EU In Vitro Diagnostic Medical Devices Regulation (IVDR)

Article 47 + Annex VIII set the risk-based classification system for IVDs into Class A (low risk; e.g. specimen receptacles, buffers), Class B (moderate risk; e.g. pregnancy tests, cholesterol), Class C (high individual + moderate public-health risk; e.g. companion diagnostics, blood gas), Class D (high individual + high public-health risk; e.g. HIV, transfusion-transmissible infections). Annex VIII has 7 classification rules + special-rule provisions for self-tests + near-patient testing. The classification drives the conformity-assessment route under Article 48.

• Annex VIII rule-by-rule classification analysis per device
• Reclassification trigger on changes to intended purpose or design

• Class C / D device classified as B or below
• Classification not revisited on substantial modification

Article 48 sets the conformity-assessment routes by class. Class A devices (other than self-tests/sterile/measuring): manufacturer self-declaration (Annex II + III technical documentation; no NB). Class A sterile, Class B, Class C, Class D: NB involvement required, with specific Annex IX (full QMS + tech doc assessment) / Annex X (type examination) / Annex XI (production-quality assurance) routes. Class C companion diagnostics require consultation with the EMA per Article 48(8). Article 49 details NB involvement. Article 50 establishes a mechanism for scrutiny of Class D conformity assessments by EU reference laboratories + the MDCG (additional safeguard for the highest-risk devices).

• Conformity-assessment route selection record per device class
• NB report + certificates
• Companion-diagnostic EMA consultation records
• Article 50 Class D scrutiny records

• Class B/C/D device self-declared without NB involvement
• Companion diagnostic placed without EMA consultation
• Class D device placed without Article 50 scrutiny

Article 51 governs certificates of conformity issued by NBs (validity max 5 years, may be subject to conditions, suspended/withdrawn/restricted on non-compliance). Article 52 establishes the electronic system on NBs + certificates. Article 53 governs voluntary change of NB by the manufacturer. Article 54 allows derogations from conformity-assessment procedures by a competent authority in the interest of public health, patient safety or health, or to enable access to clinical trial in an emergency. Article 55 governs certificates of free sale issued by competent authorities for exports.

• NB certificate file per device
• Voluntary change-of-NB procedure if engaged
• Article 54 derogation records where applicable

• Operating with an expired or withdrawn NB certificate

Article 56 requires manufacturers to plan + conduct + document a performance evaluation per Annex XIII covering scientific validity + analytical performance + clinical performance, and to update it throughout the device lifecycle (including via post-market performance follow-up, PMPF). Article 57 sets the general requirements for performance studies (informed consent + ethics committee approval + insurance + data integrity). Article 58 sets additional requirements for certain performance studies (interventional clinical performance studies involving surgical procedures, etc.) including authorisation by the Member State competent authority; coordinated assessment for multi-country studies.

• Annex XIII performance evaluation file per device
• PMPF plan + execution records
• Article 57-58 performance-study application file
• Coordinated-assessment engagement for multi-country studies

• Device placed without an Annex XIII performance evaluation
• Performance study conducted without Article 57-58 ethics committee + authority approval

Article 59 sets the informed-consent requirements for performance studies (parallel to CTR Article 29): written + dated + signed by the subject or legal representative, after receiving comprehensive information, freely given, revocable. Article 60 sets protection of incapacitated subjects. Article 61 sets protection of minors. Article 62 governs emergency-situation performance studies with deferred consent.

• Informed-consent template + investigator-signed records
• Capacity-assessment + legal-representative consent for incapacitated subjects
• Assent procedure for minors
• Article 62 deferred-consent procedure

• Subject enrolment without Article 59 informed consent
• Incapacitated subject enrolment without legal-representative consent

Article 17 requires the manufacturer to draw up the EU declaration of conformity (DoC) before placing the IVD on the market or putting it into service. The DoC contains the Article 17(1) information set out in Annex IV. By drawing up the DoC the manufacturer assumes responsibility for compliance. The DoC is kept available for the competent authority for 10 years. Article 18 requires affixing the CE marking visibly + legibly + indelibly on the device or its sterile pack and on the instructions for use and on the sales packaging. Where a notified body is involved (per Article 48 + Article 49) the NB identification number follows the CE marking.

• EU DoC per device aligned with Annex IV
• 10-year retention plan
• CE marking artwork + NB identification number where applicable

• IVD placed without EU DoC
• CE marking missing the NB identification number for Class B/C/D devices

Article 22 requires economic operators to identify, on request of competent authorities, any other economic operator that supplied them with a device + to whom they have supplied a device, for 10 years. Article 23 references the medical devices nomenclature (the EU's harmonised vocabulary). Article 24 establishes the Unique Device Identification (UDI) system: every IVD (except custom-made + investigational) carries a UDI consisting of a UDI-DI (device identifier) + UDI-PI (production identifier where relevant); class-A devices have a UDI on the packaging only. Article 25 governs the central UDI database within EUDAMED.

