1. Introduction to the MDR:

The regulatory landscape for medical devices in Europe underwent a significant transformation with the introduction of Regulation (EU) 2017/745, commonly known as the Medical Devices Regulation (MDR). This regulation was published on May 5, 2017, and officially came into force on May 25, 2017.¹ However, the date on which it became mandatory for all medical devices placed on the European market was May 26, 2021.¹ This transition marked the repeal of the previous regulatory frameworks, namely the Medical Devices Directive (93/42/EEC, MDD) and the Active Implantable Medical Devices Directive (90/385/EWG, AIMDD).¹ It is important to note that even after its initial entry into force, the MDR was subject to certain corrections and amendments.⁴

Recognizing the substantial changes required for manufacturers to comply with the new regulation, transitional provisions were established. These provisions allow for the continued market access of devices that were certified under the former directives, provided certain conditions are met. The deadlines for these transitional arrangements extend until December 31, 2027, or December 31, 2028, with the specific date depending on the risk classification of the medical device.⁵ This extended timeframe underscores the complexity and the scale of adaptation needed across the medical device industry to meet the more rigorous demands of the MDR.

The implementation of the MDR signifies a notable shift in the European approach to medical device regulation. Moving from a directive-based system to a regulation implies a more direct and uniformly applicable set of rules across all member states of the European Union. This change aims to reduce variations in how the rules are interpreted and enforced, thereby fostering a more consistent regulatory environment. The extended transition periods provided to manufacturers suggest an acknowledgment by regulatory bodies of the significant overhauls required in their compliance processes and the capacity of Notified Bodies to handle the increased workload. Furthermore, the fact that the In Vitro Diagnostic Medical Devices Regulation (IVDR) has a similar implementation timeline indicates a broader strategic initiative by the European Union to modernize the entire regulatory framework governing medical devices, encompassing both those used for treatment and those used for diagnosis.

• Overarching Objectives: Safety, Quality, Transparency:

The primary goals of the MDR are centered on enhancing the quality, safety, and reliability of all medical devices available within the European market.¹ This encompasses a commitment to ensuring that devices perform as intended and do not compromise the health or safety of patients or users.⁷ A key aspect of this is the strengthening of transparency concerning information related to medical devices, making it more accessible to both consumers and healthcare professionals.¹ This increased transparency is intended to empower stakeholders to make better-informed decisions regarding the use of medical devices.

Another critical objective of the MDR is to enhance the vigilance and market surveillance of medical devices that are already in use.¹ This includes establishing more robust systems for monitoring the performance and safety of devices throughout their lifecycle, from initial placement on the market to their eventual withdrawal.⁸ The regulation aims to protect public health and patient safety by establishing a more rigorous and comprehensive regulatory framework compared to the previous directives.⁴ Furthermore, the MDR seeks to reduce the occurrence of medical errors and to actively combat the presence of falsified medical devices within the supply chain.³

The introduction of the Unique Device Identification (UDI) system under the MDR also serves several important objectives. Beyond improving the traceability of medical devices, the UDI system is intended to facilitate more effective post-market safety-related activities, allowing for better monitoring by competent authorities.³ This system is also expected to improve the efficiency of purchasing and waste disposal policies, as well as the stock management practices of health institutions and other economic operators involved in the medical device sector.³ The emphasis on transparency within the MDR framework indicates a significant move towards greater accountability for manufacturers. By making more information about device safety, performance, and market access publicly available through initiatives like the Eudamed database, the regulation aims to foster trust and enable more effective post-market surveillance. The inclusion of objectives related to purchasing and waste disposal highlights the broader societal impact that the MDR seeks to address, extending beyond the immediate concerns of patient safety to encompass the efficiency and sustainability of healthcare systems.

• Relationship with Previous Directives (MDD, AIMDD):

The MDR represents a significant evolution from the previous directives, the MDD and AIMDD, which it now replaces.¹ While the MDR supersedes these earlier frameworks, it is important to understand that the new regulation does not simply eliminate prior requirements. Instead, it builds upon them, introducing several significant changes and imposing additional obligations on manufacturers and other stakeholders.⁴ Notably, the scope of the MDR is considerably broader than that of the MDD, encompassing a wider array of products.⁴

