	$50,000–$200,000
Estimated total (first year)	$25,000–$80,000	$80,000–$250,000	$150,000–$500,000	$250,000–$1,000,000+

Timeline Estimates

Device Class	Typical Timeline to CE Mark	Key Variables
Class I (standard)	3–6 months	Assumes QMS and documentation are substantially in place
Class I (Is/Im/Ir)	6–12 months	Notified Body engagement for specific aspects
Class IIa	9–18 months	NB queue time, documentation completeness, audit scheduling
Class IIb	12–24 months	More rigorous NB review, potential clinical investigation needs
Class III	18–36 months	Full technical documentation review per device, scrutiny procedure for implants, possible clinical investigations

Budget reality: Successful companies build contingency budgets of 20–30% above initial estimates. Common budget overruns stem from Notified Body questions that require additional testing, clinical evaluation gaps identified during NB review, QMS nonconformities requiring corrective actions, and delays in Notified Body scheduling. The MDR has increased costs across all classifications compared to the MDD system.

Hidden Cost Drivers

Beyond the obvious expenses, manufacturers frequently underestimate costs in these areas:

• Translation. Labels and IFUs in 20+ languages for pan-European distribution. Translation management, review by qualified personnel, and version control add up quickly.
• Biocompatibility testing. A full ISO 10993 biocompatibility evaluation for a new material contact can cost $50,000–$150,000 depending on the testing required.
• Usability testing. Formative and summative usability evaluations per IEC 62366, including participant recruitment and test facility costs, can range from $20,000–$80,000.
• PMCF studies. Post-market clinical follow-up studies — required for higher-risk devices — involve study design, site management, data collection, and statistical analysis. Costs depend on the study scope but can easily exceed $100,000.
• Ongoing NB surveillance fees. Annual surveillance audits, unannounced audits, and certificate review fees are recurring costs that continue for as long as the device is on the market.
• Regulatory personnel. Dedicated regulatory affairs and quality assurance staff are essential for maintaining compliance. Outsourcing is possible but carries its own costs and management overhead.

Common Pitfalls in CE Marking Applications

Based on Notified Body feedback and regulatory enforcement trends, these are the most frequent issues that delay or derail CE marking:

1. Incorrect Device Classification

Misclassifying a device — particularly under-classifying it — leads to selecting the wrong conformity assessment route, insufficient clinical evidence, and potential regulatory action after the device is on the market. Rule 11 (software) and Rule 8 (implantables) are the most common sources of classification errors.

2. Insufficient Clinical Evidence

The MDR's clinical evidence requirements are significantly more demanding than the MDD. Many manufacturers underestimate the level of clinical data required, particularly for demonstrating equivalence (Article 61(5)) and for PMCF planning.

3. Weak GSPR Checklist

A GSPR checklist with generic references ("see technical file") instead of specific, traceable evidence is one of the top reasons for Notified Body questions and documentation rejections.

4. QMS Gaps

Notified Bodies report frequent nonconformities in design and development controls (especially design transfer), CAPA effectiveness, supplier management, and post-market surveillance integration with risk management.

5. Late Notified Body Engagement

Given current capacity constraints, waiting until documentation is "complete" before contacting a Notified Body can add 12–18 months to the timeline. Early engagement is critical.

6. Inadequate Post-Market Surveillance Planning

Many manufacturers treat PMS as an afterthought. Under the MDR, PMS is a regulatory obligation that must be planned before market placement. The PMS plan is part of the technical documentation reviewed by the Notified Body.

7. Missing or Incomplete Authorized Representative Arrangements

Non-EU manufacturers sometimes designate an AR without a proper written mandate, or fail to update labeling with the AR's details. Both are regulatory violations.

8. Transition Timeline Miscalculations

Legacy device manufacturers sometimes assume they automatically qualify for extended transition deadlines without verifying all conditions — including the requirement to have a signed agreement with a Notified Body by the specified date.