• 10-year supplier / customer records by device
• UDI assignment + database submission per Article 24
• Nomenclature alignment in Article 25 records

• Devices placed without UDI (other than Article 24(2) carve-outs)
• No 10-year supply-chain records

Article 26 requires registration of devices: before placing a device on the market or putting it into service, the manufacturer (other than custom-made or investigational devices) registers the device, the manufacturer and the UDI-DI in EUDAMED. Article 27 establishes the electronic registration system for economic operators. Article 28 requires manufacturers + authorised representatives + importers to register their data (identity + authorised activities + EU economic-operator identification number) in EUDAMED. The data is publicly accessible (with limited carve-outs for confidential information).

• EUDAMED registration record per device + per economic-operator role
• Registration data kept up to date (Article 27(3) changes within 1 week)

• Device placed without EUDAMED registration
• Economic-operator data not kept current

Article 29 requires the manufacturer to draw up, for Class C and Class D devices (other than performance-study devices), a summary of safety and performance (SSP) accessible through EUDAMED. The SSP is written in plain language and made publicly available; it is part of the technical documentation. Article 30 establishes EUDAMED, the European database on medical devices (operated by the Commission), interconnecting the UDI / registration / NB+certificates / clinical-performance studies / vigilance / market surveillance modules.

• SSP per Class C / Class D device, public via EUDAMED
• Annual SSP updates
• EUDAMED module access + submission procedure

• Class C / D device placed without SSP in EUDAMED
• SSP not kept current

Article 1 establishes the scope: IVDs (including their accessories) placed on the Union market or put into service in the Union. Article 1(2) clarifies that IVDs incorporating tissues or cells of human origin or their derivatives, or substances which are administered to humans, are within scope. Article 2 supplies the definitions including 'in vitro diagnostic medical device', 'IVD intended for self-testing', 'companion diagnostic', 'genetic test', 'performance', 'risk class A/B/C/D', 'economic operator', 'manufacturer', 'authorised representative', 'importer', 'distributor', 'Person Responsible for Regulatory Compliance (PRRC)', 'EUDAMED', 'UDI'. Article 3 (regulatory status of products) governs cases where it is not clear whether an item is an IVD or a different category of product.

• Scope determination per Article 1 + 3 for each product the entity manufactures / distributes
• Definitions glossary aligned to Article 2

• Product placed without an Article 3 regulatory-status determination where status is uncertain

Article 4 imposes specific requirements for IVDs intended for use as genetic tests on individuals. Member States ensure that the use of a genetic test is accompanied by appropriate information about the nature, the significance and the implications of the genetic test, including counselling where appropriate, and informed consent. Article 4 explicitly recognises the GDPR applies to the processing of genetic data; Article 4 supplements the GDPR with the medical-device dimension.

• Pre-test + post-test counselling framework where the entity offers genetic tests
• Informed-consent template for genetic tests
• Records of genetic-data processing aligned with GDPR Article 9(2)(h)/(i)/(j) lawful bases

• Genetic test offered without Article 4 pre-test counselling
• Genetic data processed without an Article 9 GDPR lawful basis

Article 10 imposes the central manufacturer obligations: (1) demonstrate compliance with general safety and performance requirements (Annex I); (2) establish + document + implement + maintain a Quality Management System (QMS, Article 10(8)); (3) carry out clinical/performance evaluation (Article 56) + post-market performance follow-up (PMPF); (4) prepare and update the technical documentation (Annex II + Annex III); (5) carry out conformity assessment (Article 48); (6) place the CE marking + draw up the EU declaration of conformity (Article 17 + 18); (7) register manufacturer + device (Article 28); (8) post-market surveillance system (Article 78) + vigilance reports (Article 82); (9) ensure traceability (Article 25); (10) provide implant cards where applicable.

• ISO 13485-aligned QMS demonstrating compliance with Article 10(8)
• Annex II + Annex III technical documentation maintained
• Annex I conformity evidence per device
• Annual QMS review

• Manufacturer without an ISO 13485 / equivalent QMS
• Annex II / Annex III technical documentation not maintained through device lifecycle

Article 11 requires a non-EU manufacturer to designate, by written mandate, a single authorised representative established in the Union. The authorised representative is responsible for ensuring (in cooperation with the manufacturer) Article 11(3) tasks (technical documentation availability, registration, cooperation with competent authorities). Article 12 governs the orderly change of authorised representative.

