EU MDR Notified Bodies & Conformity Assessment: Complete Guide for Medical Device Manufacturers

Everything you need to know about EU MDR Notified Bodies and conformity assessment — how to select a Notified Body, assessment routes by device class (Annexes IX–XI), audit process, timeline, costs, and the 2025/2026 regulatory landscape.

Why Notified Bodies Matter Under EU MDR

If you manufacture a medical device classified as Class IIa, IIb, or III under the EU Medical Device Regulation (MDR 2017/745), you cannot place it on the European market without a Notified Body. There is no workaround, no self-declaration alternative, and no shortcut. The Notified Body is the independent organization that assesses whether your device meets the essential safety and performance requirements of the MDR before you affix the CE mark.

Under the old Medical Devices Directive (MDD), some manufacturers treated Notified Body interaction as a procedural formality. The MDR ended that era. Notified Bodies now operate under far stricter designation criteria, face joint oversight from the European Commission and other member states, and are required to apply a level of scrutiny that would have been unusual under the MDD. The result is a more rigorous process — and one that takes significantly longer.

This guide covers every aspect of Notified Bodies and conformity assessment under the EU MDR: what Notified Bodies are, which assessment routes apply to your device class, how to select and apply to a Notified Body, what the audit process looks like, realistic timelines and costs, and how the regulatory landscape is evolving in 2025 and 2026.

What is a Notified Body?

Legal Definition

Under MDR Article 2(42), a Notified Body is "a conformity assessment body designated by the competent authority of a Member State to carry out conformity assessment activities under this Regulation." In plain terms, it is an independent, third-party organization that a European Union member state has authorized to assess whether medical devices comply with the MDR before they receive a CE mark.

Role and Responsibilities

Notified Bodies perform several critical functions under the MDR:

Conformity assessment. They review technical documentation, audit quality management systems, examine device designs, and verify production quality — depending on the assessment route applicable to your device class.
Certificate issuance. They issue EU-type examination certificates (Annex X), EU quality management system certificates (Annex IX), and EU product quality assurance certificates (Annex XI), among others.
Ongoing surveillance. They conduct annual surveillance audits, unannounced audits, and periodic reassessments to ensure manufacturers maintain compliance throughout the certificate's validity.
Suspension and withdrawal. They can restrict, suspend, or withdraw certificates if a manufacturer no longer meets requirements — with serious consequences for market access.
Reporting obligations. They must inform the designating authority, other Notified Bodies, and the European Commission about certificates issued, refused, restricted, suspended, or withdrawn.

Designation Under Annex VII

Notified Bodies are not self-appointed. The designation process under MDR Annex VII is the most rigorous in the history of European medical device regulation. It includes:

Application to a national Competent Authority. The conformity assessment body applies to the authority in the EU member state where it is established.
Assessment of competence. The Competent Authority evaluates whether the body has the organizational structure, personnel, expertise, infrastructure, and impartiality to perform conformity assessment for the scope of devices it seeks designation for.
Joint assessment. The European Commission and other member states participate in the assessment. This is a major change from the MDD, where designation was purely a national matter. Joint assessment ensures consistent standards across the EU.
Designation decision. If the body meets all requirements, the member state designates it and notifies the European Commission.
NANDO listing. The designated body appears in the NANDO database (New Approach Notified and Designated Organizations) with its specific scope of designation — including device types, classification ranges, and applicable conformity assessment annexes.

The process is long. Under the MDR, it typically takes 18 to 24 months from application to full designation. Under the MDD, it was sometimes completed in under six months. The difference reflects the fundamentally higher bar the MDR sets.

Relationship With Competent Authorities and the European Commission

Notified Bodies operate within a structured oversight architecture:

National Competent Authorities designate Notified Bodies, supervise their ongoing performance, and can withdraw designation if standards are not maintained.
The European Commission coordinates joint assessments, maintains the NANDO database, and can investigate whether a Notified Body is meeting its obligations.
The Medical Device Coordination Group (MDCG) provides guidance that Notified Bodies must follow on interpretation of MDR requirements.
Team NB and other Notified Body groups facilitate coordination and consistency among Notified Bodies but do not have regulatory authority.

This multi-layered oversight structure was designed to prevent the inconsistencies that plagued the MDD era, where some Notified Bodies were perceived as less rigorous than others.

The MDR Notified Body Landscape

Current Numbers

As of early 2026, the Notified Body landscape under the MDR looks like this:

Category	Count
Notified Bodies designated under MDR	Approximately 45-50
Notified Bodies designated under IVDR	Approximately 10-12
Notified Bodies that have withdrawn or plan to withdraw from MDR designation	Approximately 15-20 former MDD NBs

The number of designated Notified Bodies has grown steadily since the first designations in late 2019. However, the pool remains significantly smaller than the approximately 80 Notified Bodies that operated under the MDD.

Capacity Constraints

This is the central problem. Roughly 45 Notified Bodies are now designated under the MDR, but they must absorb the conformity assessment workload that was previously distributed across approximately 80 MDD Notified Bodies — and the MDR requires significantly more work per assessment than the MDD did. The result is a persistent capacity gap.

