Medical Devices with DQS: a Notified Body for the long term.
DQS is a designated EU Notified Body (NB 0297) for Regulation (EU) 2017/745 on medical devices (MDR). We deliver conformity assessment for CE Marking, ISO 13485, ISO 15378, TCP III and MDSAP certification with auditors who understand your technology.
Notified Body 0297
Designated under the EU MDR to assess a broad range of active and non-active medical devices.
ISO 13485 + MDSAP
Globally recognized ISO 13485 certification and MDSAP audits for five key markets.
SaMD & Cybersecurity
A dedicated unit for software devices & cybersecurity standards like ISO 27001.
Digital Reviews, Smarter Synergies
Our digital review tool creates greater transparency, increases efficiency, and improves collaboration.
The Transition Calendar That Actually Matters
MDR transition deadlines: through 2028 and beyond.
The EU MDR became fully applicable on 26 May 2021. Regulation (EU) 2023/607, in force from 20 March 2023, extended transition periods only for eligible legacy devices that meet the conditions in Article 120. Devices placed on the market after the MDR date of application, and devices that do not qualify as legacy devices, must follow MDR directly and do not benefit from transition time.
|
| Current phase |
|
|
26 May 2021 | 20 March 2023 | 2025 / 2026 | 31 December 2027 | 31 December 2028 |
MDR Date of Application MDR became applicable. AIMDD and MDD were repealed for new devices. | Transition Extension Regulation (EU) 2023/607 entered into force for eligible legacy devices. | Active transition Legacy-device transition projects continue where the legal conditions are fulfilled. | Higher-risk legacy devices Deadline for Class III devices and Class IIb implantable devices, except certain well-established technologies. | Other eligible legacy devices Deadline for Class IIb non-implantable, Class IIa, Class Is, Class Im and Class Ir devices. |
The DQS MED portfolio
Five Core Services:
CE Marking under MDR, QMS Audits, Structured Dialogue, Software Operation Unit and Global Market Access.
The DQS medical device portfolio is designed to support manufacturers across the full regulatory and certification lifecycle. From MDR CE marking and ISO 13485 audits to early-stage Structured Dialogue services, DQS helps manufacturers navigate complex regulatory requirements with greater clarity and efficiency. Our dedicated Software & AI expertise unit supports digital health technologies, while our global network and specialized technical teams provide expertise across a broad range of medical device technologies, regulatory pathways, and international market access requirements.
Notified Body conformity assessment: the certificate that places your device on the EU market
Notified Body certification is required for all devices above Class I, as well as for Class I devices that are sterile, have a measuring function, or are reusable surgical instruments (Classes Is, Im, and Ir). Other Class I devices can be self-certified. CE certification provides access to all EU Member States and the European Economic Area.
The default conformity assessment route under MDR. Combines quality management system audit and technical documentation review, with surveillance audits over a 5-year certificate cycle. Class III and Class IIb implantable devices undergo per-product technical documentation review; Class IIa applies a sampled approach.
Annex XI Part A is an MDR conformity assessment path based on production quality assurance. Instead of assessing the full QMS route under Annex IX, the Notified Body focuses on the manufacturer’s approved quality system for production and final product verification, confirming that devices are consistently manufactured in conformity with the approved technical documentation and applicable MDR requirements. It is particularly relevant where the conformity strategy separates design evidence from production-control assurance.
Mid-cycle modifications to devices, intended use, or QMS need to be assessed for whether they constitute a significant change. DQS provides structured significant-change reviews: rather than open-ended interpretation calls: so changes can be planned, documented, and assessed efficiently.
Quality management systems: the foundation of efficient conformity assessment
ISO 13485 is the main standard used for medical device certification and is harmonized with MDR and closely aligned with FDA quality system expectations. Depending on the markets you want to access, MDSAP or ISO 9001 may also be relevant. Combining these standards in a coordinated audit programme saves time, avoids repeated work, and makes regulatory oversight easier.
The international QMS standard for medical device manufacturers. Covers design and development, production, installation, servicing, and post market surveillance: with risk-based decision-making throughout. Required as the QMS basis for MDR Notified Body assessment, and recognised globally as the medical device QMS reference.
