MDR class IIb and III: UDI, EUDAMED, NB, surveillance

Author Hugues Orgitello Last updated 27 May 2026 ~18 min read

Guide · MDR class IIb/III

This page is the in-depth companion to the MDR overview at /en/guides/mdr-medical-device-regulation/. It assumes familiarity with the general framework of Regulation (EU) 2017/745, the classification rules of Annex VIII, and the core vocabulary (notified body, EUDAMED, UDI, PRRC, authorised representative). It focuses on class IIb and class III, where notified-body involvement is heaviest, the technical file is largest, and post-market surveillance presses hardest on the device lifecycle. The intended reader is a regulatory professional preparing or maintaining a dossier in those classes.

Framing: why a separate pathway for class IIb and III

The four MDR classes (I, IIa, IIb, III) share a common backbone, general safety and performance requirements (GSPRs) in Annex I, technical file in Annex II, clinical evaluation in Annex XIV, post-market surveillance in Chapter VII. The difference between class IIa and class III lies not in the nature of the obligations, which stack, but in their depth and in the level of notified-body involvement.

For quick context, see the MDR overview and the self-declaration vs notified body comparison. Three structural lines distinguish the class IIb/III pathway from the class IIa pathway.

First line, design dossier examination. For class III and for implantable class IIb, the notified body does not merely review a representative dossier per generic device group, it examines each design dossier (Annex IX Chapter II). The periodic check becomes systematic.

Second line, clinical documentation. Non-implantable class IIb can, under certain conditions, rely on literature and equivalence data. Class III and implantable class IIb shift towards own clinical investigation, with narrowly defined exceptions (Article 61(4) to (6)).

Third line, surveillance cadence. The PSUR (Periodic Safety Update Report) is annual for implantable class IIb and class III, biennial for non-implantable class IIb. Its quality is reviewed by the notified body for class III and implantable class IIb, and the assessment report is made accessible to authorities via EUDAMED.

These three lines structure the rest of the page.

Conformity assessment routes: Annexes IX, X and XI

Annexes IX, X and XI of the MDR define the conformity assessment procedures. They combine a quality management system, documentary examination and, for the higher classes, design dossier examination on each device.

Side-by-side comparison of the three routes

Annex	Main brick	Sub-elements	Key actor
Annex IX	Assessment based on a quality management system and on technical documentation assessment	Chapter I (QMS), Chapter II (design dossier examination, class III and implantable IIb), Chapter III (technical documentation verification)	NB conducts QMS audit + dossier review, annual surveillance
Annex X	EU type-examination	Submission of a representative specimen, examination by the NB, issuance of an EU type-examination certificate	NB examines the type device, the manufacturer remains free of full QMS as long as the complementary Annex XI route is in place
Annex XI Part A	Production quality assurance	QMS limited to production, NB audits	Often combined with an EU type-examination certificate (Annex X)
Annex XI Part B	Product verification	NB verification of each batch or each device	Rarely used, reserved for very low volumes

Which route for which class

For non-implantable class IIb, two practical routes:

• Annex IX Chapters I and III, the majority route, resting on a full quality management system typically aligned with harmonised standard EN ISO 13485, plus notified-body review of at least one representative design dossier per generic device category (Article 52(6)).
• Annex X (EU type-examination) + Annex XI Part A or B, the minority route, retained by very low-volume manufacturers or by manufacturers who favour a type-based logic over an extended QMS.

For implantable class IIb and class III, the main route is Annex IX Chapters I, II and III, where Chapter II adds the design dossier examination on each device. An alternative route is theoretically available through Annex X (EU type-examination) + Annex XI Part A (production quality assurance), but remains uncommon in practice.

Several sub-categories of implantable class IIb benefit from exceptions to systematic design dossier examination (Article 52(4) point b), notably sutures, staples, dental fillings, dental braces, wires, pins and plates, wires, clips and connectors. For these categories, implantable class IIb falls back on the sampled documentary review of Annex IX Chapter III. The exhaustive list is in the text.

