EU MDREU Medical Device Regulation (2017/745)

Regulation (EU) 2017/745 — the Medical Device Regulation — is the legal framework that governs the placing on the market and putting into service of medical devices in the European Union. It entered into force on 25 May 2017, applied from 26 May 2021, and replaced two prior directives: 93/42/EEC (the Medical Device Directive, MDD) and 90/385/EEC (the Active Implantable Medical Device Directive, AIMDD). It is a Regulation, not a Directive, meaning it applies directly in every Member State without national transposition — the legal text is the law.

MDR raised the bar across almost every dimension of the prior regime: scope (now explicitly covers software, certain non-medical-purpose products listed in Annex XVI such as coloured contact lenses, and reprocessed single-use devices); classification (Annex VIII rules pushed many devices up by one class); clinical evidence (Article 61 + Annex XIV require demonstrable clinical data, not literature pointers); technical documentation (Annex II + III specify exhaustive content); transparency (EUDAMED registration of devices, certificates, clinical investigations, vigilance and PMS); post-market surveillance (Articles 83-86 made PMS a planned, continuous, document-based process); and economic-operator accountability (Articles 10-16 placed legal obligations on the manufacturer, authorised representative, importer and distributor).

Article 2 defines a 'medical device' broadly — any instrument, apparatus, appliance, software, implant, reagent, material or other article intended by the manufacturer to be used for medical purposes including diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease, injury or disability. Annex XVI extends the scope to specific products without an intended medical purpose (e.g. coloured contact lenses, dermal fillers, equipment for liposuction, intense pulsed light devices). MDR explicitly includes standalone software as a medical device (SaMD); MDCG 2019-11 explains the qualification and classification logic.

MDR introduces 'economic operators' — Articles 10-16 — and assigns each a defined set of legal obligations. The manufacturer (Article 10) holds primary responsibility for conformity. The authorised representative (Article 11) is the manufacturer's legal proxy for non-EU manufacturers and is jointly liable for defective devices. The importer (Article 13) must verify CE marking, declaration of conformity, UDI, labelling and authorised representative designation before placing on the EU market. The distributor (Article 14) must verify the same documentation as part of due diligence and act on suspected non-conformities. Each operator must keep records of complaints, non-conforming devices and recalls, and cooperate with competent authorities.

PRRC — Person Responsible for Regulatory Compliance (Article 15). Every manufacturer (and authorised representative) must permanently have at least one PRRC with documented qualifications. The PRRC ensures conformity of devices is checked before release, technical documentation and the EU declaration of conformity are drawn up and kept up to date, PMS obligations are complied with, vigilance reporting is fulfilled, and clinical-investigation obligations are met. For micro and small enterprises the PRRC can be external but permanently and continuously available.

Annex VIII contains 22 classification rules organised by device type (non-invasive, invasive, active, special rules) that allocate every device to Class I, IIa, IIb or III. The class drives the conformity-assessment route (Annex IX / X / XI), the depth of clinical evidence required, the level of Notified Body involvement, the post-market surveillance intensity and the PSUR cadence. Many devices moved up one class versus MDD — most notably substance-based devices that act locally on the body (Rule 21), software (Rule 11 pushed most diagnosis/therapy software to IIa or higher), and reusable surgical instruments (Class I but now requires Notified Body audit for the reprocessing aspect).

MDR was originally fully applicable from 26 May 2020; that date was postponed by one year to 26 May 2021 by Regulation (EU) 2020/561 due to COVID-19. The original MDR transition allowed devices with valid MDD/AIMDD certificates to remain on the market until 26 May 2024. Notified Body capacity, however, was insufficient to certify the backlog before that date; Regulation (EU) 2023/607 (the 'MDR amendment') extended the transition again — under conditions — to 31 December 2027 for Class III and Class IIb implantables, and 31 December 2028 for Class IIb non-implantables, Class IIa, Class Im / Is / Ir, and Class I devices that became reclassified upward.

The conditions for benefitting from the extension are explicit and inspectable: the device must continue to comply with the MDD/AIMDD; no significant changes in design or intended purpose; manufacturer has a QMS compliant with MDR by 26 May 2024; manufacturer or authorised representative has lodged a formal application for MDR conformity assessment with a Notified Body by 26 May 2024; and a written agreement with the Notified Body by 26 September 2024. The reprieve is not automatic — manufacturers that did not meet the application deadlines have lost the right to continue selling on the legacy certificate.

Annex II + III specify the technical documentation contents in exhaustive detail. Annex II covers the device description, manufacturer information, intended purpose, design and manufacturing information, general safety and performance requirement (GSPR) checklist, benefit-risk and risk-management documentation, product verification and validation, including pre-clinical, clinical and post-market data. Annex III covers the technical documentation on PMS — PMS plan, PSUR, PMCF and the relevant reports.

