Notified Body

A Notified Body (NB) is an independent conformity-assessment body designated by an EU Member State Competent Authority (or, in EFTA, the relevant national authority) under EU MDR Annex VII for medical devices, under IVDR Annex VII for IVDs, or under the corresponding annexes of other New Approach product directives. Once designated, the Notified Body is allocated a 4-digit identification number and is listed on the NANDO (New Approach Notified and Designated Organisations) database. Manufacturers contract a Notified Body to perform the conformity-assessment activities required by the relevant Regulation; the Notified Body then audits the manufacturer's QMS, reviews the technical documentation, conducts unannounced audits of the manufacturer and critical suppliers, witnesses validations where relevant, and issues the certificates whose presence (together with the EU Declaration of Conformity) enables the manufacturer to affix the CE marking.

Notified Bodies are private commercial organisations — typically the same major certification bodies that operate ISO 9001 / ISO 13485 / ISO 14001 schemes worldwide — but their Notified Body activity is regulated function exercised under public-law designation. They are paid by the manufacturer they assess, but they are accountable to the designating Member State Competent Authority (subject to joint assessment by the Commission and other Member States during designation and re-designation), to the Medical Device Coordination Group (MDCG), and to the European Commission. A Notified Body that loses its designation cannot continue activities; certificates issued under a withdrawn designation typically remain valid only for a defined run-off period.

Under MDD / AIMDD / IVDD, Notified Body involvement was substantial but bounded; MDR + IVDR substantially expanded the scope. MDR moved many devices up one class under Annex VIII (Rule 21 substance-based, Rule 11 software, reprocessed single-use), each of which now requires NB involvement that may not have under MDD. IVDR took the most dramatic step — from list-based ~20% NB coverage under IVDD to rule-based ~80% NB coverage under IVDR. Total demand for Notified Body capacity therefore multiplied; supply (designated NBs and qualified NB auditors / reviewers) did not keep pace. The result was the audit-backlog crisis that drove Regulation (EU) 2023/607 (MDR transition extension to 2027-2028) and Regulation (EU) 2024/1860 (IVDR transition extension to 2027-2029).

The practical implication for manufacturers: Notified Body availability — for new applications, for scope extensions, for significant-change reviews, and for surveillance audits — is the single most binding planning constraint for EU device + IVD operations. Application-to-decision times measured in years (rather than months) are not uncommon. Re-quoting a Notified Body that has reached capacity may require switching to a competitor — itself a multi-quarter exercise. The Commission's MDCG 2022-14 rev.1 monitors capacity and publishes mitigations, but no near-term path returns the system to the MDD-era timing baseline.

Designation is governed by EU MDR Annex VII (mirrored in IVDR Annex VII). The Member State Competent Authority receives the application, performs the initial assessment, and refers it to a Joint Assessment Team coordinated by the Commission with experts from other Member States. The joint assessment includes documentary review and on-site witness audits. If successful, the Member State designates the body for a defined scope (specific device codes — MDA codes for medical devices, MDN/MDS for additional categories, IVD codes for IVDs), publishes the designation on NANDO, and assigns the 4-digit number.

Designation criteria under MDR Annex VII vs MDD are substantively tightened: organisational and general requirements (independence, impartiality, confidentiality, professional integrity, structural separation from related entities); quality-management requirements (own QMS, document control, training of personnel); resource requirements (sufficient permanent administrative, technical, scientific personnel with documented qualifications in every device category designated for); process requirements (defined procedures for QMS audit, technical-documentation review, certification, surveillance, unannounced audit, complaint handling, change handling, conflict-of-interest management). Designation is reviewed at least every 5 years; surveillance occurs throughout. The Joint Assessment process is rigorous — many MDD-era Notified Bodies did not re-designate, accelerating the capacity squeeze.

Beyond these formal activities, the Notified Body issues guidance to its clients, monitors complaints and FSCA across its certified manufacturers, communicates with the designating Competent Authority on systemic issues, and participates in the Notified Body Coordination Group (NB-CG / NB-Med, NB-MED for medical devices, NB-IVD for IVDs) where consensus interpretive positions are developed across NBs.

