EU MDR Compliance

Your complete guide to EU MDR 2017/745 compliance. Covers classification, clinical evaluation, QMS, CE marking, and all regulatory requirements for medical device manufacturers.

What Is EU MDR Compliance?

EU MDR Compliance means meeting every requirement of the European Union Medical Device Regulation (EU) 2017/745 — known as the EU MDR — which governs the manufacture, placement on the market, and post-market surveillance of medical devices sold in the European Economic Area. Compliance spans clinical evidence, risk management, quality systems, and economic operator obligations.

Article 2(1) MDR defines a medical device as any instrument, apparatus, appliance, software, implant, reagent, material, or other article intended by the manufacturer for human use for diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of disease, injury, or disability.

If your product falls within this scope and you intend to place it on the European market, EU MDR compliance is not optional. It is a legal requirement. Non-compliance means your device cannot bear the CE mark, cannot be placed on the market, and cannot be sold in any EU or EEA member state.

The regulation replaced the earlier Medical Device Directive (MDD 93/42/EEC) and the Active Implantable Medical Device Directive (AIMDD 90/385/EEC) to address gaps in previous legislation, tighten clinical evidence requirements, strengthen post-market surveillance, and increase transparency. Manufacturers who held CE certificates under the MDD faced a transition period to upgrade their technical documentation, clinical evaluations, and quality systems to meet MDR standards.

The Regulatory Framework

The Medical Device Regulation (EU) 2017/745

The EU MDR was adopted on April 5, 2017, and published in the Official Journal of the European Union on May 5, 2017. The regulation entered into force on May 25, 2017, and became fully applicable on May 26, 2021. It repeals Directives 90/385/EEC and 93/42/EEC.

The legal text is available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02017R0745-20260101

The MDR is a regulation, not a directive. This means it is directly applicable in all member states without requiring national transposition legislation. Every member state applies the same rules simultaneously, which reduces fragmentation in the European market.

The regulation has 123 articles and 17 annexes. These cover everything from device classification and conformity assessment to clinical investigations, vigilance, and market surveillance. The European Commission also issues implementing acts, common specifications, and guidance documents through the Medical Device Coordination Group (MDCG) to clarify specific requirements.

EU MDR Compliance: Scope and Applicability

The MDR applies to:

Medical devices and their accessories (Article 2(1)-(2))
Active implantable medical devices
Products without an intended medical purpose listed in Annex XVI, including colored contact lenses, facial fillers, liposuction equipment, and intense pulsed light devices
Custom-made devices (subject to reduced requirements under Annex XIII)

Territorial scope covers all EU member states plus EEA countries (Norway, Iceland, Liechtenstein). Manufacturers outside the EU (excluding those in countries with specific Customs Union agreements like Turkey) must appoint an Authorized Representative (Article 11) established in the Union to act on their behalf before competent authorities.

Products outside scope include:

In vitro diagnostic devices covered by IVDR (transitional provisions apply)
Medicinal products covered by Directive 2001/83/EC
Cosmetic products covered by Regulation (EC) 1223/2009
Food and food supplements
General laboratory equipment with no medical intended purpose

Key Definitions

Medical Device (Article 2(1)): Any instrument, apparatus, appliance, software, implant, reagent, material, or other article intended for medical purposes.

Manufacturer (Article 2(30)): A natural or legal person who manufactures or fully refurbishes a device or has a device designed, manufactured, or fully refurbished under their name or trademark.

Authorized Representative (Article 2(32)): Any natural or legal person established in the Union who has received a written mandate from a manufacturer to act on their behalf in specified tasks.

CE Marking (Article 20, Annex V): The physical marking that indicates a device conforms to MDR requirements. A Notified Body must issue a certificate of conformity (Annex IX or X) for class IIa, IIb, and III devices before CE marking can be applied.

Notified Body: An independent conformity assessment body designated by an EU member state to assess manufacturers and their devices under the MDR. Notified Bodies are listed by the European Commission under the NANDO database. As of 2026, approximately 50 Notified Bodies are designated under the MDR, compared with over 80 under the MDD.

Importer (Article 2(33)): A natural or legal person established in the Union who places a device from a third country on the Union market.