9. Ignoring Horizontal Legislation

CE marking compliance may also require demonstrating conformity with other EU legislation that applies in parallel to the MDR. These obligations are often overlooked in the technical documentation but can trigger enforcement actions independently. Key horizontal legislation includes:

Legislation	Applicability	Impact
REACH (EC 1907/2006)	Devices containing chemical substances	Registration, restriction, and authorization of substances — particularly relevant for devices with CMR (carcinogenic, mutagenic, reprotoxic) or endocrine-disrupting substances
RoHS (2011/65/EU)	Devices containing electronic/electrical components	Restriction of hazardous substances (lead, mercury, cadmium, etc.) in electrical equipment
WEEE (2012/19/EU)	Electrically powered devices	Waste disposal and recycling obligations for electronic waste
Radio Equipment Directive (RED) (2014/53/EU)	Wireless-enabled devices (Bluetooth, Wi-Fi, NFC, cellular)	Radio spectrum, electromagnetic compatibility, and — from August 2025 — cybersecurity requirements for connected devices
Batteries Regulation (EU) 2023/1542	Devices containing batteries	Sustainability, labeling, due diligence, and end-of-life requirements for batteries
GDPR (EU) 2016/679	Software devices and connected devices that collect or process personal/patient data	Data protection by design, data processing agreements, privacy impact assessments
AI Act (EU) 2024/1689	Devices incorporating artificial intelligence / machine learning	Risk classification for AI systems, conformity assessment requirements, transparency obligations — medical device AI systems classified as "high-risk" under the AI Act
Ecodesign for Sustainable Products Regulation (EU) 2024/1781	Potentially applies to certain device categories in the future	Product sustainability requirements — scope for medical devices is still being defined

When a medical device falls under multiple EU regulations that each require CE marking, the manufacturer must draw up a single EU Declaration of Conformity covering all applicable legislation and ensure the technical documentation addresses each regulation's requirements. The CE mark on the device then signifies conformity with all applicable EU legislation simultaneously.

10. UDI Assignment Errors

Incorrect UDI-DI assignment, missing UDI-PI elements, or inconsistencies between UDI data on labels, in the technical file, and in EUDAMED can delay market placement.

11. Underestimating Language and Translation Requirements

The MDR requires that labels, IFUs, and certain documentation be provided in the official language(s) of each member state where the device is made available. For pan-European distribution, this means managing translations in 20+ languages — with the translations themselves subject to quality control to avoid errors that could affect patient safety.

12. Treating CE Marking as a One-Time Project

CE marking is not a project with a defined end date. It is the entry point to a continuous compliance lifecycle that includes surveillance audits, PMS data collection and reporting, clinical evaluation updates, EUDAMED maintenance, and certificate renewal. Manufacturers who staff up for the initial CE marking and then reduce resources often struggle with ongoing compliance obligations.

MDCG Guidance Documents

The Medical Device Coordination Group (MDCG) — comprising representatives from EU member states — publishes guidance documents that provide interpretive guidance on MDR and IVDR requirements. While not legally binding, these documents represent the coordinated interpretation of regulators across the EU, and Notified Bodies and Competent Authorities use them as reference points.

Key MDCG guidance documents relevant to CE marking include:

Document	Topic
MDCG 2021-24	Classification of medical devices — guidance on conformity assessment route selection
MDCG 2020-5	Clinical evaluation — equivalence
MDCG 2020-6	Sufficient clinical evidence for legacy devices
MDCG 2020-13	Clinical evaluation of medical device software
MDCG 2019-9	Summary of Safety and Clinical Performance (SSCP)
MDCG 2022-14	Transition to the MDR and IVDR — notified body capacity and availability of medical devices and IVDs
MDCG 2024-1	Transition provisions under Article 120 of the MDR
MDCG 2019-16	Guidance on cybersecurity for medical devices
MDCG 2021-1	Guidance on standardized and favorable conditions for health institution exemption

These guidance documents are published on the European Commission's public health website and are regularly updated. Manufacturers should monitor new publications and revisions as part of their regulatory intelligence activities.

Practical tip: Notified Bodies expect manufacturers to be aware of relevant MDCG guidance. If an MDCG document addresses an aspect of your device or conformity assessment, your technical documentation and procedures should reflect its guidance — or explicitly justify any deviation.

