EU MDR: what it is, who it applies to, and how CE marking works

What is the EU MDR?

Regulation (EU) 2017/745 is the European Union's law for placing a medical device on the EU market. It sets the safety and performance requirements a device must meet, the technical documentation and quality management system that show it, and the conformity assessment, through a notified body for all but the lowest-risk devices, before the manufacturer affixes the CE mark.

It has applied since 26 May 2021 and replaced the Medical Device Directive and the Active Implantable Medical Devices Directive. The CE mark signals the manufacturer's own EU declaration of conformity. The notified body's certificates cover the quality management system and the technical documentation that declaration rests on.

Who does the EU MDR apply to?

Manufacturers placing a medical device on the EU market, of any class, wherever the company is based. A manufacturer outside the EU also appoints an authorised representative in a member state

Manufacturers still selling devices on MDD or AIMDD certificates, who have until the end of 2027 or 2028 to complete MDR conformity assessment and had to meet the 2024 conditions to qualify

Software companies whose software has a medical purpose, since classification Rule 11 places most medical device software in Class IIa or above, so a notified body is involved

The regulation becomes urgent when a distributor asks for the declaration of conformity, when the notified body's surveillance audit goes on the calendar, or when the person responsible for regulatory compliance asks where the vigilance records are and nobody is sure.

What the MDR asks of a manufacturer

The manufacturer's obligations sit in Article 10 and point at the annexes. Most of them end as a procedure or a record in the quality management system the notified body audits.

Classification (Article 51, Annex VIII)

Class I, IIa, IIb or III under 22 rules, by how invasive the device is, how long it is in contact with the body and, for software, what decisions it informs

General safety and performance requirements (Annex I)

Three chapters: general requirements including risk management and the benefit-risk analysis, requirements on design and manufacture, and the label and instructions for use

Quality management system (Article 10(9))

Covering regulatory strategy, management responsibility, resources and suppliers, risk management, clinical evaluation, product realisation, UDI, post-market surveillance, vigilance and corrective action, and audited by the notified body for Class IIa and above, and for the sterile, measuring or reuse aspects of the Class I devices that have them

Technical documentation (Article 10(4), Annex II and III)

The file the notified body assesses before the CE mark goes on, with the post-market surveillance documentation that keeps it current. See EU MDR technical documentation

Clinical evaluation (Article 61, Annex XIV)

Clinical data showing the safety and performance requirements are met, planned, carried out and updated through the device's life with post-market clinical follow-up

Post-market surveillance (Articles 83 to 86)

A PMS plan for every device, a PMS report for Class I and a periodic safety update report for Class IIa, IIb and III

Vigilance (Articles 87 to 89)

Serious incidents and field safety corrective actions reported to the competent authority within the regulation's deadlines

UDI, registration and a person responsible for regulatory compliance (Articles 27 to 29 and Article 15)

A unique device identifier on the device and in EUDAMED, and a named person who checks conformity before release

How CE marking works

1. Classify the device under Annex VIII

And choose the conformity assessment route. The class decides whether a notified body is involved and how much of the technical documentation it assesses.

2. Show the general safety and performance requirements are met

Risk management, design verification and validation, clinical evaluation and the labelling, each against a requirement in Annex I, with the harmonised standards named.

3. Run the quality management system under Article 10(9)

With the PMS plan, the vigilance procedure and the clinical evaluation plan inside it, and compile the technical documentation to Annex II and III from the work it produces.

4. Conformity assessment

For Class IIa and above the notified body audits the quality management system and assesses the technical documentation, all of it for Class III and implantable Class IIb and a sample for the rest, then issues its certificates. Class I manufacturers self-declare without a notified body, except for sterile, measuring and reusable surgical devices.

5. Declare, mark and keep it current

Sign the EU declaration of conformity, affix the CE mark and register the device in EUDAMED, then run the yearly surveillance audits, the PSUR cycle and the clinical evaluation updates for as long as the device is on the market.

THE EU MDR IN QUALIO

Qualio maps your procedures, complaints and PMS records to the MDR's articles, so the notified body finds each one where the regulation puts it

Qualio breaks the MDR down article by article and maps your procedures, complaints, CAPAs and post-market surveillance records to the articles they answer. When a record changes, it reassesses the articles it touches and recommends a fix for any gap. Copilot drafts the procedure update or the CAPA from the recommendation, and your team approves it. When the surveillance audit is booked, you export the evidence by article.

