How do I place a medical device on the EU market?

The MDR guidelines from the perspective of a notified body

Anyone wishing to place a medical device on the market in the European Union generally does not require a traditional official "approval", but must demonstrate the conformity of the product with the applicable European requirements. The focus is on Regulation (EU) 2017/745 on medical devices, or MDR for short, or Regulation (EU) 2017/746 for in-vitro diagnostics, or IVDR for short, an effective quality management system, robust technical and clinical evidence, a suitable conformity assessment procedure and, finally, the CE marking. The MDR has been in force since May 26, 2021, the IVDR since May 26, 2022; both regulations apply directly in the EU member states.

From the perspective of DQS as a Notified Body, the formal conformity assessment procedure begins with the submission and examination of a complete application. From the manufacturer's perspective, however, successful EU market access begins much earlier: with a precise intended purpose, the correct regulatory classification, the right risk class, an effective quality management system, robust clinical evidence and technical documentation that is verifiable, consistent and MDR-compliant.

The application is therefore a central starting point of the formal procedure with the notified body, but not the beginning of regulatory preparation. Similarly, the submission of an application is no guarantee of certification. A certification decision can only be made after successful evaluation of the technical documentation, system assessment, auditing and final assessment.

Short answer: How is a medical device placed on the market in the EU?

A medical device may be placed on the market or put into service in the EU if it meets the essential safety and performance requirements, the applicable conformity assessment procedure has been successfully completed, the manufacturer issues an EU declaration of conformity and the CE marking is affixed. Depending on the risk class, a Notified Body is required for this. Medical devices bearing the CE marking can generally be freely marketed in the European Economic Area, but are still subject to market surveillance, post-market surveillance and vigilance.

The 12 central building blocks for EU market access

1. Clarify intended purpose and regulatory classification
2. Determine applicable regulation: MDR or IVDR
3. Determine risk class according to MDR or IVDR
4. Establish and effectively operate a quality management system
5. Demonstrate risk management and basic safety and performance requirements
6. Plan and document clinical evaluation or performance evaluation
7. Structure technical documentation in accordance with MDR Annex II and III
8. Determine conformity assessment procedure and notified body
9. Submit application and go through MDR certification process
10. Clarify procedural expectations at an early stage, for example via Structured Dialogue
11. Implement EU Declaration of Conformity, CE marking, UDI and registration
12. Continue post-market surveillance, vigilance and certification cycle

1 Clarify first: Is the product even a medical device?

The first step is the intended purpose. It describes the medical purpose for which the product is intended by the manufacturer, the environment in which it is used, the patient groups or users for whom it is intended and the performance claimed. The intended purpose influences whether a product is to be classified as a medical device, in-vitro diagnostic device, accessory, product according to MDR Annex XVI, combination product or possibly not as a medical device at all for regulatory purposes.

It is about the regulatory classification of the product. This includes the question of whether the product falls within the scope of the MDR or IVDR, whether it is an accessory, whether additional legal acts need to be taken into account and what obligations arise for the manufacturer and other economic operators. This results in the risk class, verification requirements, involvement of a notified body and the subsequent scope of post-market surveillance.

In addition to the manufacturer, economic operators include in particular EU authorized representatives, importers and distributors in accordance with Art. 11 to 16 MDR. For manufacturers outside the EU, an EU authorized representative is a prerequisite for access to the European market.

This classification should be carried out with particular care in borderline cases, such as software, AI-based products, digital health applications, products with a medicinal product component, products without an intended medical purpose in accordance with MDR Annex XVI or combinations of medical devices and IVDs.

As part of the conformity assessment procedure, we assess whether the classification chosen by the manufacturer and the evidence derived from it are comprehensible. However, the regulatory responsibility remains with the manufacturer. Therefore, the intended purpose should be consistent in the product description, risk management, clinical evaluation, instructions for use, labeling, advertising and technical documentation.

2 MDR or IVDR: Which EU regulation applies?

The following applies to medical devices Regulation (EU) 2017/745 MDR for short. Regulation (EU) 2017/746, or IVDR for short, applies to in vitro diagnostic medical devices. The European Commission describes both sets of regulations as part of the revised European medical device legislation, which is intended to take into account the technical and medical developments of recent decades.

The distinction is crucial because the MDR and IVDR provide for different classification rules, clinical or performance-related verification requirements and conformity assessment procedures. Transitional regulations, EUDAMED obligations and the involvement of notified bodies also differ in detail. The EU has also adapted transitional periods for certain medical devices with Regulation (EU) 2023/607 and addressed the gradual rollout of EUDAMED and IVDR transitional provisions with Regulation (EU) 2024/1860, among other things.