Distributor (Article 2(34)): A natural or legal person in the supply chain, other than the manufacturer or importer, who makes a device available on the market.

Unique Device Identifier (UDI) (Article 27, Part C of Annex VI): A series of numeric or alphanumeric characters identifying a specific device on the market.

Core Components of EU MDR Compliance

Compliance under the MDR is not a single deliverable. It is a system of interconnected activities. The following components form the backbone of any compliant technical file.

Quality Management System (QMS)

Article 10(9) MDR requires manufacturers to implement and maintain a quality management system that covers design, manufacturing, final verification, and post-market activities. The QMS must be documented, effective, and continuously improved.

For most manufacturers, alignment with ISO 13485:2016 is the practical route to meeting QMS requirements. ISO 13485 provides a framework for design controls, document management, purchasing, production, measurement analysis, and corrective actions. While the MDR does not mandate ISO 13485 certification, nearly all Notified Bodies expect it as the baseline for demonstrating QMS compliance.

Article 10(10) requires manufacturers to implement and keep up to date a post-market surveillance (PMS) system. Additionally, under Article 32, manufacturers of Class III and implantable devices are obligated to draw up a Summary of Safety and Clinical Performance (SSCP), which is validated by the Notified Body.

The QMS must address:

Design and development of devices
Risk management (in accordance with ISO 14971)
Supplier evaluation and purchasing controls
Production and process controls
Installation and servicing
Measurement, analysis, and improvement
Post-market surveillance (PMS) and vigilance
Communication with competent authorities and Notified Bodies
Document and record management for the technical file
Internal audit and management review cycles

The QMS operates continuously, not just during initial certification. Notified Bodies conduct surveillance audits at least every 12 months. Non-conformities found during surveillance can result in certificate suspension or withdrawal, which would prevent the manufacturer from placing devices on the market.

(Detailed guide on ISO 13485 and QMS implementation is coming soon in this series.)

Clinical Evaluation & Clinical Evidence

Article 61 MDR and Part A of Annex XIV require manufacturers to conduct a clinical evaluation for every device. This is the process of assessing and analyzing clinical data to verify the safety and performance of the device under normal conditions of use.

The clinical evaluation must follow a defined plan (CEP) and produce a Clinical Evaluation Report (CER). The CER is a living document — it must be updated with PMS data at defined intervals, at minimum annually for class III and implantable devices.

Article 61(3) allows demonstrating equivalence to an already marketed device from the same manufacturer or a competitor, provided access to the competitor’s technical documentation is available. MDCG 2020-5 guidance addresses the use of equivalence claims and imposes strict conditions on access to data.

The clinical evaluation must:

Establish the device’s intended purpose and the claims made by the manufacturer
Identify relevant clinical data from clinical investigations, scientific literature, and post-market surveillance
Appraise the quality and relevance of that data using systematic review methods
Analyze the data to determine safety and performance against state-of-the-art
Document the conclusions in the CER
Keep the CER current through regular updates based on PMS data
Summarize clinical evidence in the SSCP for class IIb and III devices

For class III devices and implantable devices, manufacturers must also conduct clinical investigations under Article 62, unless equivalence to a device already marketed by a different manufacturer can be demonstrated — which requires a contract granting full access to that device's technical documentation (Article 61(5)) — the device is a modification of the manufacturer's own previously marketed device with equivalence endorsed by the Notified Body (Article 61(4)), or the device was already lawfully marketed under the MDD/AIMDD with sufficient clinical data compliant with applicable Common Specifications (Article 61(6)). The Notified Body reviews the clinical evaluation during conformity assessment and may request additional data. For certain class III and implantable devices, the Notified Body must also submit the clinical evaluation assessment report to an expert panel through the Clinical Evaluation Consultation Procedure (Article 54)

Annex XV covers clinical investigations for investigational devices, including the clinical investigation plan (CIP), investigator’s brochure, informed consent procedures, and adverse event reporting obligations under Article 73.

(Detailed guide on Clinical Evaluation under EU MDR is coming soon in this series.)

Risk Management

Annex I Section 1 of the MDR establishes the General Safety and Performance Requirements (GSPRs). Requirement 1 states that devices must be designed and manufactured to eliminate or reduce risks as far as possible, to apply appropriate protective measures, and to inform users of residual risks.