1. Pre-audit — audit plan issued with scope, dates, locations, audit team, sampling list. Documentation request lands ~30-60 days ahead (controlled docs, design dossier samples, batch records, complaint summaries, CAPA list, supplier list, prior-finding closure evidence).
2. Opening meeting — scope confirmation, audit-plan walkthrough, logistics, identification of escorts and SME availability per process.
3. Process walks + record sampling — the auditor follows the QMS process by process (design controls, production controls, purchasing, CAPA, complaints, vigilance, management review, internal audit). Sampling is risk-based + auditor-chosen — the manufacturer cannot pre-select the samples. The auditor pulls audit-trail entries, batch records, calibration records, training records, supplier files, complaint records, CAPA files; verifies evidence against procedure; interviews the operator / supervisor / engineer / QA reviewer.
4. Technical-documentation review — for the device samples in scope, the technical file is opened end-to-end: device description, GSPR matrix, risk-management file, design history file, V&V evidence, clinical evidence, PMS / PMCF / PMPF, labelling / IFU, EU declaration of conformity.
5. Closing meeting — daily debrief during the audit, summary finding presentation at close. Findings classified per the NB scheme (typically Major / Minor / Observation; severe non-conformities may trigger immediate certificate suspension consultation).
6. Audit report — issued within the NB's procedural timeline (typically 30 days). Findings tabled with required response timing.
7. Manufacturer response — root-cause analysis + correction + corrective action + effectiveness verification per finding. NB reviews and accepts / rejects. Major findings typically require evidence of correction before the next certificate decision; minor findings can be closed at the next surveillance.
8. Certificate decision — issuance / extension / suspension / withdrawal per the cumulative finding picture.

Notified Body finding classification schemes vary in label between NBs (Major / Minor / Observation; Critical / Major / Minor; Grade 1 / 2 / 3) but the substance is consistent:

• Major non-conformity — a significant breakdown in the QMS or a significant gap in technical documentation that, if uncorrected, would affect the safety or performance of devices placed on the market or already on the market. Typically requires corrective-action evidence before the next certificate decision (issuance / extension); systemic or recurrent majors can trigger certificate suspension consultation.
• Minor non-conformity — a localised breakdown or gap that does not currently affect device safety / performance but requires correction. Typically resolved at the next surveillance audit; pattern of unresolved minors escalates to a major.
• Observation / opportunity for improvement — not a non-conformity but a recommendation; not certificate-affecting.
• Critical / safety-affecting non-conformity — a finding with immediate safety implications; may trigger urgent action including reporting to the Competent Authority, field safety corrective action, certificate suspension or withdrawal.

Certificate decisions: issuance (new), extension / scope amendment, maintenance (after surveillance), suspension (temporary; finding-closure required to lift), withdrawal (terminal for that certificate). Suspension or withdrawal triggers competent-authority notification, manufacturer obligations to inform supply chain, and — depending on circumstance — competent-authority decision on whether devices already on the market may continue to be available.

MDR Article 56 + Annex IX §4.6 requires that manufacturers obtain Notified Body approval for substantial changes to a design / intended purpose. MDCG 2020-3 rev.1 (legacy MDD devices under MDR Article 120) and MDCG 2022-14 rev.1 (capacity + interpretation) provide operational classification. Examples of changes typically considered significant: changes to indications, target population, contraindications; design changes to a critical component, function or material; sterilisation method changes; packaging changes affecting sterility; manufacturing-site changes; sterilisation-site changes; software major-version releases for SaMD; changes to the operating principle. Examples typically NOT significant: minor labelling clarifications without scope impact; cosmetic UI changes; non-critical-component supplier swap with equivalent specification; SOP improvements not affecting device design.

The decision tree is manufacturer-led, NB-confirmed; pre-submission discussions are encouraged for borderline cases. Mis-classifying a significant change as non-significant — and proceeding to market without NB review — is a serious finding that can affect certificate validity and trigger Competent Authority enforcement.

Post-Brexit, the UK separated from the EU Notified Body system. Within Great Britain (England, Scotland, Wales), conformity assessment for medical devices placed on the GB market under UK MDR 2002 (as amended) is performed by UK Approved Bodies (UKABs) designated by the MHRA. Northern Ireland — under the Windsor Framework — continues to follow EU MDR / IVDR with EU Notified Bodies; UKNI marking applies in defined circumstances. The MHRA publishes the list of UKABs; capacity is more constrained than the EU NB picture, and the UK regulatory framework continues to evolve (Future Regulations of Medical Devices consultation outcomes are being implemented in stages).