• Written mandate per Article 11(2) for each non-EU manufacturer the entity represents
• Article 11(3) responsibilities matrix
• Change-of-AR procedure

• Non-EU manufacturer placing IVDs in the Union without an authorised representative

Article 13 requires importers to verify that the IVD has been CE-marked, the EU declaration of conformity has been drawn up, the manufacturer is identified, the manufacturer has appointed an authorised representative (if non-EU), the device is registered with the manufacturer per Article 26, the labelling complies and instructions for use are in the required language. Article 14 imposes due-care obligations on distributors: verify CE marking + labelling + the importer's identity on the packaging + due care during storage and transport.

• Importer Article 13 verification records
• Distributor Article 14 due-care records

• Importing IVDs without verifying CE marking + EU DoC + manufacturer registration
• Distributor without due-care procedure

Article 15 requires manufacturers to have permanently available within their organisation at least one Person Responsible for Regulatory Compliance (PRRC) with the requisite expertise in the field of in vitro diagnostic medical devices. The PRRC has the formal responsibility to ensure: (a) the conformity of devices before release; (b) technical documentation and the EU DoC are drawn up and kept up to date; (c) post-market surveillance obligations (Article 10(9)); (d) vigilance reporting (Articles 82-86); (e) for investigational devices, the Article 70 declaration. Article 15(2) permits micro-enterprises / small enterprises to engage an external PRRC.

• PRRC appointment record (internal employee or external contract for micro/small enterprise)
• PRRC qualifications evidence (Article 15(1) credentials)
• PRRC reporting line to senior management

• Manufacturer without a documented PRRC
• PRRC without the Article 15(1) credentials (4-year degree + 1 year experience, OR 4 years experience for IVDs)

Article 16 provides that distributors / importers / other natural or legal persons are considered to be the manufacturer + assume the Article 10 obligations where: (a) they make available a device under their own name / trade mark / trademark (rebranding); (b) they change the intended purpose of a device already placed on the market; (c) they modify a device already placed on the market in such a way that compliance may be affected. Article 16(2) creates exceptions for natural-language translation + repackaging if Article 16(4) conditions met (notify manufacturer + competent authority 28 days in advance, QMS aspects in place).

• Substantial-modification policy aligned with Article 16
• Own-brand review process
• Article 16(2)-(4) translation / repackaging notification procedure

• Re-branding of IVDs without taking on Article 10 manufacturer obligations
• Repackaging without Article 16(4) notification

Article 5(1) prohibits placing on the market / putting into service of IVDs that do not comply with the Regulation; Article 5(5) sets the in-house IVD exception for healthcare institutions in narrow circumstances. Article 6 governs distance sales: IVDs offered through information-society services to natural or legal persons established in the Union must comply with the Regulation; offers must clearly state that the device complies with the Regulation. Article 7 prohibits misleading text/names/trademarks/picture/signs that may mislead the user/patient as to the device intended purpose, safety or performance.

• Pre-market compliance gate (Article 5(1))
• Online-offer compliance statement per Article 6
• Marketing-claim review process verifying Article 7 compliance
• In-house IVD Article 5(5) exception documentation (where applicable to healthcare institutions)

• IVD placed without conformity assessment + CE marking
• Online offer that does not state Article 6 conformity
• Marketing claims that mislead on intended purpose / safety / performance

Article 8 provides that IVDs in conformity with relevant harmonised standards (references published in the OJ) are presumed in conformity with the requirements of the Regulation covered by those standards. Article 9 enables the Commission, where no harmonised standards exist or are insufficient, to adopt common specifications (CS) for performance and safety requirements; conformity with CS gives presumption of conformity equivalent to harmonised standards.

• Standards-conformity mapping for each device
• CS-conformity records where applicable

• Presumption-of-conformity claim against a non-harmonised standard

Article 31 requires Member States to designate authorities responsible for the assessment, designation, notification, monitoring + re-assessment of notified bodies (NBs). Article 32 sets the substantive requirements for NBs (organisational + competence + quality-management). Article 33 governs subsidiaries and subcontracting (NB retains full responsibility).

• Engagement records with the relevant NB(s) for Class B/C/D conformity assessment
• Subsidiary / subcontracting transparency from NB

• Engagement of a body that is not an IVDR-notified NB for Class B/C/D assessment

Article 102 imposes confidentiality on competent authorities, NBs and other persons involved, with carve-outs for cooperation between authorities + publication of data through EUDAMED (subject to confidentiality safeguards). Article 103 confirms that the GDPR + Regulation (EU) 2018/1725 apply to personal-data processing under IVDR. Article 104 establishes the funding regime for Union-level activities under the IVDR. Articles 105-108 govern the Medical Device Coordination Group (MDCG) - composed of Member State representatives + Commission, with expert panels and EU reference laboratories supporting Class D scrutiny.