Key dimensions of the capacity problem:

Application backlogs. Many Notified Bodies have waiting lists of 6 to 12 months or longer before they can begin a new conformity assessment.
Staff shortages. The MDR requires Notified Body personnel to have specific qualifications and experience. Recruiting and training enough qualified auditors and reviewers has been a persistent challenge.
Increased scrutiny per device. MDR conformity assessment requires more detailed technical documentation review, more rigorous clinical evidence evaluation, and more extensive QMS auditing than the MDD. Each assessment takes longer.
Geographic concentration. Most designated Notified Bodies are based in Germany, the Netherlands, the United Kingdom (before Brexit), Italy, and France. Manufacturers in other regions may face longer timelines due to geographic and language considerations.

The NANDO Database

The NANDO database is the authoritative source for verifying a Notified Body's designation status and scope. It is maintained by the European Commission and available online.

Each Notified Body entry in NANDO specifies:

The body's name and four-digit identification number (e.g., BSI's UK Notified Body number is 0086; TUV SUD's is 0123)
The member state that designated it
The regulatory framework(s) under which it is designated (MDR, IVDR, or both)
The scope of designation, including:
- Device types and classification ranges (e.g., Class IIa, IIb, III; active devices; implantable devices)
- Conformity assessment annexes (e.g., Annex IX, Annex X, Annex XI Parts A and B)
- Relevant codes from the European Databank on Medical Devices (EUDAMED) nomenclature
- Any restrictions or conditions on the designation

You can search NANDO at the European Commission's website by filtering on regulation, member state, device type, and conformity assessment annex.

Conformity Assessment Routes by Device Class

The conformity assessment route your device must follow depends on its risk classification under MDR Annex VIII. The MDR provides several annexes that define different assessment procedures, and the applicable annexes vary by class.

Complete Conformity Assessment Table: Medical Devices (MDR)

Device Class	Conformity Assessment Route(s)	Notified Body Involvement	CE Marking Basis
Class I (non-sterile, non-measuring, non-reusable surgical instrument)	Self-declaration (Article 52(7))	None	Self-declaration of conformity
Class Is (sterile)	Annex IX Chapters I and III, or Annex XI Part A (sterility aspects only)	Yes — for sterilization aspects	NB certificate + self-declaration
Class Im (measuring function)	Annex IX Chapters I and III, or Annex XI Part A (measuring aspects only)	Yes — for metrological aspects	NB certificate + self-declaration
Class Ir (reusable surgical instruments)	Annex IX Chapters I and III, or Annex XI Part A (reuse aspects only)	Yes — for reprocessing aspects	NB certificate + self-declaration
Class IIa	Annex IX Chapters I and III, or Annex XI Part A	Full NB assessment required	NB certificate
Class IIb	Annex IX (all chapters), or Annex X + Annex XI Part A	Full NB assessment required	NB certificate
Class III	Annex IX (all chapters), or Annex X + Annex XI Part A	Full NB assessment required + scrutiny procedure for certain devices	NB certificate
Class IIb/III implantable	Same as Class IIb/III above, plus additional clinical evidence requirements and SSCP	Full NB assessment + additional clinical scrutiny	NB certificate

Complete Conformity Assessment Table: IVDs (IVDR)

Device Class	Conformity Assessment Route(s)	Notified Body Involvement
Class A	Self-declaration (Article 48(6))	None
Class B	Annex IX Chapters I and III, or Annex XI Part A	Full NB assessment
Class C	Annex IX (all chapters), or Annex X + Annex XI Part A	Full NB assessment
Class D	Annex IX (all chapters), or Annex X + Annex XI Part A	Full NB assessment + consultation with EU reference laboratories

Understanding the Annexes

The MDR provides three primary conformity assessment annexes, each with a different focus:

Annex IX — Full quality management system and technical documentation. The most comprehensive route. The Notified Body assesses both the manufacturer's QMS (Chapter I) and the technical documentation for representative devices (Chapter II), plus surveillance (Chapter III).
Annex X — EU type examination (design review). The Notified Body examines the device design and technical documentation to certify that the device type meets MDR requirements. This is a product-focused assessment.
Annex XI Part A — Product quality assurance (production QMS). The Notified Body assesses the manufacturer's production quality assurance system. This is a process-focused assessment.
Annex XI Part B — Product verification. The Notified Body examines and tests each product or a statistical sample to verify conformity.

Annex IX: Full Quality Management System and Technical Documentation

Annex IX is the most commonly used conformity assessment route and is available for all device classes that require Notified Body involvement. It has three chapters.

Chapter I: Quality Management System Assessment

This chapter requires the Notified Body to conduct a full audit of the manufacturer's quality management system. Key elements:

Scope. The QMS must cover all aspects of device design, manufacture, and post-market surveillance. For manufacturers who only manufacture (without design), the QMS scope is limited accordingly.
Standard. The QMS must be in conformity with EN ISO 13485 (or an equivalent harmonized standard). The Notified Body audits against both ISO 13485 and the MDR's QMS requirements simultaneously.
Audit duration. Initial certification audits typically last 3 to 8 days on-site (or remote, where permitted), depending on the manufacturer's size, number of sites, scope of devices, and complexity.
Documentation review. Before the on-site audit, the Notified Body reviews the manufacturer's quality manual, key procedures, and a description of the QMS structure.
Nonconformity management. Any nonconformities identified during the audit are classified as major or minor. Major nonconformities must be resolved before a certificate can be issued.
Certificate issuance. If the QMS meets all requirements, the Notified Body issues an EU quality management system certificate. This certificate is valid for up to five years.

