EU Medical Devices Regulation (MDR 2017/745)

Article 51 + Annex VIII set the risk-based classification system for medical devices into Class I (low risk; e.g. wheelchairs, spectacles), Class IIa (medium risk; e.g. hearing aids, thermometers), Class IIb (medium-high risk; e.g. ventilators, infusion pumps), Class III (high risk; e.g. implants, life-supporting devices, drug-delivery devices, contraceptives, breast implants). Annex VIII has 22 classification rules + special-rule provisions. The classification drives the conformity assessment route under Article 52.

• Annex VIII rule-by-rule classification analysis per device
• Reclassification trigger on changes to intended purpose or design
• Up-classification to Class III for high-risk software / AI as medical device per Rule 11 (MDR-software rule)

• Class IIb / III device classified as IIa or below
• No Rule 11 software-classification analysis for SaMD

Article 52 sets the conformity-assessment routes by class. Class I devices (other than sterile/measuring/reusable surgical instruments): self-declaration. Class I sterile / measuring / reusable surgical: limited NB involvement. Class IIa: NB review of technical documentation. Class IIb + Class III: full NB QMS + technical documentation assessment (Annex IX or X/XI). Class III implantables: Article 54 consultation procedure (clinical evaluation consultation) with expert panel. Certain Class IIb implantables: Article 54 procedure also applies. Article 55 establishes scrutiny mechanism for certain Class III/IIb conformity assessments by EU expert panels + MDCG.

• Conformity-assessment route selection record per device class
• NB QMS + technical-documentation assessment for Class IIa+
• Article 54 expert-panel consultation for Class III implantables + certain Class IIb implantables
• Article 55 scrutiny records where applicable

• Class IIa/IIb/III device self-declared without NB involvement
• Class III implantable without Article 54 expert-panel consultation
• Inadequate Class IIb-implantable consultation

Article 56 governs certificates of conformity issued by NBs (validity max 5 years, may be subject to conditions, suspended/withdrawn/restricted on non-compliance). Certificates are technology-bound and may require periodic surveillance. Article 57 establishes the electronic system on NBs + certificates available through EUDAMED.

• NB certificate file per device
• Certificate-validity monitoring + renewal procedure

• Operating with an expired or withdrawn NB certificate

Article 61 requires manufacturers to plan + conduct + document a clinical evaluation covering scientific validity + clinical performance + clinical safety, throughout the device lifecycle (including via post-market clinical follow-up, PMCF). Article 61(10) recognises equivalence + literature-based evaluations under conditions; Article 61(4)-(6) for Class III + implantables requires clinical investigations except in narrow circumstances. Article 62 sets the general requirements for clinical investigations: informed consent + ethics committee approval + insurance + data integrity + investigator qualification + GCP / ISO 14155 alignment. Article 62 confirms the GDPR + Regulation (EU) 2018/1725 apply to personal-data processing in clinical investigations.

• Annex XIV clinical evaluation file per device
• PMCF plan + execution records
• Article 62 clinical-investigation application file + ethics committee approval
• ISO 14155-aligned GCP for medical-device clinical investigations
• GDPR Article 9 lawful basis + DPIA for clinical-investigation data

• Class III / implantable device placed without clinical investigation (where Article 61(4)-(6) require it)
• Clinical investigation without ethics committee approval

Article 70 sets the application procedure for clinical investigations through EUDAMED + Member State competent authority. Article 74 covers clinical investigations on CE-marked devices used outside the intended purpose. Article 75 covers substantial modifications to clinical investigations. Article 80 sets recording + reporting of adverse events: investigators record + report adverse events to the sponsor; the sponsor reports serious adverse events (SAEs) and serious adverse device effects (SADEs) to Member State competent authorities + Member States cooperate to evaluate the safety profile. Article 82 covers ethics committee involvement.

• Article 70 EUDAMED application
• Article 80 SAE / SADE reporting workflow
• Article 75 substantial-modification notification

• Clinical investigation initiated without Article 70 + ethics committee approval
• Late SAE / SADE reporting

Article 19 requires the manufacturer to draw up the EU DoC per Annex IV before placing the device on the market or putting it into service. By drawing up the EU DoC the manufacturer assumes responsibility for compliance. The EU DoC is kept available for 10 years (15 years for implantable devices). Article 20 requires affixing the CE marking visibly + legibly + indelibly on the device or its sterile pack and on instructions for use and on sales packaging. Where a notified body is involved, the NB identification number follows the CE marking.

• EU DoC per device aligned with Annex IV
• 10-year retention (15-year for implantables)
• CE marking artwork + NB identification number where applicable

• MD placed without EU DoC
• Missing NB identification number for Class IIa/IIb/III devices

Article 21 covers devices for special purposes (custom-made, investigational). Article 22 covers systems and procedure packs - combinations of MDs or MDs with non-MD products (system / procedure-pack producer signs a declaration that the components are compatible + bear CE marking + the combination is properly sterilised where applicable). Article 23 covers parts and components placed on the market separately for replacement / repair / refurbishment.