Unlike the MDD, which primarily focused on the requirements for placing a medical device on the market, the MDR adopts a more comprehensive perspective by considering the entire product lifecycle.¹¹ This shift reflects a growing recognition of the importance of monitoring and ensuring the safety and performance of medical devices throughout their use, not just at the point of initial market entry. The impetus behind the transition from the MDD to the MDR was multifaceted. Several factors contributed to the need for a revised regulatory framework, including the occurrence of medical device safety scandals that underscored the limitations of the existing directives.¹² Furthermore, the varied interpretations of the MDD across different EU member states led to inconsistencies in its application and enforcement.¹² The limitations of the ISO 13485 standard, while important for quality management, in fully addressing the evolving regulatory needs of the medical device sector also played a role.¹² Finally, challenges in effectively monitoring compliance with medical device regulations under the old directives highlighted the necessity for a more robust and proactive approach.¹² The MDR, therefore, is not just an incremental update but a fundamental overhaul of the previous regulatory framework. It aims to address the identified weaknesses of the MDD and AIMDD by establishing a more comprehensive, stringent, and proactive system for regulating medical devices, ultimately prioritizing patient safety and public health.

2. Defining the Scope:

• Broad Range of Covered Medical Devices:

The European Medical Device Regulation (MDR) casts a wide net, applying to virtually all medical devices intended for sale within the European Union.¹² This includes a vast spectrum of products, ranging from everyday, low-risk items such as bandages and stethoscopes to highly complex and critical devices like pacemakers and prosthetic heart valves.¹² Significantly, the scope of the MDR is considerably broader than that of its predecessor, the Medical Device Directive (MDD).⁴ The MDR explicitly extends its reach to include all devices used for the cleaning, sterilization, or disinfection of other medical devices, as well as reprocessed single-use medical devices.⁴ Furthermore, it encompasses certain devices that do not have a direct medical purpose but nonetheless affect health, such as colored contact lenses and cosmetic implant devices, which are specifically listed in Annex XVI of the regulation.⁴

The MDR also brings under its purview devices that are designed for the purpose of predicting or forecasting the course of a disease or other health conditions.¹⁵ This inclusion acknowledges the growing role of technology in preventive healthcare and the need to ensure the safety and performance of such predictive tools. In recognition of the evolving marketplace, the MDR explicitly clarifies that its requirements apply to medical devices and related services that are offered for sale via the internet or other means of distance selling.⁴ This provision ensures that consumers purchasing medical devices online are afforded the same level of protection as those buying through traditional channels. The expanded scope of the MDR demonstrates a clear intention to regulate a wider array of products that have a potential impact on health, irrespective of their conventional medical classification or the method through which they are made available to consumers.

• Inclusions and Exclusions:

While the MDR is characterized by its broad scope, certain exceptions and specific inclusions are noteworthy. Generally, custom-made devices, which are specifically manufactured to meet a named patient's individual condition and needs, and devices intended for use in clinical trials are excluded from the Unique Device Identification (UDI) system requirements.³ However, these devices are still subject to other relevant provisions of the MDR. Moreover, the MDR explicitly applies to active implantable medical devices, along with their accessories, and these are now classified under the highest risk category, Class III.¹¹ This reclassification reflects the critical nature of these devices and the potential risks associated with their use, necessitating the most stringent levels of regulatory oversight.

• Classification Rules (Annex VIII): Overview and Hierarchy:

A cornerstone of the EU MDR is its robust system for classifying medical devices, designed to ensure their safety and efficacy.¹⁷ Manufacturers bear the primary responsibility for correctly determining the classification of their products based on the comprehensive set of rules outlined in Annex VIII of the regulation.¹⁷ This classification process is fundamental, as it dictates the level of regulatory scrutiny and the specific conformity assessment procedures that a device must undergo before it can be placed on the European market.¹⁸ The classification of a medical device is determined by several factors, including its intended medical purpose, the inherent characteristics of the device itself, and the level of risk it poses to patients and users.¹⁷ Devices that are deemed to have a higher risk profile are subject to more stringent regulatory controls and a more rigorous conformity assessment process.¹¹

The MDR significantly expands upon the classification framework of the previous MDD, increasing the number of classification rules from 18 to 22.¹¹ These rules are applied in a hierarchical manner, meaning that if a device could potentially fall under multiple classification rules, the rule that assigns it to the highest risk class will take precedence.¹⁹ The criteria for classification encompass various aspects of a device, such as the duration of its use (categorized as transient, short-term, or long-term), the degree of its invasiveness (ranging from non-invasive to surgically invasive), and whether it is an active device (relying on an energy source) or a non-active device.¹¹ Furthermore, the MDR includes specific rules tailored to certain categories of devices, including medical device software (addressed by Rule 11), diagnostic devices, implantable devices, devices incorporating nanomaterials (Rule 19), and devices composed of substances (Rule 21).⁴ The increase in the number and specificity of these classification rules under the MDR reflects a move towards a more nuanced and risk-based approach to categorizing medical devices, ensuring that the intensity of regulatory oversight is appropriately matched to the potential risks associated with each type of device.