Chapter II: Technical Documentation Assessment

This chapter requires the Notified Body to assess the technical documentation for the device(s) covered by the application:

Documentation required. Full technical documentation as specified in MDR Annexes II and III — including device description, intended purpose, risk management file, clinical evaluation report, biocompatibility data, sterilization validation, software documentation, labeling, and instructions for use.
Sampling approach. For Class IIa and Class IIb devices, the Notified Body assesses a representative sample of technical documentation from each device category. For Class III and implantable Class IIb devices, every device's technical documentation must be assessed.
Assessment depth. The Notified Body reviews the documentation for completeness, scientific validity, and compliance with General Safety and Performance Requirements (GSPRs). This includes a detailed review of the clinical evaluation report, risk-benefit analysis, and post-market surveillance plan.
Additional procedures for Class III and implantables. For these devices, the Notified Body must also consider whether a clinical investigation consultation procedure (scrutiny) applies, whether an additional expert panel review is needed, and whether the Summary of Safety and Clinical Performance (SSCP) is adequate.

Chapter III: Surveillance

Ongoing surveillance ensures that the manufacturer continues to comply with the certified QMS and that devices placed on the market remain conformant:

Annual surveillance audits. The Notified Body conducts an audit at least once per year to verify continued QMS compliance.
Sampling of technical documentation. During surveillance, the Notified Body may select additional technical documentation for review, particularly if new devices have been added or significant changes have been made.
Reassessment. Every five years (at certificate renewal), a full reassessment of the QMS and representative technical documentation is conducted.

Annex X: EU Type Examination

Annex X is the product-focused conformity assessment route. It is used in combination with Annex XI Part A for Class IIb and Class III devices (as an alternative to the full Annex IX route).

What Type Examination Involves

Under Annex X, the Notified Body:

Examines the technical documentation. This includes the device description, manufacturing process, design drawings, risk analysis, clinical evaluation, test reports, labeling, and instructions for use — everything needed to establish that the device meets GSPRs.
Assesses the design. The Notified Body reviews the design to verify it meets the MDR's essential requirements. This may include reviewing design verification and validation data.
May conduct or arrange testing. If the documentation alone is not sufficient, the Notified Body may request additional testing — either by the manufacturer, by the Notified Body's own laboratory, or by a contracted laboratory.
Issues an EU type-examination certificate. If the device type conforms to the MDR's requirements, the Notified Body issues an EU type-examination certificate. This certificate covers the specific device type as described in the documentation.

When Annex X Is Used

As the product-assessment component in the Annex X + Annex XI Part A combination route (for Class IIb and III devices)
When a manufacturer wants to certify a specific device design independently of production quality assurance
When a manufacturer produces devices at multiple sites and wants design approval separate from production assessment

Validity and Changes

EU type-examination certificates are valid for up to five years. Significant changes to the approved device type require a supplementary assessment and potentially a certificate amendment or extension.

Annex XI: Product Quality Assurance and Product Verification

Part A: Product Quality Assurance (Production QMS)

Annex XI Part A focuses on the manufacturer's production quality assurance system. It is the production-focused complement to Annex X's design focus, and is used:

As the production-assessment component in the Annex X + Annex XI Part A route for Class IIb and III
As a standalone route for Class IIa (in combination with QMS assessment elements)
For Class Is, Im, and Ir devices (limited to the specific aspects requiring Notified Body involvement)

The Notified Body assesses:

The manufacturer's production, final inspection, and testing processes
Quality assurance procedures for each product type
The manufacturer's ability to maintain consistent product quality
Compliance with the approved design (if assessed under Annex X)

The Notified Body issues an EU product quality assurance certificate covering the approved production quality system.

Part B: Product Verification

Annex XI Part B is the least commonly used route. It involves the Notified Body examining and testing each individual product (or a statistical sample from each production batch) to verify conformity with the type described in the EU type-examination certificate.

Part B is rarely used in practice because it is operationally burdensome — the Notified Body must be involved in the verification of every batch. It is primarily relevant for custom-made devices or very low-volume, high-risk devices where batch-level verification is appropriate.

How to Select a Notified Body

Selecting a Notified Body is one of the most consequential decisions a medical device manufacturer makes. The wrong choice can result in delays of years, significant additional costs, and even failure to achieve certification. Here are the factors to consider:

Scope of Designation

This is the first and most important filter. A Notified Body must be designated for:

The correct regulation (MDR, IVDR, or both)
The correct device classification (not all Notified Bodies are designated for all classes — some are limited to Class IIa and IIb, for example)
The correct device type (the NANDO database lists specific codes for the types of devices each NB is designated to assess)
The correct conformity assessment annex(es) (not all NBs are designated for all annexes)

If a Notified Body is not designated for your device class and type, they cannot assess your device. Period. Check NANDO first.