For implantable class III devices or class III devices that administer or remove a medicinal product, Article 54 further imposes a Clinical Evaluation Consultation Procedure (CECP) coordinated by the European Commission. An expert panel issues an opinion on the clinical evaluation assessment report, which feeds into the conformity dossier.

The notified body: selection, application, audits

Selection through NANDO

The European Commission's NANDO database lists notified bodies designated under the MDR with their detailed scope. The scope is encoded in three families:

• MDA (Medical Device codes A) for general categories (for example MDA 0301 for active non-implantable imaging devices),
• MDS (sub-codes) for sub-specialties (SaMD, biocompatible devices, etc.),
• MDN (Medical Device horizontal codes) for horizontal expertise (incorporated medicinal substances, animal-derived materials, etc.).

MDCG 2019-14 details the full nomenclature. The IFC code (Investigational devices) covers devices under clinical investigation. The practical rule, the notified-body scope of designation must explicitly cover the codes that match the device. A class III device combining a medicinal product requires an NB whose scope covers that specialty. A software device requires an NB whose scope covers SaMD codes.

Pre-application meeting

The established practice, recommended by most notified bodies, is to hold a pre-application meeting before formal submission. These meetings are not regulatory in the strict sense, but they help frame the scope, identify complexity points (medicinal substance, animal-derived material, novel material) and estimate the assessment timeline. They do not bind the notified body on the outcome, but they reduce the risk of having to backtrack after submission.

Submission and technical documentation review

The formal submission includes the application, the technical file under Annex II, the post-market documentation under Annex III, and the quality management system documentation. The notified body conducts a completeness review, then a content review. Content reviews are led by an assessment team whose composition is governed by Article 36 and Annex VII. For class III and implantable class IIb devices, the team typically includes:

• a clinical assessor with medical experience in the relevant specialty,
• a technical assessor with expertise in the device technology,
• a statistician for the assessment of quantitative clinical data,
• as applicable, a materials engineer, a biocompatibility expert or a software expert.

Notified-body questions are consolidated into deficiency letters. Manufacturer responses are assessed iteratively. The number of cycles depends on the initial dossier quality and on device complexity. Observed practice, without it being possible to cite a reliable average without risk of inaccuracy, shows that first MDR submissions typically go through several deficiency-letter cycles before closure.

Quality system audit and design audit

The quality system audit covers the full QMS, design, manufacturing, control, post-market surveillance, critical supplier management, and includes on-site audit (headquarters and manufacturing sites). For class IIb and III, a design audit is conducted, either in sequence with the QMS audit or in parallel. The design audit examines design controls (inputs and outputs), change management, risk management (EN ISO 14971), and verification and validation processes.

Unannounced audits were introduced by Article 56(7) and detailed by Commission Implementing Regulation (EU) 2013/920 as amended. Notified bodies must conduct unannounced audits at least once every five years, and more frequently for manufacturers identified as higher risk.

Certification cycle: 5 years, annual surveillance

The MDR certificate is issued for a maximum duration of five years (Article 56(2) for QMS certificates, Article 56(3) for EU type-examination certificates, renewable). During that duration, the notified body conducts annual surveillance, QMS audit and documentary re-examination on a sample (class IIa and non-implantable class IIb) or systematic (implantable class IIb and class III), plus verification of corrective action implementation. At the end of the five years, a full recertification is conducted, equivalent in depth to the initial assessment.

See the certification timeline for project framing, which integrates these audit sequences.

The technical file: structure imposed by Annex II

Annex II of the MDR fixes the structure of the technical file. The term structure is to be taken in the strong sense here, the notified body expects an organisation aligned with the Annex enumeration, and a structural deviation is itself a formal non-conformity.

