# EU MDR conformity assessment and notified bodies

Which assessment route each device class takes under Article 52, what a notified body checks and how often, and how the declaration and CE mark follow.

Source: https://sted.digital/docs/standards/eu-mdr/conformity-assessment · Last reviewed 17 October 2026 · Strand Standards and regulations

EU MDR Article 52 sets the route by class. Plain Class I devices are self-declared; every other device needs a notified body, usually through EU MDR Annex IX, or EU MDR Annex X with EU MDR Annex XI. You then sign the declaration of conformity (Article 19) and affix the CE mark (Article 20).

## The requirement in plain English

Before you place a device on the market you assess its conformity by one of the procedures in Annexes IX to XI (EU MDR Article 52). Your class decides which.

| Class | Route | What the notified body assesses |
|---|---|---|
| III | Annex IX, or Annex X type examination with Annex XI production checks (EU MDR Article 52(3)) | Your quality management system, and the technical documentation of every device |
| IIb | Annex IX Chapters I and III, or Annex X with Annex XI (EU MDR Article 52(4)) | Your quality management system, and the technical documentation of at least one representative device per generic device group; for implantable IIb devices, every device except the well-established types the regulation lists |
| IIa | Annex IX Chapters I and III, or Annex II and III documentation with Annex XI production checks (EU MDR Article 52(6)) | Your quality management system or production, and the technical documentation of at least one representative device per category |
| I, sterile, measuring or reusable surgical | Self-declaration, plus Annex IX Chapters I and III or Annex XI Part A for those aspects (EU MDR Article 52(7)) | Only sterility, metrology or reprocessing, as applicable |
| I | Self-declaration after drawing up the technical documentation (EU MDR Article 52(7)) | None |
| Custom-made | The Annex XIII statement; Class III custom-made implants also need Annex IX Chapter I or Annex XI Part A (EU MDR Article 52(8)) | Only for Class III custom-made implants |

Delegated Regulation (EU) 2026/1359, in force since 19 July 2026, lengthened the list of implantable Class IIb devices assessed by sample rather than one by one, adding items such as cannulas, catheters, bone fillers and dental implants.

**Expert panel consultation (EU MDR Article 54).** For Class III implants, and Class IIb active devices that give or remove a medicinal product, the notified body also asks an expert panel for its view of your clinical evaluation. It is not needed for a certificate renewal, a modification that does not harm the benefit-risk balance, or a device fully covered by common specifications (EU MDR Article 54(2)).

**Choosing and keeping a notified body (EU MDR Article 53).** You apply to one designated body at a time and disclose earlier withdrawn or refused applications. Certificates last up to five years (EU MDR Article 56(2)).

**Your own side.** A person responsible for regulatory compliance checks each device before release and keeps the technical documentation and declaration current (EU MDR Article 15). The declaration must contain at least the items in EU MDR Annex IV, including the class and the notified body's number, and by signing it you take responsibility for compliance (EU MDR Article 19). The CE mark then carries that number (EU MDR Article 20).

The Commission proposed a targeted revision of the regulation in December 2025. It is a proposal before Parliament and Council, not law.

This is guidance to help you understand the requirement, not legal advice.

## What good looks like

A 30-person company makes Class IIb decision-support software. It chooses the Annex IX route because it already runs a quality management system to ISO 13485, mapped clause by clause to the list in EU MDR Article 10(9).

Its regulatory lead shortlists three notified bodies designated for software in NANDO, asks each for its lead time and fee schedule, and picks one a year before the planned launch. A pre-application call agrees the technical documentation index, structured on Annexes II and III, before anything is submitted.

The quality system audit and the technical documentation assessment run in parallel. Findings are logged as nonconformities with an owner and a due date, and closed with evidence before the certificate is issued. The managing director signs the declaration of conformity, which names the class, the rule applied, the Basic UDI-DI, the notified body and the certificate number.

After launch, a change control procedure asks one question of every change: does it need the notified body's approval before release? Significant software changes are notified in advance. The annual surveillance audit finds the technical documentation updated with the year's post-market data, which is what the notified body looks for first.

