The harmonised standards under the MDR are listed in Commission Implementing Decision (EU) 2021/1182 and its amendments. The most recent amendment, Implementing Decision (EU) 2026/1231 of 11 June 2026, added and updated references for areas such as biological evaluation, symbols, medical electrical equipment and washer-disinfectors. The Commission's summary list generated on 17 June 2026 reflects these changes (European Commission).
Only a listed standard gives a presumption of conformity, and only for the requirements it covers. This article explains what that means, which standards matter most for software, how common specifications differ, and how to cite standards in the technical documentation.
What harmonised standards give you
Article 8(1) of the MDR provides that devices in conformity with relevant harmonised standards, or parts of them, whose references are published in the Official Journal, are presumed to conform to the MDR requirements those standards cover. Article 8(1) applies the same presumption to system and process requirements, such as quality management, risk management and post-market surveillance.
According to MDCG 2021-5 Rev.1, the MDCG guidance on standardisation:
using harmonised standards is voluntary, and other solutions are allowed where the manufacturer shows conformity;
the presumption applies only to the requirements listed as covered in the standard's Annex Z;
notified bodies take harmonised standards into consideration, even where the manufacturer does not claim them.
One exception: Annex I Section 23.1(h) requires symbols and identification colours used in the information supplied with a device to conform to harmonised standards or common specifications.
Standards that matter for software
| Standard | Harmonised under the MDR? |
|---|---|
| EN ISO 13485:2016 + AC:2018 + A11:2021 (quality management) | Yes, since 5 January 2022 (Decision 2022/6) |
| EN ISO 14971:2019 + A11:2021 (risk management) | Yes, since 17 May 2022 (Decision 2022/757) |
| EN ISO 15223-1:2021 + A1:2025 (symbols) | Yes, since 17 June 2026; the reference without A1 stops giving a presumption on 15 June 2031 |
| EN ISO 14155:2020 + A11:2024 (clinical investigations) | Yes, since 30 January 2026 (Decision 2026/193) |
| EN 62304 (software life cycle) | No |
| IEC 62366-1 (usability engineering) | No |
| IEC 81001-5-1 (health software security) | No |
Source: Commission summary list of MDR harmonised standards, generated 17 June 2026.
The summary list is for information only and has no legal effect. The Official Journal decisions are the legal reference, so check the decision text on EUR-Lex if the two differ.
Our articles on EN ISO 13485, IEC 62304 and IEC 81001-5-1 cover these standards in more detail.
How a standard gets listed
The Commission asks the European standardisation organisations, CEN and CENELEC, to develop standards in support of the MDR under standardisation request M/575. Once a standard is adopted, the Commission assesses it and decides whether to publish its reference in the Official Journal, with or without restrictions.
Legal effect starts on the date the reference is published, not the year printed on the standard. A newer edition of a listed standard is not covered until the Commission lists that edition.
In our view, review the list at every amendment of Decision 2021/1182 and record the date of the check. Article 10(9) requires changes in harmonised standards to be taken into account in a timely manner.
Standards that are not listed
Unlisted standards can still be strong evidence. According to MDCG 2021-5 Rev.1, the most recent versions of standards are commonly considered to reflect the state of the art, but complying with an unlisted standard does not automatically mean complying with the MDR.
For software, MDR Annex I Section 17.2 requires development in accordance with the state of the art. EN 62304, IEC 62366-1 and IEC 81001-5-1 are the usual evidence. In our view, cite each one with a short rationale: which requirement it supports, which edition you used, and what it does not cover. Our article on what state of the art means under the MDR explains how to document that.
Common specifications
Common specifications under Article 9 work differently:
devices in conformity with them are presumed to conform to the requirements they cover (Article 9(2));
manufacturers must comply with them unless they duly justify adopting solutions that ensure at least an equivalent level of safety and performance (Article 9(3));
products without an intended medical purpose listed in Annex XVI must comply with the relevant common specifications (Article 9(4)).
In our view, once a common specification applies, treat it as mandatory and record any justified deviation in the quality management system.
Citing standards in the technical documentation
| Provision | What it means for the file |
|---|---|
| Article 8(1) | Map each GSPR to the Annex Z coverage of the harmonised standards you claim |
| Article 9 | Map applicable common specifications, and justify any equivalent solution |
| Article 10(9) | Keep a procedure for identifying the GSPR and tracking changes in standards |
| Article 32(2)(e) | List the harmonised standards and common specifications applied in the SSCP, where one is required |
| Annex II Section 4 | Show the solutions used to meet each GSPR, including standards applied in full or in part |
Source: MDR.
The GSPR checklist is where all of this comes together, with one row per Annex I requirement.
A hypothetical example
Hypothetical example: a Dutch SaMD manufacturer prepares its GSPR checklist.
Quality management and risk: it cites EN ISO 13485 and EN ISO 14971 for the requirements in their Annex Z, and claims a presumption only for those.
Labelling: it uses symbols from EN ISO 15223-1, as Annex I Section 23.1(h) requires.
Software life cycle (Annex I 17.2): it cites EN 62304, IEC 62366-1 and IEC 81001-5-1 as the state of the art, with a written rationale for each, and claims no presumption.
Monitoring: it checks each new amendment of Decision 2021/1182 and records the date.
Manufacturers outside the EU also need an EU authorised representative, who must verify under Article 11 that the technical documentation has been drawn up. MedQAIR's Digital AR service covers that role.
Conclusion
The list in Decision 2021/1182 is the legal reference. Annex Z decides how far a presumption reaches, common specifications bind harder than standards, and unlisted standards need a written argument. Many key software standards are not harmonised under the MDR, so for software the rationale in the file matters most.
In our view, keep a dated record of the standards you use and check it at every amendment of the list.
If you need help mapping standards to your device, our regulatory strategy team can help, or contact MedQAIR.
Frequently asked questions
Are harmonised standards mandatory under the MDR?
No. They are voluntary, and other solutions are allowed if conformity is shown. Symbols are the exception under Annex I Section 23.1(h).
Is IEC 62304 harmonised under the MDR?
No. EN 62304 is not on the Commission's summary list of MDR harmonised standards generated on 17 June 2026.
Where is the official list of MDR harmonised standards?
In Commission Implementing Decision (EU) 2021/1182, as amended, published in the Official Journal. The Commission's summary list is for information only.
What is the difference between a standard and a common specification?
Harmonised standards are voluntary. Common specifications must be followed unless the manufacturer duly justifies an equivalent solution.
Does a newer edition of a harmonised standard give a presumption?
Not until the Commission lists that edition in the Official Journal.
