MDR class IIb and III: UDI, EUDAMED, NB, surveillance

Author Hugues Orgitello Last updated 11 July 2026 ~19 min read

Guide · MDR class IIb/III

This page is the in-depth companion to the MDR overview at /en/guides/mdr-medical-device-regulation/. It assumes familiarity with the general framework of Regulation (EU) 2017/745, the classification rules of Annex VIII, and the core vocabulary (notified body, EUDAMED, UDI, PRRC, authorised representative). It focuses on class IIb and class III, where notified-body involvement is heaviest, the technical file is largest, and post-market surveillance presses hardest on the device lifecycle. The intended reader is a regulatory professional preparing or maintaining a dossier in those classes.

Framing: why a separate pathway for class IIb and III

The four MDR classes (I, IIa, IIb, III) share a common backbone, general safety and performance requirements (GSPRs) in Annex I, technical file in Annex II, clinical evaluation in Annex XIV, post-market surveillance in Chapter VII. The difference between class IIa and class III lies not in the nature of the obligations, which stack, but in their depth and in the level of notified-body involvement.

For quick context, see the MDR overview and the self-declaration vs notified body comparison. Three structural lines distinguish the class IIb/III pathway from the class IIa pathway.

First line, design dossier examination. For class III and for implantable class IIb, the notified body does not merely review a representative dossier per generic device group, it examines each design dossier (Annex IX Chapter II). The periodic check becomes systematic.

Second line, clinical documentation. Non-implantable class IIb can, under certain conditions, rely on literature and equivalence data. Class III and implantable class IIb shift towards own clinical investigation, with narrowly defined exceptions (Article 61(4) to (6)).

Third line, surveillance cadence. The PSUR (Periodic Safety Update Report) is annual for class IIb and class III, implantable or not, biennial for class IIa (Article 86(1)). It is reviewed by the notified body for class III and implantable devices, and the notified body's evaluation is made accessible to authorities via EUDAMED (Article 86(2)).

These three lines structure the rest of the page.

Conformity assessment routes: Annexes IX, X and XI

Annexes IX, X and XI of the MDR define the conformity assessment procedures. They combine a quality management system, documentary examination and, for the higher classes, design dossier examination on each device.

Side-by-side comparison of the three routes

Annex	Main brick	Sub-elements	Key actor
Annex IX	Assessment based on a quality management system and on technical documentation assessment	Chapter I (QMS), Chapter II (technical documentation assessment, section 4, on each device for class III and non-exempt implantable IIb), Chapter III (administrative provisions)	NB conducts QMS audit + dossier review, annual surveillance
Annex X	EU type-examination	Submission of a representative specimen, examination by the NB, issuance of an EU type-examination certificate	NB examines the type device, the manufacturer remains free of full QMS as long as the complementary Annex XI route is in place
Annex XI Part A	Production quality assurance	QMS limited to production, NB audits	Often combined with an EU type-examination certificate (Annex X)
Annex XI Part B	Product verification	NB verification of each batch or each device	Rarely used, reserved for very low volumes

Which route for which class

For non-implantable class IIb, two practical routes:

• Annex IX Chapters I and III, the majority route, resting on a full quality management system typically aligned with harmonised standard EN ISO 13485, plus notified-body review of at least one representative design dossier per generic device group (Article 52(4)).
• Annex X (EU type-examination) + Annex XI Part A or B, the minority route, retained by very low-volume manufacturers or by manufacturers who favour a type-based logic over an extended QMS.

For implantable class IIb and class III, the main route is Annex IX Chapters I, II and III, where Chapter II adds the design dossier examination on each device. An alternative route is theoretically available through Annex X (EU type-examination) + Annex XI Part A (production quality assurance), but remains uncommon in practice.

Several sub-categories of implantable class IIb benefit from exceptions to systematic design dossier examination (Article 52(4) second subparagraph): sutures, staples, dental fillings, dental braces, tooth crowns, screws, wedges, plates, wires, pins, clips and connectors. For these categories, implantable class IIb falls back on the Annex IX section 4 assessment of one representative device per generic device group. In March 2026 the Commission adopted a delegated regulation extending this list to other well-established implantable technologies (cannulas, catheters, dental implants, among others); check its entry into force before relying on it.

