Updated: 23rd June 2026
Reviewed by: David Small BSc (Hons), MSc, MTOPRA (Founder and CEO)
What is MDR?
The Medical Device Regulation (EU) 2017/745 came into full application on 26 May 2021, replacing the Medical Device Directive (93/42/EEC) and the Active Implantable Medical Device Directive (90/385/EEC).
Unlike the previous directives, which required implementation into national law, the MDR is a regulation and therefore applies directly across all EU Member States.
The regulation was introduced to:
- Improve patient safety and public health.
- Strengthen clinical evidence requirements.
- Increase transparency across the supply chain.
- Improve device traceability.
- Enhance post-market surveillance activities.
- Ensure consistent application of regulatory requirements across Europe.
The MDR applies to most medical devices placed on the EU market, including products previously regulated under the MDD and certain products without an intended medical purpose listed in Annex XVI.
Why Was the MDR Introduced?
Several high-profile medical device incidents highlighted weaknesses in the previous regulatory framework. Regulators identified the need for greater oversight, stronger clinical evidence requirements, and improved traceability throughout the device lifecycle.
The MDR was designed to address these challenges by:
- Introducing stricter conformity assessment procedures.
- Expanding the role of Notified Bodies.
- Requiring more robust clinical evaluation processes.
- Implementing the Unique Device Identification (UDI) system.
- Establishing the European Database on Medical Devices (EUDAMED).
- Strengthening post-market surveillance and vigilance requirements.
The result is a more robust regulatory framework designed to ensure devices remain safe and effective throughout their lifecycle.
Scope of the MDR
The MDR applies to medical devices intended for human use, including:
- Diagnostic devices.
- Monitoring devices.
- Therapeutic devices.
- Implantable devices.
- Software as a Medical Device (SaMD).
- Active medical devices.
The regulation also applies to certain products without a medical purpose, including:
- Cosmetic contact lenses.
- Dermal fillers.
- Liposuction equipment.
- High-intensity electromagnetic equipment used for cosmetic purposes.
Manufacturers must carefully evaluate intended purpose, functionality, and claims to determine whether a product falls within the scope of the MDR.
Medical Device Classification
One of the first steps in MDR compliance is determining device classification.
The MDR classifies devices according to risk using four primary classes:
Class I
Low-risk devices such as:
- Non-invasive instruments.
- Wheelchairs.
- Bandages.
Certain Class I devices, including sterile devices, measuring devices, and reusable surgical instruments, require Notified Body involvement.
Class IIa
Medium-risk devices such as:
- Administration sets.
- Hearing aids.
- Suction equipment.
Class IIb
Higher-risk devices such as:
- Ventilators.
- Infusion pumps.
- Orthopaedic implants.
Class III
Highest-risk devices such as:
- Heart valves.
- Implantable pacemakers.
- Implantable neurological devices.
Classification is determined using the rules contained within Annex VIII of the MDR and has a significant impact on conformity assessment requirements.
Further Reading: Medical Device Classification
General Obligations of Manufacturers (Article 10)
Article 10 is one of the most important sections of the MDR and outlines the obligations placed upon manufacturers.
Manufacturers must:
- Establish and maintain a Quality Management System.
- Maintain technical documentation.
- Implement risk management procedures.
- Conduct clinical evaluations.
- Implement post-market surveillance systems.
- Establish vigilance reporting procedures.
- Maintain financial coverage for potential liability claims.
- Ensure ongoing compliance throughout the product lifecycle.
Failure to meet Article 10 obligations can result in regulatory action, certificate suspension or removal from the market.
Further Reading: Article 10
General Safety and Performance Requirements (GSPRs)
The General Safety and Performance Requirements (GSPRs) are outlined in Annex I of the EU MDR and form the foundation of medical device compliance. They replace the Essential Requirements previously found under the Medical Device Directive (MDD) and introduce a more comprehensive framework for demonstrating device safety and performance.
Manufacturers must show that their devices are designed and manufactured in a way that ensures they achieve their intended purpose while minimising risks to patients, users and other persons. Compliance with the GSPRs must be demonstrated throughout the entire product lifecycle, from design and development through to post-market surveillance.
