MDR: the EU Medical Device Regulation (2017/745)

Author Hugues Orgitello Last updated 26 May 2026

Guide · MDR

Regulation (EU) 2017/745, commonly referred to as the MDR (Medical Device Regulation), governs the placing on the market and putting into service of medical devices in the European Union. Adopted in 2017 and applicable since 26 May 2021, it replaces two long-standing directives, 93/42/EEC and 90/385/EEC, and constitutes arguably the deepest regulatory overhaul the sector has seen since the early 1990s. Its logic can be stated in a few words: more traceability, more transparency, more clinical evaluation, fewer interpretation margins. This page explains what the text says, what it changes versus the previous regime, and how manufacturers in practice approach it in 2026.

Why a regulation, why now

The shift from directive to regulation is not cosmetic. A directive must be transposed by each member state, leaving room for national interpretation. A regulation is directly applicable, in identical wording, across all member states. That choice answered a long-standing concern: divergences in application between national competent authorities under the MDD had produced heterogeneous, sometimes contradictory decisions from one member state to another, undermining trust in the medical CE marking.

The direct political trigger was the PIP breast implant scandal, exposed in 2010, in which a French manufacturer used industrial-grade silicone gel instead of the authorised implantable gel, with serious health consequences for some 400 000 patients worldwide. The investigation showed that the Notified Body audit system had been circumvented through concealment over years. The European Commission drew two operational conclusions from this episode. First, Notified Bodies themselves needed tighter oversight and reauthorisation. Second, traceability of devices across the entire value chain, from manufacturer to end user, needed to become central.

The MDR materialises these two directions through two new mechanisms detailed below: UDI (Unique Device Identification) and EUDAMED (European Database on Medical Devices).

Scope: what counts as a "medical device"

Article 2(1) of the MDR defines a medical device as any instrument, apparatus, appliance, software, implant, reagent, material or other article intended by the manufacturer to be used, alone or in combination, on human beings, for at least one of the following medical purposes:

• diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease,
• diagnosis, monitoring, treatment, alleviation of, or compensation for, an injury or disability,
• investigation, replacement or modification of the anatomy or of a physiological or pathological process or state,
• providing information by means of in vitro examination of specimens derived from the human body, including organ, blood and tissue donations, under certain conditions.

Two points deserve attention. First, the purpose is defined by the manufacturer. The same physical product can be a medical device when marketed with a medical claim, or a wellness product when it is not. The boundary runs through marketing claims, labelling, instructions for use and promotional material.

Second, software is explicitly included. Software intended for a medical purpose is a medical device, whether standalone (Software as a Medical Device, SaMD) or embedded (Software in a Medical Device, SiMD). Rule 11 of Annex VIII governs its classification, addressed further below.

Regulation (EU) 2017/746 on in vitro diagnostics (IVDR) covers, in a separate text, laboratory tests, biology analysers, sample collection kits and companion diagnostics. Its application phase began on 26 May 2022 with its own transitional period.

Classification by rules, Annex VIII

The MDR organises devices into four risk classes of increasing severity, I, IIa, IIb, III, plus specific sub-categories of class I. Classification results from the application of the 22 rules in Annex VIII, which cover successively:

• non-invasive devices (rules 1 to 4),
• invasive devices (rules 5 to 8),
• active devices (rules 9 to 13),
• special rules (rules 14 to 22) covering substances, nanomaterials, implants and notably, in rule 11, software.

Class	Risk level	Examples	Typical conformity route
I	Low risk	Non-sterile compresses, manual wheelchairs, simple corrective spectacles	Self-declaration, except Is/Im/Ir sub-categories
Is	Class I sterile	Sterile dressings, sterile gloves	Notified Body for sterility aspects only
Im	Class I with measuring function	Clinical thermometer, medical scale, manual mercury sphygmomanometer	Notified Body for metrological aspects only
Ir	Class I reusable surgical instrument	Reusable forceps, scissors, retractors	Notified Body for reprocessing aspects only
IIa	Moderate risk	Short-term suction catheters, diagnostic app, chairside dental scanner	Notified Body, Annex IX sections 2 and 3 or Annex XI
IIb	High risk	Intensive care ventilator, infusion pump, external defibrillator	Notified Body, Annex IX including design dossier review for certain categories
III	Maximum risk	Cardiac implant, hip prosthesis, extracorporeal circulation device	Notified Body, Annex IX with full design dossier review, expert panel consultation for innovative implants

Classification is formally documented in the technical file. A misclassification spotted during evaluation by a Notified Body may force a route change, with significant time and money lost. For borderline cases, the MDCG (Medical Device Coordination Group) publishes category-specific guidance.