• Custom-made device statement per Annex XIII where applicable
• Article 22 system / procedure-pack declaration
• Article 23 parts-and-components compliance

• System / procedure pack without Article 22 declaration

Article 25 requires economic operators to identify, on request of MSA, any other economic operator that supplied them with the device or to whom they have supplied the device, for 10 years (15 years for implantable devices). Article 27 establishes the UDI system: every MD (except custom-made + investigational) carries a UDI consisting of UDI-DI + UDI-PI; Class III + implantable devices have full UDI on the device itself + packaging. Article 28 governs the UDI database within EUDAMED.

• 10-year (15-year implantable) supplier / customer records
• UDI assignment + EUDAMED database submission
• UDI on device for Class III + implantable

• Devices placed without UDI (other than Article 27(2) carve-outs)
• No 10-year (15-year implantable) supply-chain records

Article 29 requires registration of devices in EUDAMED prior to placing on the market or putting into service: manufacturer registers device + UDI-DI + design information. Article 30 establishes the electronic system for registration of economic operators. Article 31 requires manufacturers + ARs + importers to register their data in EUDAMED (identity + activities + EU economic-operator identification number). Data is publicly accessible (with limited carve-outs).

• EUDAMED registration per device + per economic-operator role
• Registration data kept current

• Device placed without EUDAMED registration
• Economic-operator data not kept current

Article 32 requires the manufacturer to draw up, for implantable devices and Class III devices (other than custom-made + investigational), a Summary of Safety and Clinical Performance (SSCP) accessible through EUDAMED in plain language. The SSCP is part of the technical documentation. Article 33 establishes EUDAMED, the European database on medical devices (operated by the Commission), interconnecting the UDI / registration / NB+certificates / clinical-investigations / vigilance / market surveillance modules.

• SSCP per implantable + Class III device, public via EUDAMED
• Annual SSCP updates
• EUDAMED module access + submission procedure

• Implantable / Class III device placed without SSCP in EUDAMED
• SSCP not kept current

Article 10 imposes the central manufacturer obligations: (1) demonstrate compliance with general safety and performance requirements (Annex I); (2) establish + document + implement + maintain a Quality Management System (Article 10(9), aligned with ISO 13485); (3) carry out clinical evaluation (Article 61) + post-market clinical follow-up (PMCF); (4) prepare and update the technical documentation (Annex II + Annex III); (5) carry out conformity assessment (Article 52); (6) place the CE marking + draw up the EU DoC (Article 19 + 20); (7) register manufacturer + device (Article 31); (8) post-market surveillance system (Article 83) + vigilance reports (Article 87); (9) ensure traceability (Article 25); (10) provide implant cards (Article 18) where applicable; (11) corrective action obligation Article 10(12); (12) cooperation with MSA Article 10(14); (13) Article 10(16) financial coverage fo

• ISO 13485-aligned QMS demonstrating Article 10(9)
• Annex II + Annex III technical documentation
• Annex I conformity evidence per device
• Implant card per Article 18 for implantable devices
• Article 116 financial-coverage arrangements (insurance / equivalent)

• Manufacturer without ISO 13485 / equivalent QMS
• Implantable device placed without Article 18 implant card
• No Article 116 financial coverage

Article 11 requires a non-EU manufacturer to designate, by written mandate, a single authorised representative established in the Union, with Article 11(3) tasks. Article 12 governs orderly change of AR. Article 13 sets importer obligations: verify CE marking + EU DoC + manufacturer identification + AR appointment (non-EU) + device registration + labelling compliance. Article 14 sets distributor obligations: due care + verify CE marking + cooperate with manufacturer + report serious incidents.

• AR mandate per Article 11(2)
• Importer Article 13 verification records
• Distributor Article 14 due-care records

• Non-EU manufacturer without AR
• Importer accepting MDs without Article 13 verification

Article 15 requires manufacturers to have permanently available at least one Person Responsible for Regulatory Compliance (PRRC) with the requisite expertise. The PRRC has formal responsibility to ensure: (a) device conformity before release; (b) technical documentation + EU DoC are drawn up and kept up to date; (c) PMS obligations; (d) vigilance reporting (Articles 87-92); (e) for investigational devices, Article 62 declaration. Article 15(2) permits micro/small enterprises to engage an external PRRC.