For implantable class III devices and for class IIb active devices intended to administer or remove a medicinal product (Annex VIII rule 12), Article 54 further imposes a Clinical Evaluation Consultation Procedure (CECP) coordinated by the European Commission. An expert panel issues an opinion on the clinical evaluation assessment report, which feeds into the conformity dossier.

The notified body: selection, application, audits

Selection through NANDO

The European Commission's NANDO database lists notified bodies designated under the MDR with their detailed scope. The scope is encoded in four families:

• MDA for active devices (for example MDA 0301 for active non-implantable devices utilising ionizing radiation),
• MDN for non-active devices (implants, non-active instruments, etc.),
• MDS for devices with specific characteristics (software, devices incorporating a medicinal substance, sterile condition, etc.),
• MDT for specific technologies or manufacturing processes.

The four families come from Implementing Regulation (EU) 2017/2185, and MDCG 2019-14 details the full nomenclature. The practical rule, the notified-body scope of designation must explicitly cover the codes that match the device. A class III device combining a medicinal product requires an NB whose scope covers that specialty. A software device requires an NB whose scope covers SaMD codes.

Pre-application meeting

The established practice, recommended by most notified bodies, is to hold a pre-application meeting before formal submission. These meetings are not regulatory in the strict sense, but they help frame the scope, identify complexity points (medicinal substance, animal-derived material, novel material) and estimate the assessment timeline. They do not bind the notified body on the outcome, but they reduce the risk of having to backtrack after submission.

Submission and technical documentation review

The formal submission includes the application, the technical file under Annex II, the post-market documentation under Annex III, and the quality management system documentation. The notified body conducts a completeness review, then a content review. Content reviews are led by an assessment team whose composition is governed by Article 36 and Annex VII. For class III and implantable class IIb devices, the team typically includes:

• a clinical assessor with medical experience in the relevant specialty,
• a technical assessor with expertise in the device technology,
• a statistician for the assessment of quantitative clinical data,
• as applicable, a materials engineer, a biocompatibility expert or a software expert.

Notified-body questions are consolidated into deficiency letters. Manufacturer responses are assessed iteratively. The number of cycles depends on the initial dossier quality and on device complexity. Observed practice, without it being possible to cite a reliable average without risk of inaccuracy, shows that first MDR submissions typically go through several deficiency-letter cycles before closure.

Quality system audit and design audit

The quality system audit covers the full QMS, design, manufacturing, control, post-market surveillance, critical supplier management, and includes on-site audit (headquarters and manufacturing sites). For class IIb and III, a design audit is conducted, either in sequence with the QMS audit or in parallel. The design audit examines design controls (inputs and outputs), change management, risk management (EN ISO 14971), and verification and validation processes.

Unannounced audits are required by Annex IX section 3.4 (and framed by Annex VII): the notified body must randomly perform unannounced on-site audits at least once every five years, at the manufacturer and where appropriate at suppliers or subcontractors, with device or process sampling.

Certification cycle: 5 years, annual surveillance

The MDR certificate is issued for a maximum duration of five years (Article 56(2)), extendable for further periods of up to five years each on the basis of a re-assessment. During that duration, the notified body conducts annual surveillance (Annex IX section 3.3), QMS surveillance audit and technical documentation reviews on a sampling basis, plus verification of corrective action implementation. At the end of the five years, a full recertification is conducted, equivalent in depth to the initial assessment.

See the certification timeline for project framing, which integrates these audit sequences.

The technical file: structure imposed by Annex II

Annex II of the MDR fixes the structure of the technical file. The term structure is to be taken in the strong sense here, the notified body expects an organisation aligned with the Annex enumeration, and a structural deviation is itself a formal non-conformity.