Annex II outline

1. Device description and specification, including variants and accessories. Identification, intended medical purpose, indications, contraindications, target population, principles of operation, materials, critical components, configurations, previous generations placed on the market.
2. Information to be supplied by the manufacturer. Labels, instructions for use, promotional material, conformity to Annex I Chapter III requirements.
3. Design and manufacturing information. Design sites, manufacturing sites, critical supplier sites, design controls, manufacturing processes, control processes, change management.
4. General safety and performance requirements (GSPRs). Exhaustive checklist of applicable requirements, references to harmonised standards or common specifications applied, references to evidence of conformity (tests, calculations, analyses).
5. Benefit-risk analysis and risk management. Risk management plan (EN ISO 14971), risk analysis, control measures, residual risk, benefit-risk analysis aligned with Annex I sections 1 to 8.
6. Product verification and validation. Preclinical data (biocompatibility EN ISO 10993, electrical safety IEC 60601-1, electromagnetic compatibility IEC 60601-1-2, physical safety, stability, performance, sterilisation, software life cycle process IEC 62304 where applicable), clinical data (clinical evaluation report, clinical investigation plan, clinical investigation reports, PMCF plan and report, SOTA literature), additional specific information (incorporated medicinal substance, animal or human-derived materials, devices incorporating nanomaterials, drug-device combinations).

Annex III, post-market surveillance documentation

Annex III is legally distinct from the Annex II technical file, but attached to it. It requires:

• a PMS plan per device or device group (Article 84 and Annex III section 1),
• the PMS reports or PSURs generated by application of the plan (Article 85 or 86),
• the vigilance records (Articles 87 to 90),
• the trend analysis reports (Article 88),
• the field safety corrective actions (FSCAs, Article 89) with their field safety notices (FSNs).

See also the CE technical file page for the cross-cutting framing of the technical file under CE marking, which articulates with but does not replace Annex II of the MDR.

UDI: a three-layer implementation

UDI (Unique Device Identification) is the device's unique identifier. Article 27 and Annex VI Part C of the MDR set the structure. For class IIb and III, implementation is not only earlier in the rollout calendar but also more demanding in direct marking, in granularity, and in accessory coverage.

UDI-DI and UDI-PI components

Component	Nature	Typical content	Time-variable
UDI-DI	Device Identifier, static	Identifies the model, the manufacturer, the issuing entity (GS1, HIBC, ICCBBA, IFA)	No, the UDI-DI is fixed for a given reference
UDI-PI	Production Identifier, dynamic	As applicable, lot number, serial number (for implantables), manufacturing date, expiry date, software identifier for SaMD	Yes, changes with each batch or production unit
Master UDI-DI	Root identifier for a group of configurable devices (for example a system with multiple references)	Root reference for a group, link to each child UDI-DI	No, static, used for grouping
Basic UDI-DI	Root identifier at design level, used in EUDAMED and in certificates	Functional reference that gathers variants sharing the same design	No, static

The UDI carrier: AIDC + HRI

The UDI carrier must be present on the device label and on each upper packaging level. It combines two forms:

• AIDC (Automatic Identification and Data Capture), machine-readable form, typically a linear barcode or Data Matrix depending on the issuing entity (GS1, HIBC, ICCBBA),
• HRI (Human Readable Interpretation), human-readable form, plain-text transcription of the UDI elements.

For reusable implantable devices, Article 27(4) additionally requires a direct UDI marking on the device itself, engraved, printed or applied in a permanent manner. The direct marking must withstand the reprocessing cycles envisaged by the manufacturer. Compatible marking technologies include laser engraving, electrochemical etching and electroerosion.

Application calendar by class

Class	UDI application on the label	Direct marking (reusables)
Class III and implantables	26 May 2021	26 May 2023
Class IIa and IIb	26 May 2023	26 May 2025
Class I	26 May 2025	26 May 2027

UDI submission to EUDAMED

For each UDI-DI, a set of descriptive data is submitted to the UDI / device registration module of EUDAMED, in line with Annex VI Part B. The dataset comprises around fifty attributes, including the medical device nomenclature (EMDN, European Medical Device Nomenclature), the risk class, single-use or reusable status, presence of a medicinal substance, presence of animal-derived materials, and implantable status.