MDR compliance is not a one-off approval project. It is a lifecycle system. Anyone who sees EU market access only as a "CE project" is usually planning too short. By contrast, integrating MDR requirements into product development, QMS, clinical evidence, supplier management and PMS reduces friction losses in the conformity assessment process.

3 Determine the risk class: The regulatory path depends on it

The risk class determines which conformity assessment procedure is applicable, which evidence is required and whether a notified body needs to be involved. For medical devices according to MDR, there are classes I, IIa, IIb and III. Class I stands for the lowest risk, class III for the highest risk. Classification is carried out by the manufacturer using the classification rules in MDR Annex VIII and is based, among other things, on intended purpose, invasiveness, duration of use, mode of action, energy source, implantability and potential harm.

Overview of the MDR risk classes

For Class I devices without sterility, measuring function or reusability as a surgical instrument, the manufacturer can generally carry out the conformity assessment procedure without a Notified Body. Manufacturers of Class I devices are also subject to registration and market surveillance obligations, particularly in connection with EUDAMED. For Class Is, Im and Ir, the involvement of the notified body is limited to the critical aspects in each case. For classes IIa, IIb and III, the involvement of a Notified Body is mandatory.

We regularly point this out in our technical articles: Incorrect classification can cause costly delays because it affects technical documentation, clinical evaluation, PSUR, SSCP, audit planning and scope of certification.

4 Quality management system: the backbone of market access

In order for medical devices to be placed on the EU market, manufacturers must establish a suitable quality management system. An MDR-compliant quality management system is not just a document requirement. It is the operational system that manufacturers use to ensure that devices are developed, manufactured, monitored and improved in a compliant manner throughout their entire life cycle. Article 10(9) MDR requires a quality management system that covers regulatory compliance, risk management, clinical evaluation, product realization, supplier control, corrective and preventive actions, post-market surveillance and vigilance, among other things. UDI processes must also be taken into account in the QMS.

In practice, the EN ISO 13485 is the central reference framework for quality management systems in the medical device industry. We offer ISO 13485 certification for companies that manufacture or distribute medical devices or are involved in their manufacture as part of the supply chain. The standard supports manufacturers in systematically designing processes for development, production, installation, delivery, monitoring, traceability and disposal throughout the entire product life cycle.

An MDR-compliant QMS includes in particular

• Regulatory strategy and responsibilities
• Person Responsible for Regulatory Compliance, PRRC for short
• Design and development processes
• risk management
• Clinical evaluation or performance evaluation
• Technical documentation and document control
• Supplier management and outsourced processes
• Validation of production and testing processes
• CAPA, complaints and vigilance
• Post-market surveillance, PMCF or PMPF
• Change management across the entire product life cycle
• UDI, traceability and registration obligations

5 Demonstrate basic safety and performance requirements

The CE marking may only be affixed if the device meets the applicable essential safety and performance requirements. These requirements are set out in MDR Annex I and include safety, performance, risk management, biological safety, chemical and physical properties, protection against infection, electrical safety, software, suitability for use, labeling and information for users.

Proof is not provided by a single document. It results from the interaction of risk management, verification, validation, clinical evaluation, instructions for use, labeling, PMS plan and technical documentation. According to MDR Article 5, a device may only be placed on the market or put into service if it complies with the regulation; conformity with the essential safety and performance requirements includes the clinical evaluation according to Article 61.

What we examine particularly critically in the assessment: Are the intended purpose, risk management, clinical evaluation, technical documentation, labeling and QMS processes consistent with each other? Are the harmonized standards and common specifications used clearly stated? Are deviations justified? Is the state of the art taken into account? Are the performance promises backed up by data?

Typical weaknesses arise if the clinical evaluation describes a different performance profile than the instructions for use, if risks are weighted differently in risk management than in the PMS plan or if test reports cannot be clearly traced back to the claimed performance characteristics.

6 Clinical evaluation: Evidence is not an addendum

Clinical evaluation is a core component of MDR compliance. Manufacturers must determine and justify the required level of clinical evidence. This level must match the characteristics of the device and the intended purpose. According to MDR Article 61 and MDR Annex XIV, manufacturers must plan, conduct and document the clinical evaluation. The clinical evidence must be sufficient to demonstrate conformity with the applicable safety and performance requirements and the acceptability of the risk-benefit balance.

Clinical evidence can come from different sources: clinical trials, scientific literature, clinical experience, data from comparable devices, PMS data and PMCF data. For Class III devices and implantable devices, clinical investigations are generally particularly relevant; however, the MDR provides for certain exceptions, each of which must be carefully justified. The quantity and quality of clinical data must be sufficient to provide scientifically valid evidence of safety, performance and risk-benefit balance.