The quality management system under Article 10(9) assessed against the MDR and ISO 13485 in the same library, so one surveillance audit covers both and each requirement is answered once

Complaints and CAPAs for Articles 87 to 89 held with the vigilance decision dated and signed on each complaint, where the notified body samples them at surveillance

Post-market surveillance procedures for Articles 83 to 86 as controlled documents, with training assigned on the effective date of every revision

The technical documentation under Annex II and III compiled by the product-level framework in the same library, so the file the notified body assesses and the procedures it audits are read together. See EU MDR technical documentation

Standards that apply alongside the EU MDR

Product submissionsEU MDR technical documentation: The file under Annex II and III that the same notified body assesses for the CE mark, compiled from the design controls the quality management system governs
Medical devicesISO 13485: EN ISO 13485:2016 with amendment A11:2021 is the harmonised standard for the quality management system Article 10 asks for, so a system built to it is where most notified bodies start the audit
Medical devicesISO 14971: The harmonised risk management standard behind the risk requirements in Annex I and the risk management file the manufacturer keeps for every device
Medical devicesIEC 62304: The software lifecycle a notified body expects to see for devices that are or contain software, from requirements to maintenance
Medical devicesFDA QMSR: The US equivalent expectation of a quality management system, inspected by the FDA against ISO 13485 as incorporated, so the records that answer one answer most of the other

Mindstep

Mindstep adopted Qualio's eQMS to streamline regulatory compliance, allowing them to focus on product development and achieve rapid certification success.

Read the Mindstep story

“Just building a compendium of everything you need to show the notified bodies can be tricky if you're doing it manually. We wanted to start on the right footing.”

Daniel AragaoCTO, InVivo Bionics

Guides and checklists for the EU MDR

Checklist

EU MDR general safety and performance requirements (GSPR) checklist

Guide

CE marking pathway guide

Guide

Medical device classification guide

Questions about the EU MDR

What is the EU MDR?

Do we need a notified body to CE mark a device?

For Class IIa, IIb and III, yes. The notified body audits the quality management system, assesses the technical documentation and issues the certificates the declaration of conformity rests on. Class I devices are self-declared by the manufacturer, except sterile, measuring and reusable surgical Class I devices, where a notified body assesses those aspects only.

What changed from the MDD to the MDR?

The MDR replaced the Medical Device Directive in 2021 with stricter rules in the same shape. Classification moved most medical device software up to Class IIa or higher, clinical evidence requirements rose and now run through the device's life, post-market surveillance and the PSUR became explicit obligations, and UDI, EUDAMED registration and a person responsible for regulatory compliance were added.

What are the MDR transition deadlines for legacy devices?

Devices on MDD or AIMDD certificates can stay on the market until 31 December 2027 for Class III and implantable Class IIb devices, and until 31 December 2028 for other Class IIb, Class IIa and the Class I devices that need a notified body, provided an MDR quality management system was in place and an application lodged by the 2024 deadlines.

What does the notified body audit at surveillance?

The quality management system under Article 10(9), on the records it has produced since the last audit: complaints and the vigilance decisions on them, CAPAs, the PMS plan and the PSUR or PMS report, clinical evaluation updates, supplier controls and changes to the device or the system. Unannounced audits sample the same records without notice.

Does the MDR require ISO 13485?

Article 10 asks for a quality management system without naming a standard. EN ISO 13485:2016 with amendment A11:2021 is the harmonised standard for it, so a system built to ISO 13485 is presumed to meet the requirements the standard covers and is where most notified bodies start. The conformity assessment still runs on top of the certificate.

Can we add the EU MDR to the standards we already run in Qualio?

Yes. Add it from the library and Qualio assesses the procedures, complaints, CAPAs and PMS records you already hold against the MDR's articles, alongside ISO 13485 if you run that too. The technical documentation has its own framework in the same library, so the file compiles from the design controls already in Qualio.

When is the notified body audit?

Bring the audit date and your current procedures. We will show you the MDR assessed against them article by article, with the gaps listed and the evidence exported as the notified body samples it.

Book a demo Get the CE marking pathway guide

Less time on audit prep. More time on quality.