Getting a CE mark for a medical device requires you to demonstrate compliance with the European Union’s Medical Device Regulation (EU MDR 2017/745), a process that ranges from a few months for simple, low-risk products to well over a year for high-risk implantables. The path depends almost entirely on your device’s risk classification, which determines how much third-party scrutiny you’ll face. Here’s how the process works from start to finish.
Classify Your Device First
The EU MDR sorts medical devices into four risk classes using rules laid out in Annex VIII of the regulation. Your classification dictates every downstream decision, from whether you need a Notified Body to how much clinical evidence you’ll need to gather.
- Class I: Low-risk, non-invasive devices like bandages, tongue depressors, or hospital beds. These have subcategories for sterile devices (Is), devices with a measuring function (Im), and reusable surgical instruments (Ir).
- Class IIa: Low-to-medium risk devices, typically those placed inside the body for short periods (between 60 minutes and 30 days). Examples include hearing aids, urinary catheters, and surgical clamps.
- Class IIb: Medium-to-high risk devices, often implanted for 30 days or longer. Ventilators, bone plates, and infusion pumps fall here.
- Class III: The highest risk category, covering devices like heart valves, spinal implants, and drug-eluting stents.
Classification isn’t always obvious. A single device can trigger multiple classification rules, and you must apply the strictest one. Software qualifies as a medical device in its own right if it’s intended for diagnosis or treatment, and it’s often classified higher than manufacturers expect. Getting this step wrong cascades into every other part of the process, so many companies hire a regulatory consultant specifically for classification.
Build Your Quality Management System
Every medical device manufacturer needs a quality management system (QMS) that meets the requirements of ISO 13485:2016. This is the internationally recognized standard for medical device QMS, and it’s the framework Notified Bodies audit against. For Class I devices, you must have one in place but nobody audits it externally. For Class IIa and above, a Notified Body will audit your QMS as part of certification.
Your QMS covers the full device lifecycle: design controls, supplier management, production processes, complaint handling, and corrective and preventive actions. Risk management (typically following ISO 14971) is embedded throughout. If you’re building a QMS from scratch, expect the process to take six months or more before it’s mature enough to survive an external audit. The system needs to be a living operational framework, not a shelf of binders, because auditors look at records of actual use.
Compile Your Technical Documentation
The technical documentation file (sometimes called the technical file or design dossier) is the core deliverable of the CE marking process. Annex II of the MDR specifies what it must contain, and the requirements are extensive.
At minimum, your file needs to include a full device description covering the intended purpose, intended users, target patient population, indications, contraindications, and principles of operation. You’ll document the device’s risk class along with your justification for which classification rule applies. If your device has accessories or is meant to be used alongside other products, those relationships need to be described.
The file must also contain design and manufacturing information, including details about materials in contact with the body, functional components, software (if applicable), and the manufacturing process itself. A complete set of labeling, including all packaging levels and instructions for use translated into the languages of every EU member state where you plan to sell, is required.
You’ll also need to provide an overview of previous generations of your device and any similar devices already on the market. This equivalence analysis matters particularly for your clinical evaluation, where you may rely on data from similar products rather than running your own clinical studies.
Gather Clinical Evidence
Every medical device entering the EU market needs a Clinical Evaluation Report (CER), regardless of risk class. The level of clinical evidence required scales with risk and novelty, but the obligation is universal.
Clinical evidence can come from three sources: clinical investigations you conduct yourself, published literature on equivalent devices, and post-market clinical data. The MDR expects you to demonstrate three things. First, that your device’s output is associated with the clinical condition it targets (scientific validity). Second, that the device reliably and accurately produces its intended output (technical performance). Third, that the device delivers clinically meaningful results for actual patients (clinical performance).
For lower-risk devices with well-established technology, a thorough literature review and equivalence argument may suffice. For Class III devices and novel technologies, you’ll almost certainly need your own clinical investigation data. Class III implantable devices and certain Class IIb active devices face an additional layer: an expert panel reviews the clinical evaluation through a consultation procedure under Article 54 of the MDR.
The CER isn’t a one-time document. It must be updated throughout the device’s lifecycle as new clinical data becomes available.
Choose Your Conformity Assessment Route
The conformity assessment route is the specific regulatory pathway your device follows to demonstrate compliance. For standard Class I devices, this is self-certification: you compile your technical documentation, meet the General Safety and Performance Requirements in Annex I, and write a Declaration of Conformity. No Notified Body is involved.