Equivalence arguments have become significantly more demanding under MDR. The MDCG Guideline 2020-5 clarifies that proof of equivalence does not replace clinical evaluation. It only allows clinical data of an equivalent device to be included in the clinical evaluation if technical, biological and clinical characteristics are sufficiently comparable and there are no clinically significant differences.

As a Notified Body, we do not only assess whether a clinical evaluation exists. We assess whether the methodology, database, equivalence argumentation, state of the art, value proposition, risk management, IFU, PMS and PMCF fit together. In addition to technical safety, manufacturers must provide clinical data to demonstrate clinical performance and the acceptability of the benefit-risk ratio.

7 Technical documentation: The central evidence for conformity assessment

The technical documentation is the central evidence base for MDR conformity. It must be structured in such a way that the conformity of the device with the MDR can be assessed. MDR Annex II describes the technical documentation, MDR Annex III the technical documentation for post-market surveillance.

MDR Annex II requires that the technical documentation is presented in a clear, organized, easily searchable and unambiguous manner. This structure is crucial for an efficient assessment by the Notified Body.

Robust technical documentation typically includes:

• Product description and specification, including variants and accessories
• Intended use, indications, contraindications, patient groups and user groups
• Regulatory classification and classification justification
• Evidence of the essential safety and performance requirements
• Risk management acts
• Verification and validation evidence
• Clinical evaluation and clinical data
• Evidence of biological safety, sterility, software, cybersecurity, electrical safety or suitability for use, if relevant
• Instructions for use, labeling and claims
• UDI information and basic UDI-DI
• PMS plan, PMCF plan and, if applicable, PSUR and SSCP
• A Summary of Safety and Clinical Performance (SSCP) is mandatory for implantable devices and class III devices in accordance with Art. 32 MDR. This document is validated by the notified body and serves to provide transparent information to users and the public.
• Evidence of manufacturing, suppliers, outsourced processes and critical tests

From our assessment practice, we see typical reasons for delays: insufficient or contradictory information, incomplete product descriptions, unclear delimitation of variants or accessories, evidence that is difficult to find, an application scope that is too large or inconsistent, incomplete test reports, inconsistencies between the application form and technical documentation or a lack of scientifically sound justification for data gaps.

8 Conformity assessment: When do I need a Notified Body?

For market access, the manufacturer must demonstrate the conformity of the device with the applicable MDR requirements. For Class I devices without sterility, measuring function or reusability as a surgical instrument, no Notified Body is required. For Class Is, Im, Ir, IIa, IIb and III, the involvement of a Notified Body is required.

The MDR provides for different conformity assessment procedures depending on the risk class and device type in accordance with Article 52 MDR. The most important procedures are based on Annexes IX, X and XI and, depending on the procedure, include the assessment of the quality management system, technical documentation and product conformity.

DQS MED is designated in particular for the following procedures:
- Annex IX Chapter I and III MDR (Quality Management System and Surveillance)
- Annex XI Part A Paragraph 7 MDR (Product Conformity Assessment)

As DQS MED, we are a Notified Body for Regulation (EU) 2017/745 on medical devices with the identification number 0297. As part of our designation, we review product documentation and assess whether the essential safety and performance requirements and the manufacturer's documentation requirements are met.

9 What does a Notified Body like DQS check?

The formal process with the Notified Body begins with the application and the examination of the application. Prior to this, there is often an information and offer phase in which the general conditions, product portfolio, risk classes, technological complexity and expected costs are clarified. Our MDR certification process can be structured in six steps:

On average, it should take around 12 to 15 months from the date of application to obtain the CE marking. However, the actual duration can vary considerably. Key influencing factors are the quality of the QMS and technical documentation, the complexity and classification of the product and the availability of qualified auditors and assessors. For Class III products or new technologies, the procedures can take considerably longer

From 2026, we will also increasingly use digital and AI-supported tools to support the assessment of technical documentation. Such tools can support structure, efficiency and quality in the assessment process. The technical assessment and certification decision will of course remain the task of qualified experts.

10 Structured Dialogue: Early clarification

Many delays do not occur because manufacturers have not invested any work, but because they submit the wrong evidence, inconsistent documentation structures or unclear procedural assumptions. With the Structured Dialogue a formal, impartial format to clarify procedural expectations and regulatory requirements without offering advice or strategic guidance.

The Structured Dialogue can be used before or during the conformity assessment process. DQS covers topics such as whether a product falls within the scope of the regulation, overview of the certification process, required documentation, technical documentation, classification and relevant MD codes.