The GSPRs cover a wide range of requirements, including:
- Risk management and risk reduction.
- Device performance and clinical benefits.
- Chemical, physical and biological properties.
- Infection and microbial contamination control.
- Software validation and cybersecurity considerations.
- Electrical and mechanical safety.
- Usability and human factors engineering.
- Labelling and Instructions for Use (IFU).
- Protection against radiation.
- Performance during transportation and storage.
Manufacturers typically demonstrate compliance using a GSPR checklist or matrix that maps each applicable requirement to supporting evidence contained within the technical documentation.
For most devices, evidence may include:
- Risk management documentation.
- Clinical evaluation reports.
- Verification and validation testing.
- Biocompatibility studies.
- Electrical safety testing.
- Usability engineering files.
- Software validation reports.
Failure to adequately address the GSPRs is one of the most common findings during Notified Body reviews. As a result, manufacturers should ensure that every applicable requirement is clearly justified and supported by objective evidence.
For a more detailed breakdown of Annex I requirements, read our guide to EU MDR General Safety and Performance Requirements.
Further Reading: GSPRs
Clinical Evaluation Requirements
Clinical evaluation is one of the most significant areas strengthened under the MDR. Manufacturers must continuously assess and document clinical evidence demonstrating that their device is safe, performs as intended and provides an acceptable benefit-risk profile.
Under Article 61 and Annex XIV of the MDR, clinical evaluation is not a one-time exercise but an ongoing process that must be maintained throughout the device lifecycle.
A compliant clinical evaluation process generally includes:
Clinical Evaluation Planning
Manufacturers must establish a Clinical Evaluation Plan (CEP) defining:
- Device scope and intended purpose.
- State of the art considerations.
- Clinical benefits and performance claims.
- Methods for collecting and analysing clinical data.
Clinical Data Collection
Clinical evidence may be obtained from:
- Clinical investigations.
- Published scientific literature.
- Equivalent devices where appropriate.
- Post-market clinical follow-up activities.
The MDR places greater restrictions on the use of equivalence than the previous MDD framework, particularly for higher-risk devices.
Clinical Evaluation Report (CER)
The Clinical Evaluation Report summarises all available clinical evidence and demonstrates:
- Safety.
- Clinical performance.
- Benefit-risk acceptability.
- Compliance with applicable GSPRs.
The CER is one of the most heavily scrutinised documents during Notified Body reviews.
Post-Market Clinical Follow-Up (PMCF)
For many devices, manufacturers must establish PMCF activities to continuously gather clinical evidence after market placement.
PMCF activities may include:
- Clinical follow-up studies.
- User surveys.
- Registry data analysis.
- Post-market literature reviews.
The objective is to ensure the device continues to demonstrate safety and performance throughout its commercial lifecycle.
Manufacturers should view clinical evaluation as a continuous evidence-generation process rather than a regulatory hurdle. Organisations that integrate clinical evaluation into their product lifecycle management strategy typically experience smoother regulatory reviews and stronger long-term compliance outcomes.
Technical Documentation Requirements
Technical documentation serves as the primary evidence demonstrating conformity with the MDR. It provides regulators and Notified Bodies with the information necessary to assess whether a device complies with applicable requirements.
Annex II and Annex III of the MDR specify the content that must be included within the technical documentation.
A complete technical file typically contains:
Device Description and Specification
This section describes:
- Device design and functionality.
- Intended purpose.
- Target patient population.
- Contraindications and limitations.
- Device variants and accessories.
Design and Manufacturing Information
Manufacturers must document:
- Design processes.
- Manufacturing methods.
- Production controls.
- Supplier management activities.
Risk Management Documentation
Risk management should be conducted in accordance with ISO 14971 and include:
- Hazard identification.
- Risk estimation.
- Risk control measures.
- Residual risk evaluations.
- Benefit-risk analysis.
Product Verification and Validation
This section includes evidence demonstrating that the device meets applicable requirements, such as:
- Performance testing.
- Biocompatibility studies.
- Electrical safety testing.
- Software validation.
- Packaging validation.
