Regulation (EU) 2017/745 of 5 April 2017, the MDR, introduced the summary of safety and clinical performance (SSCP) in Article 32. On 28 May 2026, the Notified Bodies and Certificates module of EUDAMED became mandatory, and on 2 July 2026 the Commission held a webinar on the new SS(C)P functionality in EUDAMED (European Commission).
The SSCP makes public what the technical documentation says about a device's safety and clinical performance. This article explains which devices need one, what it must contain, how it is validated and published, how it is translated and updated, and when software needs none.
Which devices need an SSCP
Article 32(1) applies "for implantable devices and for class III devices, other than custom-made or investigational devices". According to MDCG 2019-9 Rev.1, the MDCG guidance on the SSCP, this includes implantable devices in class IIa and IIb. Devices referred to in the second paragraph of Article 52(4), such as sutures and staples, have different validation timing.
| Device | SSCP required? |
|---|---|
| Class III (implantable or not) | Yes |
| Implantable class IIa or IIb | Yes |
| Non-implantable class I, IIa or IIb | No |
| Custom-made or investigational devices | No |
Sources: MDR Article 32(1); MDCG 2019-9 Rev.1.
For in vitro diagnostic devices, class C and D devices, other than devices for performance studies, need a summary of safety and performance (SSP) under Article 29 of the IVDR, with a template in MDCG 2022-9 Rev.1.
Software: it follows the class
In our view, for most SaMD the first question is whether Article 32 applies at all. The obligation follows the class, not the technology.
Under Rule 11, as explained in MDCG 2019-11 Rev.1, software that provides information used for diagnostic or therapeutic decisions is class III only where those decisions may cause death or an irreversible deterioration of a person's state of health. Non-implantable software in class I, IIa or IIb needs no SSCP under Article 32(1). Our article on Class 3 medical devices explains how Rule 11 leads to class III.
Where software does need an SSCP, MDCG 2019-9 asks the device description to specify the software versions relevant to safety or performance.
What the SSCP must contain
Article 32(2) lists eight items. MDCG 2019-9 Rev.1 provides a template that maps them to sections.
| Article 32(2) item | MDCG 2019-9 template section |
|---|---|
| (a) Identification of the device and manufacturer, including the Basic UDI-DI and SRN | Device identification and general information |
| (b) Intended purpose, indications, contraindications and target populations | Intended use of the device |
| (c) Device description, including previous generations or variants, and accessories | Device description |
| (d) Possible diagnostic or therapeutic alternatives | Possible diagnostic or therapeutic alternatives |
| (e) Harmonised standards and common specifications applied | Reference to harmonised standards and common specifications applied |
| (f) Summary of the clinical evaluation (Annex XIV) and relevant PMCF information | Summary of clinical evaluation and post-market clinical follow-up |
| (g) Suggested profile and training for users | Suggested profile and training for users |
| (h) Residual risks, undesirable effects, warnings and precautions | Risks and warnings |
Sources: MDR Article 32(2); MDCG 2019-9 Rev.1.
In our view, the SSCP is only as good as the clinical evaluation report, risk file and PMCF reports behind it. MDCG 2019-9 expects its content to be taken entirely from the technical documentation. Our article on the clinical evaluation report covers the source for item (f).
The patient part
MDCG 2019-9 expects a separate part for patients for implantable devices that require an implant card, and for class III devices intended to be used directly by patients. It should:
use language a lay person can understand, with readability testing recommended;
be objective and not promotional;
present favourable and unfavourable data.
Validation and publication
Article 32(1) sets the sequence:
The manufacturer drafts the SSCP and submits it to the notified body with the documentation for conformity assessment.
The notified body validates it.
The notified body uploads it to EUDAMED.
The label or instructions for use (IFU) state where the SSCP is available.
According to MDCG 2019-9:
the notified body validates the SSCP in one language;
for class III and class IIb implantable devices, validation takes place before the certificate is issued; for devices under the second paragraph of Article 52(4), validation takes place at least once during the validity of the certificate;
the IFU should give the EUDAMED public website address and the device's Basic UDI-DI.
Languages
MDCG 2019-9 is guidance, not law, but it sets out the expected approach:
| Step | Timing |
|---|---|
| Translations into the languages accepted for the IFU in the countries where the device is sold, plus English if not among them | Provided by the manufacturer |
| English translation, where the validated master is in another language | Within 90 days of the master upload |
| Notified body uploads translations | Within 15 days |
Source: MDCG 2019-9 Rev.1.
The notified body does not validate translations, so the manufacturer remains responsible for their accuracy.
Keeping the SSCP up to date
MDCG 2019-9, referring to Articles 61(11) and 86(1), expects the SSCP to be reviewed and, where needed, updated when the PMCF evaluation report and the PSUR are updated. The updated SSCP is submitted together with the PSUR. The PSUR is updated at least annually, or at least every two years for class IIa implantable devices.
At certificate renewal, MDCG 2019-9 expects manufacturers of class III and class IIb implantable devices to submit a draft SSCP updated within the previous 12 months.
In our view, the SSCP should be treated as a controlled document tied to the PSUR cycle, not a one-off certification deliverable. Each PSUR review should end with a recorded decision: update the SSCP, or document why the current version still stands. Our article on post-market surveillance covers the PSUR cycle.
EUDAMED status
According to the Commission's EUDAMED overview, four modules have been mandatory since 28 May 2026, including Notified Bodies and Certificates. The vigilance and post-market surveillance module and the clinical investigation module are still under development, and will not have a voluntary-use period before mandatory use. The Commission held a webinar on the SS(C)P functionality on 2 July 2026.
A hypothetical example
Hypothetical example: a Dutch SaMD manufacturer has two products: a class IIa triage app and decision software it classifies as class III under Rule 11.
Triage app: non-implantable class IIa, so no SSCP is required under Article 32.
Class III software: the manufacturer drafts the SSCP from its clinical evaluation report, risk file and PMCF plan, and states the relevant software versions. It adds a patient part only if the software is used directly by patients. It submits the draft with its application; the notified body validates and uploads it; the IFU points to EUDAMED and gives the Basic UDI-DI. Each PSUR triggers a review of the SSCP.
Conclusion
Article 32 applies to implantable and class III devices. For most software, the class decides whether an SSCP is needed at all. Where it is, the SSCP summarises the technical documentation in eight set items, is validated and uploaded by the notified body, and must be kept in step with the PSUR and PMCF evaluation.
If you need help preparing or maintaining your SSCP, our post-market follow-up team can help, or contact MedQAIR.
Frequently asked questions
Does class IIb software need an SSCP?
Only if it is implantable. Non-implantable class IIb software is outside Article 32(1).
Who uploads the SSCP to EUDAMED?
The notified body, after validating the draft submitted by the manufacturer (Article 32(1)).
Must the SSCP be available in every EU language?
MDCG 2019-9 expects translations into the languages accepted for the IFU in the countries where the device is sold, plus English. This is guidance, not a legal requirement in Article 32.
How often must the SSCP be updated?
MDCG 2019-9 links the review to PSUR and PMCF evaluation updates: at least annually for class III and class IIb implantable devices, or at least every two years for class IIa implantables, and whenever new data changes its content.
Is a patient part always needed?
No. MDCG 2019-9 expects one for implantable devices that require an implant card and for class III devices used directly by patients.
