Regulation (EU) 2017/745, the Medical Device Regulation (MDR), was adopted on 5 April 2017 and has applied since 26 May 2021 (MDR; European Commission Q&A). Devices still on the market under the old Directives have been given until 31 December 2027 or 31 December 2028, depending on their class, provided the conditions of Regulation (EU) 2023/607 are met (Regulation (EU) 2023/607). For everything else, and for every new device, the MDR applies in full.
Getting a CE mark for a medical device is therefore not a matter of choosing a symbol; it is the end point of a sequence of obligations, each with its own article and annex. In this post we set out that sequence in the order a manufacturer works through it, with the provisions behind each step. The question of whether software that sits outside the MDR can still end up needing a CE mark is a different one, which we covered in You Can’t Escape CE Marking.
Step 1: Intended purpose and qualification
Everything starts with the intended purpose. The MDR defines a medical device by what the manufacturer intends it to be used for (Art. 2(1)), and it classifies devices “taking into account the intended purpose of the devices and their inherent risks” (Art. 51) (MDR). For software, MDCG 2019-11 Rev.1 sets out the steps for deciding whether a product qualifies as medical device software at all (MDCG 2019-11 Rev.1).
The intended purpose statement should be written once and used everywhere: in the technical documentation, the instructions for use, the labelling and the website. If those sources describe different products, the classification and the clinical evidence will be built on the wrong one.
Step 2: Classification
Classification follows Article 51 and the 22 rules in Annex VIII, with MDCG 2021-24 Rev.1 as the main guidance (MDCG 2021-24 Rev.1). Where several rules apply, “the strictest rule and sub-rule resulting in the higher classification shall apply” (Annex VIII, Section 3.5). For software, Rule 11 places software that provides information used to take decisions with diagnosis or therapeutic purposes in class IIa, rising to class IIb or III depending on the impact of those decisions; software that monitors physiological processes is class IIa, or IIb for vital parameters where variations could result in immediate danger; all other software is class I (MDCG 2019-11 Rev.1).
The class decides the rest of the route, so the rationale deserves to be written down rule by rule. We compared the EU and US approaches in our article on the classification of medical devices.
Step 3: The conformity assessment route
Article 52 links the class to the conformity assessment procedures in Annexes IX to XI (MDR). The broad picture is as follows.
| Class | Notified body involvement | Main annexes |
|---|---|---|
| Class I | None, except for the sterility, measuring or reusable surgical aspects of class Is, Im and Ir devices | Technical documentation (Annexes II and III); declaration of conformity (Annex IV) |
| Class IIa | Yes | Annex IX, or Annex XI |
| Class IIb | Yes | Annex IX, or Annexes X and XI |
| Class III | Yes | Annex IX, or Annexes X and XI |
Source: MDR, Article 52 and Annexes IX to XI. Check the exact procedure for your device type against Article 52, as specific device groups have additional requirements.
For class IIa and higher, the notified body is not a formality at the end. It assesses the quality management system and the technical documentation, and the timing of the whole project depends on when the application can be lodged and how complete it is.
Step 4: Quality management system and PRRC
Article 10(9) requires manufacturers to establish, document, implement, maintain, keep up to date and continually improve a quality management system, and lists what it must address, from regulatory compliance strategy and risk management to clinical evaluation, post-market surveillance and corrective and preventive action (MDR). In addition, manufacturers must have at their disposal at least one person responsible for regulatory compliance (PRRC) with the expertise set out in Article 15 (MDCG 2019-7 Rev.1).
For a software manufacturer, the quality management system has to cover the way software is actually built and released. If releases follow a two-week cycle and the change control procedure assumes annual design reviews, the gap will show at the first audit.
Step 5: Technical documentation and clinical evidence
The technical documentation follows Annex II, and the technical documentation on post-market surveillance follows Annex III (MDR). It has to be kept up to date and, under Article 10(8), available to the competent authorities for at least ten years after the last device covered by the declaration of conformity has been placed on the market, or fifteen years for implantable devices.
Two parts carry most of the weight. The first is the demonstration of conformity with the general safety and performance requirements in Annex I; for software, Section 17 requires development in accordance with the state of the art, taking into account the principles of development life cycle, risk management, including information security, verification and validation (MDCG 2019-16 Rev.1). The second is the clinical evaluation under Article 61 and Annex XIV; for software, MDCG 2020-1 describes the evidence in terms of valid clinical association, technical performance and clinical performance (MDCG 2020-1). Our SaMD technical documentation checklist sets out the structure in more detail.
Step 6: Declaration of conformity and the CE mark
Once conformity has been demonstrated, the manufacturer draws up the EU declaration of conformity under Article 19, with the content set out in Annex IV. By drawing it up, the manufacturer assumes responsibility for compliance with the MDR, and the declaration has to be kept up to date. Where other Union legislation also requires a declaration of conformity, a single declaration covers all of it (MDR). The Basic UDI-DI is part of the declaration (Art. 27(6)).