The accepted standard for risk management in medical devices is ISO 14971:2019 . The MDR does not explicitly cite ISO 14971, but MDCG guidance and Notified Body expectations make it effectively mandatory for demonstrating conformity to GSPR 1 through 9.

Risk management under ISO 14971 involves:

Risk analysis: identifying known and foreseeable hazards and estimating associated risks for each hazard
Risk evaluation: comparing estimated risks against predefined acceptability criteria
Risk control: reducing risks through inherent safety by design, protective measures, and information for safety
Evaluation of residual risk acceptability against the overall benefit-risk ratio
Production and post-production monitoring as part of the PMS system

The risk management process is iterative. Each identified hazard must be linked to risk control measures, and each measure must be verified for effectiveness. The Risk Management File must integrate with the clinical evaluation and PMS activities. Residual risks identified in the risk management process must be communicated in the instructions for use (Annex I Section 23.4).

A common gap manufacturers face is the failure to demonstrate how risk management informed the clinical evaluation. The benefit-risk determination (Annex I Section 8) must be clinically validated — safety alone is insufficient. The benefit-risk ratio must remain favorable over the device’s entire lifetime.

(Detailed guide on ISO 14971 Risk Management is coming soon in this series.)

Post-Market Surveillance (PMS)

Article 83 MDR requires every manufacturer to establish and maintain a Post-Market Surveillance (PMS) system proportionate to the device class and risk. This system must collect, record, and analyze data on the device’s quality, performance, and safety throughout its lifetime.

Article 84 defines the PMS Plan as the documented framework for conducting proactive and systematic data collection. The plan must specify what data is collected, from which sources, at what frequency, and how it informs corrective actions.

Required PMS outputs depend on device classification:

Class I devices: A PMS Report (Article 85) summarizing results and conclusions, updated as necessary
Class IIa, IIb, and III devices: A Periodic Safety Update Report (PSUR) (Article 86) updated at least every two years for class IIa, and annually for class IIb and III. The PSUR includes the benefit-risk determination and key findings from PMCF.For Class III and implantable devices, the PSUR must be submitted electronically via EUDAMED to the Notified Body

The PMS system must cover:

Information from users, distributors, and importers
Feedback from complaint handling and customer service
Serious incident data and field safety corrective actions (FSCA)
Trends and statistical analysis — Article 88 requires trend reporting for significant increases in non-serious incidents
Literature searching and regulatory updates
Data from PMCF activities

Article 87 requires manufacturers to report serious incidents to the competent authorities. The reporting timeline depends on the severity of the incident: immediately, and not later than 2 days for serious public health threats, not later than 10 days for death or serious deterioration in health, and not later than 15 days for other serious incidents (Article 87(3)-(5)).

(Detailed guide on Post-Market Surveillance under EU MDR is coming soon in this series.)

Post-Market Clinical Follow-up (PMCF)

Part B of Annex XIV requires manufacturers to conduct Post-Market Clinical Follow-up (PMCF) as a continuous process to confirm safety and performance throughout the device’s lifetime. PMCF is generally expected as part of the PMS system and must be justified if not conducted.

PMCF activities aim to:

Confirm safety and performance over the device’s expected lifetime
Identify previously unknown side effects and monitor known ones
Identify and monitor residual risks on the basis of factual evidence
Detect emerging risks based on real-world evidence
Ensure clinical data remain relevant and reflect actual use in the target population
Contribute to the clinical evaluation update required by Article 61(11)

Article 61(11) explicitly states that clinical evaluation and its documentation must be updated throughout the device’s lifetime with data from PMCF. The PMCF must be planned and described in a PMCF Plan (Annex XIV Part B Section 6.2) that specifies methods, frequency, and justification.

PMCF methods include:

Clinical registries and database studies
Clinical investigations focused on post-market questions
Literature reviews targeting specific safety endpoints
Surveys and user feedback on device performance
Analysis of real-world usage data

Each PMCF method must produce a documented PMCF Report (Annex XIV Part B Section 6.3) that feeds back into the clinical evaluation, risk management, and the PSUR. If PMCF identifies new risks or demonstrates unacceptable risk, the manufacturer must take immediate corrective action under the vigilance system.

(Detailed guide on PMCF is coming soon in this series.)

Technical Documentation

Articles 10(4) and Annexes II and III define the Technical Documentation requirements. This is the complete file that every manufacturer must prepare to demonstrate conformity to the MDR. Notified Bodies review the technical documentation during initial certification and surveillance audits.

Annex II — the Pre-Market Technical Documentation — requires:

A description of the device, variants, intended purpose, and accessories
Information on the manufacturer, authorized representative, and manufacturing sites
Design and manufacturing information, including raw materials, production processes, sterilization methods, and validation
The GSPR checklist demonstrating conformity to each applicable requirement in Annex I, with reference to specific test methods and standards
Benefit-risk analysis
Risk management documentation
Product verification and validation data:
Pre-clinical data (biocompatibility per ISO 10993 series, physical and chemical characterization, microbiological testing)
Clinical evaluation report (CER)
Software verification and validation for SaMD or software in a device
Stability and shelf-life data, including packaging validation
Performance data against manufacturer claims

Annex III requires the Post-Market Surveillance Technical Documentation, which includes the PMS Plan per Article 84, PMS Report or PSUR, PMCF Plan and reports, and vigilance data including trending reports and FSCA documentation.

The technical documentation must be maintained and kept up to date. Article 10(12) requires manufacturers to notify competent authorities of any significant changes that could affect device safety or performance. MDCG 2020-3 provides guidance on what constitutes a significant change, covering design, intended purpose, raw materials, manufacturing processes, and sterilisation.

For class III and implantable devices, the manufacturer must submit summaries of safety and clinical performance (SSCP) per Article 32 to be publicly available via EUDAMED.

Achieving CE Marking Under EU MDR

The conformity assessment route depends on device classification. The MDR uses the classification rules in Annex VIII, consistent with the globally harmonized system based on risk.

Device Classification

Under Annex VIII, devices are classified into four risk categories using 22 classification rules. The rules cover all device types including non-invasive, invasive, active, implantable, and devices with special characteristics such as those incorporating medicinal substances or nanomaterials.

Class I: Low risk (e.g., non-invasive bandages, examination gloves, stethoscopes, ophthalmoscopes)
Class IIa: Medium-low risk (e.g., contact lenses, ultrasound equipment, dental fillings, surgical clamps)
Class IIb: Medium-high risk (e.g., ventilators, bone fixation plates, insulin pens, wound dressings for chronic use)
Class III: High risk (e.g., pacemakers, heart valves, drug-eluting stents, absorbable sutures, implantable joint replacements)

The classification determines the conformity assessment route. The manufacturer is responsible for determining the correct classification. MDCG 2021-24 provides guidance on classification of medical devices under the MDR, and a manufacturer can request a binding classification decision from the competent authority if there is uncertainty.

Key changes from MDD classification include stricter rules for software, nanomaterials, substances absorbed by the human body, and devices intended for female anatomy.

Up-classification is common — many devices previously class I under MDD moved to class IIa or higher under MDR, requiring Notified Body involvement where none was needed before. This has created significant demand for regulatory consulting services and has strained Notified Body capacity across the industry.

Conformity Assessment Routes

Class I devices: The manufacturer declares conformity under Annexes II and III and affixes the CE mark. No Notified Body involvement is required except for sterile, reusable surgical instruments, and measuring function devices.

Class IIa devices: Conformity assessment based on Annex IX (QMS-based) or Annex X (EU-type examination) plus Annex XI (product conformity verification). The Notified Body issues a CE certificate with validity up to five years.

Class IIb devices: Same routes as class IIa, but the Notified Body conducts closer scrutiny of the technical documentation, including the clinical evaluation. The Notified Body reviews a representative sample of technical documentation.

Class III devices: Conformity assessment via Annex IX (QMS) plus review of the clinical evaluation and a specific procedure for devices incorporating medicinal substances or animal tissues. Alternatively, Annex X (EU-type examination) plus Annex XI (production QMS). The Notified Body must consult an expert panel under the Clinical Evaluation Consultation Procedure (Article 54) for certain class III and implantable devices, and a European reference laboratory (Article 100) for certain high-risk devices.

For all classes above I, the Notified Body issues a certificate that remains valid for a maximum of five years (Article 52, Annex IX Section 4.4). Surveillance audits are conducted at least once every 12 months.

Involvement of Notified Bodies

Notified Bodies under the MDR face stricter designation requirements (Articles 36-46 and Annex VII) than under the MDD. Designation criteria include competence, impartiality, independence, and adequate personnel. Notified Bodies may subcontract specific tasks but remain fully responsible.

Manufacturers should verify their chosen Notified Body is designated for the specific device scope required. The NANDO database lists all designated Notified Bodies and their scope codes.

Conformity Assessment by Device Class

Understanding the specific assessment path for each class is essential for planning.

Class I

The manufacturer draws up the EU declaration of conformity (Annex IV) and affixes CE marking without Notified Body involvement. The technical documentation per Annexes II and III must still be complete and available for competent authority inspection.

Exception: Class I sterile, class I with measuring function, and class I reusable surgical instruments require Notified Body involvement for the sterile processing, metrological validation, or reprocessing validation aspects.

Class IIa

Manufacturers have two routes:

Annex IX (QMS) — The Notified Body assesses the quality system for design, manufacturing, final verification, and post-market surveillance. This is the most common route.
Annex X (EU-type examination) plus Annex XI (production QMS) — Less common for class IIa.

The Notified Body issues a Certificate of Conformity valid for up to five years, with annual surveillance audits.

Class IIb

The same routes as class IIa apply, but the Notified Body conducts a more rigorous review. Under Annex IX Section 3.4, the Notified Body must examine a representative sample of technical documentation for class IIb devices. The clinical evaluation receives particular scrutiny.

For class IIb devices that are implantable or incorporate a medicinal substance as an ancillary action, the consultation procedures of Article 54 and 117 may apply.

Class III

The strictest requirements apply. For most class III devices, the conformity assessment follows Annex IX with two additional procedures:

Clinical Evaluation Consultation Procedure (Article 54) — The Notified Body submits the manufacturer’s clinical evaluation assessment report to the competent authorities via EUDAMED. Expert panels may provide opinions on the clinical evidence.
Device Specific Consultation — For devices with medicinal substances (Rule 14), animal-derived tissues (Rule 18), or those composed of human cells (Rule 17), the Notified Body consults either a medicinal competent authority or the European Medicines Agency (EMA).

Manufacturers of class III custom-made implantable devices must follow Annex XIII for the custom-made statement and Annex IX for the QMS.

Timeline and Deadlines

The MDR has been fully applicable since May 26, 2021. Key transition periods under the amended transitional provisions (Regulation 2023/607) include:

MDD certificates expiring before March 20, 2023: Transitioned already expired. These devices required MDR certification.
MDD certificates valid as of May 26, 2021: Extended based on certificate expiry, subject to conditions:
Class III and IIb implantable devices: until December 31, 2027
Class IIb non-implantable, class IIa, and class I sterile/measuring: until December 31, 2028
Class I devices under MDD: No transition period — must comply with MDR from May 26, 2021, unless up-classified.Up-classified Class I devices benefit from the extended transition period until December 31, 2028, provided specific conditions are met.

Extended validity under Regulation 2023/607 requires that the device does not present unacceptable risk, no significant changes in design or intended purpose have been made, and the manufacturer has implemented a QMS and PMS system meeting MDR requirements.

Certificate validity under MDR: Maximum five years for Notified Body-issued certificates, with periodic surveillance audits. Recertification requires a full reassessment.

For custom-made devices, the manufacturer must follow Annex XIII requirements, including a statement of manufacture that is retained for 10 years.

The Economic Operator Obligations

The MDR assigns specific responsibilities to each economic operator in the supply chain.

Manufacturers (Article 10) must:

Design and manufacture in accordance with GSPRs
Prepare technical documentation and conduct conformity assessment
Draw up an EU declaration of conformity and affix CE marking
Comply with UDI obligations and register in EUDAMED
Implement and maintain QMS, PMS, PMCF, and vigilance systems
Appoint a Person Responsible for Regulatory Compliance (PRRC) in accordance with Article 15.