§ § §

Conformity assessment routes

Routes, or conformity assessment procedures, are defined by Annexes IX, X and XI of the MDR. They combine quality management system, technical documentation and, for higher classes, design dossier review. The manufacturer chooses among the routes authorised for its class.

Class	Base route	Notified Body involvement
I (excluding Is/Im/Ir)	Annex II + EU declaration of conformity by the manufacturer	None
Is, Im, Ir	Annex IX chapters I and III limited to the relevant aspects, or Annex XI part A	NB for sterility, metrology or reprocessing only
IIa	Annex IX chapters I and III (QMS + sampled documentation review), or Annex XI part A (production QA), or Annex XI part B (product verification)	NB, QMS audit + review of at least one representative file per generic device group
IIb non-implantable	Annex IX chapters I and III with review of at least one representative file per category, or Annex X (EU-type examination) + Annex XI part A or B	NB, full QMS audit + sampled design dossier review
IIb implantable and certain categories	Annex IX chapters I, II and III, design dossier review on every device	NB, in-depth design dossier review
III	Annex IX chapters I, II and III, or Annex X + Annex XI part A	NB, full design dossier review, expert panel for innovative implants under Article 54

Three practical remarks. First, unlike Decision 768/2008/EC which structures the modules for most sectoral directives (EMC, LVD, RED), the MDR has its own dedicated annexes: the vocabulary is procedures, not modules. The vocabulary differs, the logic is comparable. See the self-declaration vs Notified Body guide for the general framework.

Second, the classic MDR route, used by most manufacturers from class IIa onwards, combines Annex IX chapter I (quality management system audit, comparable to a module H) and Annex IX chapter III (technical documentation assessment). For class IIb implantable and class III, Annex IX chapter II is added, requiring design dossier review by the Notified Body.

Third, EU-type examination (Annex X) combined with product verification (Annex XI part B) remains possible, notably for very low-volume manufacturers with no interest in maintaining a full ISO 13485 quality system, but this route is in practice a minority choice.

The MDR Notified Body shortage

Article 35 and Annex VII of the MDR raised the requirements applicable to Notified Bodies themselves. Each NB must be redesignated under MDR by its own designating authority, after a joint audit involving the European Commission and the member state assessment team. The process is lengthy and has produced a net reduction in the number of available Notified Bodies compared to the MDD regime, with the exact list evolving in the Commission's NANDO database.

The practical effect for manufacturers was significant during the first years of application, long queues, difficult selection for the most specialised scopes, cost increases. The Commission and the MDCG published several rounds of measures to ease the market, including the extension of MDD certificates via Regulation (EU) 2023/607. The situation has evolved since 2024, but it would be incorrect here to cite a precise figure without sourcing. The live reference remains NANDO, which lists at any given time the NBs designated under MDR with their detailed scope.

Unique Device Identification, UDI

UDI (Unique Device Identification) is one of the two pillars of MDR traceability. Every device receives a unique identifier, structured in two parts:

• UDI-DI (Device Identifier), a static part identifying the model and the manufacturer,
• UDI-PI (Production Identifier), a dynamic part identifying the lot, serial number, manufacturing date or expiry date as applicable.

The UDI must appear on the device label and on every higher level of packaging, both in plain (human-readable) form and in AIDC encoded form (Automatic Identification and Data Capture, typically a GS1, HIBC or ICCBBA barcode). The UDI application timeline is staged by class:

• class III and implantable devices, 26 May 2021,
• class IIa and IIb, 26 May 2023,
• class I, 26 May 2025.

UDI requirements are detailed in Article 27 and Annex VI part C of the MDR. Three agencies are currently designated as UDI-issuing entities, GS1, HIBC and ICCBBA, plus IFA for Germany.

EUDAMED, the European medical devices database

EUDAMED is the centralised database foreseen by Article 33 of the MDR. It comprises six functional modules:

1. registration of actors (manufacturers, ARs, importers),
2. registration of devices (UDI-DI),
3. notified bodies and certificates,
4. clinical investigations and performance studies,
5. vigilance and post-market surveillance,
6. market surveillance.

EUDAMED has been rolled out module by module, with a significant delay against the original MDR timetable. The Commission publishes the status of each module on its dedicated page. The mandatory nature of each module is tied to a Commission notice declaring it fully functional. For up-to-date status, consult the Commission's EUDAMED page directly.

