Medical Devices Regulation (EU) 2017/745 (MDR)

Do our legacy Directive certificates still give us market access in the EU — and did we actually meet the 26 May 2024 conditions that MDR's transition period requires?

For Class III devices and high-risk Class IIb implantables, legacy Directive certificates permit EU market placement until 31 December 2027 [Art. 120(3a)(a)] — but only if a notified body application was filed by 26 May 2024 and a written agreement signed by 26 September 2024 [Art. 120(3c)]; missing those conditions means MDR certification is required immediately, with Member States obligated to impose effective and dissuasive penalties for any infringement [Art. 113].

Short Answer

Regulation (EU) 2017/745 replaced Council Directives 90/385/EEC and 93/42/EEC and has applied fully since 26 May 2021 [Art. 123], imposing stricter clinical evidence requirements [Art. 61], mandatory post-market surveillance with Periodic Safety Update Reports (PSURs) for Class IIa, IIb, and III devices [Art. 83, Art. 86], and UDI traceability across all risk classes [Art. 27]. The transition window for legacy certificates is conditional: manufacturers must have had a quality management system in place by 26 May 2024, a formal notified body application filed by that date, and a written agreement with a notified body signed by 26 September 2024 [Art. 120(3c)(d)-(e)] — any missing condition closes the transition immediately. Two Delegated Regulations that entered into force on 19 July 2026 expand relief options: Reg. (EU) 2026/1359 enlarged the Art. 52(4) list of Class IIb implantables exempt from notified body assessment of technical documentation, and Reg. (EU) 2026/1451 extended the Art. 61(6)(b) list of implantable and Class III devices exempt from a dedicated clinical investigation. Regulation (EU) 2024/1860 added a permanent 6-month advance notification obligation for anticipated supply interruptions that could cause serious patient harm [Art. 10a], enforceable since 9 July 2024.

Who is affected

All manufacturers of medical devices for human use — instruments, apparatus, appliances, software, implants, reagents, and materials with a specific medical purpose — placing products on the EU market, regardless of where the manufacturer is established [Art. 1, Art. 2 No. 1]. Authorised representatives are mandatory for non-EU manufacturers and carry personal obligations [Art. 11]. Importers [Art. 13] and distributors [Art. 14] bear separate obligations including verification of CE marking, labelling, and manufacturer identity. Health institutions that manufacture devices in-house for their own patients benefit from a limited exemption under Art. 5(5) but still face minimum safety requirements.

Deadline

Next hard deadline: 31 December 2027 — legacy Directive certificates for all Class III devices and complex Class IIb implantables expire [Art. 120(3a)(a)]. Class IIa, other Class IIb devices, and Class I sterile or measuring devices follow on 31 December 2028 [Art. 120(3a)(b)]. Both deadlines only apply if the 26 May 2024 QMS and notified body conditions were already met [Art. 120(3c)]; companies that missed them have no valid transition basis and must already hold MDR certificates. The permanent supply interruption notice obligation (6 months in advance) has applied since 9 July 2024 [Art. 10a]. Serious incident reporting runs continuously: 2 days (public health threat), 10 days (death or unanticipated serious deterioration), 15 days (other serious incidents) [Art. 87(3)-(5)].

Risk

Article 113 requires Member States to establish rules on penalties for MDR infringements that are effective, proportionate, and dissuasive — penalty ceilings are set by national law, not by MDR itself. The primary enforcement consequence is market surveillance authority action: product withdrawal from the market, prohibition on continued market placement, mandatory field safety corrective actions with EUDAMED publication, and device recall — all generating commercial and reputational disruption across all 27 Member States simultaneously. Criminal liability for fraudulent CE marking exists in multiple Member States under national criminal law. Manufacturers who lose access to the Art. 120 transitional period — because the 2024 conditions were not met — face immediate market placement prohibition with no cure period.

