Medical Device Regulation (EU) 2017/745 — MDR

Can I still sell my medical device in the EU if it only has an old MDD certificate — and what happens when those certificates expire?

Legacy MDD/AIMDD certificates expire on 31 December 2027 for class III and IIb implantable devices or 31 December 2028 for all others — after that, placing a non-MDR-certified device on the market is unlawful and Member States must impose effective, proportionate and dissuasive penalties [Art. 113].

Short Answer

Regulation (EU) 2017/745 (MDR) replaced the former Medical Device Directives (93/42/EEC and 90/385/EEC) and has applied since 26 May 2021 [Art. 123(2)]. Manufacturers must demonstrate conformity through notified-body certification under Annexes IX to XI, implement a quality management system [Art. 10(9)], and maintain a post-market surveillance system [Art. 83]. Transitional provisions allow legacy-certified devices to remain on the market until staggered cut-off dates — but only if the manufacturer lodged a notified-body application by 26 May 2024 and signed a written agreement by 26 September 2024 [Art. 120(3c)]. Failure to transition in time means the device can no longer be placed on the EU market.

Who is affected

Any manufacturer, authorised representative, importer or distributor placing medical devices on the EU market — including software qualified as a medical device (SaMD). Class III and class IIb implantable devices face the earliest deadline. Devices without a prior MDD certificate that now require notified-body involvement under MDR are also covered [Art. 120(3b)].

Deadline

31 December 2027 for class III and class IIb implantable devices; 31 December 2028 for class IIb non-implantable, class IIa, and class I sterile/measuring devices still on legacy certificates [Art. 120(3a)]. Ongoing: UDI obligations for reusable class III devices must carry the UDI on the device itself [Art. 27(4)].

Risk

Penalties are set at Member State level and must be effective, proportionate and dissuasive [Art. 113]. In practice, national authorities can prohibit market placement, order recalls and impose administrative fines. Beyond fines, a non-certified device cannot bear a CE marking, which blocks market access across all 27 Member States. For serious incidents, manufacturers must report to competent authorities within 15 days — or within 2 days in the event of a serious public health threat [Art. 87(3)–(4)].

Proof

Legal status

• In force
• as of 2026-04-18
• Consolidated version of 01.01.2026 (006.001)

Primary sources

• EUR-Lex — Full text
• European Commission — Medical Devices — EU medical devices policy

What to do now

Legal / DPO

•Verify that a written agreement with a notified body designated under MDR was signed by 26 September 2024 for every legacy-certified device still on the market — devices without this agreement lose the right to transitional placement [Art. 120(3c)(e)].
•Prepare and maintain an EU declaration of conformity for each device in accordance with Article 19, including the Basic UDI-DI, and keep documentation available for at least 10 years (15 years for implantables) [Art. 10(8)].
•Map national penalty regimes in each target market, since Art. 113 delegates enforcement and penalty levels to Member States — non-compliance consequences vary significantly by jurisdiction.

Compliance

•Establish, document and maintain a quality management system covering risk management, clinical evaluation, PMCF, UDI verification, post-market surveillance and supplier control — the QMS must have been in place by 26 May 2024 for transitional devices [Art. 10(9), Art. 120(3c)(d)].
•Implement a post-market surveillance plan proportionate to the device risk class, with periodic safety update reports (PSUR) at least annually for class IIa, IIb and III devices [Art. 83, Art. 86].
•Ensure EUDAMED registration of the manufacturer, authorised representative, device information and UDI data once the relevant electronic systems become functional [Art. 29, Art. 31].

IT / Security

•Comply with the general safety and performance requirements for devices incorporating software, including IT security risk management, secure design and validation of software lifecycle processes [Annex I, Section 17.2].
•Assign and manage UDI-DI and UDI-PI identifiers for each device and packaging level, ensure UDI carriers (barcode/RFID) are machine-readable on labels, and submit core data to the UDI database [Art. 27, Art. 28].
•Integrate serious-incident reporting into IT systems to meet the 15-day general, 10-day death/serious-deterioration, and 2-day public-health-threat reporting deadlines to competent authorities [Art. 87(3)–(5)].