Capacity and Availability

Even if a Notified Body has the right scope, they may not have the capacity to take on your assessment within a reasonable timeframe:

Ask about current waiting times for new applications
Ask about their typical timeline from application to certificate issuance
Consider whether the Notified Body has adequate staffing for your device type — some NBs are heavily backlogged in certain device categories (e.g., orthopedic implants, active devices, software as a medical device)

Geography and Language

While any EU-designated Notified Body can assess devices for any market within the EU (a certificate from a German NB is valid across all member states), practical considerations matter:

Language. Can the Notified Body conduct audits and review documentation in your language or a language your team is comfortable with?
Location. On-site audits will require auditors to travel to your manufacturing sites. A Notified Body with auditors in your region may offer shorter scheduling lead times.
Time zone. Remote audits and communication are more efficient when you share working hours.

Cost

Notified Body fees vary significantly. Typical cost drivers include:

Application fee. One-time fee for processing your application.
Audit fees. Charged per day of auditing (typically EUR 1,500 to EUR 3,500 per auditor per day, plus travel expenses).
Technical documentation review fees. Charged per documentation set reviewed.
Certificate fees. Issuance and annual maintenance fees.
Surveillance audit fees. Annual ongoing costs.

For a small-to-medium manufacturer with a Class IIb device, total costs from application through first certification typically range from EUR 50,000 to EUR 150,000. For Class III implantable devices, costs can exceed EUR 200,000. These are rough ranges; actual costs depend heavily on the number of devices, the complexity of the product portfolio, and the specific Notified Body.

Reputation and Track Record

Not all Notified Bodies are equal in experience, expertise, and consistency:

How long has the Notified Body been operating under the MDR? Early designees (2019-2020) have more MDR-specific experience.
What is their track record with your device type? A Notified Body experienced with orthopedic implants may not be the best choice for in vitro diagnostics, even if their designation technically covers both.
What do other manufacturers say? Industry forums, trade associations, and peer networks can provide practical insights.
Have they had any designations restricted or withdrawn? Check the NANDO database for any limitations on their scope.

Subcontracting

Some Notified Bodies subcontract portions of their assessment work (e.g., specific testing or clinical evaluation review) to external experts. This is permitted under the MDR, but you should understand:

Whether the Notified Body plans to subcontract any part of your assessment
Who the subcontractors are and what their qualifications are
How the Notified Body maintains oversight of subcontracted work
Whether subcontracting will affect your timeline

The Application Process: Step-by-Step

Here is what the conformity assessment process looks like in practice, from initial contact to certificate issuance.

Step 1: Preparation (2-6 Months Before Application)

Before you approach a Notified Body, you should have:

A complete or near-complete quality management system conforming to EN ISO 13485
Technical documentation for your device(s) that addresses all elements of MDR Annexes II and III
A clinical evaluation report that meets MDR Article 61 and Annex XIV requirements
A risk management file (ISO 14971)
Post-market surveillance plan and PMCF plan (if applicable)
Labeling and instructions for use that comply with MDR Annex I requirements
UDI assignment for your devices

Step 2: Notified Body Selection and Initial Contact

Shortlist Notified Bodies based on scope, capacity, geography, cost, and reputation (as described above)
Verify their designation status in NANDO
Contact your top choices to discuss your device portfolio, classification, and timeline
Request a formal quote and timeline estimate

Step 3: Formal Application

Submit the formal application to your chosen Notified Body
Provide a description of your organization, manufacturing sites, device portfolio, and intended scope of certification
Include preliminary technical documentation (or a summary) for the devices to be assessed
Sign the conformity assessment agreement, which will specify the scope, timeline, fees, and terms

Step 4: Documentation Review (1-4 Months)

The Notified Body reviews your submitted documentation:

QMS documentation (quality manual, key procedures, organizational structure)
Technical documentation for representative devices
Clinical evaluation report
Risk management file
Any supplementary information the NB requests

The Notified Body will likely issue requests for additional information (RFIs) during this phase. Respond promptly and completely — delays in RFI responses are one of the most common causes of timeline slippage.

Step 5: On-Site Audit (1-2 Weeks On-Site, Plus Follow-Up)

The Notified Body conducts an audit of your quality management system:

Opening meeting to confirm scope and logistics
Interviews with key personnel (management, R&D, quality, regulatory, manufacturing, etc.)
Review of records, procedures, and objective evidence
Facility walkthroughs (manufacturing areas, storage, laboratories)
Closing meeting to present findings

Step 6: Nonconformity Resolution (1-3 Months)

Almost all initial audits result in nonconformities:

Major nonconformities must be resolved and verified before any certificate can be issued. Typically, the manufacturer submits a corrective action plan, implements the corrections, and the Notified Body verifies effectiveness (sometimes through a follow-up audit).
Minor nonconformities must be addressed within an agreed timeframe (usually 90 days). Certification may proceed with a commitment to resolve them.