Submission is the manufacturer's responsibility (or that of its authorised representative for non-EU manufacturers). Notified bodies do not assign UDIs but use Basic UDI-DIs to structure their certificates.

EUDAMED: module status

EUDAMED consists of six modules. Their effective rollout since 2018 has experienced significant delays compared with the initial MDR calendar. The situation evolves, the table below is qualitative and should be verified against the European Commission's page for current status.

Module	Qualitative status	Mandatory character
Actors (manufacturers, ARs, importers)	Operational	Mandatory for registration of new actors
UDI and devices	Operational	Mandatory for new devices
Notified bodies and certificates	Operational	Used for consultation, fed by notified bodies
Clinical investigations and performance studies	Progressive rollout	Phasing in
Vigilance and post-market surveillance	Progressive rollout	Phasing in
Market surveillance	Progressive rollout	Phasing in

The mandatory character of each module's use is subject to a Commission opinion noting its full functionality, in line with Article 34. Until that opinion is published for a given module, the obligation remains suspended, and alternative national declarations (vigilance to competent authorities) continue to apply.

Clinical evaluation: a structuring investment

Framework: Article 61 and Annex XIV

Article 61 of the MDR requires a structured clinical evaluation. Annex XIV fixes its content and method, in two parts, clinical evaluation in the strict sense (Part A) and PMCF (Part B). The clinical evaluation report (CER) consolidates data sources, analyses them according to a documented method, and concludes on performance and safety.

MDCG 2020-13 publishes a Clinical Evaluation Assessment Report (CEAR) template used by notified bodies. MDCG 2020-1 on clinical evaluation for software and MDCG 2020-5 on equivalence complete the corpus.

Three sources of clinical data

The clinical evaluation rests on the combination of three possible sources:

• own clinical data, that is, data from clinical investigations conducted by the manufacturer on the device under evaluation (pre or post placing on the market, the latter falling under PMCF),
• equivalence-based clinical data, that is, data from a device considered equivalent under the strict criteria of Annex XIV section 3 (technical, biological and clinical equivalence, cumulatively),
• scientific literature data, processed under a documented systematic review (inclusion criteria, methodological quality, synthesis).

The relative weight of the three sources varies by class. For non-implantable class IIb, the combination of literature + equivalence + PMCF data may be sufficient depending on the maturity of the domain. For class III and implantable class IIb, own clinical data are expected save for exceptions.

Equivalence: severely restricted under the MDR

Article 61(5) and Annex XIV section 3 have significantly tightened equivalence. The cumulative criteria:

• technical equivalence, similar design, similar conditions of use, similar specifications and technical properties, identical operating principles,
• biological equivalence, materials or substances in contact with the same human tissues, body fluids, similar contact durations,
• clinical equivalence, same clinical condition, same purpose, same severity, same stage of disease, same site of application, same population.

For implantable devices and class III, Article 61(5) further requires a written agreement with the manufacturer of the equivalent device guaranteeing access to the technical documentation at any time, failing which equivalence cannot be invoked. In practice, such agreements are rare outside integrated groups, which makes equivalence a minority route under the MDR by comparison with its use under the MDD.

Clinical investigations: when mandatory

Article 61(4) requires clinical investigations for implantable devices and class III devices, save three families of exception:

• modifications to the design of a device already commercialised by the same manufacturer, provided the manufacturer demonstrates equivalence with its own device and the clinical data remain sufficient,
• equivalence demonstrated with a device already commercialised by another manufacturer, subject to a written agreement (Article 61(5)),
• exemption under Article 61(10) for devices supported by clinical data from an equivalent legacy device commercialised by the same manufacturer under the MDD, provided the data are sufficient and GSPR conformity is demonstrated. This exemption is interpreted restrictively by notified bodies and the MDCG, its application remains rare.