Proof

Legal status

• In force
• as of 2026-07-19
• Consolidated version of 1 January 2026

Primary sources

• EUR-Lex — Full text
• European Commission — Medical Devices — EU medical devices policy

What to do now

Legal / DPO

•Audit Art. 120(3c) compliance for every device on a legacy Directive certificate: confirm that a quality management system per Art. 10(9) was in place by 26 May 2024 and that a formal notified body application was filed by that date and a written agreement signed by 26 September 2024 — any device missing these three conditions cannot rely on the Art. 120(3a) or (3b) transition and must not be placed on the market without an MDR certificate.
•Map all active CE certificates by device class against the transition schedule: Class III + complex IIb implantables expire 31 December 2027 [Art. 120(3a)(a)], other IIb + IIa + Class I sterile/measuring expire 31 December 2028 [Art. 120(3a)(b)] — and verify that all EU Declarations of Conformity reference Regulation (EU) 2017/745, not the repealed Directives 90/385/EEC or 93/42/EEC [Art. 19].
•Assess whether any Class IIb implantable device qualifies for the expanded Art. 52(4) exemption following Reg. (EU) 2026/1359 (in force 19 July 2026): qualifying listed devices are exempt from the notified body assessment of technical documentation under Chapter I Section 4 of Annex IX, reducing certification scope and potential notified body bottleneck risk.

Compliance

•Establish the post-market surveillance (PMS) system per Art. 83 and PMS plan per Art. 84 for every marketed device; schedule reporting outputs by class: Class I requires a PMS report per Art. 85 (updated when necessary), Class IIa, IIb, and III require a Periodic Safety Update Report (PSUR) per Art. 86 — updated at least annually for Class IIb and Class III devices and shared with the notified body and stored in EUDAMED.
•Implement the Art. 10a supply interruption notification procedure (inserted by Reg. 2024/1860, enforceable since 9 July 2024): designate a responsible owner in the quality management system, define the 6-month advance notice trigger for anticipated interruptions or discontinuations that could cause serious harm to patients or public health in one or more Member States, and draft notification templates for competent authorities, economic operators, and health institutions.
•Establish a serious incident and field safety corrective action (FSCA) reporting workflow per Art. 87 with documented escalation paths and competent authority contacts by Member State, covering all three statutory timelines: immediately but no later than 2 days for a serious public health threat [Art. 87(4)], 10 days for death or unanticipated serious deterioration in health [Art. 87(5)], and 15 days for other serious incidents [Art. 87(3)].

IT / Security

•Build or validate the UDI generation and labelling workflow per Art. 27: each device requires a Unique Device Identification comprising a UDI device identifier (UDI-DI) and a UDI production identifier (UDI-PI) assigned before market placement, with the basic UDI-DI and core data elements per Annex VI Part B uploaded to the EUDAMED UDI database before or at the time of market placement [Art. 29] — automate schema validation against EUDAMED requirements and enforce mandatory field completeness at point of registration.
•Integrate EUDAMED API access for device registration, certificate submission, and post-market surveillance reporting per Art. 33 — implement phased activation aligned to the module-by-module rollout confirmed by the Commission per Art. 34(3) as amended by Reg. (EU) 2024/1860, maintain a documented fallback manual submission process for each module not yet confirmed live, and establish monitoring for Commission activation notices.
•Implement access-controlled technical documentation management with immutable audit trails: Art. 10(8) mandates retention of technical documentation, EU Declarations of Conformity, and certificates for at least 10 years after the last device is placed on the market, extended to at least 15 years for implantable devices — enforce role-based access for regulatory affairs and quality assurance, and maintain versioned storage of Annexes II and III documentation with tamper-evident logging.

Product / Engineering

•Verify device classification against the Annex VIII classification rules and confirm that the designated notified body's scope of designation covers the current classification and intended purpose — any design change, new clinical use claim, or regulatory reclassification triggers re-initiation of the applicable conformity assessment procedure under Art. 52 before the modified device may be placed on the market.
•Audit clinical evaluations for all marketed devices against the Art. 61 requirements: sufficient clinical evidence proportionate to device risk class, intended purpose, and lifetime; confirm whether any implantable or Class III device appears in the Art. 61(6)(b) exemption list as expanded by Reg. (EU) 2026/1451 (in force 19 July 2026) — exempted devices may demonstrate conformity through clinical evaluation with existing clinical data rather than a dedicated clinical investigation, potentially removing a significant development timeline constraint.
•Update technical documentation per Annexes II and III to reflect any design changes, post-market findings, updated clinical evaluations, or revised common specifications; Art. 10(8) document retention obligations run from the date the last unit of the affected device version is placed on the market — implement version-controlled documentation workflows that trigger retention clock resets at each significant design iteration.