- Sterilisation validation.
Clinical Evaluation Documentation
Manufacturers must include:
- Clinical Evaluation Plans.
- Clinical Evaluation Reports.
- PMCF plans and reports where applicable.
Labelling and Instructions for Use
The technical documentation must contain all device labelling, packaging information and Instructions for Use supplied to users.
Technical documentation is not a static collection of documents. It must be actively maintained and updated whenever changes occur to the device, manufacturing processes, regulatory requirements or post-market information.
Poorly structured technical documentation remains one of the leading causes of certification delays, making early planning and robust document management essential.
Further Reading: Technical Documentation
Quality Management Systems and ISO 13485
A Quality Management System (QMS) provides the framework through which manufacturers consistently design, manufacture and maintain compliant medical devices.
Although the MDR does not explicitly require ISO 13485 certification, the standard is widely recognised as the most effective method for demonstrating compliance with regulatory quality requirements.
An effective QMS should address:
- Design and development controls.
- Document control.
- Risk management.
- Supplier management.
- Corrective and Preventive Actions (CAPA).
- Complaint handling.
- Post-market surveillance.
- Internal audits.
- Management review.
ISO 13485 certification can provide significant advantages during conformity assessment activities by demonstrating that the organisation has implemented structured quality processes aligned with international best practice.
For many manufacturers, a well-implemented ISO 13485 system forms the foundation upon which MDR compliance is built.
Further Reading: QMS and ISO 13485
Unique Device Identification (UDI)
The Unique Device Identification (UDI) system was introduced under the MDR to improve traceability throughout the medical device lifecycle. By assigning a unique identifier to each device, regulators, healthcare providers and manufacturers can more effectively track products, monitor safety issues and conduct recalls when necessary.
The UDI system consists of two main components:
UDI-DI (Device Identifier)
The UDI-DI identifies a specific device model and manufacturer. It remains consistent across identical products and serves as the primary identifier within regulatory databases.
UDI-PI (Production Identifier)
The UDI-PI provides information relating to the production of a specific device, such as:
- Batch or lot number.
- Serial number.
- Manufacturing date.
- Expiry date.
Together, these identifiers provide complete traceability throughout the supply chain.
Manufacturers must ensure that UDI information appears on:
- Device labels.
- Higher levels of packaging.
- Technical documentation.
- Relevant EUDAMED records.
The introduction of UDI has significantly improved transparency, recall effectiveness and market surveillance activities across the European medical device sector.
Further Reading: UDI
EUDAMED and Device Registration
The European Database on Medical Devices (EUDAMED) is a centralised platform designed to enhance transparency, coordination and regulatory oversight throughout the European Union.
EUDAMED enables regulators, manufacturers, healthcare professionals and, in some cases, the public to access important information regarding medical devices placed on the European market.
The database consists of several interconnected modules covering:
Actor Registration
Manufacturers, Authorised Representatives and Importers must register and obtain a Single Registration Number (SRN).
UDI and Device Registration
Manufacturers must submit device information, including UDI data, to support transparency and traceability.
Notified Bodies and Certificates
Information relating to designated Notified Bodies and issued certificates is maintained within the database.
Clinical Investigations
Clinical study information and associated regulatory activities are recorded.
Vigilance
Serious incidents and Field Safety Corrective Actions (FSCAs) are managed through dedicated vigilance modules.
Market Surveillance
Competent Authorities can coordinate surveillance activities and exchange regulatory information.
Although EUDAMED implementation has been phased, manufacturers should prepare for increasing registration and reporting obligations as additional modules become fully operational.
Organisations that proactively establish EUDAMED processes often find regulatory interactions significantly easier than those attempting to implement systems at the last minute.
Further Reading: EUDAMED
Economic Operators Under MDR
The MDR establishes specific responsibilities for all economic operators involved in placing medical devices on the European market.
The primary economic operators include:
- Manufacturers.
- Authorised Representatives.
- Importers.
- Distributors.
Each operator has legally defined obligations designed to ensure that only compliant devices reach patients and healthcare professionals.
Manufacturers remain primarily responsible for device compliance, while importers and distributors act as additional checkpoints within the supply chain.
Economic operators must cooperate with Competent Authorities and provide information necessary to demonstrate compliance whenever requested.
Failure by any economic operator to fulfil their responsibilities can result in enforcement actions, product withdrawals or restrictions on market access.
Further Reading: Economic Operators
Person Responsible for Regulatory Compliance (PRRC)
One of the most significant additions introduced by the MDR is the requirement for manufacturers and certain Authorised Representatives to designate at least one Person Responsible for Regulatory Compliance (PRRC).
The PRRC serves as the organisation’s internal regulatory expert and is responsible for ensuring that regulatory obligations are consistently fulfilled.
Responsibilities typically include ensuring:
- Device conformity is appropriately assessed before release.
- Technical documentation is prepared and maintained.
- Post-market surveillance activities are conducted.
- Vigilance reporting requirements are met.
- Regulatory records remain current and accurate.
The individual must possess appropriate qualifications and experience, which may include:
- A degree in law, medicine, pharmacy, engineering or a relevant scientific discipline combined with regulatory experience.
- Alternatively, sufficient professional experience in medical device regulatory affairs or quality management.
The PRRC plays a critical role in maintaining ongoing compliance and reducing regulatory risk.
Further Reading: PRRC
Authorised Representatives, Importers and Distributors
For manufacturers located outside the European Union, appointing an Authorised Representative is typically mandatory.
The Authorised Representative acts on behalf of the manufacturer and serves as a point of contact for regulatory authorities.
Key responsibilities include:
- Verifying technical documentation availability.
- Maintaining copies of declarations and certificates.
- Supporting Competent Authority requests.
- Assisting with vigilance and corrective actions.
Importers are responsible for ensuring that devices entering the EU market:
- Bear CE marking where required.
- Have valid declarations of conformity.
- Include appropriate labelling and UDI information.
- Are accompanied by the necessary documentation.
Distributors must verify that devices remain compliant throughout storage, transport and onward distribution activities.
Strong collaboration between all economic operators is essential for maintaining regulatory compliance throughout the supply chain.
CE Marking and Notified Bodies
CE marking demonstrates that a medical device complies with applicable MDR requirements and may be legally placed on the European market.
The route to CE marking depends primarily on device classification.
Class I Devices
Most non-sterile, non-measuring Class I devices can be self-certified by the manufacturer.
Higher-Risk Devices
Class IIa, Class IIb and Class III devices generally require assessment by a designated Notified Body before CE marking can be applied.
Notified Bodies evaluate:
- Quality Management Systems.
- Technical documentation.
- Clinical evidence.
- Risk management activities.
- Post-market surveillance processes.
Successful conformity assessment results in the issuance of MDR certification, allowing CE marking to be applied.
Manufacturers should engage with Notified Bodies early in the development process, as review timelines can be significant and capacity constraints continue to affect the industry.
Obtaining CE marking should not be viewed as the end of compliance activities. Manufacturers must continue to maintain compliance throughout the entire product lifecycle, including post-market monitoring, vigilance reporting and technical documentation updates.
Further Reading: CE Marking
Post-Market Surveillance and Vigilance
Achieving MDR certification is not the end of the compliance journey. Manufacturers are required to actively monitor device performance after market placement to ensure continued safety, performance and regulatory compliance.
Post-Market Surveillance (PMS) is a systematic process for collecting, analysing and acting upon information obtained from devices once they are commercially available.
The objectives of PMS include:
- Confirming continued device safety and performance.
- Identifying emerging risks.
- Detecting trends in complaints and incidents.
- Evaluating the effectiveness of risk control measures.
- Supporting continuous improvement activities.
Manufacturers must establish a documented PMS Plan outlining how information will be collected, analysed and reviewed throughout the device lifecycle.
PMS Reports and PSURs
Depending on device classification, manufacturers may be required to prepare:
PMS Reports
Generally applicable to lower-risk devices, PMS reports summarise post-market activities and findings.
Periodic Safety Update Reports (PSURs)
Required for many higher-risk devices, PSURs provide a detailed assessment of:
- Safety performance.