11 EU declaration of conformity, CE marking, UDI and registration

After a successful conformity assessment procedure, the manufacturer issues the EU declaration of conformity and affixes the CE marking. The CE marking documents that the product fulfills the applicable requirements and that the required procedure has been completed. The responsibility remains with the manufacturer, even if a Notified Body was involved.

In addition, manufacturers must take into account the requirements for UDI, Basic UDI-DI and registration. For devices that are subject to a conformity assessment involving a Notified Body, the Basic UDI-DI must be assigned before the application is submitted to the Notified Body. UDI processes have an impact on design, labeling, documentation, EUDAMED data, vigilance and PMS processes and should therefore be anchored in the QMS at an early stage.

The MDR distinguishes between Basic UDI-DI, UDI-DI and UDI-PI. In addition, staggered UDI and registration requirements apply depending on the risk class. The registration obligations in EUDAMED apply to all manufacturers and products.

The CE marking is not the end of responsibility. It is the visible expression of a system that must continue to function: technical documentation, clinical evaluation, PMS, vigilance, change management and QMS must be kept up to date.

12 After market access: PMS, vigilance and continuous compliance

CE marking is not the end of the regulatory process. Manufacturers must plan, document, implement, maintain and update a post-market surveillance system. This system must be proportionate to the risk class and appropriate for the type of product. It serves to actively and systematically collect and analyze data on the quality, performance and safety of the product throughout its life cycle and to derive measures from this.

PMS data influences risk management, clinical evaluation, PMCF, PSUR, SSCP, instructions for use, labeling and, if necessary, changes to the product. Vigilance processes ensure that serious incidents and safety corrective actions in the field are assessed and reported in a timely manner.

Specific reporting deadlines apply in accordance with Art. 87 MDR: serious incidents must be reported within 15 days at the latest, and within 2 days in the case of immediate risk. In addition, there are trend reporting obligations in accordance with Art. 88 MDR.

MDR certification has a maximum term of five years and is continued via surveillance activities, audit cycles, change assessments and recertification. Changes to the QMS or technical documentation may require additional surveillance activities.

Typical errors that delay EU market access

1. intended purpose remains too vague

If it is not clearly described for whom, for what, how and in which clinical context the device is used, classification, clinical evaluation and risk management become uncertain.

2. classification is reviewed too late

Late reclassification can significantly change audit planning, technical documentation, clinical evidence and timelines.

3. technical documentation is complete but not auditable

A large amount of documentation is no substitute for a clear structure. We point out that lack of coherence and hard-to-find information are common reasons for delays in auditing technical documentation.

4. clinical evidence does not match the value proposition

The more the product claims clinical benefits, the more stringent the clinical evaluation must be to demonstrate these benefits.

5 PMS is only planned after CE

PMS must be established as a system before market access because it is part of the product life cycle and technical documentation.

6. suppliers are underestimated

Components, outsourced processes and critical service providers influence safety, performance and availability. We emphasize that supplier management is an essential part of an ISO 13485-compliant QMS and should be considered early on alongside document control and risk management.

FAQ: Frequently asked questions about EU market access for medical devices

Do I need approval for a medical device in the EU?

Not in the sense of a classic official market authorization as in some other markets. In Europe, the manufacturer declares conformity with the legal requirements following a conformity assessment procedure. Depending on the risk class, a notified body must be involved.

When do I need a Notified Body?

A Notified Body is generally required for Class IIa, IIb and III products as well as for certain Class I products, such as sterile products, products with a measuring function or reusable surgical instruments.

What is the role of DQS MED?

DQS MED is a Notified Body for Regulation (EU) 2017/745 on medical devices with identification number 0297. As a Notified Body, DQS MED assesses technical documentation, QMS requirements and other evidence of conformity within its scope of designation independently, impartially, neutrally and objectively.

Is ISO 13485 mandatory for EU market access?

The MDR requires a suitable quality management system. ISO 13485 is the central international standard for quality management systems in the medical device industry and is often used in practice as a structured framework. ISO 13485 serves as the basis for the certification of QMS for manufacturers, distributors and companies in the medical device supply chain. However, certification in accordance with ISO 13485 is not mandatory, but it does help to make it easier to meet the requirements of the MDR.

What belongs in the technical documentation?

The technical documentation must prove that the product meets the essential safety and performance requirements. It includes product description, intended purpose, classification, risk management, verification and validation, clinical evaluation, labeling and PMS documentation. MDR Annex II and III form the central structural requirements.

What happens after CE marking?

After CE marking, the manufacturer must continue to monitor the product, collect market data, keep technical documentation and clinical evaluation up to date, fulfill vigilance obligations and initiate corrective actions if necessary. PMS and vigilance are integral parts of MDR compliance.