Key Terms

Medical Device: Any instrument, apparatus, appliance, software, implant, reagent, material, or other article intended by the manufacturer for use in human beings for a specific medical purpose (diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of disease or injury), as defined in Art. 2 No. 1 MDR.
Notified Body: A conformity assessment body designated by a Member State under Art. 42 MDR to perform third-party conformity assessments for Class IIa, IIb, and III medical devices, issuing EU technical assessment certificates that form the basis for CE marking.
Unique Device Identification (UDI): A series of numeric or alphanumeric characters allowing unambiguous identification of a specific device on the market, comprising a UDI device identifier (UDI-DI, identifying the device model and manufacturer) and a UDI production identifier (UDI-PI, identifying the specific production unit), assigned before market placement [Art. 27, Annex VI].
EUDAMED: European Database on Medical Devices (Art. 33): the central EU information system for registering manufacturers, authorised representatives, devices, certificates, clinical investigations, vigilance reports, and market surveillance data across all 27 Member States.
Post-Market Surveillance (PMS): A systematic and continuous process by which the manufacturer plans, collects, records, and analyses real-world data from devices already on the market to enable timely corrective and preventive actions, proportionate to device risk class [Art. 83, Art. 84, Annex III].
Periodic Safety Update Report (PSUR): A report prepared by manufacturers of Class IIa, IIb, and III devices summarising post-market surveillance results, benefit-risk conclusions, PMCF findings, and sales volume data; updated at least annually for Class IIb and III devices and stored in EUDAMED [Art. 86].
Clinical Evaluation: A systematic, continuous, and planned process of generating, collecting, analysing, and assessing clinical data for a device to verify and update its safety and performance under the intended purpose, documented in a clinical evaluation report [Art. 61, Annex XIV Part A].
Post-Market Clinical Follow-up (PMCF): A proactive and ongoing data collection process conducted by the manufacturer to update the clinical evaluation with clinical evidence from post-market use of a CE-marked device by its intended users under real-world conditions, forming part of the PMS plan [Annex XIV Part B, Art. 86(1)(b)].
Field Safety Corrective Action (FSCA): A corrective action taken by a manufacturer to reduce a risk of death or serious deterioration in health associated with a device already placed on the market — including recalls, on-site modifications, and safety notices — which must be reported to competent authorities without undue delay [Art. 87(1)(b), Art. 89].
Authorised Representative: A natural or legal person established in the European Union who is explicitly designated by a manufacturer established outside the EU to act on the manufacturer's behalf in relation to specified MDR obligations, including registration, vigilance reporting, and competent authority communications [Art. 11].

Frequently Asked Questions

Does Regulation (EU) 2017/745 apply to medical software?

Yes. Art. 2 No. 1 expressly includes 'software' in the definition of 'medical device' when intended by the manufacturer for one or more of the listed medical purposes — diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of disease or injury. Software that merely drives hardware or performs administrative functions is excluded, but software intended for a specific medical purpose (software as a medical device, SaMD) is subject to full MDR requirements: classification per Annex VIII, conformity assessment per Art. 52, UDI per Art. 27, EUDAMED registration, and post-market surveillance per Art. 83.

What is the difference between MDR and IVDR, and which applies to my product?

Regulation (EU) 2017/745 (MDR) covers medical devices for human use, including instruments, implants, surgical tools, and medical software. Regulation (EU) 2017/746 (IVDR) covers in vitro diagnostic medical devices — reagents, test kits, calibrators, and instruments used on specimens from the human body for diagnosis. Art. 1(6) MDR clarifies the boundary: a product cannot fall under both Regulations simultaneously. The intended purpose stated by the manufacturer in labelling and instructions for use determines which Regulation applies.

My device holds a Directive 93/42/EEC certificate. Until when can I continue placing it on the EU market?