Practical: manufacturers selling into both EU + UK GB markets need both an EU NB certificate (for the EU + Northern Ireland) and a UKAB certificate (for GB). The CE marking continues to be recognised in GB on a transitional basis under defined deadlines, but the long-term position is UKCA + UKAB; manufacturers should track MHRA publications for the binding cut-over dates.

• Verify scope on NANDO — the NB must be designated for every device code (MDA / MDN / MDS / IVD code) you need certified.
• Verify capacity + lead times — request realistic application-to-decision timelines for QMS audit + technical-documentation review + significant-change review.
• Verify Annex IX vs Annex X vs Annex XI preferences — some NBs lean to particular routes; align with your QMS maturity.
• Verify clinical / IVD performance expertise — for higher-risk classes, request CV summaries of the lead reviewer for clinical evaluation / performance evaluation.
• Verify language coverage — audit and review language for multi-site operations.
• Verify pricing + invoice cadence — NB fees scale with audit days + review effort; budget multi-year.
• Establish a single point of contact (SPOC) at the NB and at the manufacturer; document SPOC continuity.
• Maintain a Notified Body workspace — audit history, finding history, certificate calendar (issuance / surveillance / recertification dates), significant-change register, fees + contracts.
• Schedule internal audits to lead NB audits — surface findings yourself first.
• Pre-stage unannounced-audit readiness — visitor management trained, escort SMEs on a rota, document-control system queryable, audit-room available.
• Plan for NB change — capacity, designation withdrawal or service-level issues may force a switch; switching mid-cycle is a multi-quarter exercise; have a fallback NB scoped.

• Risk-management file static post-launch — no integration of complaint / vigilance / PMS data per ISO 14971 §10.
• GSPR matrix incomplete — applicability rationale missing for items marked non-applicable.
• Clinical evaluation / performance evaluation report stale — not updated at the required cadence per class.
• PMCF / PMPF claimed unnecessary without acceptable justification.
• CAPA root-cause analysis shallow; preventive action scope too narrow; effectiveness verification absent or generic.
• Critical supplier list incomplete; critical suppliers not audited per defined cadence; supplier quality agreement missing for a critical supplier.
• Design changes implemented without notifying the NB where significance was met.
• UDI placement / EUDAMED registration incomplete.
• Vigilance reporting clock missed (e.g. 15-day deadline treated as 15 business days).
• Document control gaps — obsolete versions in use at the line; training records out of date for the current effective procedure version.
• Internal-audit programme incomplete — process audits not covered within planned interval; findings open beyond closure target.
• Management-review minutes do not document every required input or evidence of improvement decisions.
• Significant-change classification mis-applied — change implemented as non-significant when significance criteria are met.
• Cybersecurity evidence absent for connected devices despite MDCG 2019-16 expectations.
• PRRC qualification evidence missing or PRRC continuity gap.

V5 Ultimate models the Notified Body relationship as a first-class workspace. Each device record carries its Notified Body, designated scope (NANDO codes), certificate type (Annex IX / X / XI), issuance / surveillance / recertification dates, certificate document with auto-reminders ahead of expiry. The audit-history dashboard surfaces all audits (initial, surveillance, unannounced, recertification, scope-extension, significant-change review), the audit team, the audit-day count and the findings — open and closed.

Findings logged during the audit are captured directly into the CAPA system with the NB's classification (Major / Minor / Observation / Critical), the required response deadline, the corrective and preventive actions and the effectiveness verification — fully integrated with the broader CAPA loop and management review. The significant-change register routes proposed design / intended-purpose / manufacturing changes through the MDCG 2020-3 / 2022-14 decision tree; significance triggers an automatic NB-notification workflow with the required submission package assembled from the controlled documents.

Unannounced-audit readiness is a permanent state — the document-control system is queryable in real time, the audit trail is on-demand, the operator-on-shift escort rota is published, and the visitor-management procedure is trained to all front desks. Pre-audit documentation requests assemble into a one-click bundle. The Notified Body-fees ledger tracks contracts, invoices and the multi-year fee projection — surfaced at management review and finance planning.