• Device Classes (I, IIa, IIb, III) and Their Characteristics:

The EU MDR categorizes medical devices into four distinct classes based on their perceived risk level: Class I, Class IIa, Class IIb, and Class III.¹¹ Class I represents the lowest risk category and includes devices that pose a minimal risk to users and patients, such as surgical drapes, many surgical instruments like tweezers, latex gloves, masks, wheelchairs without motors, stethoscopes, bandages, and spectacles.¹³ In many instances, manufacturers can self-certify Class I devices, meaning they can declare conformity without the mandatory involvement of a Notified Body. However, there are three sub-classifications within Class I that have a slightly higher perceived risk and require Notified Body intervention for specific aspects: Class Is (devices that must be presented sterile), Class Im (devices with a measuring function), and Class Ir (reusable surgical instruments).¹³

Class IIa devices are considered to have a moderate level of risk and require the involvement of a Notified Body in the conformity assessment process.¹³ Examples of devices in this class include catheters, hearing aids, and short-term contact lenses.¹³ Class IIb devices are classified as medium- to high-risk and necessitate more comprehensive conformity assessments that also require the participation of a Notified Body.¹³ This category includes devices such as incubators, insulin pens, long-term contact lenses, and ventilators, as well as devices that administer or remove medicinal products or therapeutic substances.¹³ Class III devices represent the highest risk category and encompass devices with the greatest complexity and potential for harm.¹³ These devices, such as pacemakers, prosthetic heart valves, surgical mesh, and breast implants, require the most stringent regulatory controls and thorough scrutiny by Notified Bodies, often including clinical evaluation.¹³

It is important to note that under the MDR, some devices have been reclassified into different risk categories compared to the previous MDD, and certain device types are being classified for the first time.¹¹ For instance, all active implantable devices and their accessories are now classified as Class III under the MDR.¹¹ Generally, the higher the risk class of a medical device, the more extensive and rigorous the regulatory requirements that the manufacturer must adhere to throughout the device's lifecycle.¹¹ This risk-based classification system ensures that the level of regulatory control is proportionate to the potential harm that a device could pose to patients and users, with the most critical devices undergoing the most thorough and continuous oversight.

3. Navigating Conformity Assessment:

• General Principles of Conformity Assessment:

The conformity assessment process is a fundamental aspect of the European Medical Device Regulation (MDR), serving as the mechanism to demonstrate whether all the requirements of the regulation pertaining to a medical device have been fulfilled.²⁰ Before any medical device can be legally placed on the market within the European Union, it must undergo a conformity assessment that yields a positive outcome, confirming its compliance with the MDR's stipulations.²¹ The MDR meticulously outlines the specific conformity assessment procedures that are applicable to different types and classes of medical devices in its Annexes IX, X, and XI.²¹ This assessment process is designed to verify that a medical device meets the stringent standards and regulations set forth by the EU MDR 2017/745.¹⁸

Evidence of conformity, obtained through this rigorous evaluation, provides assurance to regulatory authorities, healthcare professionals, patients, and users that the device is safe for its intended purpose, performs effectively, and has been designed and manufactured to meet the specific regulatory criteria established by the MDR.¹⁸ For any medical device to be commercially available within the European Economic Area (EEA), it must bear the CE mark. This mark is a visual declaration by the manufacturer that the device complies with all the essential regulatory standards, particularly those mandated by the EU MDR.¹⁸ The presence of the CE mark on a medical device signifies that it has been subjected to thorough testing and evaluation processes to ensure its quality, safety, and effectiveness for its intended use.¹⁸ The conformity assessment process, therefore, acts as a critical gatekeeper, ensuring that only medical devices that meet the high standards of the MDR can access the European market, thereby safeguarding public health and patient well-being.