Annex II outline

1. Device description and specification, including variants and accessories. Identification, intended medical purpose, indications, contraindications, target population, principles of operation, materials, critical components, configurations, previous generations placed on the market.
2. Information to be supplied by the manufacturer. Labels, instructions for use, promotional material, conformity to Annex I Chapter III requirements.
3. Design and manufacturing information. Design sites, manufacturing sites, critical supplier sites, design controls, manufacturing processes, control processes, change management.
4. General safety and performance requirements (GSPRs). Exhaustive checklist of applicable requirements, references to harmonised standards or common specifications applied, references to evidence of conformity (tests, calculations, analyses).
5. Benefit-risk analysis and risk management. Risk management plan (EN ISO 14971), risk analysis, control measures, residual risk, benefit-risk analysis aligned with Annex I sections 1 to 8.
6. Product verification and validation. Preclinical data (biocompatibility EN ISO 10993, electrical safety IEC 60601-1, electromagnetic compatibility IEC 60601-1-2, physical safety, stability, performance, sterilisation, software life cycle process IEC 62304 where applicable), clinical data (clinical evaluation report, clinical investigation plan, clinical investigation reports, PMCF plan and report, SOTA literature), additional specific information (incorporated medicinal substance, animal or human-derived materials, devices incorporating nanomaterials, drug-device combinations).

Annex III, post-market surveillance documentation

Annex III is legally distinct from the Annex II technical file, but attached to it. It requires:

• a PMS plan per device or device group (Article 84 and Annex III section 1),
• the PMS reports or PSURs generated by application of the plan (Article 85 or 86),
• the vigilance records (Articles 87 to 90),
• the trend analysis reports (Article 88),
• the field safety corrective actions (FSCAs, Article 89) with their field safety notices (FSNs).

See also the CE technical file page for the cross-cutting framing of the technical file under CE marking, which articulates with but does not replace Annex II of the MDR.

UDI: a three-layer implementation

UDI (Unique Device Identification) is the device's unique identifier. Article 27 and Annex VI Part C of the MDR set the structure. For class IIb and III, implementation is not only earlier in the rollout calendar but also more demanding in direct marking, in granularity, and in accessory coverage.

UDI-DI and UDI-PI components

Component	Nature	Typical content	Time-variable
UDI-DI	Device Identifier, static	Identifies the model, the manufacturer, the issuing entity (GS1, HIBCC, ICCBBA or IFA GmbH, designated by Implementing Decision (EU) 2019/939)	No, the UDI-DI is fixed for a given reference
UDI-PI	Production Identifier, dynamic	As applicable, lot number, serial number (for implantables), manufacturing date, expiry date, software identifier for SaMD	Yes, changes with each batch or production unit
Master UDI-DI	Identifier of a group of highly individualised devices, introduced by Delegated Regulation (EU) 2023/2197 (contact lenses first, then spectacle products)	Groups references sharing the same clinically relevant design parameters	No, static, used for grouping
Basic UDI-DI	Root identifier at design level, used in EUDAMED and in certificates	Functional reference that gathers variants sharing the same design	No, static

The UDI carrier: AIDC + HRI

The UDI carrier must be present on the device label and on each upper packaging level. It combines two forms:

• AIDC (Automatic Identification and Data Capture), machine-readable form, typically a linear barcode or Data Matrix depending on the issuing entity (GS1, HIBCC, ICCBBA),
• HRI (Human Readable Interpretation), human-readable form, plain-text transcription of the UDI elements.

For reusable devices, including reusable implantables, Annex VI Part C section 4.10 additionally requires a direct UDI marking on the device itself, permanent and readable after each reprocessing. The direct marking must withstand the reprocessing cycles envisaged by the manufacturer. Compatible marking technologies include laser engraving, electrochemical etching and electroerosion.

Application calendar by class

Class	UDI application on the label	Direct marking (reusables)
Class III and implantables	26 May 2021	26 May 2023
Class IIa and IIb	26 May 2023	26 May 2025
Class I	26 May 2025	26 May 2027

UDI submission to EUDAMED

For each UDI-DI, a set of descriptive data is submitted to the UDI / device registration module of EUDAMED, in line with Annex VI Part B. The dataset comprises several dozen attributes, including the medical device nomenclature (EMDN, European Medical Device Nomenclature), the risk class, single-use or reusable status, presence of a medicinal substance, presence of animal-derived materials, and implantable status.

Submission is the manufacturer's responsibility (or that of its authorised representative for non-EU manufacturers). Notified bodies do not assign UDIs but use Basic UDI-DIs to structure their certificates.