• Personal-data-processing records aligned with GDPR Articles 6 + 9 lawful basis for IVDR personal data
• Confidentiality regime for trade-secret material in technical documentation submissions
• Engagement records with the MDCG / expert panels where the entity is consulted

• Personal-data processing without GDPR Article 9 lawful basis (special-category health data)
• No process to assert trade-secret protection during MSA submissions

Article 110 as amended by (EU) 2024/1860 sets the transitional periods for legacy IVDs (devices already on the market under Directive 98/79/EC before 26 May 2022). Legacy devices with notified-body certificates issued under 98/79/EC may continue to be placed on the market until the certificate expires + 2 years (max). For self-declared devices under 98/79/EC, the staggered transition extends to: Class D devices until 31 December 2027; Class C devices until 31 December 2028; Class B + sterile-A devices until 31 December 2029. Article 110(3a) (added by 2024/1860) imposes a 'placing-on-the-market' notification obligation for manufacturers benefiting from the transition (6 months before the transitional deadline). Devices on the market before transition continue to be made available + put into service per Article 110(4).

• Transition plan per legacy device aligned with Article 110 + Article 110(3a) notification
• 6-month-before notification submitted to MSA
• EUDAMED submissions for transitioning devices

• Legacy device transitioned without Article 110 conformity assessment under the new IVDR
• Missed Article 110(3a) 6-month notification deadline

Article 112 requires Member States to lay down penalties for infringements of the Regulation. Penalties shall be effective, proportionate and dissuasive. Member States notify the Commission of the rules. Article 113 (Entry into force and date of application): the Regulation entered into force on 25 May 2017 and applied from 26 May 2022 (subject to the Article 110 transitional provisions for legacy devices).

• Awareness of the applicable national-law penalty regime in each Member State the entity operates in
• Compliance program managing risk against the Article 112 penalty regime

Article 78 requires manufacturers to plan, establish, document, implement, maintain and update a post-market surveillance (PMS) system, proportionate to the risk class and appropriate for the type of device. The PMS system actively + systematically gathers, records and analyses data on the quality, performance and safety of the device throughout its entire lifetime; the PMS plan is part of the technical documentation (Annex III). PMS information feeds back into performance evaluation (Article 56), into vigilance (Articles 82-86), and into the SSP (Article 29).

• PMS plan per device (Annex III content)
• PMS data-collection sources (complaints, returns, social media, literature, registries)
• PMS feedback loop to performance evaluation + vigilance + SSP

• PMS plan absent or not proportionate to risk class
• PMS data not feeding back to performance evaluation

Article 80 requires manufacturers of Class C and Class D devices to prepare a Periodic Safety Update Report (PSUR) summarising the PMS-data results and conclusions for each device or category of devices, and updated annually for Class D / every 2 years for Class C, made available through EUDAMED. Article 81 enables the NB to review the PSUR for Class C/D devices and provide an evaluation. For Class A and Class B devices, manufacturers prepare and keep up to date a PMS report (Article 80(1)) - simpler than the PSUR.

• PSUR per Class C / D device on the Article 80 cycle (annual D / 2-year C)
• PMS report per Class A / B device
• EUDAMED submission of PSURs
• NB review records for PSURs

• No PSUR for Class C / D devices
• PSUR not updated on the Article 80 cycle

Article 82 governs reporting of serious incidents and field safety corrective actions (FSCAs): manufacturer must report a serious incident no later than 15 days after becoming aware (10 days where serious incident is unanticipated and likely to result in death or unanticipated serious deterioration; 2 days where serious public-health threat). Article 83 governs trend reporting. Article 84 governs analysis of serious incidents and field safety corrective actions. Article 85 governs analysis of vigilance data at Union level. Article 86 governs electronic system on vigilance and post-market surveillance.

• Serious-incident detection + classification + reporting workflow within Article 82 timelines
• FSCA workflow including Field Safety Notices (FSN)
• Trend-reporting analysis
• EUDAMED vigilance-module submissions

• Serious incident reported beyond Article 82 timeline
• FSCA without Field Safety Notice published
• Trend reporting absent or perfunctory

Article 92 establishes market-surveillance powers of competent authorities including unannounced inspections of premises + sampling + testing. Article 93 covers evaluation of devices presenting a risk + measures available (corrective action, withdrawal, recall). Article 94 covers cases where devices comply with the Regulation but still present a risk. Article 95 covers cases of formal non-compliance with the Regulation.

• Inspection-readiness records (technical documentation + QMS + PMS file + vigilance file ready)
• Corrective-action / withdrawal / recall procedure

• No inspection-readiness program
• CAPA backlog from prior inspections