The answer depends on device class AND whether your company met the 2024 conditions. Under Art. 120(3a), certificates issued from 25 May 2017 that were still valid on 26 May 2021 remain valid for market placement until: 31 December 2027 for Class III devices and complex Class IIb implantables [point (a)]; 31 December 2028 for other Class IIb, Class IIa, and Class I sterile or measuring devices [point (b)]. However, Art. 120(3c) requires that the manufacturer had a QMS in place by 26 May 2024, a formal notified body application filed by 26 May 2024, and a written agreement with the notified body signed by 26 September 2024. Missing any of these conditions means the transition does not apply and MDR certification is required before any further market placement.

Which classes of medical device require a notified body under MDR?

Under Art. 52: Class I non-sterile, non-measuring devices are self-certified by the manufacturer. All Class IIa, Class IIb, and Class III devices require involvement of a notified body designated under Art. 42. Class IIb implantable devices listed in Art. 52(4) — a list expanded by Reg. (EU) 2026/1359 in force 19 July 2026 to include additional common, simple, stable-design devices (sutures, staples, dental fillings, screws, plates, cannulas, catheters, and new additions including spinal posterior fixations, textile braids, and dental implants) — are exempt from the notified body's assessment of technical documentation under Chapter I Section 4 of Annex IX, though they still require notified body involvement for other conformity assessment elements.

What is EUDAMED, and when are registration obligations binding?

EUDAMED is the European Database on Medical Devices (Art. 33), covering registration of manufacturers, devices, certificates, clinical investigations, vigilance, and market surveillance data for the EU. Registration obligations become binding for each electronic module 6 months after the European Commission formally confirms that module is fully functional per Art. 34(3) — as amended by Reg. (EU) 2024/1860, which shifted from a single launch date to gradual module-by-module activation. Until a module is confirmed, corresponding national registration requirements apply. Manufacturers must register their Basic UDI-DI and core data elements before or at the time of placing a device on the market once the relevant module is live [Art. 29].

How quickly must serious incidents be reported under MDR?

Art. 87 sets three statutory timelines, each running from when the manufacturer becomes aware: (1) immediately and no later than 2 days for an event constituting a serious public health threat [Art. 87(4)]; (2) no later than 10 days in the event of death or unanticipated serious deterioration in a person's state of health — triggered as soon as the manufacturer suspects a causal relationship, not just when it is established [Art. 87(5)]; (3) no later than 15 days for other serious incidents after a causal relationship is established or reasonably possible [Art. 87(3)]. Reports are submitted to the competent authority of the Member State where the incident occurred via the EUDAMED vigilance module [Art. 92].

When is a clinical investigation required, and which devices are exempt?

Under Art. 61, implantable devices and Class III devices generally require a clinical investigation unless the manufacturer can demonstrate that reliance on existing clinical data is sufficient and scientifically justified. Art. 61(6)(b) lists specific devices exempt from this requirement when sufficient clinical data from similar devices and compliance with relevant common specifications can be demonstrated. Reg. (EU) 2026/1451 (in force 19 July 2026) expanded the Art. 61(6)(b) exemption list to include additional device types: cranial perforators, ventricular drains, embolisation coils, shunts, endovascular coils, pacing wires, reusable surgical instruments, and others. Exempted devices still require a full clinical evaluation per Art. 61 with sufficient clinical data — only the requirement for a dedicated clinical investigation is removed.

What does the supply interruption notification obligation under Art. 10a require?

Art. 10a (inserted by Reg. (EU) 2024/1860, enforceable since 9 July 2024) requires manufacturers to notify the competent authority at least 6 months before they anticipate interrupting or discontinuing supply of a device — where it is reasonably foreseeable that the interruption could result in serious harm or a risk of serious harm to patients or public health in one or more Member States. The obligation covers both MDR-certified devices and devices still under transitional provisions. Manufacturers must also inform distributors, health institutions, and healthcare professionals. Exceptional circumstances allow shorter notice, but the manufacturer must still inform the competent authority as soon as the interruption becomes foreseeable.

Assessment Factors & Checklist

Premium

Try for free

Questions for Your Lawyer

Premium

Try for free

Conclusion & Summary

Premium

Try for free

Detailed analysis with source links.

Schalten Sie die KI-Analyse frei — mit markierten Fundstellen und direkten Links zu EUR-Lex. Kostenlos prüfen mit Scout.

Try for free →

Keine Kreditkarte. 50 Recherchen + 5 KI-Analysen frei.