Conformity assessment and the notified body
A device reaches the European market with a CE mark rather than an agency's authorisation. Its class and characteristics decide which conformity assessment routes are open to it: some of the lowest-risk devices are self-certified by their manufacturer, and the others are assessed by a notified body, a private organisation designated for the purpose and chosen by the manufacturer, against technical documentation that shows the device conforms. Notified bodies are designated and overseen under the regulation, which also limits the advice a manufacturer can get from them before submitting, while expert panels supported by the European Medicines Agency advise on certain high-risk devices.
The route to the CE mark
European device regulation rests on the New Approach, established in the mid-1980s to harmonise the regulation of the technical aspects of industrial products in the EU. The approach sets a minimum of mandatory essential requirements for safety and performance that a product must meet to be sold in the EU, but it prescribes no detailed technical specifications or solutions. It promotes voluntary harmonised standards, developed by the recognised European standards organisations and referenced in the Official Journal of the European Union, and compliance with them can be used to demonstrate conformance with the essential requirements as appropriate.
Certification for devices and implants in Europe is European rather than national, through the CE mark (Conformité Européenne). This spares companies registering a device country by country, which would be more complex and time-consuming and might lead them not to seek approval in some countries. In many countries, however, CE certification does not guarantee access to new devices until reimbursement negotiations take place there.
A device cannot be commercially distributed or sold in the European market without CE certification, so every device patients receive is CE-certified. The few exceptions, such as devices in pre-market clinical studies or in compassionate use, must be labelled as investigational devices, and the patients must be adequately informed of the device's status and must sign an informed consent form that also records that they know it is not CE-certified.
Under the directives, devices sold on the EU single market had to be CE marked to certify that they complied with the essential requirements of the relevant directive and of any additional EU legislation that applied. The process took into account the category of device, its pertinent characteristics and its risk profile. The route to a CE mark ran in six steps, in order:
- Define the scope of regulation: is the product a medical device, and which directives apply?
- Classify the device as class I, IIa, IIb or III.
- Identify the applicable essential requirements and the available conformity assessment routes.
- Establish compliance with the essential requirements through the harmonised standards that can be applied.
- Undergo the conformity assessment: review of the device documentation, assessment of the quality systems and examination of the device by a notified body, as appropriate.
- Draw up the declaration of conformity and affix the CE mark.
Devices are stratified by risk, because they are so varied that subjecting all of them to the same level of scrutiny in a conformity assessment is not considered practical or cost-effective. Under the directives, the device's characteristics, such as whether it was sterile, had a measuring function or incorporated a medicinal product or software, together with its class, determined the applicable essential requirements and the available conformity assessment routes. For example, a non-sterile class I device without a measuring function required only that the manufacturer self-certify conformance to the essential requirements, while class IIa to class III devices required an independent conformity assessment by a notified body. The notified body's assessment could include an audit of the manufacturer's technical documentation or quality system, or a product inspection, and could focus on some or all aspects of the device's design and production. To obtain the CE mark, a manufacturer had to identify and comply with the applicable essential requirements, which it could do through harmonised standards, and had to prepare technical documentation capturing the evidence of conformance. It might also have to establish a quality management system covering some or all aspects of design and production. It then drew up a written declaration of conformance and affixed the mark.
The annexes of the Medical Device Regulation (MDR) set out three conformity assessment routes: one based on a quality management system and assessment of the technical documentation, one based on type examination and one based on product conformity verification. Further annexes cover the EU declaration of conformity, the CE marking of conformity, the requirements to be met by notified bodies, the procedure for custom-made devices and the certificates a notified body issues.
What a notified body is
A notified body is an organisation designated by an EU country to assess the conformity of certain products before they are placed on the market. Notified bodies can be designated under many different regulations and pieces of legislation, and the CE mark on a lift or on a child's toy may have involved one. Under the MDR and the In Vitro Diagnostic Regulation (IVDR), a notified body is a third party that carries out the conformity assessment procedures the legislation sets out. It evaluates a manufacturer's compliance with the regulation and, where compliance has been demonstrated, issues a certificate that allows the manufacturer to put the CE mark on the device.
In Europe, unlike in the United States with the FDA, private entities such as TÜV, BSI and DEKRA may decide whether a device receives certification. Notified bodies are private companies rather than government agencies, and they range in size and scope. Many began as government agencies or as spin-outs from them. BSI, for example, started with weights and measures standards and moved into ISO standards before expanding into notified-body work, and it is now a chartered company rather than a government agency. Many other notified bodies share that history, among them many of the TÜVs, which started life as standards agencies. Others are entirely separate private companies.