- Clinical benefits.
- Benefit-risk conclusions.
- Corrective actions undertaken.
PSURs must be updated at defined intervals and made available to regulators and Notified Bodies upon request.
Vigilance Requirements
Vigilance is closely linked to post-market surveillance and focuses on the reporting of safety-related events.
Manufacturers must establish procedures for:
- Serious incident reporting.
- Field Safety Corrective Actions (FSCAs).
- Trend reporting.
- Regulatory communication.
Examples of reportable events include:
- Device malfunctions leading to serious injury.
- Patient deaths associated with device use.
- Serious deterioration in health.
- Significant increases in complaint rates.
Prompt reporting and effective investigation are essential to maintaining compliance and protecting patient safety.
System and Procedure Packs (Article 22)
Article 22 of the MDR establishes specific obligations for organisations that combine multiple devices into systems or procedure packs.
Examples include:
- Surgical procedure packs.
- Customised treatment kits.
- Combined diagnostic systems.
- Procedure-specific medical packs.
Organisations assembling systems or procedure packs must ensure that:
- Individual components are compatible.
- Manufacturer instructions are followed.
- Appropriate verification activities are performed.
- Documentation is maintained.
In some situations, system and procedure pack producers may assume additional regulatory responsibilities beyond those associated with simple distribution activities.
Manufacturers and healthcare organisations involved in assembling procedure packs should carefully evaluate Article 22 obligations to ensure compliance.
Further Reading: System & Procedure Packs
Common MDR Compliance Challenges
Despite years of preparation across the industry, MDR compliance continues to present significant challenges for many organisations.
Some of the most common issues include:
Incorrect Device Classification
Misclassification remains one of the most frequent causes of regulatory delays.
Manufacturers should carefully assess classification rules within Annex VIII and document their rationale.
Insufficient Clinical Evidence
The MDR places greater emphasis on clinical data than previous legislation.
Many organisations underestimate the level of evidence required to support safety and performance claims.
Weak Technical Documentation
Technical files often contain gaps relating to:
- Risk management.
- Clinical evaluation.
- Verification testing.
- Labelling.
- PMS activities.
Poorly organised documentation can significantly delay certification projects.
Delayed Notified Body Engagement
Many manufacturers underestimate certification timelines.
Early engagement with Notified Bodies is essential to avoid project delays and potential interruptions to market access.
UDI and EUDAMED Challenges
Implementing traceability systems and maintaining accurate EUDAMED records can be resource-intensive, particularly for organisations managing large product portfolios.
Resource and Expertise Limitations
Many organisations lack dedicated regulatory resources, making it difficult to interpret complex requirements and maintain ongoing compliance.
Working with experienced regulatory consultants can help reduce these challenges and improve project outcomes.
Step-by-Step MDR Compliance Roadmap
While every device is different, most MDR projects follow a similar pathway.
Step 1: Determine Device Qualification and Classification
Confirm that the product is a medical device and identify the applicable classification according to Annex VIII.
Step 2: Perform a Regulatory Gap Analysis
Assess existing documentation, processes and evidence against MDR requirements.
Step 3: Implement a Quality Management System
Establish a compliant QMS aligned with MDR expectations and ISO 13485 principles.
Step 4: Conduct Risk Management Activities
Perform risk analysis and risk control activities in accordance with ISO 14971.
Step 5: Prepare Technical Documentation
Compile all required evidence demonstrating conformity with MDR requirements.
Step 6: Conduct Clinical Evaluation
Gather and assess clinical evidence supporting device safety and performance.
Step 7: Implement UDI Requirements
Assign UDI identifiers and update labelling and traceability systems.
Step 8: Register Devices and Economic Operators
Complete applicable registrations, including EUDAMED submissions where required.
Step 9: Undergo Notified Body Assessment
For applicable devices, complete conformity assessment activities and certification reviews.
Step 10: Obtain CE Marking
Once conformity is demonstrated, devices may be placed on the EU market.
Step 11: Implement Post-Market Activities
Maintain ongoing compliance through PMS, vigilance reporting and continuous regulatory monitoring.