Post-Market Surveillance (PMS) and PSUR

The MDR devotes the whole of Chapter VII (Articles 83 to 86) to post-market surveillance. The manufacturer must put in place a post-market surveillance system proportionate to the risk class, documented in a PMS plan describing information sources, analysis methods and indicators tracked.

For class IIa and above, the manufacturer produces a PSUR (Periodic Safety Update Report). The frequency is annual for classes IIb and III, biennial for class IIa. The PSUR consolidates vigilance data, benefit-risk evolution and corrective actions taken.

For class I, a lighter PMS report is required, updated when necessary.

PSURs for classes IIb and III are filed in EUDAMED and accessible to competent authorities and to the Notified Body. For class IIb implantable and class III, the PSUR assessment by the Notified Body is documented and its report made available to authorities.

§ § §

Clinical evaluation and state of the art (SOTA)

Clinical evaluation is the block that changed the most between MDD and MDR. Article 61 and Annex XIV of the MDR require the manufacturer to produce a structured clinical evaluation, based on:

• own clinical data (clinical investigations conducted by the manufacturer),
• equivalent clinical data (on equivalent devices, with strict criteria of technical, biological and clinical equivalence),
• relevant scientific literature, processed via a documented method.

The concept of state of the art (SOTA) becomes central. The manufacturer must describe available therapeutic alternatives, the expected performance of the standard of care, and position its device against that benchmark. A structured systematic literature review is required, with selection criteria, methodological quality and synthesis.

For implantable and class III devices, Article 61(4) additionally requires specific clinical investigations, subject to strictly framed exceptions (equivalence with a device from the same manufacturer already placed on the market under MDR, identical device with agreement to use its data).

The Clinical Evaluation Report (CER) is a living document, updated by the manufacturer throughout the device lifecycle, fed by PMS and post-market data.

The Person Responsible for Regulatory Compliance (PRRC)

Article 15 of the MDR creates the function of Person Responsible for Regulatory Compliance, abbreviated PRRC. Every manufacturer must have at least one PRRC within its organisation, holding appropriate qualifications (a university degree in law, medicine, pharmacy, engineering or another relevant scientific discipline, plus one year of experience in regulatory affairs or quality management systems in the medical device sector).

For micro and small enterprises within the meaning of Recommendation 2003/361/EC, the PRRC may be outsourced to a consultant available on a permanent basis.

The PRRC is responsible for verifying conformity before each device is released, for establishing the technical documentation, for following up post-market surveillance obligations, and for notifying serious incidents. The Authorised Representative (AR) must also designate its own PRRC.

The Authorised Representative (AR) for non-EU manufacturers

Article 11 of the MDR requires any manufacturer not established in the Union to designate an Authorised Representative (AR) established in the EU by written mandate. The AR is nominatively responsible for:

• verifying that the EU declaration of conformity and the technical documentation have been drawn up,
• keeping the technical documentation and a copy of the declaration available to competent authorities,
• cooperating with competent authorities during corrective actions,
• forwarding to the manufacturer any request from competent authorities,
• registering its mandate in EUDAMED.

The AR's name and address must appear on the device label or in the instructions for use. The AR is legally liable in case of a defective device, jointly with the manufacturer (Article 11(5)).

Transition deadlines: where we stand in 2026

MDR application has been staged. Here are the key markers in the timeline.

• 26 May 2017, entry into force of the regulation, start of progressive application.
• 26 May 2021, date of application of the MDR, which becomes the mandatory regime for new devices.
• 26 May 2022, date of application of the IVDR (Regulation (EU) 2017/746, outside MDR scope).
• 26 May 2024, end of valid MDD certificates as initially planned, postponed by Regulation (EU) 2023/607.
• 31 December 2027, new deadline for valid MDD certificates covering class III devices and class IIb implantable devices (with certain exceptions defined in amended Article 120(3a)).
• 31 December 2028, new deadline for valid MDD certificates covering class IIa, non-implantable class IIb, and class I devices that have been up-classified under MDR.

The extension granted by Regulation (EU) 2023/607 is not automatic. To benefit from it, the manufacturer must:

• hold a valid MDD certificate before 26 May 2024,
• have signed a formal contract with an MDR Notified Body before 26 May 2024,
• have lodged a formal MDR assessment application before 26 September 2024,
• maintain the MDR quality management system in place during the transition period,
• refrain from substantial changes to the device.