Step 7: Technical Documentation Review Completion

In parallel with or after the QMS audit, the Notified Body completes its review of your technical documentation. This may involve:

Additional questions or clarification requests
Requests for additional testing or clinical data
Review of design changes made since the initial submission

Step 8: Certificate Issuance

If all requirements are met:

The Notified Body issues the relevant certificate(s) — EU QMS certificate, EU type-examination certificate, or EU product quality assurance certificate, depending on the assessment route
The certificate specifies the scope (devices, classification, manufacturing sites)
The certificate is valid for up to five years, subject to annual surveillance
You can now draw up your EU Declaration of Conformity and affix the CE mark to your devices

Timeline and Costs: Realistic Expectations

Timeline

The total time from application to certificate issuance varies significantly. Based on industry experience as of 2025-2026:

Stage	Typical Duration
Application to audit scheduling	3-9 months (depends on NB backlog)
Documentation review	1-4 months
On-site audit	1-2 weeks (on-site)
Nonconformity resolution	1-3 months
Technical documentation review completion	2-6 months (may overlap with other stages)
Certificate issuance	1-2 months after all requirements met
Total: Application to certificate	6-18 months

For manufacturers with complex devices (Class III implantables, novel technologies, devices requiring clinical investigations), the timeline can extend to 24 months or more.

Costs

Costs vary widely based on device class, number of devices, manufacturing sites, and the specific Notified Body. The following ranges are indicative:

Cost Category	Typical Range (EUR)
Application fee	5,000 - 20,000
QMS audit (initial, per site)	15,000 - 50,000
Technical documentation review (per device family)	10,000 - 40,000
Type examination (per device type, if applicable)	10,000 - 30,000
Certificate issuance	2,000 - 10,000
Annual surveillance audit	10,000 - 30,000
Total: Initial certification (single Class IIa/IIb device)	50,000 - 150,000
Total: Initial certification (Class III implantable)	100,000 - 250,000+

These are rough estimates. Always obtain a detailed, written quote from your chosen Notified Body before committing.

Transition from MDD to MDR

The transition from the Medical Devices Directive to the Medical Device Regulation is the largest compliance undertaking the European medical device industry has ever faced. Regulation (EU) 2023/607, adopted in March 2023, extended transition timelines, but the fundamental requirement remains: all devices on the EU market must eventually comply with the MDR.

Transition Deadlines by Device Class

Device Category	Deadline for MDR Compliance
Class III implantable devices (certified under MDD/AIMDD)	December 31, 2027
Class IIb implantable devices (certified under MDD/AIMDD)	December 31, 2027
Class IIb non-implantable devices (certified under MDD)	December 31, 2028
Class IIa devices (certified under MDD)	December 31, 2028
Class Is, Im, Ir devices requiring NB involvement	December 31, 2028
Class I self-declared devices	Already required to comply with MDR (from May 26, 2021)

Conditions for Extended Transition

To benefit from the extended deadlines, manufacturers must meet several conditions:

The device must have been certified under the MDD or AIMDD before May 26, 2021 (the MDR date of application)
The device must not have undergone significant changes in design or intended purpose
The device must not present an unacceptable risk to health or safety
The manufacturer must have submitted a formal application to a Notified Body for MDR conformity assessment by May 26, 2024 (for higher-risk devices) or by May 26, 2025 (for lower-risk devices)
The manufacturer must have signed a written agreement with the Notified Body by September 26, 2024 (for higher-risk) or September 26, 2025 (for lower-risk)
The manufacturer must continue to meet MDD requirements and MDR post-market surveillance requirements during the transition period

Strategic Implications

The transition deadlines are not aspirational — they are legally binding. Manufacturers who fail to meet them face the loss of market access for affected devices. The key strategic decisions are:

Which devices to transition and which to discontinue. Given the cost and complexity of MDR conformity assessment, many manufacturers are rationalizing their portfolios and focusing on their most commercially important devices.
When to apply to a Notified Body. Earlier is better. Waiting lists are long, and the deadlines will not be extended again.
Whether to use the same Notified Body or switch. Some manufacturers are switching from their MDD Notified Body to one with more MDR capacity or expertise. This is possible but adds complexity.

Structured Dialogue: A New MDR Concept

The MDR introduced the concept of "structured dialogue" (Article 55a, added by Regulation 2023/607) as a mechanism for manufacturers and Notified Bodies to engage in early, focused discussions before and during the conformity assessment process.

What Structured Dialogue Covers

Clarification of regulatory expectations for specific devices
Discussion of the appropriate conformity assessment route
Agreement on the scope and depth of clinical evidence required
Identification of relevant guidance documents and harmonized standards
Discussion of whether additional expert consultation is needed (e.g., for novel technologies)

When It Occurs

Structured dialogue can take place:

Before a manufacturer submits a formal application (pre-application dialogue)
During the conformity assessment process (to address specific questions as they arise)
When significant changes to a device are being planned

Why It Matters

Structured dialogue is particularly valuable for manufacturers of novel or complex devices, where the applicable regulatory requirements may not be entirely straightforward. It reduces the risk of surprises during the assessment process and can help align expectations between the manufacturer and the Notified Body.

Not all Notified Bodies offer structured dialogue as a formal service, and some charge additional fees for it. Ask about availability and terms when selecting a Notified Body.

Surveillance Audits

Obtaining a certificate is not the end of the Notified Body relationship — it is the beginning. The MDR requires ongoing surveillance to ensure continued compliance.