A single audit programme accepted by five regulators: TGA Australia, ANVISA Brazil, Health Canada, MHLW/PMDA Japan, and FDA. One audit, one report, five jurisdictions. Mandatory in Canada; recognised in the others as a substitute or supporting audit. DQS is an authorised MDSAP Auditing Organization: combining MDSAP with ISO 13485 surveillance is the most common configuration.
For organisations producing both medical devices and non-medical products. The two standards share the Annex SL structure but differ on risk-based design, post market surveillance, and regulatory communication. One auditor team, one audit calendar: sharing common-clause testing across both standards.
Structured Dialogue: regulatory alignment before and during conformity assessment
Structured Dialogue is a transparent communication process between the manufacturer and the Notified Body. It helps clarify questions, expectations, scope and documentation logic before and during the conformity assessment, without replacing the formal assessment itself.
The manufacturer submits a request on topics such as classification, conformity assessment, technical documentation or required evidence. DQS confirms whether the topic is suitable and sets clear boundaries to keep the exchange efficient, transparent, and compliant. Submit your request here.
Relevant DQS specialists are assigned according to the topic, such as MDR route planning, technical documentation, QMS, software, AI, cybersecurity, clinical evidence or post-market surveillance.
The session is conducted and the outcome is documented and archived. The purpose is to improve efficiency and predictability, avoid misunderstandings and delays, and align on regulatory expectations.
Software Operations Unit: a dedicated unit for regulatory excellence in Software, AI and Cybersecurity
DQS has a dedicated Software Operation Unit with experts in software, AI, and cybersecurity. As the MDR classifies most diagnostic and therapeutic software as Class IIa or higher, Notified Body involvement is now commonly required. Key expectations are reflected across IEC 62304, IEC 62366-1, IEC 82304-1, IEC 81001-5-1, and MDCG 2019-16.
The lifecycle process standard for medical device software. Defines software safety classes (A, B, C), required process activities per class, and the boundary between software within a device and stand-alone SaMD. The non-negotiable foundation for any software in MDR scope: Notified Body assessors apply IEC 62304 even where a manufacturer has not formally claimed it.
Where IEC 62304 covers the software lifecycle, IEC 82304-1 covers the product-level requirements for stand-alone health software: safety, security, intended use environment, and information for the user. Most relevant for SaMD products distributed via app stores or as installed software, not as part of a hardware device.
The product-lifecycle cybersecurity standard for health software. Sets requirements for secure-by-design development, secure update management, vulnerability disclosure, and post market security monitoring. Now the Notified Body reference for evaluating MDR Annex I.17 requirements for electronic programmable systems.
Global market access: FDA, South Africa, MDSAP, and beyond
Most medical device manufacturers operate across multiple international markets. From both a commercial and regulatory perspective, the EU, US, Canada, Australia, Brazil and Japan represent some of the world’s most significant and strategically relevant healthcare markets. As regulatory frameworks continue to evolve globally, manufacturers increasingly benefit from aligning requirements for CE marking, FDA, Health Canada (via MDSAP), Brazil ANVISA, South Africa SAHPRA and Japan PMDA through a coordinated approach rather than addressing each market sequentially.
The FDA Quality Management System Regulation replaces 21 CFR Part 820 from 2 February 2026, incorporating ISO 13485:2016 by reference. For manufacturers already certified to ISO 13485, this materially closes the gap between EU and US quality-system expectations. DQS ISO 13485 certification supports manufacturers in aligning their quality-management requirements with FDA expectations, creating a stronger basis for efficient US market readiness.
South Africa requires medical device establishments to demonstrate an ISO 13485:2016 quality management system as part of SAHPRA establishment licensing and renewal expectations. DQS ISO 13485 certification helps manufacturers, importers and distributors structure the QMS evidence needed for South African regulatory alignment and market access.
Health Canada requires MDSAP certification as the QMS basis for licensing Class II, III and IV medical devices in Canada. DQS is an authorised MDSAP Auditing Organization: the audit feeds directly into the Canadian device licence application without duplicate work.