The structure that Notified Bodies expect:

• Device description and specification — variants, accessories, intended purpose, indications, contraindications, target populations.
• Information to be supplied by the manufacturer — label, IFU, packaging, training materials.
• Design and manufacturing information — design controls outputs, manufacturing-process flow, sites, suppliers (especially critical suppliers).
• GSPR matrix — Annex I requirements with the manufacturer's justification of applicability, the method used to demonstrate conformity, references to the controlled documents that evidence conformity.
• Benefit-risk analysis and risk management — the ISO 14971 RMF.
• Product verification and validation — bench, biocompatibility (ISO 10993), electrical safety (IEC 60601 family), EMC (IEC 60601-1-2), software (IEC 62304), usability (IEC 62366), animal data, clinical evaluation report (CER) per MEDDEV 2.7/1 rev 4 superseded by MDCG-aligned templates.
• Annex III — PMS plan, PSUR (Class IIa+), PMCF plan and evaluation report.
• EU declaration of conformity (Article 19, Annex IV).
• References to the QMS and to the controlled documents that contain the underlying records.

Annex I contains 23 General Safety and Performance Requirements grouped into three chapters: General requirements (§1-9), Requirements regarding design and manufacture (§10-22), and Requirements regarding the information supplied with the device (§23). Every requirement applies to every device unless the manufacturer can justify non-applicability. The standard inspection deliverable is the 'GSPR matrix' — a row per requirement with columns for applicability (yes/no with rationale), the method used to demonstrate conformity (standard, internal test, clinical data, justification), the relevant harmonised standard (with year and clause), and the references into the technical documentation that evidence conformity.

Hot-button GSPRs: §3 risk management (the chronological hook for ISO 14971); §5 ergonomic features and use environment (the hook for IEC 62366); §14 chemical, physical and biological properties (the hook for ISO 10993); §17 electronic programmable systems (software lifecycle per IEC 62304 + cybersecurity per MDCG 2019-16); §22 lay-user devices (additional requirements); §23 labelling and IFU.

Article 61 + Annex XIV require a Clinical Evaluation that demonstrates conformity with the relevant GSPRs, with sufficient clinical evidence — including, where applicable, the manufacturer's own clinical investigations. The historic MDD shortcut of relying on equivalence to a competitor device is heavily restricted under MDR — equivalence requires technical, biological and clinical equivalence, demonstrated against detailed criteria, with full access to the comparator's technical documentation (almost never available across competitors). For implantable and Class III devices, equivalence is essentially closed; clinical investigations under Articles 62-82 + Annex XV are typically required.

The Clinical Evaluation Report (CER) is a controlled deliverable updated at the cadence specified above. It must integrate the PMS data — including PMCF — and feed back into the benefit-risk analysis. A CER that has not been updated with the most recent PMS / PMCF data is a major finding.

Articles 83-86 + Annex III formalise post-market surveillance as a planned, documented, continuous process — see the dedicated /glossary/pms pillar for the full mechanism. Key MDR-specific points: (a) a PMS plan is required for every device class; (b) a PMS report is required for Class I devices, updated when necessary; (c) a PSUR is required for Class IIa (every 2 years), Class IIb non-implantable (annually) and Class IIb implantable + Class III (annually, submitted via EUDAMED for review); (d) PMCF is required by default and the absence of PMCF requires explicit justification per MDCG 2020-7.

Article 88 'trend reporting' is the statistical-significance loop — a manufacturer that observes a statistically significant increase in the frequency or severity of incidents that are not serious incidents must report and may be required to take action. Article 87 vigilance is the serious-incident reporting clock — 15 days for serious incidents, 10 days for serious public-health threats, 2 days for death or unanticipated serious deterioration.

Article 27 + Annex VI Part C establish the Unique Device Identification (UDI) system. Each device has a UDI consisting of a UDI-DI (device identifier — static, identifies the model) and a UDI-PI (production identifier — dynamic, identifies the lot / serial / expiry / manufacturing date). UDIs are issued by accredited issuing entities (GS1, HIBCC, ICCBBA, IFA). The UDI is placed on the device label, on higher levels of packaging and, for reusable devices, directly on the device. UDI-DI is registered in EUDAMED with the device data.

EUDAMED — the European Database on Medical Devices — is the central transparency platform. It comprises modules for Actor registration, UDI/Device registration, Notified Bodies and certificates, Clinical investigations, Vigilance and PMS, and Market surveillance. Rollout has been phased: Actor (live since Dec 2020), UDI/Device (live), Notified Bodies/certificates (live), CIP and Vigilance (becoming mandatory through 2026-2027). When EUDAMED becomes fully mandatory, technical documentation, PSURs (Class III + IIb implantables), Annex XIV PMCF reports, FSCA reports and trend reports become inspectable to competent authorities across all Member States simultaneously — a significant change in scrutiny intensity.

Article 87 establishes the serious-incident reporting obligations. A serious incident is any malfunction or deterioration in characteristics or performance, any inadequacy in the labelling or IFU, or any undesirable side effect that has led, might have led, or might lead to death, a serious deterioration in health, or a serious public-health threat. Reporting clocks: 2 days for serious public-health threat or death / unanticipated serious deterioration; 10 days for serious public-health threat (lesser); 15 days for other serious incidents.

Field Safety Corrective Action (FSCA) — any action taken by a manufacturer to reduce the risk of death or serious deterioration in health associated with the use of a device already on the market. FSCAs are reported to competent authorities and communicated to users via a Field Safety Notice (FSN). The MDCG has published templates for both. FSCAs are also entered into EUDAMED.

Article 88 trend reporting — statistically significant increases in non-serious incidents or expected undesirable side-effects must be reported. The threshold is the manufacturer's documented signal-detection method; the report is made via EUDAMED when fully operational.

Notified Bodies are independent conformity-assessment bodies designated by Member States and listed on NANDO. Under MDR, designation criteria are stricter than under MDD (Annex VII), and Notified Bodies are subject to ongoing surveillance and re-designation. Manufacturers contract a Notified Body for conformity assessment per Annex IX (QMS + technical-documentation assessment), Annex X (type examination) or Annex XI (production quality assurance). The Notified Body's scope is defined by device codes (MDA codes for medical devices, MDN/MDS for the same).

Annual surveillance audits are mandatory; unannounced audits of the manufacturer and of critical suppliers occur at least every five years (typically more often for higher-risk devices). For Class III implants and class IIb implantables intended to administer or remove a medicinal product, the 'clinical evaluation consultation procedure' (CECP, Article 54) involves an expert panel review of the manufacturer's clinical evaluation assessment report — adding a layer of scrutiny.

Article 10(9) requires every manufacturer to establish, document, implement, maintain and improve a QMS. EN ISO 13485:2016 + A11:2021 is the harmonised standard used to demonstrate conformity. Notified Bodies audit the QMS against ISO 13485 with MDR-specific add-ons (PRRC, PMS, vigilance, UDI, EUDAMED). The QMS scope must cover the full set of activities: design controls per Annex II §6, supplier control, production and process controls, CAPA, document control, training, risk management per ISO 14971 throughout, PMS, vigilance, PMCF, change management and notifications to the Notified Body.

• GSPR matrix incomplete or with applicability rationale missing for non-applicable items.
• CER not updated at the required cadence; PMS / PMCF data not integrated.
• PMCF claimed unnecessary without the MDCG 2020-7 justification.
• Risk management file static — no integration of post-market data per ISO 14971 §10.
• Software classification per Rule 11 wrong (Class I claimed where IIa/IIb applies).
• Equivalence claim made for an implant / Class III without full access to comparator data.
• Critical supplier list incomplete or critical suppliers not subject to audit.
• Vigilance clock missed for a serious incident; 15-day deadline interpreted as 15 business days.
• UDI placement on label / packaging / reusable device non-compliant or missing.
• EUDAMED registrations not maintained for new variants.
• PSUR cadence wrong for the device class; Class III PSUR not submitted via EUDAMED.
• Authorised representative agreement missing the Article 11(3) minimum content.
• Importer / distributor due-diligence records absent.
• Significant change notifications to Notified Body missing for design updates.
• PRRC qualification evidence missing or PRRC turnover with no documented successor coverage.
• Annex XVI products (e.g. coloured contact lenses) handled outside the MDR framework.

• GSPR matrix completeness (% requirements with applicability + evidence + rationale).
• CER update currency vs required cadence per device class.
• PMS plan currency and PMS report / PSUR on-time submission rate.
• PMCF data acquisition vs PMCF plan milestones.
• Vigilance reporting on-time rate (2-day / 10-day / 15-day).
• Article 88 trend signal-detection cycle time.
• Significant-change notifications to Notified Body — open vs closed within target.
• Critical supplier audit coverage and frequency.
• UDI assignment completeness across portfolio.
• EUDAMED registration completeness per device, certificate, FSCA.
• PRRC continuity (successor documented; no gaps).
• Notified Body finding rate and time-to-closure.

V5 Ultimate treats EU MDR as a first-class compliance overlay on the discrete-industry QMS. Every device record carries its MDR classification (with the Annex VIII rule reference and the applicability rationale) and the conformity-assessment route. The GSPR matrix is a controlled workspace — every applicable requirement is a row, every evidence reference is a live link to the controlled document, and incomplete rows are flagged before the technical documentation can be locked for the Notified Body submission.

PMS, PMCF and CER cadences are scheduled per device class with automatic reminders and overdue escalations. The vigilance module enforces the 2 / 10 / 15-day clocks (in calendar days, not business days), with escalations to the PRRC and country competent-authority routing built in. FSCAs are tracked from initiation through FSN dispatch and EUDAMED reporting. Article 88 trend signals are surfaced from the complaints + service data with the manufacturer-defined statistical threshold.

UDI assignment is automated against the GS1 / HIBCC issuing entity rules; UDI-DI and UDI-PI are placed on label and packaging via the labelling module; EUDAMED export packages assemble automatically from the controlled records. The PRRC dashboard surfaces the operator's daily worklist (pre-release conformity checks, PMS report due-dates, vigilance reports, PMCF milestones, certificate expiries) so the legal obligation is visibly held and historically auditable. Notified Body findings can be logged, mapped to CAPAs, tracked to closure with effectiveness verification — and surfaced in the next management review.