Annual Surveillance Audits

The Notified Body conducts an audit at least once per year. These audits are less extensive than the initial certification audit but cover:

Continued effectiveness of the QMS
Implementation of any corrective actions from previous audits
Review of post-market surveillance data and vigilance reports
Sampling of technical documentation (particularly for new or modified devices)
Review of any significant changes to the device, manufacturing process, or QMS
Verification that the manufacturer is meeting its obligations under the MDR

Periodic Reassessment (Recertification)

Every five years (at certificate renewal), the Notified Body conducts a full reassessment:

Complete QMS audit
Fresh review of representative technical documentation
Updated assessment of clinical evidence
Review of the manufacturer's post-market surveillance and vigilance track record
Issuance of a new five-year certificate (if all requirements are met)

Unannounced Audits

The MDR requires Notified Bodies to conduct unannounced audits. Key points:

The Notified Body may arrive at your manufacturing site(s) without prior notice
These audits are conducted at least once every five years for each manufacturer, and more frequently if risk factors warrant it
The audit may include checking production processes, reviewing records, and verifying that devices on the market conform to the certified type
You must have procedures to receive and cooperate with unannounced audits

Certificate Changes and Extensions

If you make significant changes to your device, manufacturing process, or QMS, you must notify your Notified Body. Depending on the nature of the change:

Some changes can be approved through a documentation review (notification)
Some require a partial audit or assessment
Some require a full re-evaluation

Always discuss planned changes with your Notified Body before implementing them. Implementing a significant change without Notified Body approval can result in certificate suspension.

Common Audit Findings

Notified Body audits under the MDR are more rigorous than MDD audits were. Understanding the most common findings can help you prepare more effectively.

Quality Management System Findings

The most frequently cited QMS nonconformities include:

Incomplete design control procedures. Missing or inadequate design input/output requirements, design verification and validation plans, or design transfer procedures.
Inadequate risk management integration. Risk management treated as a separate exercise rather than integrated throughout the product lifecycle — from design inputs through post-market surveillance.
Software validation gaps. Software used in the quality management system (QMS software, ERP systems, complaint handling databases) not validated to the level required.
Supplier management weaknesses. Inadequate supplier qualification, monitoring, or control — particularly for critical suppliers and contract manufacturers.
Post-market surveillance system immaturity. PMS plans that exist on paper but are not fully implemented, or that do not generate meaningful data for trending and signal detection.
Training and competence. Insufficient documentation of training effectiveness, or a disconnect between assigned responsibilities and documented competence.

Technical Documentation Findings

Technical documentation is where the MDR's requirements are most significantly expanded compared to the MDD. Common findings include:

Incomplete documentation. Industry estimates suggest that approximately 75% of initial technical documentation submissions to Notified Bodies are 50% or less complete relative to MDR Annex II and III requirements. This is the single biggest driver of timeline delays.
Inadequate clinical evaluation. Clinical evaluation reports that do not meet MDR Article 61 requirements, rely on insufficient clinical data, fail to address equivalence claims properly, or lack a clear clinical development plan.
Weak risk-benefit analysis. Risk management files that list risks but do not demonstrate a systematic risk-benefit analysis, or that do not address residual risks adequately in the instructions for use.
Missing or inadequate post-market clinical follow-up (PMCF) plans. Especially for Class IIb and III devices where PMCF is expected.
Labeling non-compliance. Instructions for use that do not meet MDR Annex I requirements, missing UDI information, or non-compliant symbols and statements.
GSPR matrix gaps. The General Safety and Performance Requirements (GSPR) checklist is incomplete or does not map evidence to each applicable requirement.

Clinical Evidence Gaps

The MDR demands substantially more clinical evidence than the MDD, and this is where many manufacturers — particularly those transitioning legacy devices — encounter the most difficulty:

Over-reliance on literature. Clinical evaluation reports that depend entirely on published literature without demonstrating relevance to the specific device and its intended use.
Equivalence issues. Manufacturers claiming equivalence to a predicate device without providing adequate evidence of biological, technical, and clinical equivalence — or where the predicate's clinical data is insufficient under MDR standards.
Absence of PMCF data. For devices that have been on the market for years, the absence of any systematic post-market clinical data collection is a significant finding.
Insufficient clinical investigation data. For Class III and implantable devices, the lack of clinical investigation data without adequate justification.

Recent Developments and the Evolving Landscape

The 2025 Simplification Proposal

In December 2025, the European Commission published a proposal to simplify the MDR and IVDR. While this proposal has not yet been adopted, several elements are directly relevant to Notified Bodies and conformity assessment:

Proposed changes to Notified Body involvement:

For Class IIa and certain Class IIb devices, the proposal would reduce the depth of technical documentation review required, shifting toward a more sampling-based approach rather than full review of every device category
Introduction of a "silent consent" mechanism where NB responses to manufacturer requests (e.g., for changes) would be deemed approved if not responded to within a specified timeframe
Extension of certificate validity to five years (it is already up to five years, but the proposal clarifies that the maximum should be the default)

Proposed changes to post-market obligations:

Reduction of PSUR frequency for Class IIb and III devices from annual to every two years after the first year
Extension of serious incident reporting deadlines from 15 to 30 days for most incidents
Reduced NB review requirements for PSURs from well-established technology devices

SME support measures:

Mandatory fee reductions for micro and small enterprises (at least 50% for micro, 25% for small)
Payment deferral options for SMEs until conformity assessment is completed
Requirement for Notified Bodies to treat all manufacturers equally regardless of size

Current Status

As of early 2026, this proposal is working through the European legislative process. It has not been adopted, and all current MDR requirements remain in full force. Manufacturers should not delay compliance activities in anticipation of these changes — the legislative process will likely take until 2027-2028 before any amendments enter into force.