Our certification services for medical device and pharmaceutical packaging manufacturers.
The strategic portfolio above maps to our core certification services you can request a quote for today: EU MDR conformity assessment, ISO 13485 QMS certification, MDSAP, ISO 15378 for pharmaceutical packaging, and Taiwan TCP III market-access support.
EU MDR 2017/745 Certification
Full Notified Body conformity assessment under Regulation (EU) 2017/745: QMS audit, technical documentation reviw, and certificate issue under NB 0297 for Class IIa, IIb and III devices.
ISO 13485 Certification
The internationally recognised QMS standard for medical device manufacturers. Three-year cycle with annual surveillance, and the foundation that MDR, MDSAP, FDA quality-systems and South Africa SAHPRA expectations all rest on.
MDSAP: Medical Device Single Audit Program
A single audit program accepted by TGA Australia, ANVISA Brazil, Health Canada, MHLW/PMDA Japan, and FDA. One audit, one report, five regulators: significantly reduces total audit days across the global QMS program.
ISO 15378 Certification for pharmaceuticals firms
For manufacturers of primary packging materials for medicinal products. Combines ISO 9001 with GMP-aligned requirements speficit to pharmaceutical packaging integrity, hygiene, and traceability.
Your MDR device class determines the conformity assessment route, the sampling logic and the depth of Notified Body review.
MDR Annex VIII classifies devices into risk classes. This is not only a label for the certificate: it determines whether DQS is involved as Notified Body, which conformity assessment annex is appropriate, how technical files are sampled, and which evidence must be strongest before submission.
MDR risk classes and Notified Body involvement
The higher the class, the more product-specific the assessment. Class I is generally self-declared, while Class IIa, IIb and III normally require Notified Body involvement. Class Im, Is and Ir are special Class I cases where the Notified Body assesses the measuring, sterile or reusable surgical aspects.
Class I
Manufacturer self-declaration for non-sterile, non-measuring, non-reusable surgical devices. DQS involvement only for Class Is, Im or Ir aspects.
Class IIa
Notified Body assessment of the QMS and sampled technical documentation across representative device groups.
Class IIb
Deeper Notified Body involvement. Non-implantable devices are generally sampled; implantable devices require per-product technical documentation review.
Class III
Per-product technical documentation review, with additional clinical evaluation scrutiny and consultation routes in defined cases.
MDR classification defines the formal conformity-assessment route. The boxes below make the practical assessment scope easier to understand. They show which evidence areas usually become decisive for different device technologies and business roles: for example, software architecture and cybersecurity for SaMD, biological safety for patient-contacting devices, process validation for sterile products, or supplier and import responsibilities for economic operators. Use them as a preparation guide after the MDR class has been confirmed, not as a substitute for Annex VIII classification.
- Clarifies whether the assessment focuses on mechanical, electrical, software or sterile characteristics
- MDR Annex IX route with QMS audit and technical-file review for Class IIa and above
- ISO 14971 risk management and GSPR traceability as the backbone of the file
- ISO 10993 biological evaluation where patient contact is relevant
- IEC 60601 electrical safety and EMC evidence for active devices
- Clarifies whether the software has its own intended medical purpose or supports a hardware device
- Most diagnostic or therapeutic SaMD falls into Class IIa or higher under MDR Rule 11
- IEC 62304 software lifecycle and IEC 82304-1 product-level requirements
- ISO 27001 and IEC 81001-5-1 cybersecurity and post-market vulnerability handling
- AI governance touchpoints, including ISO/IEC 42001 where relevant. AI Act & JTC21 standards – that reflect the State of the Art – Artificial Intelligence.
- Clarifies when product-specific technical documentation review is expected
- Class III and Class IIb implantables require the highest evidence maturity before submission
- Clinical evaluation, PMCF and benefit-risk conclusions must be tightly connected
- SSCP, UDI and EUDAMED data quality become critical for market access
- Change control must anticipate significant-change assessment during the certificate cycle
- Clarifies whether the principal mode of action is medical device, medicinal, cosmetic or another regulatory route
- Article 117 consultation may apply where a medicinal product incorporates a device component
- Ancillary medicinal substances or biological materials may require external authority consultation
- ISO 13485, GMP and technical documentation interfaces must be coordinated
- Early qualification prevents late changes to the regulatory pathway
- Clarifies which MDR obligations apply to each economic operator role in the supply chain
- Manufacturers own the conformity assessment and technical documentation
- Importers verify CE marking, registration, labelling and manufacturer compliance signals
- Distributors verify required information and support complaint and vigilance flows
- UDI, EUDAMED, traceability and complaint forwarding must be operationally controlled
Risk management, biocompatibility, sterilisation and usability evidence.
Regulatory value: when these files are aligned, the Notified Body can follow the logic from intended purpose to hazard, risk control, verification, clinical evidence and post-market feedback without contradictions.
These horizontal evidence areas support the MDR certificate across many device types. They are not a separate commercial add-on: they are the safety proof that links GSPR claims, test reports, clinical evaluation, production controls and post-market surveillance into one coherent technical file.
ISO 14971 risk management
Defines the lifecycle process for hazards, risk controls, residual risk and benefit-risk evaluation. Reviewers expect risk controls to be traceable into verification, usability, PMS and labelling.
ISO 10993 biological evaluation
Supports the biological safety strategy for patient-contacting devices. The evaluation must connect material characterisation, contact type and duration, test selection and toxicological rationale.
Sterilisation validation
For sterile devices, sterilisation validation and routine control evidence must demonstrate that the chosen process is validated, monitored and maintained over the production lifecycle.
IEC 62366-1 usability engineering
User interface, use-related risk, formative work and summative evaluation must show that foreseeable use errors are addressed, especially for lay-user, home-use and software-driven devices.
How MDR evidence is assessed by a Notified Body.
MDR conformity assessment is not a document collection exercise. It is an evidence chain: qualification, classification, safety and performance, clinical evaluation, risk management, QMS control, post market surveillance and traceability must all support the same intended purpose and claims.
The first regulatory decision is qualification and classification: intended purpose, claims, mode of action, user population, clinical context, accessories, borderline status and applicable classification rules. Misclassification is the single most common cause of submission delays. A structured qualification and classification rationale, signed off early, prevents costly rework and keeps the conformity assessment route defensible.
The GSPR matrix is the regulatory map of the file. It connects every applicable requirement to objective evidence: standards, test reports, biological evaluation, electrical safety, software validation, usability, labelling and risk controls. A strong GSPR matrix tells the reviewer where the evidence is and why it is sufficient.
Clinical evaluation under MDR must justify safety, performance, clinical benefit and the acceptability of residual risks for the specific device and claims. PMCF is planned where needed to close residual clinical questions over the lifecycle. Equivalence rationales are scrutinised more closely under MDR, so the clinical evidence strategy must be proportionate, current and traceable to the intended purpose.
Risk management is a continuous lifecycle process, not a single document. The risk management file must connect hazards, risk controls, verification, usability, clinical evaluation, PMS and labelling. Coherence is key: Notified Body assessors trace risk control measures through the entire technical file and expect the evidence to tell one consistent story.
The QMS must control design and development, production, supplier management, complaint handling, PMS, vigilance, UDI, change control and technical documentation updates. QMS weaknesses can block technical documentation progress, because the certificate depends on both product evidence and controlled processes.
PMS is where real-world data feeds back into risk management, clinical evaluation, benefit-risk conclusions and corrective actions. PSURs, trend reporting and vigilance must be more than administrative outputs. Good PMS gives the Notified Body confidence that the manufacturer can detect signals and maintain conformity after certification.
UDI, EUDAMED registration and economic operator obligations support traceability, field safety actions and market surveillance. Traceability must be built into labelling, master data, distribution controls and complaint handling, not treated as a late implementation task.
MDR certification process: from initial information to certification cycle.