European Commission December 2025 Simplification Proposal

On 16 December 2025, the European Commission published a legislative proposal to amend the MDR and IVDR. This proposal — driven by industry feedback that the current framework is too complex, slow, and costly — includes several changes that would directly affect CE marking:

Proposed Change	Impact on CE Marking
Amendment to Rule 11 (software classification)	More medical device software could qualify as Class I, reducing NB involvement
Removal of the five-year certificate cap	NB certificates would remain valid as long as compliance is maintained through surveillance audits
Expanded use of electronic IFU (eIFU)	Reduced labeling burden for professional-use devices
More flexible in-house device rules	Health institutions could transfer in-house devices in certain circumstances
Streamlined performance study requirements for IVDs	Routine blood draw performance studies would not require prior authorization

The Commission estimates the proposed changes would save approximately EUR 3.3 billion per year across the industry. However, this proposal must pass through the ordinary legislative process (European Parliament and Council), and is not expected to become binding until late 2026 at the earliest.

Practical guidance: Do not delay your CE marking strategy in anticipation of these changes. Plan and execute based on current requirements. If the simplification measures are adopted, they will provide relief — but manufacturers who wait risk missing transition deadlines and facing market access gaps.

Frequently Asked Questions

What does CE marking mean on a medical device?

CE marking on a medical device indicates that the manufacturer declares the device conforms to all applicable requirements of the EU Medical Device Regulation (MDR) 2017/745 or the In Vitro Diagnostic Regulation (IVDR) 2017/746. It confirms the device has undergone the applicable conformity assessment procedure and meets the General Safety and Performance Requirements. CE marking is the legal prerequisite for placing a medical device on the market in the European Economic Area.

Can a manufacturer self-certify CE marking?

Yes, but only for specific device classes. Under the MDR, manufacturers can self-declare conformity and affix the CE mark for Class I medical devices that are non-sterile, non-measuring, and non-reusable surgical instruments. Under the IVDR, Class A non-sterile IVDs can be self-declared. All other device classes require Notified Body involvement.

How long does it take to get CE marking?

Timelines range from 3–6 months for self-declared Class I devices to 18–36 months for Class III devices. The primary variables are device classification, the manufacturer's QMS maturity, completeness of technical documentation, clinical evidence availability, and Notified Body capacity. As of 2026, NB queue times of 6–12 months before the first audit are common.

How long is a CE certificate valid?

CE certificates issued by Notified Bodies under the current MDR rules are valid for a maximum of five years. The manufacturer must undergo annual surveillance audits and a full re-certification before expiration. The European Commission's December 2025 simplification proposal would remove the five-year cap if adopted.

What is the difference between CE marking and FDA approval?

CE marking is the manufacturer's self-declaration (supported by conformity assessment) that a device meets EU regulatory requirements. FDA approval (PMA) or clearance (510(k)) is a decision made by the FDA after its own review. The regulatory frameworks, classification systems, clinical evidence requirements, and post-market obligations differ significantly between the EU and US. A CE-marked device is not automatically cleared for sale in the US, and vice versa.

Do I need a Notified Body for CE marking?

It depends on your device classification. Standard Class I medical devices and Class A non-sterile IVDs do not require a Notified Body — the manufacturer self-declares conformity. All other classes (Class Is/Im/Ir, IIa, IIb, III, and Class A sterile, B, C, D IVDs) require Notified Body involvement at varying levels of scrutiny.

What happens if I place a device on the EU market without CE marking?

Placing a device without CE marking — or with improper CE marking — constitutes a regulatory violation. Consequences include prohibition of market access, product seizure and recall, enforcement actions by Competent Authorities (fines, injunctions), withdrawal or suspension of certificates, import refusal at EU borders, and reputational damage.

Can CE marking be transferred if I sell my device to another company?

CE marking does not transfer automatically. The new legal manufacturer must ensure the device continues to meet all applicable requirements, update the Declaration of Conformity, revise labeling and technical documentation to reflect the new manufacturer, notify the Notified Body, and update EUDAMED registrations. In practice, this often requires a new or amended conformity assessment.