• Role of Risk Classification in Determining the Route:

The risk classification assigned to a medical device, which as discussed earlier ranges from Class I (low risk) to Class III (high risk), plays a pivotal role in determining the specific conformity assessment route that the manufacturer must follow.¹⁸ The MDR employs a risk-based approach, meaning that the level of regulatory control and the intensity of the conformity assessment are directly proportional to the potential risk associated with the device.¹¹ Higher-risk devices, such as those in Class IIb and Class III, are subjected to more stringent conformity assessment procedures and a greater degree of scrutiny by regulatory bodies and Notified Bodies compared to lower-risk devices in Class I and Class IIa.¹¹

This risk-based strategy ensures that the resources and efforts involved in the conformity assessment process are appropriately aligned with the potential harm that a device could cause if it were to malfunction or fail to perform as intended. By tailoring the requirements for conformity assessment to the specific risk class of the device, the MDR aims to create a more efficient and targeted regulatory system. This approach avoids imposing unnecessary burdens on manufacturers of low-risk devices, where the potential for harm is minimal, while simultaneously ensuring that high-risk devices, which could have significant implications for patient safety, undergo a thorough and comprehensive evaluation before they can be placed on the market.

• Detailed Steps in the Conformity Assessment Procedure:

The conformity assessment procedure under the EU MDR involves a series of detailed steps that manufacturers must undertake to demonstrate that their medical devices comply with the regulation's requirements.¹⁸ These steps are designed to ensure a thorough evaluation of the device's safety and performance.

The initial and crucial step is the preparation of comprehensive technical documentation.¹⁸ Manufacturers are required to compile a detailed technical file that includes all relevant information about the device, such as its design specifications, manufacturing processes, and the data from all tests conducted to demonstrate its safety and performance.¹⁸ Annexes II and III of the MDR specify the precise content and structure of this technical documentation.¹⁸ Following this, every medical device must undergo a thorough risk management process to identify and evaluate potential hazards and associated risks throughout its lifecycle, as well as a clinical evaluation to assess the device's performance and safety for its intended medical purpose.¹⁸

Depending on the risk classification of the device, the involvement of a Notified Body, an independent third-party assessment organization, may be necessary.¹⁸ Notified Bodies are accredited to assess specific categories of medical devices. Manufacturers have the option to select a Notified Body that is accredited for their particular type of device.¹⁸ The Notified Body will then conduct a thorough review of the manufacturer's technical documentation, and in many cases, will also perform audits of the manufacturer's quality management system and processes.¹⁸ If the Notified Body is satisfied that the device meets the requirements of the MDR, it will issue the necessary conformity certificates.¹⁸ This certification then authorizes the manufacturer to affix the CE mark to their device.¹⁸ The CE mark indicates that the device complies with all applicable EU regulations and can be legally marketed within the European Economic Area (EEA).¹⁸

Finally, even after a device has been placed on the market, manufacturers are obligated to implement a robust post-market surveillance (PMS) system.¹⁸ This system is designed to continuously monitor the device's performance in real-world use, gather feedback from users, and address any issues that may arise, ensuring the ongoing safety and compliance of the medical device throughout its lifecycle.⁸ The entire conformity assessment process typically involves several stages, including the submission of an application to a Notified Body, a completeness check of the submitted documents, a detailed technical review, and a clinical review.²³ It is not uncommon for multiple rounds of questions and responses between the manufacturer and the Notified Body to occur during these reviews.²³ This iterative process ensures that all aspects of the device are thoroughly evaluated before CE marking is granted.

• The Crucial Role of Notified Bodies: Designation and Responsibilities:

Notified Bodies hold a pivotal position within the European medical device regulatory framework. A Notified Body is an organization that has been officially designated by an EU Member State to assess the conformity of specific products, including medical devices, before they are allowed to be placed on the market.²⁴ These organizations are authorized to carry out conformity assessment procedures in instances where the applicable legislation, such as the MDR, requires the intervention of an independent third party.²⁴ To achieve the status of a Notified Body, a candidate organization must meet a rigorous set of specific requirements that pertain to its organizational structure, quality management system, available resources, and operational processes. These criteria are thoroughly verified by the national authorities responsible for Notified Bodies, often with the involvement of experts from other European countries.²⁴ The European Commission maintains a publicly accessible list of all designated Notified Bodies within a system known as NANDO (New Approach Notified and Designated Organisations).²⁴ This system allows manufacturers to identify bodies that are accredited for the specific types of medical devices they produce.