Product / Engineering

•Conduct a clinical evaluation following a defined methodology based on literature review, clinical investigation results and consideration of alternative treatments — for implantable and class III devices, clinical investigations are generally required unless equivalence to an existing device is demonstrated [Art. 61(1), Art. 61(4)].
•Ensure the technical documentation meets the requirements of Annexes II and III, including the device description, risk management file, clinical evaluation report, labelling and instructions for use [Art. 10(4)].
•For class III implantable devices and class IIb active devices administering medicinal products, undergo the additional clinical evaluation consultation procedure with expert panels before notified-body certification [Art. 54(1)].

Key Terms

Medical device: Any instrument, apparatus, appliance, software, implant, reagent, material or other article intended for a specific medical purpose as defined in Art. 2(1) MDR.
Notified body: A conformity assessment body designated by a Member State under Art. 42 MDR and authorised to carry out conformity assessment activities for medical devices.
Unique Device Identification (UDI): A traceability system comprising a UDI device identifier (UDI-DI) and a UDI production identifier (UDI-PI) enabling identification of a device throughout its lifecycle [Art. 27].
Clinical evaluation: A systematic and planned process to continuously generate, collect, analyse, and assess the clinical data pertaining to a device to verify safety and performance [Art. 61, Annex XIV].
Post-market surveillance (PMS): An active and systematic process by the manufacturer to gather, record and analyse data on the quality, performance and safety of a device throughout its entire lifetime [Art. 83].
Post-market clinical follow-up (PMCF): A continuous process that updates the clinical evaluation with clinical data obtained from devices already on the market, ensuring ongoing safety and performance [Annex XIV, Part B].
EU declaration of conformity: A document drawn up by the manufacturer under Art. 19 MDR stating that the device fulfils the applicable requirements of the Regulation.
Field safety corrective action (FSCA): An action taken by a manufacturer to reduce a risk of death or serious deterioration of health associated with a device that is already placed on the market [Art. 2(68)].

Frequently Asked Questions

When did the MDR start to apply?

The MDR entered into force on 25 May 2017 and has applied from 26 May 2021, replacing the former Medical Device Directives 93/42/EEC and 90/385/EEC [Art. 123(2), Art. 122].

How long can devices with legacy MDD certificates remain on the market?

Class III and class IIb implantable devices (except specified low-risk implants) may remain on the market until 31 December 2027. All other legacy-certified devices may remain until 31 December 2028, provided the manufacturer has an active notified-body application and signed agreement [Art. 120(3a), Art. 120(3c)].

What conformity assessment route applies to class III devices?

Class III devices must undergo a full quality management system assessment and technical documentation review under Annex IX, or alternatively a type examination under Annex X coupled with production quality assurance under Annex XI [Art. 52(3)].

What are the serious incident reporting deadlines?

Manufacturers must report serious incidents within 15 days of becoming aware, within 10 days for death or unanticipated serious deterioration, and within 2 days for serious public health threats [Art. 87(3)–(5)].

Does the MDR apply to software?

Yes. Software that is intended by the manufacturer for a specific medical purpose listed in Art. 2(1) qualifies as a medical device. Software used in medical devices must also comply with Annex I, Section 17 requirements on electronic programmable systems and software lifecycle processes [Art. 2(1)].

What is the UDI system and when is it mandatory?

The Unique Device Identification (UDI) system requires manufacturers to assign a UDI-DI and UDI-PI to each device, place UDI carriers on labels and packaging, and submit core data to the UDI database. Timelines are staggered by risk class and are linked to EUDAMED functionality [Art. 27, Art. 123(3)(d)].

What documentation retention period applies?

Manufacturers must keep technical documentation, the EU declaration of conformity and any notified-body certificates available for at least 10 years after the last device was placed on the market — or 15 years for implantable devices [Art. 10(8)].

Assessment Factors & Checklist

Premium

Start 7-day free trial

Questions for Your Lawyer

Premium

Start 7-day free trial

Conclusion & Summary

Premium

Start 7-day free trial

Detailed analysis with source links.

Schalten Sie die KI-Analyse frei — mit markierten Fundstellen und direkten Links zu EUR-Lex. 7 Tage kostenlos testen.

Start 7-day free trial →

Keine Kreditkarte heute. Kündigung jederzeit.