EUDAMED: module status

EUDAMED consists of six modules. Their effective rollout has experienced significant delays compared with the initial MDR calendar. Regulation (EU) 2024/1860 reorganised the deployment module by module: each module becomes mandatory six months after a Commission notice declaring it fully functional. Decision (EU) 2025/2371, published on 27 November 2025, declared the first four modules functional, and their use has been mandatory since 28 May 2026.

Module	Status	Mandatory character
Actors (manufacturers, ARs, importers)	Operational	Mandatory since 28 May 2026
UDI and devices	Operational	Mandatory since 28 May 2026
Notified bodies and certificates	Operational	Mandatory since 28 May 2026
Clinical investigations and performance studies	Progressive rollout	Will follow the same notice mechanism
Vigilance and post-market surveillance	Progressive rollout	Will follow the same notice mechanism
Market surveillance	Operational	Mandatory since 28 May 2026

Until the vigilance module becomes mandatory under the same mechanism, incident reporting continues through the existing national channels to competent authorities. The table should still be checked against the European Commission's EUDAMED page for current status.

Clinical evaluation: a structuring investment

Framework: Article 61 and Annex XIV

Article 61 of the MDR requires a structured clinical evaluation. Annex XIV fixes its content and method, in two parts, clinical evaluation in the strict sense (Part A) and PMCF (Part B). The clinical evaluation report (CER) consolidates data sources, analyses them according to a documented method, and concludes on performance and safety.

MDCG 2020-13 publishes a Clinical Evaluation Assessment Report (CEAR) template used by notified bodies. MDCG 2020-1 on clinical evaluation for software and MDCG 2020-5 on equivalence complete the corpus.

Three sources of clinical data

The clinical evaluation rests on the combination of three possible sources:

• own clinical data, that is, data from clinical investigations conducted by the manufacturer on the device under evaluation (pre or post placing on the market, the latter falling under PMCF),
• equivalence-based clinical data, that is, data from a device considered equivalent under the strict criteria of Annex XIV section 3 (technical, biological and clinical equivalence, cumulatively),
• scientific literature data, processed under a documented systematic review (inclusion criteria, methodological quality, synthesis).

The relative weight of the three sources varies by class. For non-implantable class IIb, the combination of literature + equivalence + PMCF data may be sufficient depending on the maturity of the domain. For class III and implantable class IIb, own clinical data are expected save for exceptions.

Equivalence: severely restricted under the MDR

Article 61(5) and Annex XIV section 3 have significantly tightened equivalence. The cumulative criteria:

• technical equivalence, similar design, similar conditions of use, similar specifications and technical properties, identical operating principles,
• biological equivalence, materials or substances in contact with the same human tissues, body fluids, similar contact durations,
• clinical equivalence, same clinical condition, same purpose, same severity, same stage of disease, same site of application, same population.

For implantable devices and class III, Article 61(5) further requires a written agreement with the manufacturer of the equivalent device guaranteeing access to the technical documentation at any time, failing which equivalence cannot be invoked. In practice, such agreements are rare outside integrated groups, which makes equivalence a minority route under the MDR by comparison with its use under the MDD.

Clinical investigations: when mandatory

Article 61(4) requires clinical investigations for implantable devices and class III devices, save three families of exception:

• modifications to the design of a device already commercialised by the same manufacturer, provided the manufacturer demonstrates equivalence with its own device and the clinical data remain sufficient,
• equivalence demonstrated with a device already commercialised by another manufacturer, subject to a written agreement (Article 61(5)),
• exemption under Article 61(6) for devices already lawfully placed on the market under the MDD or AIMDD (legacy devices) whose clinical evaluation rests on sufficient clinical data and complies with the relevant product-specific common specification where one exists, and for the standard list of well-established devices (sutures, staples, dental fillings, etc., Article 61(6)(b)). MDCG 2020-6 frames what counts as sufficient clinical evidence for legacy devices.

Clinical investigations are conducted under Articles 62 to 82 and Annex XV, which require a clinical investigation plan (CIP), an opinion from the national ethics committee, authorisation from the competent authority, and registration in EUDAMED.