The MDR certification process follows a structured six-step flow aligned with the DQS Medical Devices presentation: initial information and cost estimation, application submission and review, audit planning and initial evaluations, system assessment, certification decision and certificate issuance, and continuation of the certification cycle. As a planning benchmark, the process typically takes around 12 to 15 months, depending on QMS maturity, technical documentation quality, device complexity, classification, and availability of auditors and assessors.
Initial information and cost estimation
The manufacturer provides the project description, intended purpose, risk classification and DQS basic data template. DQS uses this information to understand the scope, estimate the required audit effort and technical documentation review effort, and prepare the initial cost estimate.
Outcome: an early view of scope, expected effort and commercial basis before the formal application is submitted.
Application submission and review
The manufacturer submits the application form and the necessary technical documentation. DQS reviews the application, documents the result, performs a completeness check of the technical documentation, requests clarifications where needed and confirms whether the application can be accepted.
Outcome: formal acceptance of the application and initiation of the MDR conformity assessment procedure under Regulation (EU) 2017/745.
Audit planning and initial evaluations
DQS plans the audit programme based on the submitted information. This includes the technical file review at product level and the QMS evaluation at system level. Technical files are selected by sampling to cover the product scope, normally by code and risk class, and the Stage 1 system analysis checks QMS readiness for the next step.
Outcome: audit programme, technical documentation review plan, Stage 1 results and any updates needed before the full system assessment.
System assessment, Stage 2
DQS performs the onsite Stage 2 assessment to verify QMS implementation and conformity with the technical file specifications. The system evaluation report summarises audit findings, nonconformities and the certification recommendation. The period between Stage 1 and Stage 2 is planned within the applicable maximum time window.
Outcome: documented system assessment results, including findings and the basis for the certification recommendation.
Certification decision and certificate issuance
The Certification Decision Board reviews the assessment report and confirms whether certification can be granted. If rework is required, it is handled before the decision. Once conformity is confirmed, the certificate and the detailed system assessment report are issued, completing the initial certification process.
Outcome: MDR certificate issuance for the approved scope, with devices covered through the applicable sampling and assessment approach.
Continuation of the certification cycle
Certification continues through regular surveillance activities. This includes annual QMS surveillance audits, technical documentation assessments according to the defined sampling plan, unannounced audits where applicable, and review of significant QMS or technical documentation changes. MDR certificates have a maximum validity of five years and can be renewed through recertification.
Outcome: maintained conformity over the full certificate cycle, with surveillance aligned to MDR requirements and the latest applicable regulatory expectations.
A Notified Body with deep technical expertise, a global presence, and a comprehensive portfolio.
What you get with DQS
An accredited certification body, with deep technical specialisation across active, non-active, in-vitro, software, and combination devices. Clear capacity, named contacts, and audit timelines you can take to your launch plan.
- NB 0297, European Notified Body under MDR, designated in Germany under the German Central Authority of the Federal States for Health Protection (ZLG)
- Authorised MDSAP Auditing Organization: United States (FDA), Canada (Health Canada), Japan (MHLW/PMDA), Australia (TGA) and Brazil (ANVISA)
- Software-as-a-medical device specialists: IEC 62304, IEC 81001-5-1, AI/ML
- Predictable timelines: transparent capacity, planned slot allocation
- Named contacts: a project manager owns your file from application to certificate
- Sector experience: auditors with industry backgrounds, not generalists
- Coordinated audit programmes: one audit team across MDR, ISO 13485 and MDSAP
Engage DQS early: the difference between a planned launch and a delayed one.
Tell us your device, your class, and your target market. We’ll come back with scope, timeline and capacity: not a brochure. Most pre-application conversations close in two short calls.
Perspectives from DQS medical device specialists.
Where MDR meets adjacent DQS focus areas.
A predictable path to CE, with a Notified Body that owns its dates
- Tell us your device, class and target markets
- We confirm scope, capacity and timeline within two calls
- You get a Notified Body who owns the audit calendar with you
Frequently asked questions.
What does Notified Body designation NB 0297 cover?