## Evidence an auditor expects

- **Quality management system documentation** (required): the notified body audits it against EU MDR Article 10(9), usually alongside an ISO 13485 certificate.
- **Technical documentation** (required): assessed per device or per sample, depending on class.
- **Classification rationale**: the notified body confirms the class before it confirms the route.
- **EU declaration of conformity** (required): checked against the Annex IV contents and against the certificate.
- **Person responsible for regulatory compliance**: named, qualified as Article 15 requires, with duties in writing.
- **Change notifications and approvals**: evidence that substantial changes went to the notified body before release.
- **Closed audit findings**: each nonconformity from earlier audits closed with evidence.

## Common mistakes

### Picking a notified body without checking its designation

A notified body can only certify the device types it is designated for. Check its scope in NANDO for your technology before you sign anything.

### Treating the certificate as the finish line

Surveillance audits come at least every 12 months, and an unannounced visit at least every five years. Run the system as if the auditor arrives next week.

### Changing the device without telling the notified body

A change to design, intended purpose or the quality system that the notified body has not assessed can put the certificate at risk. Build the question "does this need notified body approval?" into every change request.

### A declaration that does not match the certificate

Mismatched device names, classes or Basic UDI-DIs between the declaration, the certificate and the labelling are among the easiest findings to avoid. Generate them from one controlled source.

### A person responsible in name only

Naming a founder without the Article 15 qualifications, or a consultant with no written duties, fails at the first audit. Check the qualification and write the responsibilities down.

## How Sted helps

For ISO 13485 Sted's knowledge base carries 23 policies and procedures and 60 record templates tagged to its clauses, adding to the shared quality set the Post-Market Surveillance and Vigilance Procedure (PRC-PMSV), Sterility and Cleanroom Controls (PRC-SCC), Software Development Lifecycle (PRC-SDLP), Software Maintenance (PRC-SWMAINT), Usability Engineering (PRC-UEP), Incident Management (PRC-IMP), Traceability and Identification (PRC-TRID), Control of Monitoring and Measuring Devices (PRC-CMMD) and Validation of Non-Product Software (PRC-VNPS), with record templates such as the Design and Development Plan (REC-DDPL), Design Review Record (REC-DRR), Verification and Validation Record (REC-VVR), Design Transfer Record (REC-DTR), UDI Assignment Record (REC-UDI), Medical Device Risk Management File (REC-MDRM), Post-Market Surveillance Plan (REC-PMS), Periodic Safety Update Report (REC-PSUR) and Medical Device Incident Record (REC-MDI), and a 29-row clause catalogue.
An administrator, or a Policy and Process Owner who owns the document, approves a Draft or starts a new version of an Approved one, and only an administrator assigns a document's owner; a document still awaiting review cannot be approved.
Each revision records "Why this revision" and the changes; the PDF ends with a revision history of approved versions.
Administrators and a document's owner can open superseded versions from History.
You can export a document or record as a PDF on any paid plan.
PDF export is not part of the Preview plan.

Sted does not assess conformity, issue certificates or sign a declaration of conformity. A notified body assesses the device and the manufacturer signs.

## Related guides and terms

- [EU MDR](/docs/standards/eu-mdr): where conformity assessment sits among the regulation's chapters.
- [EU MDR device classification](/docs/standards/eu-mdr/classification): the class that decides your route.
- [EU MDR technical documentation](/docs/standards/eu-mdr/technical-documentation): the file the notified body assesses.
- [ISO 13485 quality management system](/docs/standards/iso-13485/quality-management-system): the system the Annex IX audit tests.
- [UK MDR 2002 and UKCA marking](/docs/standards/uk-mdr-2002): Great Britain uses UK approved bodies, which cannot issue CE certificates.
- [Nonconformity](/docs/glossary/nonconformity): how audit findings are raised and closed.

## Frequently asked questions

Q: How do I choose a notified body for EU MDR?
A: Start from the Commission's NANDO database and shortlist bodies designated under EU MDR for your device type and technology, such as software or active implantables. Then compare their lead times, fees and experience with devices like yours. You may apply to only one notified body at a time for the same procedure, and you must tell it about any earlier application you withdrew or that was refused.

Q: Can a startup be its own person responsible for regulatory compliance?
A: Yes, if someone on the team holds the qualifications in Article 15. A micro or small enterprise may instead have an external person permanently and continuously at its disposal, often a regulatory consultant on contract. The duties include checking each device before release and making sure vigilance reports are filed.

Q: How long is an EU MDR certificate valid?
A: Up to five years, as the certificate states, and it can be renewed for further periods of up to five years after a re-assessment. During that time the notified body audits you at least once every 12 months and makes an unannounced visit at least once every five years.