Only then is the CE mark affixed, in line with Article 20 and Annex V. Where a notified body has been involved, the CE marking is followed by that notified body’s identification number (MDR).
Step 7: UDI, registration and the economic operators
Placing the device on the market also requires the identification and registration steps. The manufacturer assigns the Basic UDI-DI and UDI-DIs (Art. 27), registers as an actor and obtains a Single Registration Number, and registers its devices in EUDAMED; the first four EUDAMED modules have been mandatory since 28 May 2026 (European Commission). We described the sequence in our article on the registration of medical devices and in our EUDAMED UDI checklist.
A manufacturer established outside the EU must designate an authorised representative under Article 11 before placing the device on the market; we discussed that role in Role of the Authorised Representative.
Step 8: After the CE mark
The CE mark starts the post-market obligations rather than ending the project. Manufacturers operate a post-market surveillance system (Art. 83) based on a post-market surveillance plan (Art. 84, Annex III), report serious incidents and field safety corrective actions (Art. 87), and, for class IIa, IIb and III devices, prepare a periodic safety update report (Art. 86). MDCG 2022-21 states that the PSUR is updated at least every two years for class IIa devices and at least annually for class IIb and III devices (MDCG 2022-21).
For software, the practical consequence is that every release has to pass through the same questions: does this change affect the intended purpose, the classification, the clinical evidence or the declaration of conformity? If it does, the file has to change before the release does.
AI-enabled devices have an additional layer. Under the AI Act, AI that is, or is a safety component of, a device requiring notified body involvement is a high-risk AI system (MDCG 2025-6). Regulation (EU) 2026/1744 has moved the date from which those high-risk requirements apply to such systems to 2 August 2028 (Regulation (EU) 2026/1744; MDCG 2025-6). We covered the interplay in our article on AI Act requirements for medical devices.
Example: A software manufacturer working through the route
To show how the steps connect, take a hypothetical case. A Dutch company develops software that analyses ECG recordings and flags possible atrial fibrillation for a cardiologist to review.
The company first writes the intended purpose and confirms, following MDCG 2019-11 Rev.1, that the software is medical device software. It then applies Rule 11: the software provides information used to take decisions with diagnostic purposes, so it is at least class IIa. Suppose its documented rationale, after considering the possible impact of those decisions, concludes that class IIa applies. The route then runs through a notified body under Annex IX or Annex XI, which means the quality management system, including software lifecycle and change control, has to be in place and operating before the application is lodged.
The technical documentation follows Annexes II and III, with Annex I Section 17 addressed for development life cycle, risk management, information security, verification and validation, and a clinical evaluation built on MDCG 2020-1. After certification, the company draws up its declaration of conformity with the Basic UDI-DI, affixes the CE mark followed by the notified body’s number, completes its EUDAMED actor and device registration, and prepares a PSUR at least every two years.
None of these steps is exotic. What determines the timeline is whether the intended purpose, classification rationale and quality management system were settled before the notified body was approached.
Conclusion
A CE mark for a medical device under the MDR is the visible result of eight connected steps: intended purpose, classification, conformity assessment route, quality management system, technical documentation and clinical evidence, declaration of conformity, registration, and post-market surveillance. Each has its own provisions, and each depends on the one before it. In our view, the manufacturers that move through the route most predictably are the ones that treat the intended purpose and classification rationale as controlled documents from the first day, and build their software release process around the questions the MDR will ask after launch.
Our advice is simple: settle the intended purpose and classification first, put the quality management system in place before approaching a notified body, and make every release pass through the same regulatory check. If you would like support in planning that route, our regulatory strategy team can help, or you can contact the MedQAIR team.
Frequently asked questions
Does every medical device need a notified body for the CE mark?
No. Class I devices are CE marked on the basis of the manufacturer’s own technical documentation and declaration of conformity, except for the sterility, measuring and reusable surgical aspects of class Is, Im and Ir devices, which need a notified body. Class IIa, IIb and III devices require notified body involvement under Article 52 and Annexes IX to XI (MDR).
Why is there a number next to the CE mark?
Where a notified body was involved in the conformity assessment, the CE marking is followed by that notified body’s identification number (Art. 20 and Annex V) (MDR).
How long must the technical documentation be kept?
For at least ten years after the last device covered by the declaration of conformity has been placed on the market, or fifteen years for implantable devices (Art. 10(8)) (MDR).
Can devices certified under the old Directives still be sold?
Yes, under the conditions of Regulation (EU) 2023/607, until 31 December 2027 or 31 December 2028 depending on the class, and the former sell-off date has been removed (European Commission Q&A).
Does an AI-enabled device need anything beyond the CE mark under the MDR?
If the AI system is, or is a safety component of, a device requiring notified body involvement, it is a high-risk AI system under the AI Act, with requirements applying from 2 August 2028 after Regulation (EU) 2026/1744 (MDCG 2025-6; Regulation (EU) 2026/1744).