Manufacturers that follow a structured roadmap generally experience fewer delays and a smoother path to certification.
Optional Additional Reading
How Patient Guard Can Help
Navigating MDR requirements can be complex, particularly for organisations facing certification deadlines, resource limitations or changing regulatory expectations.
Patient Guard provides practical regulatory support throughout every stage of the compliance journey.
Our services include:
MDR Gap Analysis
We assess your current level of compliance and identify areas requiring improvement before certification activities begin.
Device Classification Support
Our regulatory specialists assist manufacturers in accurately classifying devices and documenting classification justifications.
Technical Documentation Preparation and Review
We support the development and review of technical files, ensuring documentation aligns with MDR and Notified Body expectations.
Clinical Evaluation Support
Our team assists with Clinical Evaluation Plans (CEPs), Clinical Evaluation Reports (CERs), literature reviews and PMCF activities.
Risk Management
We help organisations implement risk management systems aligned with ISO 14971 and MDR requirements.
ISO 13485 and Quality Management Systems
Patient Guard supports the implementation and maintenance of effective Quality Management Systems tailored to medical device manufacturers.
Authorised Representative Services
Through Patient Guard Europe UG, we provide EU Authorised Representative services for non-EU manufacturers seeking access to the European market.
Ongoing Regulatory Support
Our consultants provide long-term support for post-market surveillance, vigilance, regulatory updates and continuous compliance activities.
Whether you are bringing a new device to market or transitioning an existing portfolio to MDR compliance, Patient Guard can help simplify the process and reduce regulatory risk.
Frequently Asked Questions about EU MDR Compliance
The EU MDR is Regulation (EU) 2017/745, the legislation governing medical devices placed on the European market.
The MDR became fully applicable on 26 May 2021, replacing the Medical Device Directive (MDD).
No. Some Class I devices can be self-certified, while most Class IIa, Class IIb and Class III devices require Notified Body involvement.
A Clinical Evaluation Report is a document that assesses clinical evidence to demonstrate device safety and performance throughout the product lifecycle.
Unique Device Identification (UDI) is a traceability system that assigns unique identifiers to medical devices to improve transparency and facilitate recalls and market surveillance activities.
EUDAMED is the European Database on Medical Devices, designed to improve transparency, device registration and regulatory oversight throughout the European Union.
A Person Responsible for Regulatory Compliance (PRRC) is an individual designated to oversee compliance with MDR requirements and ensure regulatory obligations are fulfilled.
ISO 13485 certification is not legally mandatory, but it is widely recognised as the most effective framework for demonstrating compliance with MDR quality management requirements.
Non-compliant devices may be refused market access, subject to enforcement action, recalled from the market or have certificates suspended or withdrawn.
Patient Guard provides regulatory consulting services including device classification, technical documentation support, clinical evaluation, ISO 13485 implementation, Authorised Representative services and ongoing compliance assistance.
Patient Guards Recent Posts
EU Authorised Representative Services for Medical Device & IVD Manufacturers
Selling medical devices or IVDs in Europe? If your company is based outside the EU, appointing an EU Authorised Representative (EC Rep) is a legal requirement under EU MDR 2017/745 and IVDR 2017/746. Patient Guard provides expert EU Authorised Representative services, EUDAMED support, regulatory guidance, and ongoing compliance management to help manufacturers access and maintain the European market with confidence.
Predetermined Change Control Plans (PCCPs): The Future of Agile Compliance for Medical Device Software
Learn how PCCPs help medical device software manufacturers manage updates, support AI systems, and enable agile compliance under evolving MDR and UKCA frameworks.
The AI Act Omnibus Explained: What the 2026 EU Rules Mean for Medical Device and IVD Manufacturers
Discover how the EU AI Act Omnibus affects AI medical devices and IVD manufacturers. Learn about the No Duplication principle, transparency rules, key 2026 and 2028 deadlines, and how MDR and IVDR compliance are converging with AI regulation.
Patient Guards Related Services
Patient Guards Regulatory Tools
Need Training?
Do you need training on Quality Management Systems or EU MDR/ EU IVDR? then check out our training courses.