• PRRC appointment record (internal or external for micro/small)
• PRRC qualifications evidence per Article 15(1)
• PRRC reporting line to senior management

• Manufacturer without documented PRRC
• PRRC without Article 15(1) credentials (4-year degree + 1 year experience OR 4 years experience)

Article 16 provides that distributors / importers / other natural or legal persons are considered to be manufacturer + assume Article 10 obligations where: (a) they make available a device under their own name / trade mark (rebranding); (b) they change the intended purpose; (c) they modify a device already placed on the market such that compliance may be affected. Article 16(2)-(4) create exceptions for natural-language translation + repackaging if conditions met (notify manufacturer + competent authority 28 days in advance, QMS aspects in place).

• Substantial-modification policy aligned with Article 16
• Own-brand review process
• Article 16(2)-(4) translation / repackaging notification procedure

• Re-branding of MDs without taking on Article 10 manufacturer obligations
• Repackaging without Article 16(4) notification

Article 17 permits the reprocessing of single-use devices only where authorised by national law and subject to Article 17(2) safe-handling conditions; the reprocessor is considered to be the manufacturer of the reprocessed device. Article 18 requires manufacturers of implantable devices to provide an implant card together with information to be supplied to the patient. The card contains: device identifier + manufacturer identity + clinical / safety information + UDI + post-implant patient instructions.

• Reprocessing-as-manufacturer compliance where the entity reprocesses single-use devices
• Implant card content per Article 18 in plain language + patient-accessible languages

• Reprocessing single-use devices without Article 17(2) authorisation
• Implantable device placed without implant card

Article 5 prohibits placing on the market / putting into service of MDs that do not comply with the Regulation; Article 5(5) sets the in-house MD exception for healthcare institutions in narrow circumstances (single-use exception). Article 6 governs distance sales / information-society services. Article 7 prohibits misleading text / names / trademarks / pictures / signs as to the device intended purpose, safety or performance.

• Pre-market compliance gate (Article 5(1))
• Online-offer compliance statement per Article 6
• Marketing-claim review process verifying Article 7

• MD placed without conformity assessment + CE marking
• Online offer that does not state Article 6 conformity

Articles 35-38 govern designation of authorities responsible for notified bodies + the substantive NB requirements + the designation + notification procedure. Article 39 sets NB identification numbers. Article 40 governs monitoring + re-assessment of NBs. Article 41 covers review of NB assessments. Article 42 covers changes to designations. Articles 45-47 cover NB exchange of experience + coordination. Article 50 lists NB operational obligations including independence + impartiality + competence + transparency + fees.

• Engagement records with the relevant NB(s) for Class IIa/IIb/III
• Subsidiary / subcontracting transparency from NB
• Article 50 operational obligations verified

• Engagement of a body that is not an MDR-notified NB for Class IIa/IIb/III

Article 103 establishes the Medical Device Coordination Group (MDCG) composed of Member State representatives + Commission, with expert panels and EU reference laboratories supporting the Article 54 consultation procedure + Article 55 scrutiny mechanism + clinical evaluation guidance + class-up evaluation. Articles 104-108 detail expert-panel + reference-laboratory roles.

• Engagement records with MDCG / expert panels / EU reference laboratories where the entity is consulted

Article 109 imposes professional-secrecy on competent authorities, NBs and other persons involved, with carve-outs for cooperation between authorities + publication of data through EUDAMED. Article 110 confirms that the GDPR + Regulation (EU) 2018/1725 apply to personal-data processing under MDR. Article 111 governs personal-data processing in EUDAMED. Article 113 covers Member-State penalty regimes. Article 116 (note: Articles 115/116 in some renumbered versions) requires Member States to ensure that manufacturers + AR + importer + distributor have sufficient financial coverage (insurance or equivalent) for civil liability for damages caused by devices.

• GDPR Article 9 lawful basis + Article 32 security for personal-data processing under MDR
• Financial-coverage arrangements per Article 116 (insurance / captive / equivalent)
• Confidentiality regime for trade-secret material in MSA submissions

• Personal-data processing without GDPR Article 9 lawful basis
• No Article 116 financial coverage

Article 120 as amended by (EU) 2023/607 sets the transitional periods for legacy MDs (devices already on the market under Directives 90/385/EEC or 93/42/EEC before 26 May 2021). Class III implantables + Class IIb implantables (with exceptions): legacy devices may continue under specified conditions until 31 December 2027. Other Class IIb + Class IIa + Class I sterile/measuring: until 31 December 2028. Conditions: existing MDD/AIMDD certificate + ongoing PMS + no significant change in design/intended purpose + Article 120(3a) notification to MSA of intention to rely on the extension. CRA-Art.11 carve-out: MD cybersecurity remains under MDR; CRA does not apply.