Authorized Representatives (Article 11) must:

Verify the EU declaration of conformity and technical documentation are drawn up
Register manufacturers and devices in EUDAMED
Provide competent authorities with requested information
Terminate the mandate and inform competent authorities if the manufacturer violates obligations
Assume joint and several liability with the manufacturer for defective devices (Article 11(5)).
Appoint a Person Responsible for Regulatory Compliance (PRRC) in accordance with Article 15.

Importers (Article 13) must:

Verify CE marking, EU declaration of conformity, and UDI are present
Confirm the manufacturer has an authorized representative
Store and transport devices under appropriate conditions
Register in EUDAMED
Notify authorities of suspected non-conformity

Distributors (Article 14) must:

Verify CE marking and EU declaration of conformity
Ensure labeling and instructions are in the appropriate language
Report suspected non-conformity to authorities

EUDAMED

The European Database on Medical Devices (EUDAMED) is the IT system established under Article 33 MDR to integrate information on medical devices, manufacturers, Notified Bodies, certificates, vigilance, and market surveillance. EUDAMED has six modules:

Actor registration (Article 30)
UDI/Device registration (Article 29)
Notified Bodies and certificates (Article 56)
Clinical investigations (Articles 70-73)
Vigilance and post-market surveillance (Article 92)
Market surveillance (Article 100)

As of mid-2026, four of EUDAMED's six modules — Actor registration, UDI/Device registration, Notified Bodies and Certificates, and Market Surveillance — are fully operational and, since 28 May 2026, mandatory for economic operators (Commission Decision (EU) 2025/2371, following the transition mechanism under Regulation (EU) 2024/1860). The remaining two modules, Post-Market Surveillance & Vigilance and Clinical Investigation & Performance Studies, are still under development and will become mandatory only once the Commission publishes a functionality notice for each, with no voluntary-use period beforehand.
Manufacturers with legacy devices placed on the market before 28 May 2026 have until 28 November 2026 to complete UDI/Device registration, and Notified Bodies have until 28 May 2027 to upload legacy certificate data — outside vigilance- related cases, which require immediate registration regardless of these dates.

How We Can Help

MDRcert provides end-to-end MDR compliance services for medical device manufacturers worldwide. Our team of regulatory consultants has direct experience preparing technical documentation, conducting clinical evaluations, implementing QMS, and managing Notified Body interactions under the MDR.

Our services include:

Technical documentation preparation aligned with Annexes II and III, including GSPR checklists, design dossiers, and verification and validation summaries
Clinical evaluation including CER writing, systematic literature reviews, PMCF strategy and protocols, and clinical investigation support
QMS implementation to ISO 13485 with MDR-specific integration for PMS, vigilance, and communication with competent authorities
Risk management file creation under ISO 14971, including hazard analysis, risk control verification, and benefit-risk analysis
Gap analysis to assess current MDD documentation against MDR requirements and develop a remediation roadmap
Notified Body selection, strategy, and audit liaison support through the entire conformity assessment process
EUDAMED registration and UDI management including Basic UDI-DI and UDI-DI assignment
Training for internal regulatory teams on MDR requirements, technical documentation, and vigilance reporting

View our full services →

Learn about our MDR consulting approach →

About MDRcert →

Contact our team →

References

Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02017R0745-20170505
Medical Device Coordination Group (MDCG) guidance documents. European Commission: https://health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en
Regulation (EU) 2023/607 amending Regulations (EU) 2017/745 and (EU) 2017/746 regarding the transitional provisions for certain medical devices and in vitro diagnostic medical devices.
ISO 13485:2016 — Medical devices — Quality management systems — Requirements for regulatory purposes.
ISO 14971:2019 — Medical devices — Application of risk management to medical devices.
European Commission NANDO database for Notified Body designation and scope.

Stay Compliant. Stay Ahead.

Join the MDRCert Newsletter

Get the latest MDR/IVDR updates, compliance checklists & expert tips delivered weekly. No spam, ever

MDR (Medical Device Regulation) Consulting

IVDR (In Vitro Diagnostic Regulation) Consulting

ISO 13485:2016 Consulting

ISO 14971 Risk Management Consulting

Biocompatibility Documentation Consultancy

Post Market Surveillance (PMS) Consulting

Post Market Clinical Follow up (PMCF) Documentation Consulting

Registration Strategy Consulting