What is the role of EUDAMED in CE marking?

EUDAMED is the European database for medical devices. From 28 May 2026, manufacturers must register their devices (including UDI data), economic operator information, and related certificates in EUDAMED before placing new devices on the market. EUDAMED provides regulatory transparency and supports traceability, post-market surveillance, and market surveillance across the EU.

How much does CE marking cost?

Costs vary by device class. Self-declared Class I devices may achieve CE marking for $25,000–$80,000 total. Class IIa devices typically cost $80,000–$250,000. Class IIb devices range from $150,000–$500,000. Class III devices can exceed $1 million when clinical investigations are required. Major cost drivers include QMS development, technical documentation, clinical evaluation, Notified Body fees, and regulatory consulting.

What is the difference between a CE mark and a CE certificate?

The CE mark is the physical symbol affixed to the device by the manufacturer, declaring conformity with applicable EU regulations. A CE certificate is the formal document issued by a Notified Body confirming that the device (and/or the manufacturer's QMS) meets MDR requirements after a conformity assessment. Not all CE-marked devices have a CE certificate — Class I self-declared devices carry the CE mark without a Notified Body certificate.

Can I use my MDD CE certificate under the MDR?

MDD certificates that were valid before 26 May 2021 can be used to continue placing legacy devices on the market under the extended transition provisions — but only if specific conditions are met (no significant changes, NB application submitted by the applicable deadline, etc.). An MDD certificate does not satisfy MDR requirements. You must eventually obtain an MDR certificate through a Notified Body designated under the MDR.

What is EUDAMED and is it mandatory?

EUDAMED (European Database on Medical Devices) is the EU's centralized database for medical devices. Four modules became mandatory on 28 May 2026: Actor Registration, UDI/Device Registration, Notified Bodies and Certificates, and Market Surveillance. From that date, new devices must be registered in EUDAMED before market placement, and legacy devices must be registered by 28 November 2026.

What harmonized standards should I use for CE marking?

The specific harmonized standards depend on your device type and technology. Universal standards include EN ISO 13485 (QMS), EN ISO 14971 (risk management), and EN ISO 15223-1 (symbols for labeling). Device-specific standards — such as the EN IEC 60601 series for electrical medical equipment, EN IEC 62304 for medical device software, or the EN ISO 10993 series for biocompatibility — apply based on your device's characteristics. Always use the European harmonized version (EN ISO / EN IEC) with the applicable Annex ZA, not just the ISO or IEC version.

What happens when I make a design change to a CE-marked device?

Every change to a CE-marked device must be evaluated for its impact on safety, performance, and regulatory compliance. Non-substantial changes — such as cosmetic modifications or minor documentation corrections — can be managed internally through your change control process. Substantial changes — such as modifications to the intended purpose, materials in patient contact, sterilization method, or clinical functionality — must be notified to the Notified Body before implementation. The NB will determine whether a supplementary assessment, updated certificate, or special audit is required. Failure to notify the NB of substantial changes can result in certificate suspension.

What is a STED and is it required for CE marking?

A Summary Technical Documentation (STED) is a structured format for organizing technical documentation, originally developed by the IMDRF (International Medical Device Regulators Forum). While the MDR does not mandate the STED format specifically — it defines its own documentation requirements in Annexes II and III — many manufacturers use the STED structure as a framework for organizing their technical file because it is widely recognized by Notified Bodies and facilitates parallel submissions to multiple regulatory jurisdictions (e.g., EU and certain IMDRF member countries). Whether you use the STED format or structure your documentation directly around MDR Annexes II and III, the content requirements are the same.

Can a non-EU manufacturer obtain CE marking?

Yes. Non-EU manufacturers can obtain CE marking for their medical devices, but they must appoint an EU Authorized Representative established within the EU before placing devices on the market. The Authorized Representative acts as the legal liaison with EU regulators, and their name and address must appear on the device label. The Notified Body can be located in any EU member state — it does not need to be in the same country as the Authorized Representative. All other requirements (QMS, technical documentation, clinical evaluation, PMS, EUDAMED registration) apply equally to EU and non-EU manufacturers.