For Class I devices that are sterile, have a measuring function, or are reusable surgical instruments, you still need a Notified Body to assess the specific aspects related to sterility, measurement accuracy, or reprocessing. The rest of the device assessment remains self-certified.
For Class IIa devices and above, a Notified Body must be involved. You typically have a choice between conformity assessment routes. The most common approach combines an audit of your quality management system with assessment of your technical documentation on a representative basis (per device category). Alternatively, you can pursue type examination, where the Notified Body evaluates a representative sample of your device, combined with either production quality assurance or product verification.
Class IIb devices follow similar routes, but with closer scrutiny. For Class IIb implantable devices, technical documentation is assessed for every device rather than on a representative basis. Class III devices face the most rigorous pathway: full assessment of technical documentation for every individual device, with no representative sampling allowed.
Devices incorporating a medicinal substance require additional expert assessment and consultation with a national medicines authority. Devices using human blood derivatives trigger consultation with the European Medicines Agency. Products containing non-viable animal tissue require yet another specialized review.
Engage a Notified Body
Unless you’re making a standard Class I device, you need a Notified Body, and this is where many manufacturers hit a bottleneck. There are a limited number of bodies designated under the MDR, and their capacity hasn’t kept pace with demand. Lead times of 12 to 18 months just to begin the review process are common, and some bodies have even longer backlogs.
Start the Notified Body selection process early. Different bodies have different areas of expertise, fee structures, and timelines. Fees vary significantly and are published on each body’s website. The total cost depends on your device class, the number of device variants, whether a clinical investigation is involved, and how many audit days your QMS requires. For a Class IIa device, total Notified Body costs through initial certification can range from tens of thousands to over a hundred thousand euros. Class III devices cost substantially more.
The Notified Body will audit your QMS, review your technical documentation (including the CER), and potentially request additional information or testing. Expect at least one round of questions. Addressing deficiencies promptly keeps the timeline from stretching further.
Register Your Device and Apply UDI
Before placing your device on the EU market, you need to assign it a Unique Device Identifier (UDI). The UDI system has two components: a device identifier (UDI-DI) that’s specific to your device model and manufacturer, and a production identifier (UDI-PI) that tracks individual production units. You also assign a Basic UDI-DI, which serves as the primary key linking your device to its certificates, Declaration of Conformity, and technical documentation in the European database.
The UDI must appear on your device label and packaging. You’re responsible for submitting all required device information to the UDI database before the product reaches the market. You also register your device and your organization in EUDAMED, the EU’s central database for medical devices, where regulatory authorities and (for some information) the public can access device data.
Issue Your Declaration of Conformity
Once your Notified Body issues a certificate (or, for standard Class I devices, once you’ve completed your own assessment), you draw up a Declaration of Conformity. This is a formal document in which you, as the manufacturer, declare that your device meets all applicable requirements of the MDR. It references your device identification, the conformity assessment procedures followed, and the Notified Body involved (if any). With the Declaration of Conformity in place, you affix the CE mark to your device and can legally place it on the EU market.
Plan for Post-Market Surveillance
CE marking isn’t the finish line. The MDR requires every manufacturer to operate a post-market surveillance (PMS) system for the life of the device. Your PMS plan, which is part of your technical documentation, must describe how you’ll proactively and systematically collect data on device performance, investigate complaints, track incidents, and compare your device against similar products on the market. You need defined indicators and threshold values that trigger a reassessment of your device’s benefit-risk profile.
The reporting obligations differ by class. For Class I devices, you produce a PMS report that you update on your own schedule (per your PMS plan) and make available to regulators on request. For Class IIa, IIb, and III devices, you produce a Periodic Safety Update Report (PSUR) on a defined schedule and submit it through EUDAMED. Serious incidents must be reported to national competent authorities within strict timelines regardless of device class.
Your Notified Body will review your PMS activities during surveillance audits, which occur at least annually. If your post-market data reveals new risks or declining performance, you’re expected to take corrective action, update your technical documentation and CER, and notify regulators as required.
Key Transition Deadlines for Legacy Devices
If you have a device currently on the market under a certificate issued under the old Medical Devices Directive (MDD), extended transition deadlines apply. Class III and implantable Class IIb devices must comply with the MDR by December 31, 2027. Non-implantable Class IIb devices and all lower-risk devices that reclassified upward under the MDR have until December 31, 2028. Custom-made Class III implantable devices face the earliest deadline: May 26, 2026. To qualify for these extensions, manufacturers needed to have applied for MDR certification by May 26, 2024 and had a contract with an MDR Notified Body in place before September 26, 2024.