How a notified body is designated
Although notified bodies are private entities, they cannot act in a legal vacuum. Each is designated and supervised or audited by the national competent authority, which reports CE approvals to the European Commission. The national authority is responsible for setting up and carrying out the procedures for assessing and designating conformity assessment bodies under a Mutual Recognition Agreement or the CETA Protocol on Conformity Assessment. Annex VII of the MDR sets out the requirements notified bodies must meet.
Designation as a notified body is substantial work. A body is audited by the EU competent authorities against the regulation it is to be designated for. Because the device regulation covers the whole of Europe, the audit also involves joint assessment teams. Accounts differ on who then designates the body. In one notified body's account, a group of European countries designates it rather than a single country. An account of the MDR at its adoption has the member states still designating and assessing the notified bodies, with multinational teams overseeing those assessments. BSI began working towards designation under the MDR about three years before the regulation took effect in 2021.
An application for designation under the MDR and the IVDR consisted of process flow diagrams, procedures, forms and templates, none of them yet used to assess the conformity of an actual device, and no body was allowed to take on actual conformity assessment work until it was designated. Once BSI was designated, its technical specialists and quality management system teams used those documents together with their expertise, and its processes, procedures, forms and IT systems, built in theory, were improving as hundreds of people completed hundreds of reviews. BSI was the first body designated under the MDR and the second under the IVDR. The regulations are more prescriptive, but BSI was already doing many of the activities Annex VII requires.
Choosing a notified body
Under the directives, a manufacturer first determined whether the device fell within their scope and, if it did, applied to a notified body to demonstrate that the obligations for CE marking had been met. Each member state's competent authority could designate one or more notified bodies to assess conformity for specified types of device, such as non-active functional implants (MD 0204), devices for wound care (MD 0300) and devices incorporating medicinal substances (MDS 7001), and a manufacturer was free to choose any body designated for its type.
Because notified bodies are private companies, the manufacturer chooses which one to work with, provided the body is designated in the area. Notified bodies have different scopes, so a manufacturer should check that the body's scope covers its type of device or combination device. A full-scope body such as BSI covers any type of device or IVD falling under the two regulations with the relevant expertise in-house, while some bodies specialise, as digital notified bodies or IVD-only notified bodies, for example. The NANDO website lists every notified body with its scope under each piece of legislation. Fees are one factor in the choice, but nothing affects the cost more than the quality of the documentation given to the notified body. The better the technical documentation, the fewer questions it brings and the quicker the process, and a quicker process is a cheaper one.
A manufacturer can change its notified body when unsatisfied with its work, and only 84 devices had been rejected in the eight years up to 2019. The low rejection rate might be because most certifications are recertifications, since a device's certification has to be renewed regularly, generally every three years.
Technical documentation
The technical documentation is the dossier submitted to notified bodies for the conformity assessment of medical devices, the equivalent of the CTD for a medicinal product. It includes all the documentation providing evidence of compliance with the general safety and performance requirements of Annex I of the MDR, and it is the entirety of the documents describing the device: its design, development, verification and validation, including clinical and performance validation, and its regulatory status in the target markets. It must be made available for every device, whatever its class, before the device is placed on the European market. The technical documentation of a self-certified class I device is not always subject to review, while that of devices from class I non-sterile up to class III is always reviewed by the notified body.
The MDR, unlike the directive, gives the technical documentation a clear structure by defining its requirements in its annexes. Annex II sets out its contents: the device description and specification, including variants and accessories and reference to previous and similar generations of the device; the information to be supplied by the manufacturer; design and manufacturing information; the general safety and performance requirements; benefit-risk analysis and risk management; and product verification and validation, with pre-clinical and clinical data and additional information required in specific cases. Annex III sets out the technical documentation on post-market surveillance: the post-market surveillance plan, the periodic safety update report and the post-market surveillance report. The MDR also requires a closed-loop process fed by data from the device's post-market use, so that early warnings are captured, the general safety and performance requirements are continuously fulfilled and the benefits for the patient always outweigh the risks.
BSI has published a best practice guideline on documentation submissions under Article 117, which takes a manufacturer through the sections of the technical documentation and what the conformity assessment expects to see, so that a complete original file brings fewer questions. Team-NB, the notified bodies' trade association, and other notified bodies publish guidance as well. Team-NB's position paper on best practice guidance for technical documentation under the MDR reached its third version in April 2025.