IVDR Notified Body Progress

The IVDR transition has been even more challenging than the MDR transition in terms of Notified Body availability. As of early 2026:

Approximately 10-12 Notified Bodies are designated under the IVDR
More designations are expected through 2026 and 2027
The IVDR transition timeline extends through 2029 for lower-risk IVDs (Class B), giving manufacturers and Notified Bodies more time — but the capacity gap remains a concern

EUDAMED Integration

EUDAMED is becoming increasingly central to the Notified Body ecosystem:

Notified Bodies must register certificates in EUDAMED
Certificate status (valid, suspended, withdrawn) is tracked through the system
The UDI module links device identification to certificate information
Full mandatory use of EUDAMED is being phased in, with the registration and UDI modules already operational

The NANDO Database: How to Search and Verify NB Scope

The NANDO database is your primary tool for verifying a Notified Body's designation. Here is how to use it effectively.

Accessing NANDO

The NANDO information system is available on the European Commission's website. Navigate to the medical devices section to search for Notified Bodies designated under the MDR or IVDR.

Search Parameters

You can search NANDO using several filters:

Regulation. Filter by MDR (2017/745) or IVDR (2017/746)
Member state. Filter by the country that designated the Notified Body
Device classification. Filter by the device classes the NB is designated for
Conformity assessment annex. Filter by the specific annexes (IX, X, XI Part A, XI Part B)
Device code. Filter by the specific type of device using the relevant coding system

Verifying Scope

When you find a Notified Body in NANDO, check:

Is the designation active? Some entries show historical designations that are no longer valid. Look for the current status.
What is the exact scope? The NB may be designated for Class IIa and IIb but not Class III, or for non-active devices but not active implantable devices.
Are there any conditions or restrictions? Some designations come with limitations on the scope of devices or assessment activities.
What annexes are covered? Verify that the NB is designated for the specific conformity assessment annex(es) applicable to your device.

Cross-Referencing

After verifying scope in NANDO, cross-reference with:

The Notified Body's own website (which may list their services and contact information)
Industry feedback from other manufacturers who have worked with the NB
The Notified Body's published client list (if available) to assess their experience with your device type

Frequently Asked Questions

What is the difference between a Notified Body and a Competent Authority?

A Competent Authority is a government body in an EU member state responsible for implementing and enforcing medical device regulations within that country. A Notified Body is an independent, third-party organization that the Competent Authority has designated to perform conformity assessments. The Competent Authority designates and oversees the Notified Body but does not itself conduct conformity assessments.

Can I self-declare conformity for any device under the MDR?

Only Class I devices that are non-sterile, non-measuring, and not reusable surgical instruments can be self-declared. All other devices — including Class Is, Im, Ir, IIa, IIb, and III — require Notified Body involvement. Under the IVDR, only Class A IVDs can be self-declared.

How many Notified Bodies are designated under the MDR?

As of early 2026, approximately 45 to 50 Notified Bodies are designated under the MDR. This number continues to grow as more bodies complete the designation process.

Can I use any Notified Body in the EU, regardless of where my company is located?

Yes. A Notified Body designated by any EU member state can issue certificates that are valid across the entire EU/EEA. A certificate from a German Notified Body is valid in France, Italy, Spain, and all other member states. However, practical considerations like language, geography, and scheduling may make some Notified Bodies more suitable than others.

How long does the conformity assessment process take?

Realistically, 6 to 18 months from application to certificate issuance. For complex devices (Class III implantables, novel technologies, devices requiring clinical investigations), the timeline can extend to 24 months or more. The timeline depends heavily on the Notified Body's backlog, the completeness of your technical documentation, and the complexity of your device.

How much does conformity assessment cost?

For a single Class IIa or IIb device, expect total costs of EUR 50,000 to EUR 150,000 for initial certification. For Class III implantable devices, costs can exceed EUR 200,000. Annual surveillance costs add EUR 10,000 to EUR 30,000 per year. These are rough estimates — always obtain a detailed quote from your chosen Notified Body.

What happens if my Notified Body loses its designation?

This is a serious situation but not unprecedented. If your Notified Body's designation is withdrawn, your certificates remain valid for a limited transition period (typically 12 months) to allow you to transfer to another Notified Body. You should begin the transfer process immediately. The MDR (Article 53) provides provisions for certificate transfer, and you should work with both the outgoing and incoming Notified Bodies, as well as the relevant Competent Authority, to manage the transition.

Can I change Notified Bodies after certification?

Yes, but it requires planning. You must apply to the new Notified Body, which will assess your QMS and technical documentation under the MDR. The new NB may issue its own certificates, or in some cases, may build on the assessment work done by the previous NB (with appropriate transfer provisions). Always coordinate the transfer to avoid gaps in certification coverage.

What is the scrutiny procedure for Class III devices?

For Class III devices and Class IIb implantable devices, the Notified Body must follow a clinical evaluation consultation procedure (sometimes called "scrutiny"). This involves the Notified Body consulting with independent clinical experts to review the clinical evidence supporting the device. For certain device types, the Notified Body must also submit the clinical evaluation assessment report to an expert panel established under the MDR. The expert panel may provide an opinion that the Notified Body must consider before issuing the certificate.