The detail of the conditions and exceptions is set out in the corresponding MDCG guidances.

See the certification timeline for project planning and the CE page for the general CE marking framework.

Rule 11, software classification (SaMD)

Rule 11 of Annex VIII specifically concerns software intended to provide information used for diagnostic or therapeutic decisions. The text is dense, the logic in summary:

Software intended purpose	Default class	Up-classification if
Diagnostic or therapeutic decisions	IIa	Death or irreversible deterioration (III), serious deterioration of health (IIb)
Monitoring of physiological processes	IIa	Monitoring of vital parameters where variation could be an immediate danger (IIb)
Other medical purposes	I	No default up-classification

The most visible effect of rule 11 has been the up-classification of a significant share of software previously class I under the MDD. Many mobile applications with a diagnostic or decision-support purpose have moved into class IIa, with mandatory Notified Body involvement, reshaping go-to-market strategies.

The MDCG has published several guidances dedicated to SaMD (MDCG 2019-11 on qualification and classification of software), and IMDRF (International Medical Device Regulators Forum) has produced an internationally recognised reference framework.

Interactions with other EU regulations

A medical device may, depending on its functions, fall simultaneously under the MDR and other texts.

• GDPR (Regulation (EU) 2016/679) for any personal data collected, including health data, which are by nature special category data under Article 9.
• RED (Directive 2014/53/EU) if the device includes a radio part (Wi-Fi, Bluetooth, cellular, NFC), in parallel with the MDR. See the RED pillar for radio in a medical context.
• AI Act (Regulation (EU) 2024/1689) for devices embedding a high-risk AI system, applying cumulatively with the MDR without replacing it.
• Cyber Resilience Act (Regulation (EU) 2024/2847), which explicitly excludes from its scope medical devices covered by the MDR to avoid a double regime, while the MDR's cybersecurity requirements (Annex I section 17.2 on general safety and performance requirements for devices containing software) remain fully in force.
• Product Liability Directive (Directive 85/374/EEC, under recast), which applies independently of the MDR.

For the broader CE marking framework, see the CE procedure, the scope page and the technical file page. The glossary lists key terms (UDI, EUDAMED, Notified Body, EU declaration of conformity, etc.).

§ § §

Common pitfalls observed in the field

Without intending to be an exhaustive implementation guide, several recurring patterns appear in MDCG literature and in industry feedback.

• Underestimated clinical evaluation, especially for devices previously marketed under the MDD with a light clinical file. The MDR transition often forces a systematic literature review and, for class IIb implantable and class III, a dedicated clinical investigation.
• Software classified too low, through an optimistic reading of rule 11. The rule quickly raises the class as soon as a diagnostic or therapeutic decision is involved.
• PMS planned, never executed, the PMS plan is drafted then left inactive. But PSURs are expected on a fixed cadence, and their absence is a non-conformity routinely observed during surveillance audits.
• Authorised Representative designated without real operational mandate, the AR must be able to produce the technical documentation on request by authorities. A purely nominal AR cannot respond, exposing the entire device.
• UDI implemented without consistency between product marking and EUDAMED data, gaps generate validation issues at registration.

Where this overview leads

This page is a Wave 1 overview. The dedicated pages to follow will cover in depth:

• detailed classification by rule (Annex VIII line by line),
• SaMD and rule 11 (IMDRF framework, MDCG 2019-11, worked examples),
• clinical evaluation and the CER (Annex XIV, MDCG 2020-13),
• MDR cybersecurity (Annex I section 17, MDCG 2019-16),
• MDD-to-MDR transition (Article 120, Regulation (EU) 2023/607, related guidances),
• IVDR for in vitro diagnostics (Regulation (EU) 2017/746).

Working on upfront regulatory positioning of a medical product before the MDR file for a real product? AESTECHNO can audit your design and certification plan. Get in touch →

Sources & references

1. Regulation (EU) 2017/745 on medical devices , EUR-Lex eur-lex.europa.eu/eli/reg/2017/745/oj
2. Regulation (EU) 2023/607, extension of transitional provisions , EUR-Lex eur-lex.europa.eu/eli/reg/2023/607/oj
3. MDCG guidance documents , European Commission health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en
4. EUDAMED, the European database on medical devices , European Commission ec.europa.eu/tools/eudamed/
5. NANDO, notified bodies designated under MDR , European Commission ec.europa.eu/growth/tools-databases/nando/
6. IMDRF, reference documents on SaMD , IMDRF www.imdrf.org/