A roadmap to EU MDR conformity for medical-device manufacturers

A manufacturer that already holds a CE mark under the old Medical Device Directive often treats the move to the EU MDR as a paperwork refresh. It almost never is. Regulation (EU) 2017/745 reorganized both the evidence a device file has to contain and, more decisively, the order in which that evidence has to come together. Get the sequence wrong and you can spend the better part of a year building a technical file around a classification that later shifts, or finally approach a Notified Body only to join a review queue that pushes your launch past the window you were planning for.

The regulation has applied since 26 May 2021, and the transitional deadlines for legacy certificates have since been extended by amending regulation and vary by risk class, so confirm the dates that apply to your own devices. Deadlines aside, the part that quietly decides whether a programme runs to plan is sequencing. The same tasks done in a different order can mean months of avoidable rework.

MDR readiness is a dependency chain, not a checklist

It helps to stop thinking of MDR as a list of deliverables to tick off and start treating it as a dependency chain. Each stage produces something the next stage needs. Classification fixes your conformity assessment route. The quality system becomes the container that every later record is created and controlled inside. The clinical evaluation feeds the technical documentation. Post-market data eventually loops back and updates all of it. Most manufacturers should hold roughly this order:

1. Classification under Annex VIII
2. The ISO 13485 quality management system
3. Technical documentation to Annex II and III
4. Clinical evaluation under Annex XIV
5. The Notified Body conformity assessment, where the class requires it
6. UDI assignment and Eudamed registration
7. Post-market surveillance and vigilance

None of these are truly independent, and a mature programme runs several in parallel. The value is in knowing which stage gates which, so the long-lead work starts early and the dependent work is not blocked. Here is the reasoning behind the order.

Classification comes first because it sets every route after it

MDR sorts devices into Class I, IIa, IIb and III by risk, using the twenty-two rules in Annex VIII, with Class I further split into sterile (Is), measuring (Im) and reusable surgical instruments (Ir). The class is not a label you attach at the end. It is the switch that decides your conformity assessment route, whether a Notified Body has to be involved at all, how much clinical evidence is expected, and how often you report once the device is on the market. MDR also up-classified several groups compared with the old directive, including a great deal of software under Rule 11, substance-based devices under Rule 21, and reusable surgical instruments, so a product that self-declared under the MDD may now sit in a class that needs a Notified Body. Pin down the class, and the specific rule you relied on, in writing before anything else, because a reclassification halfway through invalidates assumptions already baked into the quality system, the technical file and the clinical plan.

Stand up the ISO 13485 quality system before the records pile up

Article 10 requires every manufacturer to operate a quality management system, and EN ISO 13485:2016 is the recognized way to build and demonstrate one. The reason it belongs this early is practical rather than bureaucratic. Design controls, risk management to ISO 14971, document and record control, supplier controls and corrective and preventive action are the processes that generate and govern everything that later lands in your technical file. Write the documentation first and formalize the system afterwards, and you spend weeks retrofitting traceability and re-issuing records under controlled procedures. Establish the system first, including your risk management file, your design and development records, and the person responsible for regulatory compliance named under Article 15, then let the rest of the evidence be produced inside it from the start. For a manufacturer building this layer, our ISO 13485 medical device quality management system service sets out the scope an MDR file leans on.

Build the technical documentation as a living file

Annex II defines what the technical documentation must hold and Annex III adds the post-market surveillance documentation: device description and specification, design and manufacturing information, the general safety and performance requirements with the evidence supporting each one, the benefit-risk analysis, verification and validation, and labeling. The recurring mistake is to treat this as a report written at the end. The general safety and performance requirements checklist in particular should be opened early and filled in as evidence arrives, because that is what exposes the gaps, a missing biocompatibility test or an unverified performance claim, while there is still time to close them. A file assembled in the final weeks almost always surfaces a study that needed to start months earlier.