DQS is designated as Notified Body NB 0297 under Regulation (EU) 2017/745 (MDR). The designation covers a broad range of medical-device technologies and product categories, including active and non-active devices, implantable devices, software and SaMD, sterilisation processes, combination products, and selected Annex XVI products. The scope also includes related manufacturing technologies and processes relevant to MDR conformity assessment. The current and authoritative designation scope, including the exact MDR device and technology codes covered by NB 0297, is published in the European Commission’s NANDO database.
What changed under Regulation (EU) 2023/607: do we still have a transition?
Yes, but only for eligible legacy devices. Regulation (EU) 2023/607 extended the MDR transitional periods while keeping MDR requirements in force. For devices that already had a valid MDD/AIMDD certificate as of 26 May 2021 and meet the Article 120 conditions, the deadlines are: 31 December 2027 for Class III and Class IIb implantable devices, and 31 December 2028 for Class IIb non-implantable, Class IIa, Class Im, Class Is and Class Ir devices. Manufacturers had to lodge a formal application with a Notified Body and sign a written agreement by 26 September 2024 to remain in the transition. Devices submitted for MDR conformity assessment after the MDR entered into application, and which do not qualify as legacy devices, do not benefit from transitional timelines and must follow MDR directly.
Is software-as-a-medical device automatically Class IIa under MDR?
Not automatically: it is a function of MDR Annex VIII Rule 11. Software intended to provide information used for diagnostic or therapeutic decisions is generally Class IIa, rising to IIb where decisions cause serious deterioration or surgical intervention, and to III where they may cause death or irreversible deterioration. Software for monitoring physiological processes is generally Class IIa, IIb in critical-parameter monitoring. The pre-MDR classification under MDD Rule 9 was much lower for most software: this is the upclassification that brought the bulk of SaMD into Notified Body scope.
How does MDSAP work alongside MDR?
MDSAP is a separate audit programme: it is not part of MDR. However, both rest on ISO 13485, and both audit the same QMS. DQS, as both a Notified Body and an authorised MDSAP Auditing Organization, runs combined audits: one audit team, one audit week, with the QMS portion serving both purposes. Technical-documentation review under MDR is a separate activity from the MDSAP audit, but the QMS evidence is shared.
What is changing in FDA quality-system expectations in February 2026?
From 2 February 2026, FDA’s Quality Management System Regulation (QMSR) amends 21 CFR Part 820 by incorporating ISO 13485:2016 by reference as the core QMS framework for medical device manufacturers. This creates stronger alignment with international quality-system expectations, but it does not make ISO 13485 certification automatically equivalent to FDA compliance. Manufacturers still need to address FDA-specific requirements, including applicable provisions on labelling and packaging, complaint handling, records, UDI, MDR reporting, corrections and removals, and other U.S. regulatory obligations outside Part 820. DQS ISO 13485 certification can support manufacturers in building a globally aligned quality-management system and identifying the FDA-specific deltas that remain for U.S. market access.
Can DQS support MDR certification and ISO 13485 market-access alignment?
Yes. DQS can coordinate MDR conformity assessment with ISO 13485 certification, MDSAP audits and market-specific ISO 13485 alignment. For manufacturers operating globally, this means one coordinated QMS programme, one audit calendar where applicable, and a clearer route from certification evidence to market-access needs.
How long does conformity assessment take, end to end?
For a manufacturer with mature ISO 13485 and complete technical documentation: typically 12 to 15 months from formal application to certificate, depending on class and number of devices. Class III and Class IIb implantable devices add review time on the technical-documentation side. The variables that drive timeline are completeness of documentation, manufacturer responsiveness to findings and Notified Body capacity. DQS defines the expected timeline during the planning and contracting phase so the audit calendar is clear before the project starts.
Does engaging a Notified Body before submission make any difference?
A material difference. The single biggest predictor of certificate timeline is documentation maturity at submission: not Notified Body queue length. A pre-application call with DQS, focused on classification, conformity assessment route, and technical-documentation structure, typically takes two short calls and saves months downstream. We do not pre-assess the device, but we can confirm the regulatory strategy is on solid ground before you commit to the formal application.