Do I need a Notified Body for custom-made devices?

Custom-made devices are exempt from certain MDR requirements but still require some Notified Body involvement in specific circumstances. Class IIa, IIb, and III custom-made devices require conformity assessment by a Notified Body. Class I custom-made devices can be self-declared with a statement. Always check the specific requirements for your device class and type.

What is a Summary of Safety and Clinical Performance (SSCP)?

The SSCP is a public-facing document required for Class III and implantable devices. It summarizes the device's safety and clinical performance in a format intended to be understood by intended users and patients. The Notified Body must validate the SSCP before it is uploaded to EUDAMED.

What are unannounced audits and should I be worried about them?

Unannounced audits are Notified Body audits conducted without prior notice to the manufacturer. They are required by the MDR and are intended to verify ongoing compliance under normal operating conditions. You should not be worried if your QMS is well-maintained and your documentation is current. You should, however, have procedures in place for receiving auditors, granting access to relevant areas and records, and ensuring that knowledgeable personnel are available (or can be reached) during the audit.

What is the difference between Annex IX and the Annex X + XI Part A route?

Both routes can be used for Class IIb and III devices. Annex IX is a single, integrated assessment covering QMS, technical documentation, and surveillance. The Annex X + XI Part A route separates the assessment into two parts: Annex X covers the device design and type examination, while Annex XI Part A covers production quality assurance. In practice, most manufacturers use Annex IX because it is simpler to manage as a single process. The Annex X + XI Part A route may be preferred when design and production are managed by different entities.

What should I do if I receive a nonconformity during an audit?

First, do not panic — nonconformities are normal, especially during initial certification audits. Respond with a root cause analysis and corrective action plan within the timeframe specified by the Notified Body (typically 15-30 days for major nonconformities). Implement the corrections, gather evidence of effectiveness, and submit it to the Notified Body for review. For major nonconformities, the NB may conduct a follow-up audit to verify effectiveness before issuing the certificate.

How do I know if my technical documentation is complete enough for submission?

Review your documentation against MDR Annexes II and III systematically. Use a checklist that maps each Annex II and III requirement to the specific section of your technical documentation where the evidence is located. Have an internal or external regulatory expert perform a gap analysis before submission. Given that approximately 75% of initial submissions are significantly incomplete, investing in a pre-submission review can save months of back-and-forth with your Notified Body.

Can a non-EU manufacturer apply directly to a Notified Body?

Yes, but a non-EU manufacturer must have an Authorized Representative established within the EU. The Notified Body will assess the manufacturer's QMS and documentation regardless of geographic location, but the regulatory framework requires an EU-based point of contact. The Authorized Representative holds certain legal responsibilities under the MDR, including maintaining copies of technical documentation and cooperating with Competent Authorities.

What is the validity period of a Notified Body certificate?

MDR certificates issued by Notified Bodies are valid for up to five years, subject to satisfactory annual surveillance audits. At the end of the five-year period, the manufacturer must undergo a full reassessment (recertification) to obtain a new certificate.

Conclusion

Notified Bodies are the gatekeepers of the European medical device market for everything above Class I. Understanding how they work, how to select the right one, and how to navigate the conformity assessment process is not optional — it is a core competency for any medical device manufacturer seeking or maintaining market access in the European Union.

The MDR has fundamentally raised the bar. Conformity assessment is more rigorous, more detailed, and more time-consuming than it was under the MDD. Technical documentation requirements have expanded significantly, clinical evidence expectations are higher, and the Notified Bodies themselves operate under stricter designation and oversight criteria.

For manufacturers, the practical implications are clear:

Start early. Application backlogs mean that waiting until the last minute before a transition deadline is a recipe for market access loss.
Invest in your documentation. The single biggest factor in a smooth conformity assessment is the quality and completeness of your technical documentation and QMS records.
Choose your Notified Body carefully. Scope, capacity, expertise, and cultural fit all matter.
Treat the relationship as ongoing. Certification is not a one-time event — it requires continuous investment in your QMS, post-market surveillance, and regulatory compliance.
Stay informed. The regulatory landscape is evolving rapidly, with the simplification proposal, EUDAMED rollout, and ongoing guidance from the MDCG all shaping the future of conformity assessment.

The manufacturers who approach Notified Body engagement as a collaborative process — one built on transparency, thorough preparation, and genuine commitment to regulatory excellence — will find the conformity assessment process challenging but manageable. Those who treat it as a bureaucratic hurdle to be cleared with minimal effort will find the MDR unforgiving.

The pathway to the CE mark runs through your Notified Body. Make sure you are ready for the journey.

Related Guides

EUDAMED Registration Guide — Step-by-step walkthrough of the EUDAMED database modules, timelines, and mandatory registration requirements.
EU MDR / IVDR Complete Guide — Comprehensive overview of both regulations, including scope, classification, and transition timelines.
Medical Device Technical File Guide — How to compile Annex II and Annex III technical documentation for NB review.
Clinical Evaluation Report Guide — Detailed guidance on writing a CER that meets MDR Article 61 requirements.
ISO 13485 Certification Guide — Understanding the QMS standard that underpins your NB audit.