Clinical evaluation is the longest pole, so start it early

Under Article 61 and Annex XIV, clinical evaluation is a planned and continuous process: a clinical evaluation plan, a structured appraisal of the clinical data available to you, and a clinical evaluation report that has to support every clinical claim in your labeling. MDR raised the threshold for what counts as sufficient clinical evidence and tightened the conditions for relying on equivalence, so data that satisfied the old directive may no longer carry the file. Where the evidence is thin, you may need a clinical investigation under Annex XV, which brings its own approvals and lead times. That is why clinical evaluation should run alongside the quality system rather than wait for the technical file to be drafted. It is the stage most likely to add months, and it gates the credibility of everything downstream of it.

Engage the Notified Body sooner than feels necessary

For every class above the self-declared part of Class I, and for the Is, Im and Ir sub-classes, an MDR-designated Notified Body has to assess your conformity, usually through the quality system and technical documentation route in Annex IX, or the type-examination and production routes in Annexes X and XI. Two practical realities drive the timing. The number of designated bodies and their assessment capacity has been tight since the regulation applied, so contracting and onboarding can take longer than the audit itself. And a Notified Body cannot assess a moving target, so your classification, quality system and technical file need to be stable enough to review. Identify a body whose designated scope actually covers your device type and approach it early, while your documentation is still maturing, so the queue runs in parallel with your internal work rather than after it. Class I devices that are not sterile, have no measuring function and are not reusable surgical instruments self-declare and affix the CE marking without this step; confirming which path applies on the medical device CE certificate route is worth doing before you assume either one.

Assign UDI and register in Eudamed before the device ships

Before a device reaches the EU market it needs a Unique Device Identification: a UDI-DI tied to the device and model, and a UDI-PI for production attributes, obtained through an issuing entity such as GS1. The manufacturer, or for a non-EU manufacturer the authorized representative appointed under Article 11, also registers as an economic operator and submits device data to Eudamed, the European database that links registration, certificates, vigilance and market surveillance. Eudamed has been rolling out in phases, with some modules available ahead of others, so plan UDI assignment and data submission as part of the launch rather than a formality once the certificate is in hand. Your labeling, packaging and technical file all reference the UDI, which is one more reason it cannot be added at the very end.

Post-market surveillance closes the loop and feeds the next cycle

Certification is not the finish line. Articles 83 to 86 require a post-market surveillance system that actively gathers field data against a written PMS plan, and the output depends on class: a post-market surveillance report for Class I, and a periodic safety update report for Class IIa, IIb and III that has to be kept current. Post-market clinical follow-up feeds fresh clinical data back into the clinical evaluation, while the vigilance articles that follow require you to report serious incidents and field safety corrective actions. Putting this stage last in the list is misleading in one sense: it is not last in time. The data it produces updates your risk management, your clinical evaluation and your technical documentation, which is exactly what turns MDR from a one-off project into a cycle.

The sequencing errors that cost the most time

A handful of ordering mistakes account for most of the lost months:

• Drafting the technical file before the classification is confirmed, then reworking it when the class changes.
• Formalizing the quality system after the records already exist, which forces a controlled re-issue.
• Leaving clinical evaluation until the file is otherwise finished, when it is the stage most likely to need new data.
• Approaching a Notified Body only once documentation is complete, and losing time in a queue that could have run in parallel.
• Treating UDI and Eudamed as a post-certification formality instead of a launch dependency.

Phasing the work so the dependencies line up

A realistic programme rarely runs these stages strictly end to end. Classification and the quality system come first and move quickly. Clinical evaluation and Notified Body engagement start early precisely because they carry the longest lead times. Technical documentation, UDI and Eudamed mature alongside them, and post-market surveillance is designed before launch and then runs for the life of the device. For Turkish and other non-EU manufacturers there is one more early dependency worth naming: appointing an EU authorized representative, since several registration steps depend on it being in place. If you want to map this sequence onto a specific device, Eurocert audits and certifies against ISO 13485 and supports the medical-device CE route; the ISO 13485 quality system and medical-device CE marking pages are practical places to begin.