Clinical investigations are conducted under Articles 62 to 82 and Annex XV, which require a clinical investigation plan (CIP), an opinion from the national ethics committee, authorisation from the competent authority, and registration in EUDAMED.

Post-market surveillance: PMS, PSUR, PMCF, vigilance

Post-market surveillance is codified in Articles 83 to 100 and in Annexes III and XIV Part B.

The PMS plan (Annex III)

The PMS plan is a surveillance document proportionate to the risk class. It describes:

• the data sources monitored (internal vigilance, external vigilance, scientific literature, registries, user complaints, state of the art, PMCF, commercial feedback),
• detection indicators and thresholds (incident rates, complaint rates, performance drifts),
• statistical analysis methods for trend detection,
• escalation procedures to corrective actions.

Without an operational PMS plan, PSURs cannot be produced credibly in practice.

PSUR cadence by class

Class	Type of report	Cadence	NB review
Class I	PMS report (Article 85)	Updated when necessary	No systematic NB review
Class IIa	PSUR (Article 86)	At least every two years	Available to the NB on request
Non-implantable class IIb	PSUR (Article 86)	At least every two years	Available to the NB and to the competent authority
Implantable class IIb	PSUR (Article 86)	At least annually	Reviewed by the NB, assessment report in EUDAMED
Class III	PSUR (Article 86)	At least annually	Reviewed by the NB, assessment report in EUDAMED

The PSUR consolidates PMS data, the conclusions of the updated benefit-risk analysis, the main findings of PMCF, corrective actions taken and planned, and sales volumes. For class III and implantable class IIb, the notified body reviews the PSUR and its assessment report is uploaded into EUDAMED (Article 86(2)).

Vigilance: 15 days, 10 days, 2 days

Article 87 of the MDR fixes three deadlines for reporting serious incidents to competent authorities:

• 15 days for a general serious incident,
• 10 days for a serious incident having led to death or unanticipated serious deterioration of health,
• 2 days for a serious public health threat.

Field Safety Corrective Actions (FSCAs) follow Article 89, with a Field Safety Notice (FSN) communicated to users. Trend reports (Article 88) are expected when the manufacturer notes a statistically significant increase in non-serious incidents or expected side effects.

PMCF (Annex XIV Part B)

PMCF (post-market clinical follow-up) is mandatory for class IIb and class III, unless a documented justification supports omission. It comprises:

• a PMCF plan integrated into the clinical evaluation plan, describing the objectives (confirmation of long-term performance and safety, identification of residual or emerging risks, identification of off-label use), the methods (registry, prospective study, retrospective study on a clinical database, user survey), and the time milestones,
• a PMCF report, updated periodically, feeding into the CER and PSUR.

Absence of PMCF, or a PMCF planned but not executed, is one of the most frequently observed non-conformities during MDR surveillance.

The PRRC and the authorised representative

The Person Responsible for Regulatory Compliance (PRRC, Article 15) is internal to the manufacturer for companies exceeding the micro/small enterprise threshold (Recommendation 2003/361/EC). For micro and small enterprises, the PRRC may be outsourced to a permanently available consultant (Article 15(2)).

Minimum qualifications are set by Article 15(1): university degree in law, medicine, pharmacy, engineering or another relevant scientific discipline, plus at least one year of experience in regulatory affairs or quality management systems in the medical device sector. The PRRC takes responsibility for conformity check before release, technical documentation, post-market surveillance follow-up, and serious incident notification.

For non-EU manufacturers, Article 11 requires the designation of an Authorised Representative (AR) established in the EU, registered in EUDAMED. The AR must in turn designate its own PRRC. The manufacturer + AR pair is legally liable, the AR may be held jointly and severally liable in case of a defective device (Article 11(5)). Established practice is to select the AR with as much rigour as the notified body, and to formalise the mandate by contract with operational clauses (technical documentation access, transmission deadlines, coordination in case of inspection).

