EU MDR at a Glance: What It Is, Who It Affects, and How It Works

Why MDR replaced MDD

EU Regulation 2017/745 — the Medical Device Regulation — entered into force in May 2017 and became fully applicable in May 2021, with legacy device transition extensions running through 2027 and 2028 depending on class. It replaced the Medical Device Directive (93/42/EEC) and the Active Implantable Medical Devices Directive (90/385/EEC).

The move from directives to a regulation matters more than it might sound. Directives had to be transposed into national law by each member state, which meant the same rules could be interpreted and enforced differently across the EU. A regulation applies directly and uniformly — no transposition, no national variation. That was the explicit goal: one set of rules, consistently applied.

The trigger was a series of high-profile device failures — the PIP breast implant scandal and metal-on-metal hip implants — that exposed how weak the notified body oversight system was, and how easily products with inadequate clinical evidence could stay on the market under MDD. MDR was the response: tighter scrutiny, stronger clinical evidence requirements, and a surveillance framework that doesn't end at CE marking.

What MDR covers

MDR covers medical devices intended for human use. The scope is wider than most teams expect when they first read it. The definition casts a broad net — instruments, software, implants, reagents, and materials all qualify, as long as the primary way the product works is not pharmacological, immunological, or metabolic. That last point is what separates a device from a medicinal product, and it creates a genuine grey zone: combination products, drug-device combinations, and products on the border with cosmetics, food supplements, or general-purpose software all require careful analysis before you can be confident you're even in scope.

If you're not sure whether your product is a medical device at all, start with the MDCG borderline guidance — particularly MDCG 2019-16 — before you touch the classification rules. Scope comes before classification.

The regulation covers the full product lifecycle: development, clinical investigation, conformity assessment, registration, post-market surveillance, vigilance, and withdrawal. Obligations fall on manufacturers most heavily, but authorised representatives, importers, and distributors all have defined responsibilities — and the closer you are to the manufacturer end of the chain, the more you own.

The classification system

MDR classifies devices into four risk classes — I, IIa, IIb, and III — using 22 rules in Annex VIII. You apply the rules to your specific device based on what it does, how long it contacts the body, how invasive it is, and whether it delivers energy or releases a substance. The rules don't always give a clean answer on first read, and some devices hit more than one rule — in which case the higher class applies.

• Class I — lowest risk; most self-certify with no notified body, except Class Is (sterile), Class Im (measuring function), and Class Ir (reusable surgical instruments), which need a notified body for specific aspects
• Class IIa — medium-low risk; notified body review required
• Class IIb — medium-high risk; notified body required, more rigorous scrutiny
• Class III — highest risk (implants, active devices administering or withdrawing substances); full notified body involvement, and certain devices require an additional expert panel procedure

Getting classification right early matters because it determines everything downstream: which conformity route you follow, how much clinical evidence you need, what your PMCF obligations look like, and the scope of your technical documentation. Misclassification is one of the more common reasons notified bodies push back on submissions.

The conformity assessment routes

Once you know your device class, you know which conformity assessment route applies. This is how you show the device meets the General Safety and Performance Requirements in Annex I — and for most classes, it involves a notified body reviewing either your quality management system, your technical documentation, or both.

• Class I (non-sterile, non-measuring, non-reusable surgical): Self-declaration — no notified body, but you still need a complete technical file and Declaration of Conformity.
• Class Is / Im / Ir, IIa, IIb: Notified body reviews your QMS and/or technical documentation under the Annex XIV procedures. Which combination you choose has implications for audit scope and ongoing surveillance.
• Class III and implantable IIb: Full QMS assessment plus notified body review of the design dossier.

One thing worth noting: CE marking is not regulatory approval in the way pharmaceutical market authorisation is. It is the manufacturer's declaration — supported by notified body certification where required — that the device meets the applicable requirements. It allows free movement in the EU/EEA market, but it is not an approval granted by a regulator.

EUDAMED and UDI

EUDAMED — the European Database on Medical Devices — is where manufacturers register their devices, UDI codes, certificates, and serious incident reports. The UDI system assigns a device identifier (UDI-DI) and production identifier (UDI-PI) to each device, creating traceability from manufacturer through supply chain into clinical use.

EUDAMED rolled out in phases and is now active for registration obligations, though some modules were delayed beyond the original timeline. If you are placing devices on the EU market under MDR, you need to be registered. The key distinction to understand is UDI-DI versus UDI-PI, and the requirements in Article 27 and Annex VI Part C are where that detail lives.

What this means in practice

If you are a manufacturer placing a medical device on the EU market, MDR is not something you implement once and forget. It is a continuous quality and surveillance system. You need a QMS (typically ISO 13485-aligned), technical documentation meeting Annex II and III, a clinical evaluation following Annex XIV (and for most devices, a post-market clinical follow-up plan), and a post-market surveillance system with a PMCF plan and annual or periodic safety update reports.

If you are early in your MDR journey, the most useful next step after this overview is device classification — because every other obligation follows from it. The MDCG classification guidance and the classification rules in Annex VIII are where that work begins.