Documentation Regulatory pathway

CE Mark

The route to market in the European Union: demonstrate conformity with the Medical Device Regulation or the In Vitro Diagnostic Regulation, usually with a Notified Body, then apply the CE mark.

Legal basis: Regulation (EU) 2017/745 (MDR) for medical devices; Regulation (EU) 2017/746 (IVDR) for in vitro diagnostics
In application: MDR since 26 May 2021, IVDR since 26 May 2022, with transition periods for devices certified under the earlier directives
Risk classes: MDR: I, IIa, IIb, III. IVDR: A, B, C, D
Who assesses: The manufacturer alone for most Class I and Class A devices. A Notified Body for everything else
Outcome: An EU Declaration of Conformity and the CE mark, with the Notified Body’s number where one was involved

In short

The CE mark is the manufacturer’s declaration that a device meets the general safety and performance requirements in Annex I of the regulation. For anything above the lowest class, a Notified Body audits the quality system and reviews the technical documentation before issuing certificates. There is no central EU agency that approves devices.

What it asks for

Classification. By the rules in Annex VIII. For software, MDR Rule 11 places most software that informs diagnostic or treatment decisions in Class IIa or higher. MDCG 2019-11 is the guidance.
A quality system and risk management. In practice ISO 13485 and ISO 14971.
Technical documentation. Annex II, plus the post-market surveillance documentation in Annex III.
Clinical evidence. A clinical evaluation under the MDR or a performance evaluation under the IVDR, kept up to date after launch.
Conformity assessment. By one of the routes in Annexes IX to XI that the device class allows.
Identification and registration. Unique device identification, registration in EUDAMED, a person responsible for regulatory compliance (Article 15) and, for manufacturers outside the EU, an authorised representative.
Post-market obligations. A surveillance plan, periodic safety update reports for higher classes, vigilance reporting and post-market follow-up.

On a software project

Annex I has a software section. Section 17 of the MDR and section 16 of the IVDR require development to the state of the art, covering the life cycle, risk management including information security, verification and validation, and stated minimum IT requirements. IEC 62304, IEC 82304-1 and IEC 81001-5-1 are the usual evidence.
Settle classification first. It decides whether a Notified Body is involved and how much evidence is needed, and it is hard to change late.
Changes may need the Notified Body. Depending on the certificate, a change to a certified device can require notification or approval before release. Build that into release planning.
Legacy devices are frozen. A device still sold under a certificate from the old directives cannot have significant changes to its design or intended purpose. MDCG 2020-3 explains which software changes count.

Status at the last review

Transition deadlines. For legacy devices that meet the conditions: under the MDR, 31 December 2027 for Class III and most implantable Class IIb devices, and 31 December 2028 for other devices that need a Notified Body. Under the IVDR, 31 December 2027 for Class D, 2028 for Class C, and 2029 for Class B and sterile Class A.
EUDAMED. The first modules became mandatory on 28 May 2026.
Revision. In December 2025 the European Commission proposed a targeted revision of both regulations. Until it is adopted, the current text applies.
Great Britain and Switzerland have their own arrangements and are not covered here.

Official sources

A summary for orientation. It is not regulatory or legal advice, and it is no substitute for the standard or regulation itself. Requirements change: confirm the current edition before relying on anything here. Last reviewed November 2026.