Post-market surveillance: PMS, PSUR, PMCF, vigilance

Post-market surveillance is codified in Articles 83 to 100 and in Annexes III and XIV Part B.

The PMS plan (Annex III)

The PMS plan is a surveillance document proportionate to the risk class. It describes:

• the data sources monitored (internal vigilance, external vigilance, scientific literature, registries, user complaints, state of the art, PMCF, commercial feedback),
• detection indicators and thresholds (incident rates, complaint rates, performance drifts),
• statistical analysis methods for trend detection,
• escalation procedures to corrective actions.

Without an operational PMS plan, PSURs cannot be produced credibly in practice.

PSUR cadence by class

Class	Type of report	Cadence	NB review
Class I	PMS report (Article 85)	Updated when necessary	No systematic NB review
Class IIa	PSUR (Article 86)	When necessary, at least every two years	Made available to the NB and, on request, to the competent authority (Article 86(3))
Non-implantable class IIb	PSUR (Article 86)	At least annually	Made available to the NB and, on request, to the competent authority (Article 86(3))
Implantable class IIb	PSUR (Article 86)	At least annually	Submitted to the NB, evaluation accessible to authorities (Article 86(2))
Class III	PSUR (Article 86)	At least annually	Submitted to the NB, evaluation accessible to authorities (Article 86(2))

The PSUR consolidates PMS data, the conclusions of the updated benefit-risk analysis, the main findings of PMCF, corrective actions taken and planned, and sales volumes. For class III and implantable devices, the manufacturer submits the PSUR to the notified body through the Article 92 electronic system, the notified body adds its evaluation, and both are made accessible to competent authorities (Article 86(2)).

Vigilance: 15 days, 10 days, 2 days

Article 87 of the MDR fixes three deadlines for reporting serious incidents to competent authorities:

• 15 days for a general serious incident,
• 10 days for a serious incident having led to death or unanticipated serious deterioration of health,
• 2 days for a serious public health threat.

Field Safety Corrective Actions (FSCAs) follow Article 89, with a Field Safety Notice (FSN) communicated to users. Trend reports (Article 88) are expected when the manufacturer notes a statistically significant increase in non-serious incidents or expected side effects.

PMCF (Annex XIV Part B)

PMCF (post-market clinical follow-up) is mandatory for class IIb and class III, unless a documented justification supports omission. It comprises:

• a PMCF plan integrated into the clinical evaluation plan, describing the objectives (confirmation of long-term performance and safety, identification of residual or emerging risks, identification of off-label use), the methods (registry, prospective study, retrospective study on a clinical database, user survey), and the time milestones,
• a PMCF report, updated periodically, feeding into the CER and PSUR.

Absence of PMCF, or a PMCF planned but not executed, is one of the most frequently observed non-conformities during MDR surveillance.

The PRRC and the authorised representative

The Person Responsible for Regulatory Compliance (PRRC, Article 15) is internal to the manufacturer for companies exceeding the micro/small enterprise threshold (Recommendation 2003/361/EC). For micro and small enterprises, the PRRC may be outsourced to a permanently available consultant (Article 15(2)).

Minimum qualifications are set by Article 15(1): university degree in law, medicine, pharmacy, engineering or another relevant scientific discipline, plus at least one year of experience in regulatory affairs or quality management systems in the medical device sector. The PRRC takes responsibility for conformity check before release, technical documentation, post-market surveillance follow-up, and serious incident notification.

For non-EU manufacturers, Article 11 requires the designation of an Authorised Representative (AR) established in the EU, registered in EUDAMED. The AR must in turn designate its own PRRC. The manufacturer + AR pair is legally liable, the AR may be held jointly and severally liable in case of a defective device (Article 11(5)). Established practice is to select the AR with as much rigour as the notified body, and to formalise the mandate by contract with operational clauses (technical documentation access, transmission deadlines, coordination in case of inspection).

Expert panels, expert laboratories and EURLs

EU Reference Laboratories (EURLs) are often cited in this context, but they are an institution of the IVDR, not of the MDR: Article 100 of Regulation (EU) 2017/746 provides for them, Implementing Regulation (EU) 2022/944 sets their tasks and criteria, and the first laboratories, designated by Implementing Regulation (EU) 2023/2713, operate since October 2024 for certain class D in vitro diagnostics (see the IVDR guide).