Medical writers may occasionally be asked to help update the technical documentation, and most device writers will have been involved in regularly updating the clinical evaluation plans and reports that are based on it.
No public database yet groups devices under similar codes for a writer to use as references in technical documents. BSI holds databases of the devices it assesses but does not make them public. EUDAMED, which will be a database of all medical devices in Europe, will answer the need once it is running, although its implementation has been "a little bit delayed". Other sources give information on device types and device groups, but none does what such a database would.
Notified bodies under the MDR
Because they assess the clinical evaluation the manufacturer provides, notified bodies play a key role in approving and marketing devices. The regulation stresses the importance of their proper functioning and of a coherent process to designate and monitor them throughout Europe, which was expected to reduce discrepancies between member states. The bodies are to be regularly controlled to ensure quality and ethical standards. Their workload was expected to rise substantially, since under the MDR they carry out unannounced factory inspections and physical or laboratory tests on devices. The experts assessing devices are expected to rotate at regular intervals to keep the relationship with manufacturers neutral.
Notified bodies face closer scrutiny from the competent authorities, and strict designation requirements and evaluations of their capabilities may leave a number of them not re-notified. Designated notified bodies will work closely with the Commission to ensure that clinical evaluation and post-market clinical follow-up plans are adequate before certificates are gained for certain classes of devices, and will follow stricter procedures in the conformity assessment of high-risk class III devices.
Among the MDR's most important changes are enhanced criteria for conformity assessment, which rests in part on the clinical evaluation report.
Conformity assessment of class III devices and of class IIb devices that administer a medicinal product is no longer wholly in the notified body's hands. For those devices, the notified body sends its clinical evaluation assessment to an expert panel via the Commission, and it can certify the device only once the panel has issued comments or has failed to issue an opinion within 60 days, a procedure similar to the one Commission Directive 2003/32/EC sets for devices that include animal tissues. Independent expert panels under the supervision of the European Commission are involved in reviewing class III and implantable devices. For high-risk devices, and not for lower-risk ones, the notified body has to consult the expert panels set up at the European Medicines Agency within its certification assessment. Under Regulation (EU) 2022/123, the agency provides the secretariat that supports the expert panels. The panels give notified bodies opinions and views on the scientific assessment of the clinical and performance evaluations of certain high-risk devices and in vitro diagnostics. The agency sees sharing expertise between itself and the notified bodies as a work in progress, and much expertise was lost after Brexit, since the UK had been doing a lot of assessment.
The regulation prescribes the sample size and frequency of technical documentation reviews. The increased number of reviews will raise manufacturers' costs, which may lead some to choose not to place a product on the EU market.
Earlier changes to EU legislation added a few new things to check, without a full re-review of the technical documentation. The 2007 amendment, Directive 2007/47/EC, made clinical evaluation a requirement for all devices, and it required reviews of the specific risks of single-use devices and of specific justifications for not performing clinical investigations on high-risk devices and for not completing post-market clinical follow-up. The MDR and the IVDR require all technical documentation to be re-reviewed. The conformity assessment for listing a device on an MDR certificate is an initial assessment, even for a safe device with 10, 20 or 30 years of evidence of performing as intended, and it takes time that used to be spread over many years.
After issuing its first few hundred MDR and IVDR certificates, BSI found that its people had gained confidence from actually assessing conformity to the regulations and that manufacturers' applications had started to flow more smoothly. Its greatest remaining challenges were interacting with EUDAMED and keeping its teams trained on the thousands of pages of MDCG guidance.
Scientific advice before submission
Scientific advice is a difficult thing for notified bodies to give. They are a disparate group of private entities and are not typically involved at the clinical trial stage, since most device manufacturers come to them when the product is fully developed and tested and ask for a conformity assessment. They have a process called structured dialogue for conversations with manufacturers, but the regulation limits the advice they can give and forbids them to stray into consultancy. That limit makes advice awkward, and it is the reason the agency is looking into how scientific advice for combination products could be improved. Notified bodies do give some advice and guidance, particularly on the documentation required. For novel devices, companies usually discuss with the notified body in advance what data it wants to see, and they rarely invest the time and money in a submission for a device that does not meet the pre-specified success criteria. Those criteria commonly require a sample size calculated statistically from an expected endpoint.