What is the difference between CE marking and ISO 13485 certification?

These are related but distinct. ISO 13485 certification confirms that a manufacturer's quality management system meets the requirements of the ISO 13485 standard — it is issued by a certification body (which may or may not be a Notified Body). CE marking is the manufacturer's declaration that the device itself meets the requirements of the MDR or IVDR. ISO 13485 certification alone does not authorize market placement; CE marking does. However, in practice, the two are closely linked: Notified Bodies use ISO 13485 as the benchmark for QMS assessment under the MDR (Annex IX), and most manufacturers pursue ISO 13485 certification as part of their CE marking process. A manufacturer can hold ISO 13485 certification without CE marking (e.g., a contract manufacturer not placing devices on the market), and a Class I device manufacturer can have CE marking without formal ISO 13485 certification (though having a documented QMS is still required).

Does CE marking apply to custom-made devices?

Custom-made devices — devices specifically made in accordance with a written prescription for a named patient — follow a modified regulatory pathway. They do not carry the CE mark. Instead, the manufacturer must draw up a statement per Annex XIII of the MDR containing the device's identification data, intended purpose, and a declaration that the device conforms to the General Safety and Performance Requirements. For Class III custom-made implantable devices, Notified Body involvement is required (by 26 May 2026), and the manufacturer must maintain documentation available for Competent Authorities. All other custom-made devices are exempt from Notified Body involvement but must still comply with relevant GSPRs.

What are Common Specifications and when are they used?

Common Specifications (CS) are technical requirements — established by the European Commission through implementing acts — that provide alternative means of demonstrating conformity with specific GSPRs when no harmonized standard exists or when harmonized standards are insufficient. Unlike harmonized standards, Common Specifications are mandatory: if a CS exists for a requirement, the manufacturer must follow it unless they can demonstrate that their alternative solution provides an equivalent or higher level of safety and performance. Notable examples include the CS for the reprocessing of single-use devices (Implementing Regulation (EU) 2020/1207) and the CS for IVD performance evaluation (Implementing Regulation (EU) 2022/1107).

Key Takeaways

1. CE marking is a legal obligation, not a quality award. It is the manufacturer's declaration that the device meets all applicable EU regulatory requirements. Without it, your device cannot enter the European market.

2. Classification drives everything. Your device class determines the conformity assessment route, Notified Body involvement, clinical evidence requirements, and post-market obligations. Get classification right first.

3. The MDR is fundamentally more demanding than the MDD. Clinical evidence requirements, post-market surveillance obligations, and technical documentation standards have all been raised significantly. Do not underestimate the gap between MDD and MDR compliance.

4. Notified Body capacity is a strategic constraint. With limited NBs and converging transition deadlines, early engagement is essential. Wait times of 12–18 months are common for higher-risk devices.

5. Technical documentation must be specific and traceable. Vague references in GSPR checklists, incomplete clinical evaluations, and disorganized risk management files are the most common reasons for Notified Body rejections and delays.

6. Post-market obligations are substantial and continuous. CE marking is not a one-time achievement. PMS plans, PSURs, PMCF, vigilance reporting, and SSCP documents require ongoing resources and attention.

7. EUDAMED becomes mandatory in May 2026. Manufacturers must be prepared to register devices and UDI data in EUDAMED before placing new devices on the market from 28 May 2026.

8. The regulatory landscape is evolving. The December 2025 simplification proposal, new harmonized standards, and ongoing EUDAMED rollout mean manufacturers must stay current with regulatory developments. Build your compliance strategy on current requirements while monitoring upcoming changes.

9. Budget for contingencies. CE marking costs frequently exceed initial estimates by 20–30%. Clinical evaluation gaps, NB questions, QMS nonconformities, and scheduling delays are common sources of overruns.

10. Plan for multi-market access. If you sell in both the EU and UK, monitor UKCA developments closely. If the MHRA adopts indefinite CE recognition, maintaining CE marking alone could provide access to both markets. If not, dual conformity assessment will be required.