Under the MDR, the scientific reinforcement for high-risk devices takes two forms:

• the expert panels of Article 106, mobilised in particular through the Article 54 clinical evaluation consultation procedure for class III implantable devices and class IIb active devices administering or removing a medicinal product,
• the expert laboratories the Commission may designate under Article 106(7) for physico-chemical characterisation or specific testing domains.

For manufacturers of devices in the Article 54 scope, the expert panel consultation adds a step and a delay to the conformity assessment pathway, to be integrated in project planning.

Classic pitfalls observed in the field

Surveillance and audits since the start of MDR application have surfaced a recurring set of non-conformities for class IIb and III.

• Under-scoped CER. Insufficient SOTA literature review, equivalence claimed without meeting the cumulative criteria of Annex XIV section 3, own clinical data absent for an implantable. The CER is the document that triggers the most deficiency letters in early iterations.
• Late notified-body engagement. Hasty NANDO selection, contract signed without pre-application meeting, submission without prior scoping. Backtracking after the first NB review is expensive. See the certification timeline for recommended milestones.
• Mis-applied UDI. Mismatch between data submitted to EUDAMED and physical markings, direct marking forgotten for reusable implantables, Basic UDI-DI missing from the certificate or the EU declaration of conformity. NBs detect these inconsistencies at audit.
• PSUR without stable cadence. PMS plan drafted but unused, PSURs filed late or with incomplete data. The cadence is legally fixed, breach is noted.
• PMCF planned but not executed. The PMCF plan cites methods (registry, post-market study) without any operational implementation being demonstrable. Annual surveillance picks this up.
• Weak post-market signal detection. Non-quantitative PMS indicators, undefined thresholds, no documented trend analysis. The early signal of serial incidents is missed.
• Generic PMS plan. PMS plan copied from one device to another without adaptation to the specific risk profile. The NB notes the absence of proportionality.
• Nominally designated AR. Authorised representative without the operational capacity to produce the technical documentation on demand from the competent authority, or without effective coordination with the manufacturer.
• PRRC overloaded with cumulated functions. PRRC designated who simultaneously holds several critical roles (QSE director, head of production) without demonstration of sufficient availability. The QMS audit notes it.

Articulation with related pages

• For the baseline MDR overview, go back to the MDR guide, which is the prerequisite for this page.
• For the general CE framework, see the CE pillar, the conformity assessment procedure, and the technical file.
• For the module/route decision, see the self-declaration vs notified body comparison.
• For project framing, see the certification timeline.
• For definitions, see the glossary, which covers UDI, EUDAMED, notified body, PRRC, authorised representative, PMS, PSUR, PMCF, CER, EURL, NANDO.

See also

• IVDR (EU) 2017/746: in vitro diagnostic medical devices
• FDA 510(k), De Novo and PMA: US medical devices
• QMS: ISO 9001, AS 9100, ISO 13485, TL 9000 compared
• IATF 16949: automotive quality management

Working on upstream regulatory positioning for a class IIb or III medical device for a real product? AESTECHNO can audit your design and certification plan. Get in touch →

Sources & references

1. Regulation (EU) 2017/745 on medical devices , EUR-Lex eur-lex.europa.eu/eli/reg/2017/745/oj
2. Regulation (EU) 2023/607, extension of transitional provisions , EUR-Lex eur-lex.europa.eu/eli/reg/2023/607/oj
3. MDCG guidance documents , European Commission health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en
4. MDCG 2020-13, Clinical Evaluation Assessment Report template , European Commission health.ec.europa.eu/latest-updates/guidance-clinical-evaluation-assessment-report-template-2020-07-17_en
5. EUDAMED, the European database on medical devices , European Commission ec.europa.eu/tools/eudamed/
6. NANDO, notified bodies designated under the MDR , European Commission ec.europa.eu/growth/tools-databases/nando/
7. IMDRF, UDI guidance and reference documents , IMDRF www.imdrf.org/