EU MDR

EU MDR is the law a medical device must meet before it is placed on the market in the EU or Northern Ireland. It binds manufacturers first, then authorised representatives, importers and distributors. It is enforced rather than certified: you assess your device’s conformity, usually with a notified body, sign a declaration of conformity and affix the CE mark.

What it is and who it applies to

The formal designation is Regulation (EU) 2017/745 on medical devices. It has applied since 26 May 2021, replacing the Medical Device Directive and the Active Implantable Medical Device Directive, and as a regulation it applies directly in every Member State. The consolidated text of 19 July 2026 includes the 2023 extension of the transition, the 2024 rules on supply interruptions and Eudamed, and two delegated regulations of 2026 that widen the lists of well-established implantable devices exempt from some assessments.

It reaches any product that meets the device definition in EU MDR Article 2: an instrument, implant, software or other article intended by its manufacturer for a medical purpose such as diagnosis, monitoring, prediction or treatment, that does not work mainly by pharmacological, immunological or metabolic means. In vitro diagnostics fall under a separate regulation, EU IVDR.

The manufacturer carries most of the obligations (EU MDR Article 10): a risk management system, a clinical evaluation, technical documentation, a quality management system (EU MDR Article 10(9)), post-market surveillance and a person responsible for regulatory compliance. A manufacturer outside the EU appoints an authorised representative. Importers and distributors check what they receive. Under the Windsor Framework the same rules apply in Northern Ireland.

Devices certified under the old directives may still be placed on the market under EU MDR Article 120, until 31 December 2027 or 31 December 2028 depending on class (paragraph 3a), if the conditions in paragraph 3c were met. Those devices already follow EU MDR’s surveillance and vigilance rules (paragraph 3d). The Commission’s December 2025 proposal for a targeted revision is a proposal, not law.

This is guidance to help you understand the requirement, not legal advice.

Structure

The regulation has 123 articles in ten chapters and 17 annexes. Most readers meet it in the order a device does: what it is, which class, what evidence, which assessment, then life on the market. The table paraphrases each part.

The quality management system is not spelt out clause by clause. EU MDR Article 10(9) lists what it must cover, and the harmonised edition of ISO 13485 is the recognised way to meet it, so most manufacturers run one system for both.

Certification and enforcement

EU MDR is not a certificate you hold; it is a law you comply with. The proof is your declaration of conformity and the CE mark, backed for most devices by a notified body’s certificates.

The class decides the route (EU MDR Article 52). A plain Class I device is self-declared. A Class I device that is sterile, measures or is a reusable surgical instrument, and every Class IIa, IIb and III device, needs a notified body. The usual route is the one in EU MDR Annex IX: an audit of your quality management system plus an assessment of technical documentation, sampled per category or group for Class IIa and most Class IIb, and per device for Class III and most Class IIb implantables. Certificates last up to five years (EU MDR Article 56(2)). The notified body audits at least once every 12 months and makes an unannounced visit at least once every five years.

Notified bodies are designated by Member States for specific device types and listed in the Commission’s NANDO database. They check you; they do not enforce the law.

Enforcement belongs to each Member State’s competent authority, such as BfArM in Germany or the HPRA in Ireland. Under EU MDR Article 93 it reviews documentation, takes samples and inspects premises, announced or not. Action usually starts from a vigilance report, a complaint, a notified body’s finding or a planned campaign. The tools escalate: a request for documents or corrective action, then measures to restrict, withdraw or recall a device that presents an unacceptable risk (EU MDR Article 95). Penalties are set by each Member State, not by the regulation (EU MDR Article 113).

How the pieces fit

The chapters form a loop around one device. You first decide that the product is a device (EU MDR Article 2), then classify it under EU MDR Annex VIII. The class sets how much evidence you need and who checks it. You build that evidence inside a quality management system: risk management, the general safety and performance requirements of EU MDR Annex I, and a clinical evaluation under EU MDR Article 61 and EU MDR Annex XIV. The technical documentation of EU MDR Annex II and EU MDR Annex III holds all of it. A notified body assesses it where the class requires, you sign the declaration and affix the CE mark, and post-market surveillance (EU MDR Article 83) and vigilance (EU MDR Article 87) begin.

The dashed line is the part manufacturers underestimate. What surveillance finds must flow back into the risk file, the clinical evaluation and the technical documentation, and the notified body checks that it did at every surveillance audit.

In this section

• Device classification: which of the four classes is your device in, and how does Rule 11 treat software?
• Conformity assessment and notified bodies: which route does your class take, and what does the notified body check?
• Technical documentation: what goes in the Annex II and III file, and how do the safety and performance requirements tie it together?
• Clinical evaluation: how much clinical evidence do you need, and when can you rely on equivalence?
• Post-market surveillance and vigilance: what must you monitor and report once the device is on the market, and how fast?

Great Britain follows its own rules; see UK MDR 2002 and UKCA marking. The quality system underneath both is ISO 13485, with ISO 14971 for risk management, IEC 62304 for device software and IEC 62366-1 for usability.

How Sted maps it

EU MDR is one of the standards and regulations in Sted’s catalogue.

Sted treats it as applying when a product qualifies as a medical device, you intend to sell it in the EU or Northern Ireland, and you hold an economic-operator role for it, or when you run an EU clinical investigation or rely on the Article 120 transition. A manufacturer role brings in ISO 13485, ISO 14971, IEC 62366-1 and IEC 62304, and a product whose answers are still missing reads as pending, not as out of scope. Those rules, and the device’s class, are worked out from your recorded answers; the AI model does not decide them.

For each device product Sted shows the regulation, the class and the rule that produced it, with the reasoning, for the EU and Northern Ireland and for the other markets it supports. The classification remains your legal determination under EU MDR Article 51, which your notified body checks. See how Sted decides what applies to you.

Sted recommends the regulation with its reasons, and you select it or remove it. Administrators and Policy and Process Owners make that choice. Pressing Update and generate framework builds the documents it needs.

The EU MDR set in Sted’s knowledge base is led by the Clinical Evaluation and PMCF Procedure and the Post-Market Surveillance and Vigilance Procedure, with the surveillance plan, the periodic safety update report and the device incident record. The quality-system, design and traceability records come through ISO 13485. Each is drafted for your organisation for you to review and approve. Audit readiness shows how much of that work is done.

Sted does not classify your device legally, assess conformity, sign your declaration or report to a competent authority. Your notified body and your regulator do those things, with you.

Frequently asked questions