A manufacturer can bring questions on a specific planned submission, but in one notified body's understanding scientific advice may give very specific written answers to very specific questions, while structured dialogue more likely gives very general answers, especially early in development. Under structured dialogue BSI will not make specific commitments, such as agreeing that a clinical trial of 70 patients will be perfect, but it can give general advice on the regulatory pathways. A manufacturer may talk to its notified body about the process and its expectations, but the body cannot give the answers to the tests it is going to mark.
Structured dialogue is a meeting rather than the review of a briefing document, though questions sent in advance are always useful, and so is briefing information where the matter is complicated. The term is new and MDCG guidance has formalised it, but conversations of the same sort could be held under the device directives without that name. A manufacturer may hold a structured dialogue with one notified body and then submit to another. The advice should still hold there, because it all comes from the same legislative background, but this possibility is one of the reasons scientific advice from individual notified bodies is difficult.
The agency's own advice routes for devices include scientific advice for certain high-risk devices, which sponsors and notified bodies can request; scientific advice for a manufacturer that wants feedback on its clinical development strategy; and a pilot for high-risk orphan devices. The agency's experience of scientific advice, mainly on medicines, is gradually expanding into the device field through the expert panels.
The agency, in close collaboration with the European Commission, has established a regular procedure for manufacturers of class III devices and of class IIb active devices intended to administer or remove medicines to request scientific advice on their intended clinical development strategy and proposals for clinical investigation. They submit the request through a portal and can consult the medical device expert panels at different stages of clinical development. The agency describes advice from the panels as a key tool to foster innovation and to promote faster patient access to safer and more effective devices. The procedure follows a pilot launched in February 2023, which, in the agency's account, helped to establish it and gathered positive feedback from manufacturers and panel experts. The agency was to publish a report on the pilot. In early 2025 there were no fees for these requests, and the agency's website gave step-by-step instructions and monthly submission deadlines. Manufacturers of high-risk devices for treating a rare condition were to apply through the ongoing pilot for orphan devices.
Expert-panel advice for orphan devices
Orphan drugs are well defined in EU legislation, but the MDR does not define orphan devices. The first EU definition came in 2024, in guidance MDCG 2024-10 from the Medical Device Coordination Group, which is composed of representatives of all member states: a device specifically intended to benefit patients in the treatment, diagnosis or prevention of a disease or condition that presents in not more than 12,000 individuals in the EU a year. The guidance, announced by the Commission in June 2024, gives the criteria for when a device should be regarded as an orphan device under the MDR and aims to guide manufacturers and notified bodies in applying the clinical evidence requirements. Orphan devices are often used to treat or diagnose rare diseases or conditions for which no or insufficient alternative diagnostic or therapeutic options exist, and so meet an unmet medical need.
On 2 August 2024 the agency launched a pilot in which the expert panels give selected manufacturers and notified bodies free advice on orphan device status and on the data needed for clinical evaluation. The pilot was set up to help manufacturers and notified bodies with the challenges orphan devices face, mainly high-risk ones in class IIb and class III, especially in generating their clinical evidence before they reach the market. Manufacturers can consult the panels at different stages of developing the clinical strategy for their device, and notified bodies at specific points of an ongoing conformity assessment. The pilot prioritises certain orphan devices, such as devices for a condition that is life-threatening or could permanently impair a body function, devices intended for children, and novel devices with potential major clinical benefit. The pilot was scheduled to run until the end of 2025, with a long-term process for orphan devices as the aim. An information session was held in September 2024, followed by a question-and-answer document.
The orphan-device pilot is part of the agency's support for the expert panels, which it has given since 1 March 2022. It runs alongside the scientific-advice pilot for manufacturers, which already prioritised advice on the clinical development strategy and clinical investigations of devices addressing unmet needs. The agency describes early advice to manufacturers, particularly small and medium-sized enterprises, as a key tool to foster innovation and access to safer and effective devices that address patients' needs.
An application for expert-panel consultation comprises an application form and a briefing document. One of its key sections justifies the device's orphan status from the state of the art, such as the epidemiology of the disease or condition and the insufficiency of current treatment options. For legacy devices and devices in advanced stages of development, the clinical evaluation report has to include the rationale for the orphan designation, which should be consistent with the state of the art in the briefing document. Another component is the consideration of limited premarket clinical evidence, off-label use data and the extrapolation of that information to the orphan intended use. For a drug-device combination, the link between the orphan medicinal product and the orphan device component has to be very clear. Regulatory medical writers play a vital role in putting these components together.