Transforming medical equipment procurement globally

Getting CE marking for medical devices is one of the most complex regulatory processes a manufacturer will face — and it just got harder. The EU Medical Device Regulation (MDR 2017/745) has fundamentally raised the bar for clinical evidence, technical documentation, and post-market surveillance requirements. Manufacturers who understood the old directive (MDD 93/42/EEC) are discovering that MDR requires substantially more effort, longer timelines, and significantly higher investment to achieve and maintain market access in Europe.

This step-by-step guide walks you through the CE marking process under MDR, from device classification to market placement and beyond.

Understanding EU MDR 2017/745 Requirements

The Medical Device Regulation replaced the Medical Device Directive as the governing framework for placing medical devices on the EU market. While the transition period has created overlap, all new device certifications now fall under MDR requirements.

The key differences from MDD that affect your CE marking strategy include stricter classification rules that reclassify many devices into higher risk categories, enhanced clinical evidence requirements that demand real-world data rather than literature-based equivalence claims for most devices, comprehensive technical documentation requirements following a structured format, and mandatory post-market surveillance with periodic safety update reports.

The regulation also introduces the Unique Device Identification (UDI) system, a European database for medical devices (EUDAMED), and requirements for an EU-based Authorized Representative for non-EU manufacturers. Understanding these requirements upfront prevents costly rework during the certification process.

Step 1: Device Classification and Conformity Route

Classification determines your entire regulatory pathway. Under MDR, devices are classified into four categories — Class I, Class IIa, Class IIb, and Class III — based on intended purpose, duration of contact, invasiveness, and whether the device is active or uses a substance considered medicinal.

Class I devices (lowest risk, such as non-sterile manual instruments) can self-certify without a Notified Body. Class IIa and IIb devices require Notified Body involvement through various conformity assessment routes. Class III devices (highest risk, including implantable devices) require the most rigorous assessment including full quality management system audits and individual device examination.

Classification errors are expensive. A device classified too low will be rejected during Notified Body review, wasting months of preparation. A device classified too high will trigger unnecessarily burdensome requirements. Invest in a thorough classification assessment early — ideally with input from a regulatory consultant experienced in MDR and your specific device type.

Platforms like MedIX consolidate fragmented CE guidance and display verified CE marking status for listed products, helping both suppliers and buyers understand the regulatory standing of equipment in the European market.

Step 2: Technical Documentation and Clinical Evidence

MDR requires technical documentation that is far more comprehensive than what MDD demanded. Your technical documentation must follow the structure outlined in Annexes II and III and cover the complete device lifecycle.

Key documentation components include device description and specification (including all variants and accessories), design and manufacturing information, general safety and performance requirements checklist with evidence for each applicable requirement, benefit-risk analysis, product verification and validation, and clinical evaluation.

The clinical evaluation is where most manufacturers struggle. MDR has dramatically tightened the rules around claiming equivalence to other devices, which was the most common pathway under MDD. For most devices, you now need device-specific clinical data — either from your own clinical investigations or from sufficient post-market clinical data.

Clinical Evaluation Reports: What MDR Actually Requires

Your Clinical Evaluation Report (CER) must follow MEDDEV 2.7/1 Rev 4 guidance and demonstrate that your device achieves the clinical benefits claimed in its intended purpose while maintaining an acceptable benefit-risk profile.

The equivalence pathway under MDR requires demonstrating equivalence across three dimensions: clinical (same intended purpose, same clinical condition, same patient population), technical (same design, specifications, and materials), and biological (same biological effects). Critically, you must have contractual access to the equivalent device's technical documentation to claim equivalence — a requirement that effectively blocks equivalence claims to competitor devices.

For most manufacturers, this means generating device-specific clinical data. Plan your clinical evidence strategy early in the process, as clinical investigations can add 12-24 months to your CE marking timeline.

Common Rejection Reasons and How to Avoid Them

Notified Bodies are rejecting technical documentation at higher rates under MDR than under MDD. The most common rejection reasons include insufficient clinical evidence (especially equivalence claims that do not meet the three-dimensional equivalence standard), incomplete general safety and performance requirements checklists, benefit-risk analysis that does not address all identified hazards, inadequate post-market surveillance plans, and missing or outdated biocompatibility testing per ISO 10993 series.

Avoid these pitfalls by conducting an internal pre-audit of your documentation against the MDR requirements before submitting to a Notified Body. Many manufacturers engage regulatory consultants for a gap analysis that identifies deficiencies before the formal review process begins.

Step 3: Selecting and Working With a Notified Body

Notified Bodies are the organizations authorized to assess your technical documentation and quality management system for conformity with MDR. Choosing the right one is a strategic decision, not just an administrative step.

The Notified Body landscape has contracted significantly under MDR. Fewer organizations have achieved MDR designation compared to the number that operated under MDD, and those that remain are handling higher volumes with more rigorous requirements. This means longer queues and more scrutiny during audits.

When selecting a Notified Body, consider their experience with your device classification and product type, current queue times for initial assessment (which can range from 6-18 months depending on the organization and device class), geographic convenience for audit logistics, fee structure transparency, and communication responsiveness.