• Transition plan per legacy MD aligned with Article 120 + Article 120(3a) notification
• 6-month-before notification submitted to MSA
• EUDAMED submissions for transitioning devices

• Legacy MD transitioned without Article 120 conformity assessment under the new MDR
• Missed Article 120(3a) notification deadline
• Treating MD as subject to CRA cybersecurity baseline (CRA Article 2 / Article 11 carve-out applies; MDR Annex I cybersecurity continues)

Article 122 repealed Council Directives 90/385/EEC (AIMDD) and 93/42/EEC (MDD) with effect from 26 May 2021 (later partly extended via Article 120 as amended by (EU) 2023/607). Article 123 provides that the Regulation entered into force on 25 May 2017 and applied from 26 May 2021 (subject to the Article 120 transitional provisions for legacy devices).

• Compliance calendar reflecting 25 May 2017 entry into force + 26 May 2021 application + Article 120 transitional deadlines (31 Dec 2027 / 31 Dec 2028)

• Operating against the MDD/AIMDD baseline outside the Article 120 transitional conditions

Article 83 requires manufacturers to plan + establish + document + implement + maintain + update a post-market surveillance (PMS) system, proportionate to the risk class and appropriate for the type of device. The PMS system actively + systematically gathers, records and analyses data on the quality, performance and safety of the device throughout its entire lifetime; the PMS plan is part of the technical documentation (Annex III). PMS information feeds back into clinical evaluation (Article 61), vigilance (Articles 87-92), the SSCP (Article 32) and the PSUR (Article 86).

• PMS plan per device (Annex III content)
• PMS data-collection sources (complaints, returns, social media, literature, registries)
• PMS feedback loop to clinical evaluation + vigilance + SSCP

• PMS plan absent or not proportionate to risk class
• PMS data not feeding back to clinical evaluation

Article 84 sets out the structure of the PMS plan (Annex III content). Article 85 requires Class I devices to have a PMS report (Annex III) updated when necessary and made available to MSA on request. Article 86 requires Class IIa, IIb and III devices to have a Periodic Safety Update Report (PSUR) summarising the PMS-data results and conclusions, with PSUR submitted via EUDAMED: annual for Class III + implantables / every 2 years for Class IIa / Class IIb. PSUR is reviewed by the NB for Class IIa/IIb/III.

• PMS report per Class I device + PSUR per Class IIa/IIb/III
• EUDAMED PSUR submission on Article 86 cycle
• NB review records for PSURs

• No PSUR for Class IIa/IIb/III devices
• PSUR not updated on the Article 86 cycle

Article 87 governs reporting of serious incidents and field safety corrective actions (FSCAs): manufacturer must report a serious incident no later than 15 days after becoming aware (10 days where the incident is unanticipated and likely to result in death or unanticipated serious deterioration; 2 days where serious public-health threat). Article 88 governs trend reporting (statistically significant increase in non-serious incidents or expected SAEs). Article 89 covers analysis of serious incidents + FSCAs. Article 90 covers periodic summary reporting in agreement with MSA. Article 91 covers analysis at Union level. Article 92 governs the EUDAMED vigilance + PMS electronic system.

• Serious-incident detection + classification + reporting workflow within Article 87 timelines
• FSCA workflow with Field Safety Notice
• Trend-reporting analysis
• EUDAMED vigilance-module submissions

• Serious incident reported beyond Article 87 timeline
• FSCA without Field Safety Notice
• Trend reporting absent

Article 93 establishes market-surveillance powers including unannounced inspections + sampling + testing. Article 94 covers evaluation of devices presenting a risk + measures available (corrective action, withdrawal, recall). Article 95 covers cases where devices comply with MDR but still present a risk. Article 96 covers cases of formal non-compliance with MDR. Articles 97-98 cover product-safety procedures + Union-level action.

• Inspection-readiness records (tech doc + QMS + PMS file + vigilance file ready)
• Corrective-action / withdrawal / recall procedure

• No inspection-readiness program
• CAPA backlog from prior inspections

Article 1 establishes the scope: medical devices for human use and accessories. Sectoral carve-outs include in vitro diagnostics (covered by IVDR), medicinal products (Directive 2001/83/EC), human blood, transplants, foodstuffs. Article 1(2) makes specific provisions for devices incorporating a medicinal-product substance or human-blood derivative. Article 2 supplies definitions including 'medical device', 'accessory', 'active implantable medical device', 'custom-made device', 'investigational device', 'single-use device', 'reprocessed device', 'Class I/IIa/IIb/III', 'PRRC', 'EUDAMED', 'UDI', 'serious incident', 'field safety corrective action (FSCA)', 'periodic safety update report (PSUR)'. Article 3 governs regulatory-status determinations. Article 4 covers products with both medical and non-medical use.

• Scope determination per Article 1 + 3 for each product
• Definitions glossary aligned to Article 2
• Annex XVI Article 1(2) products (devices without intended medical purpose, e.g. coloured contact lenses, dermal fillers) compliance plan

• Product placed without an Article 3 regulatory-status determination
• No coordination between MDR and Directive 2001/83/EC for medicinal-product-containing devices