EURLs: EU Reference Laboratories

Article 100 of the MDR creates the figure of EU Reference Laboratories (EURLs). Their mission is to:

• verify the conformity of certain high-risk class III device categories defined by Commission implementing acts,
• assist notified bodies on tests and methods,
• contribute to standardised test methods and to scientific coordination.

Commission Implementing Regulation (EU) 2022/944 and its subsequent amendments define the covered categories and designate the laboratories. Designation is progressive. The presence of a competent EURL in the evaluation chain is a factor to integrate for manufacturers of concerned class III devices, since its involvement adds a step and a delay to the pathway.

Classic pitfalls observed in the field

Surveillance and audits since the start of MDR application have surfaced a recurring set of non-conformities for class IIb and III.

• Under-scoped CER. Insufficient SOTA literature review, equivalence claimed without meeting the cumulative criteria of Annex XIV section 3, own clinical data absent for an implantable. The CER is the document that triggers the most deficiency letters in early iterations.
• Late notified-body engagement. Hasty NANDO selection, contract signed without pre-application meeting, submission without prior scoping. Backtracking after the first NB review is expensive. See the certification timeline for recommended milestones.
• Mis-applied UDI. Mismatch between data submitted to EUDAMED and physical markings, direct marking forgotten for reusable implantables, Basic UDI-DI missing from the certificate or the EU declaration of conformity. NBs detect these inconsistencies at audit.
• PSUR without stable cadence. PMS plan drafted but unused, PSURs filed late or with incomplete data. The cadence is legally fixed, breach is noted.
• PMCF planned but not executed. The PMCF plan cites methods (registry, post-market study) without any operational implementation being demonstrable. Annual surveillance picks this up.
• Weak post-market signal detection. Non-quantitative PMS indicators, undefined thresholds, no documented trend analysis. The early signal of serial incidents is missed.
• Generic PMS plan. PMS plan copied from one device to another without adaptation to the specific risk profile. The NB notes the absence of proportionality.
• Nominally designated AR. Authorised representative without the operational capacity to produce the technical documentation on demand from the competent authority, or without effective coordination with the manufacturer.
• PRRC overloaded with cumulated functions. PRRC designated who simultaneously holds several critical roles (QSE director, head of production) without demonstration of sufficient availability. The QMS audit notes it.

Articulation with related pages

• For the baseline MDR overview, go back to the MDR guide, which is the prerequisite for this page.
• For the general CE framework, see the CE pillar, the conformity assessment procedure, and the technical file.
• For the module/route decision, see the self-declaration vs notified body comparison.
• For project framing, see the certification timeline.
• For definitions, see the glossary, which covers UDI, EUDAMED, notified body, PRRC, authorised representative, PMS, PSUR, PMCF, CER, EURL, NANDO.

See also

• IVDR (EU) 2017/746: in vitro diagnostic medical devices
• FDA 510(k), De Novo and PMA: US medical devices
• QMS: ISO 9001, AS 9100, ISO 13485, TL 9000 compared
• IATF 16949: automotive quality management

Working on upstream regulatory positioning for a class IIb or III medical device for a real product? AESTECHNO can audit your design and certification plan. Get in touch →

Sources & references

1. Regulation (EU) 2017/745 on medical devices , EUR-Lex eur-lex.europa.eu/eli/reg/2017/745/oj
2. Regulation (EU) 2023/607, extension of transitional provisions , EUR-Lex eur-lex.europa.eu/eli/reg/2023/607/oj
3. MDCG guidance documents , European Commission health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en
4. MDCG 2020-13, Clinical Evaluation Assessment Report template , European Commission health.ec.europa.eu/document/download/0a08d4bc-7b29-4c30-8e30-c5dc7c7e3a3d_en
5. EUDAMED, the European database on medical devices , European Commission ec.europa.eu/tools/eudamed/
6. NANDO, notified bodies designated under the MDR , European Commission ec.europa.eu/growth/tools-databases/nando/
7. IMDRF, UDI guidance and reference documents , IMDRF www.imdrf.org/