The responsibilities of Notified Bodies under the MDR are extensive. They are tasked with assessing a manufacturer's quality management system, scrutinizing the technical documentation pertaining to their devices, and often directly evaluating the devices themselves to ensure compliance with all the requirements stipulated in the MDR.²⁴ If a Notified Body determines that a manufacturer and their medical device meet the necessary standards, it will issue a certificate of conformity. This certificate is essential as it allows the manufacturer to affix the CE marking to their device, thereby enabling them to market and sell it within the European Union.²⁴ Furthermore, Notified Bodies are not involved only in the initial certification process; they also conduct periodic surveillance audits of manufacturers and their devices to ensure that ongoing compliance with the MDR is maintained throughout the product's lifecycle.²⁴

For Class I medical devices that fall under the sub-categories of sterile devices (Class Is), devices with a measuring function (Class Im), or reusable surgical instruments (Class Ir), a Notified Body is required to be involved, albeit for specific aspects related to these characteristics.¹⁴ For medical devices classified as Class IIa, Class IIb, and Class III, the involvement of a Notified Body in the conformity assessment process is mandatory.²⁵ Notified Bodies are expected to maintain open lines of communication with competent authorities, regularly reporting on their assessments and the certificates they have issued.²⁶ They are also held to a high standard of competence, ensuring that their staff possess the necessary skills and training to conduct thorough and accurate conformity assessments.²⁶ It is important for manufacturers to note that they cannot submit parallel applications to multiple Notified Bodies for the same conformity assessment procedure related to a specific device.²⁵ The independent oversight provided by Notified Bodies is a critical element of the MDR, ensuring that medical devices, particularly those with higher risk profiles, meet the stringent standards for safety and performance before they can be made available to patients in the European market.

• Overview of Conformity Assessment Routes (Annex IX, X, XI):

The European Medical Device Regulation (MDR) provides a selection of conformity assessment routes that manufacturers can utilize to demonstrate compliance, as detailed in Annexes IX, X, and XI of the regulation.²¹ Each of these routes has specific requirements regarding the technical documentation that must be prepared and the quality management system (QMS) that the manufacturer must have in place.²³

Annex IX outlines the conformity assessment based on a Quality Management System and an assessment of the Technical Documentation.²⁰ This is a commonly chosen route, especially for manufacturers who have already implemented a QMS that is compliant with ISO 13485 standards.²⁰ The process under Annex IX involves a Notified Body conducting an audit of the manufacturer's QMS to ensure it meets the requirements of the MDR, as well as a review of the technical documentation for the medical device.²⁹ For devices classified as Class III, the Notified Body is required to examine the complete technical documentation for each individual product.²⁹

Annex X describes the conformity assessment based on type examination.²⁹ This route is often used in conjunction with Annex XI for Class III and Class IIb implantable devices. It involves the Notified Body assessing the design documentation and the results of tests performed on a representative sample of the device to verify that it meets the requirements of the MDR.²⁹ Upon successful examination, the Notified Body issues a type examination certificate.

Annex XI details the conformity assessment based on product conformity verification.²² This annex is typically applicable to Class IIb and Class III devices. It offers two options: Option A, which focuses on production quality assurance, where the Notified Body assesses the manufacturer's quality system for production, final product inspection, and testing; and Option B, which involves product verification, where the Notified Body examines and tests each individual product or a representative batch to confirm its conformity with the approved type and the requirements of the MDR.²² Annex XI can also be used in combination with Annex X or with the technical documentation (Annexes II and III) for medical devices that fall into lower risk classes.²²

For Class I devices, the conformity assessment typically involves self-certification by the manufacturer, with the exception of Class Is, Im, and Ir devices. These sub-classifications of Class I require limited involvement of a Notified Body, specifically for the aspects related to sterility, measuring function, or reusability of surgical instruments.¹⁴ For Class IIa devices, manufacturers have the choice between pursuing a full QMS assessment under Annex IX or selecting a route based on production control under Annex XI, in addition to preparing the necessary technical documentation as specified in Annexes II and III.²² Manufacturers of Class IIb devices can opt for Annex IX, which includes a comprehensive review of their QMS and technical documentation, or they can choose a combination of Annex X (type examination) and Annex XI (product conformity verification).²² Notably, for implantable Class IIb devices (excluding certain well-established technologies), every device must undergo a technical documentation assessment as part of the Annex IX procedure.²¹ For the highest risk devices, Class III, manufacturers can either follow the Annex IX route, which involves a thorough assessment of their QMS and technical documentation, or they can opt for the Annex X (type examination) and Annex XI (product conformity verification) pathway.²² The variety of conformity assessment routes provided by the MDR allows manufacturers to select the most appropriate method based on the risk classification of their device, their existing quality management system capabilities, and the specific characteristics of their products, while still ensuring that all medical devices undergo a rigorous evaluation process commensurate with their potential risk.

Key Table for Section 3: