EU MDR Notified Body Technical File Deficiencies: Common Nonconformities, Implementing Regulation 2026/977 Changes, and How to Prepare for NB Review

What This Article Covers

The most common reason EU MDR certification gets delayed is not missing paperwork or late fees. It is technical file deficiencies that the notified body identifies during conformity assessment — gaps in clinical evidence, risk management that does not connect to the rest of the file, equivalence arguments that notified bodies reject, postmarket surveillance plans that exist in isolation from the clinical evaluation, and documentation that reads as a compliance exercise rather than a coherent clinical justification.

On May 4, 2026, the European Commission adopted Implementing Regulation (EU) 2026/977 (published in the Official Journal on May 5, 2026), which sets uniform procedural requirements for notified body assessments. This regulation introduces maximum assessment timelines, structured dialogue frameworks, and standardized recertification processes that will fundamentally change how manufacturers interact with their notified bodies.

This article covers the most frequently cited technical file deficiencies, how Implementing Regulation 2026/977 changes the NB assessment landscape, and practical strategies for building a technical file that survives notified body review without multiple deficiency cycles.

What This Article Does NOT Cover

This article focuses on technical file deficiencies and NB assessment preparation. For general EU MDR technical file structure, see the Medical Device Technical File Guide. For SSCP-specific deficiency responses, see the SSCP Notified Body Deficiency Response Pack Guide. For NB selection and change, see the EU Notified Body Selection and Change Guide. For the full guide to Implementing Regulation 2026/977's requirements, see the EU Implementing Regulation 2026/977 Guide.

The Current NB Landscape: Why Deficiencies Are So Common

Capacity Constraints Drive Scrutiny

As of early 2026, approximately 50 to 52 notified bodies have been designated under the MDR and approximately 12 to 15 under the IVDR. While this is an improvement from the initial bottleneck, capacity remains constrained. The average time for a successful MDR certification review is 13 to 18 months, and for complex devices, it can be longer.

Notified bodies are processing high volumes of applications under significant time pressure, and they are applying a level of scrutiny that the previous Medical Device Directive (MDD) did not require. The result is a high rate of technical file deficiencies, many of which follow predictable patterns.

The Transition Deadline Pressure

MDR transition deadlines are approaching. Legacy devices with MDD certificates must transition to MDR certification by December 2027, 2028, or 2029, depending on device risk class and the manufacturer's engagement with a notified body. Manufacturers who submit late or submit deficient technical files risk not being assessed in time, which could lead to gaps in certification and withdrawal of devices from the EU market.

The Most Common Technical File Deficiencies

1. Clinical Data Gaps and Insufficient Evidence

This is the single most frequent deficiency category. Notified bodies report that clinical evaluation reports are often the weakest element of technical files.

Common patterns:

• Insufficient clinical data for the indicated population. The clinical evaluation report relies on literature that does not fully cover the device's intended use, indications, or patient population as described in the device description and labeling.

• Overreliance on literature without critical appraisal. Manufacturers include published studies but do not critically appraise the methodology, relevance, or quality of the evidence. MDCG 2020-13 expectations echo the structure of systematic reviews: defined search strategies, justified inclusion/exclusion criteria, and documented appraisal of methodological quality.

• Missing or inadequate PMCF data. Postmarket clinical follow-up is treated as optional or is addressed with a statement like "no complaints have been received" rather than proactive data collection. Notified bodies expect PMCF activities to be designed to answer specific clinical questions that the premarket data could not fully address.

• Legacy data that does not meet current MDR standards. Clinical data collected under the MDD may not meet MDR requirements for evidence quality, particularly for equivalence arguments, clinical outcome measures, and follow-up duration.

2. Disjointed Risk Management

The technical file must tell a coherent story from concept through postmarket. Risk management is often the element that breaks the narrative.

Common patterns:

• Risk management file is isolated from the clinical evaluation. The risk management report lists hazards and risk-control measures but does not connect to clinical evidence. The clinical evaluation report does not reference the risk management file's conclusions about residual risks.

• Risk-control measures are documented but not verified as implemented. The risk file describes mitigations, but the technical file does not demonstrate that those mitigations are in production, validated, and monitored.

• Postmarket risk review is not defined. The risk management file does not describe how risk estimates will be updated with postmarket data, including complaints, adverse events, and registry data.

• Benefit-risk analysis is incomplete. The assessment of whether residual risks are acceptable relative to the benefits does not incorporate clinical data from the CER or patient perspectives.

3. Equivalence Arguments That Fail

For manufacturers relying on equivalence to an existing device, notified bodies are applying stricter criteria than under the MDD.

Common patterns:

• Equivalence is claimed based on technical similarity without clinical and biological equivalence. MDR Article 61 and MDCG 2020-5 require demonstration of technical, biological, and clinical equivalence. Many submissions establish technical equivalence but do not adequately address biological and clinical dimensions.

• The equivalent device's clinical data is not accessible. Manufacturers claim equivalence to a competitor's device but cannot access the clinical data generated by that device's manufacturer. Without access to the full clinical data set, the equivalence claim cannot be verified.

• Changes to the device break equivalence. Modifications made to the subject device after establishing equivalence (material changes, manufacturing process changes, new indications) are not re-evaluated for their impact on the equivalence foundation.

4. Weak PMS Integration

Postmarket surveillance is often submitted as a standalone document rather than an integrated component of the technical file.

Common patterns:

• PMS plan does not reference specific clinical questions or residual risks. The PMS plan lists generic data sources but does not describe how PMS data will address specific clinical questions from the CER or specific residual risks from the risk management file.

• PSUR is a summary of complaints rather than an analysis. The Periodic Safety Update Report lists complaint counts but does not analyze trends, assess benefit-risk impact, or connect findings to clinical evaluation and risk management conclusions.

• PMCF plan is generic. The PMCF plan describes general literature review activities rather than specific clinical investigations, registry studies, or targeted data collection designed to answer defined clinical questions.

5. Incomplete or Inaccurate Document Content

Common patterns:

• Outdated standards and regulations referenced. Technical files reference superseded versions of harmonized standards, outdated MDD provisions, or revoked guidance documents.

• Device description does not match the labeling. Inconsistencies between the device description in the technical file and the information on the label, instructions for use, or promotional materials.

• Intended purpose is vague. The intended purpose is not defined with sufficient specificity to enable the notified body to assess whether the clinical evidence covers the claimed indications.

Implementing Regulation (EU) 2026/977: What Changes

Overview

Published on May 4, 2026, Implementing Regulation (EU) 2026/977 establishes uniform quality management and procedural requirements for notified bodies conducting conformity assessments under the MDR and IVDR. The regulation was developed in response to inconsistent and divergent practices between notified bodies that made the certification process unpredictable for manufacturers.

Key Changes for Manufacturers

Standardized assessment timelines. The regulation introduces maximum timelines for different phases of the conformity assessment. Notified bodies must complete assessments within defined periods, and manufacturers will have clear expectations for how long each stage should take.

Structured dialogue framework. A formal process for interaction between manufacturers and notified bodies during the assessment, including defined touchpoints for clarification requests and responses. This replaces the informal and often inconsistent communication practices that varied between notified bodies.

Recertification requirements (Article 5). At recertification, manufacturers must provide:

• A list of changes, including those based on state of the art and field safety corrective actions
• Summary vigilance data (PSUR and FSCAs)
• Summary of changes to risk evaluation with impact on the benefit-risk ratio
• Current clinical evaluation or performance evaluation report updated with clinical investigation data and PMS findings
• Additional information when changes are based on new standards or common specifications

Change assessment timelines (Articles 2 and 3). Structured timelines for reviewing changes to certified devices, applicable to conformity assessment procedures for agreements signed after February 25, 2027. Notified bodies have 30 days to assess a proposed change and decide whether further activities are needed, plus 90 days for any additional conformity assessment activities. Requests for clarification are limited to specific information necessary to complete the assessment.

Transparency requirements. Notified bodies must provide manufacturers with information about total assessment costs and expected timelines at the outset of the conformity assessment process. This is a significant change from the opaque pricing and scheduling practices that some manufacturers have experienced.

What This Means for Deficiency Cycles

The implementing regulation does not eliminate technical file deficiencies. But it does change how they are handled:

• Faster turnaround on clarification requests. Notified bodies will be required to issue specific, targeted clarification requests rather than broad requests for additional information.
• Limited rounds of clarification. The structured process implies a more disciplined approach to deficiency resolution, potentially reducing the number of back-and-forth cycles.
• Clearer timelines for manufacturer responses. Manufacturers will have defined windows to respond to deficiency findings, which should reduce delays caused by open-ended response periods.

Building a Technical File That Survives NB Review

Principle 1: The Technical File Must Tell a Coherent Story

The most fundamental deficiency is a technical file that reads as a collection of standalone documents rather than a connected narrative. Each section should build naturally into the next:

• The device description and intended purpose define what the device is and what it claims to do
• The intended purpose drives the clinical claims in the clinical evaluation
• The clinical claims determine the literature search strategy and evidence requirements
• The clinical evidence supports the risk-benefit assessment in risk management
• The residual risks from risk management define the PMS and PMCF activities
• The PMS data feeds back into the clinical evaluation and risk management

If any section exists in isolation, the notified body will identify it as a deficiency.

Principle 2: Start with the Intended Purpose

The intended purpose is the foundation of the entire technical file. If it is vague, every downstream element will be weak:

• Define the intended purpose with specific clinical indications, patient populations, anatomical sites, and conditions of use
• Ensure the intended purpose is consistent across all documents: technical file, labeling, instructions for use, and promotional materials
• Limit claims to those supported by clinical evidence. Expanding claims beyond the evidence base is a common source of deficiencies.

Principle 3: Invest in Clinical Evidence Quality

The clinical evaluation report is the most scrutinized element of the technical file:

• Follow MDCG 2020-13 and the MEDDEV 2.7/1 rev 4 methodology for literature search, appraisal, and analysis
• Document the search strategy with enough detail that it could be replicated: databases used, search terms, date ranges, inclusion/exclusion criteria
• Critically appraise each included study for relevance, reliability, and methodological quality
• Address the "so what" question: how does the body of evidence support the specific clinical claims for the specific patient population?

Principle 4: Connect Risk Management to Everything Else

Risk management should be the connective tissue of the technical file:

• Risk control measures described in the risk management file should be traceable to design outputs, production processes, and labeling
• Residual risks should be referenced in the clinical evaluation's benefit-risk analysis
• Postmarket risk review should be defined with specific triggers, data sources, and update criteria
• The risk management file should be updated when new clinical or postmarket data becomes available

Principle 5: Design PMS and PMCF to Answer Specific Questions

Generic PMS plans are a common deficiency. Instead:

• Identify specific clinical questions that the premarket data could not fully answer
• Design PMS data collection to address those questions
• Define PMCF activities that are targeted to specific evidence gaps
• Specify how PMS and PMCF data will be integrated into the CER and risk management file

Principle 6: Prepare for the Recertification Package Early

Implementing Regulation 2026/977 Article 5 defines specific requirements for recertification submissions. Manufacturers should begin compiling the recertification package well before the certificate expiry date:

• Maintain a running change log that documents all changes since the last certification, including changes based on state of the art and FSCAs
• Keep the clinical evaluation report continuously updated rather than attempting a comprehensive update at recertification
• Ensure PSUR and vigilance summaries are current and address all relevant findings
• Document the impact of any new standards or common specifications on the device and its technical file

Managing Nonconformities When They Occur

Even well-prepared technical files may receive nonconformity findings. The key is to respond effectively:

Understand the Finding

Nonconformities can range from missing procedures to clinical data gaps to inappropriate equivalence claims. Before responding:

• Identify whether the finding is about missing documentation, inadequate content, or a fundamental evidence gap
• Determine whether the finding is isolated or systemic (i.e., does it affect other devices in your portfolio?)
• Assess whether the finding reveals a disconnect between two sections of the technical file

Respond Comprehensively

• Address each nonconformity point individually
• Provide specific evidence of corrective action, not general commitments
• Update all related documents, not just the one directly cited in the finding
• If the finding reveals a systemic issue, describe how it will be addressed across the portfolio

Target the Root Cause

Many nonconformities are symptoms of deeper issues:

• A clinical data gap may reflect an intended purpose that is too broadly defined
• A risk management disconnect may reflect a lack of integration between the clinical and regulatory teams
• An outdated standard reference may reflect an inadequate document control system

The Cost of Deficiency Cycles

Each round of NB deficiency findings adds significant time and cost to the certification process:

• Timeline impact: Each deficiency cycle can add 3–6 months to the certification timeline, depending on the complexity of the findings and the speed of the manufacturer's response
• Resource impact: Responding to deficiencies requires significant regulatory, clinical, and quality resources, often pulling staff from other projects
• Financial impact: Notified bodies may charge additional fees for re-review cycles
• Market access impact: Delays in certification mean delays in market access, which directly affects revenue for time-sensitive product launches

Key Takeaways

1. Clinical data gaps are the most common deficiency. Invest in clinical evidence quality upfront rather than attempting to patch gaps during NB review.

2. The technical file must be a coherent narrative, not a document collection. Every section should connect to the others through traceable links between intended purpose, clinical claims, evidence, risk management, and PMS.

3. Equivalence arguments are under heightened scrutiny. Demonstrate technical, biological, and clinical equivalence with accessible data, and re-evaluate equivalence after any device change.

4. Implementing Regulation 2026/977 standardizes the NB assessment process. Maximum timelines, structured dialogue, and recertification requirements will make the process more predictable but also more structured.

5. PMS must be integrated, not standalone. The PMS plan should address specific clinical questions and residual risks, and its outputs must feed back into the CER and risk management file.

6. Prepare the recertification package continuously. Do not wait until the certificate expiry date. Maintain running change logs, update the CER continuously, and keep vigilance summaries current.

Sources

• European Commission, Implementing Regulation (EU) 2026/977 on uniform quality management and procedural requirements for conformity assessment, adopted May 4, 2026, published in the Official Journal May 5, 2026.
• Arnold & Porter, "EU Implements New Rules on Uniform Procedural Requirements for Notified Body Assessments," BioSlice Blog, May 6, 2026.
• Emergo by UL, "Europe Legislates More Formal Notified Body Processes and Timelines — Part 2: Related Changes," May 6, 2026.
• Mantra Systems and Cyber Alchemy, "How to Handle Notified Body Non-conformities and Get Back on Track," 2026.
• European Parliament Briefing, "Medical Devices: Simplifying the Rules," EPRS PE 785.663, March 2026.
• MDCG 2020-13, "Clinical Evidence Assessment — Best Practice Guidance."
• MDCG 2020-5, "Clinical Evaluation — Equivalence."
• QbD Group, "EU MDR Bottleneck Ahead: Why 2026 Will Be a Defining Year," 2026.
• RQM+, "Strategic Impact of the 2026 EU MDR/IVDR Targeted Revisions," 2026.