Begin the Notified Body selection process early — ideally while your technical documentation is still in development. Some manufacturers apply to multiple Notified Bodies simultaneously to secure the fastest available slot, though this approach has cost implications.

Step 4: Declaration of Conformity and Market Placement

Once your Notified Body issues a certificate of conformity (for Class IIa, IIb, and III devices), you can draw up your EU Declaration of Conformity. This is a legally binding document in which you, as the manufacturer, declare that your device meets all applicable MDR requirements.

The Declaration of Conformity is the legal foundation of your market access. While it might seem like a formality after months of technical documentation and Notified Body review, errors in the Declaration of Conformity can invalidate your CE marking and create serious legal liability.

Common mistakes to avoid: referencing the old MDD instead of MDR (Regulation 2017/745), failing to update the declaration when device modifications are made, omitting applicable harmonized standards or common specifications, and having the declaration signed by someone without actual authority to bind the manufacturer.

Once the CE mark is affixed and the Declaration of Conformity is signed, plan your EUDAMED registration strategy. While EUDAMED has experienced implementation delays, manufacturers should prepare their data entries in advance. The UDI system, which assigns unique identifiers to every device, requires planning for label redesign, database entry, and supply chain system updates.

For manufacturers using platforms like MedIX to reach European buyers, having your CE marking documentation in order and readily accessible builds immediate buyer confidence. MedIX consolidates CE status verification into its supplier profiles, providing a trust signal that procurement managers can verify independently.

The Declaration of Conformity must reference the specific MDR (Regulation 2017/745), identify the Notified Body and certificate number, list all applicable common specifications and harmonized standards, and be signed by an authorized representative of the manufacturer.

With the Declaration of Conformity in place, you can affix the CE mark to your device and place it on the EU market. You must also register the device in EUDAMED (the European database on medical devices) and ensure your UDI system is operational.

Non-EU manufacturers must appoint an EU Authorized Representative who takes on defined legal responsibilities under MDR. Choose your Authorized Representative carefully — they are more than a mailbox; they can be held legally accountable for aspects of your device's regulatory compliance.

Maintaining CE Marking Post-Certification

CE marking is not a one-time achievement — it is an ongoing commitment. MDR requires active post-market surveillance and periodic safety update reporting throughout the device's lifecycle.

Post-certification compliance is where many manufacturers stumble. The pressure to bring new products to market can overshadow the ongoing obligations for products already on the market. But regulatory authorities are increasingly scrutinizing post-market activities, and Notified Bodies are more rigorous in their surveillance audits than ever before.

Build post-market surveillance into your standard operating procedures — do not treat it as a separate project. Your PMS system should integrate with your complaint handling, CAPA, and quality management processes. When a complaint is received, it should automatically feed into your PMS analysis. When PMS data identifies a trend, it should trigger a risk management review.

Keep your technical documentation living and current. MDR requires that technical documentation be updated whenever there is a significant change to the device, its manufacturing process, or the clinical evidence base. Set up a periodic documentation review cycle (at least annually) where responsible personnel review each section of the technical file for accuracy and completeness.

You must maintain a Post-Market Surveillance (PMS) system that systematically collects and reviews clinical experience with your device after it reaches the market. For Class IIa, IIb, and III devices, this includes Periodic Safety Update Reports (PSURs) submitted to your Notified Body at defined intervals.

Vigilance reporting requirements mandate that serious incidents involving your device are reported to the relevant competent authority within specified timeframes. Field safety corrective actions must be implemented and reported when safety issues are identified.

Your Notified Body will conduct surveillance audits (typically annually) to verify ongoing compliance. Non-conformities identified during these audits can result in certificate suspension or withdrawal, so maintain your quality management system and documentation continuously rather than preparing for audits reactively.

Frequently Asked Questions

How long does it take to get CE marking for a medical device?

Timeline varies significantly by device class and preparedness. For Class I devices (self-certification), the process can be completed in 3-6 months if documentation is well-prepared. For Class IIa devices, expect 12-18 months including Notified Body review. For Class IIb and III devices, timelines of 18-30 months are common, especially if clinical investigations are required. Notified Body queue times (currently 6-18 months for initial assessment) are the largest variable. Start planning at least 24 months before your target market entry date for any device requiring Notified Body involvement.

How much does CE marking certification cost for medical devices?

Costs depend on device classification, complexity, and whether clinical investigations are needed. Class I self-certification costs are primarily internal (regulatory personnel, testing) and typically range from €10,000-€50,000. Class IIa and IIb devices with Notified Body involvement typically cost €50,000-€200,000 including Notified Body fees, testing, and documentation preparation. Class III devices requiring clinical investigations can exceed €500,000-€1,000,000 when clinical study costs are included. Ongoing annual costs for surveillance audits, post-market surveillance, and PSUR preparation add €15,000-€75,000 per year depending on device class.

Can you sell medical devices in the EU without CE marking?

No. CE marking is a legal requirement for placing medical devices on the EU market. Selling, distributing, or even making available medical devices without valid CE marking under MDR is illegal and can result in market withdrawal orders, fines, and criminal penalties. The only exception is devices provided under compassionate use or custom-made device provisions, which have their own specific regulatory requirements. Devices with CE marking under the old MDD may continue to be sold during the transition period under certain conditions, but all new certifications must be under MDR.