EU MDR · Regulation (EU) 2017/745 on medical devices
EU MDR compliance consulting for devices that reach the European market and stay on it.
Bring your devices to the EU under Regulation (EU) 2017/745 with a quality management system, technical documentation and post-market surveillance that a notified body can certify. Sterling's expert and experienced consultants build the Article 10 system, the Annex II and III files, the person responsible for regulatory compliance and the UDI and EUDAMED set-up with your engineers, in 60+ countries, and stay with you through the notified body's assessment and after it. We ensure successful CE marking for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced medical device regulatory consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling prepares the QMS and the technical documentation; the notified body assesses and certifies, and you affix the CE mark under your own declaration of conformity
8,100+ client engagements in 60+ countries.
EU MDR client experience
What it is
What is the EU MDR and what does it require?
The Medical Device Regulation is the European Union's law for medical devices, from wound dressings to implants and software. It applies directly in every Member State and reaches any manufacturer whose devices are placed on the EU market. It replaced Directives 93/42/EEC and 90/385/EEC on 26 May 2021 and raised the bar on classification, clinical evidence, technical documentation, notified body scrutiny, traceability and post-market duties.
There is no MDR certificate to be awarded. The CE mark is affixed by the manufacturer under its own EU declaration of conformity. For all but plain class I devices a notified body audits the quality management system, assesses the technical documentation and issues the EU certificates on which the declaration rests. Compliance is therefore a working system (Article 10), a set of files (Annexes II and III), a named person responsible for regulatory compliance (the PRRC, Article 15), a database presence (UDI and EUDAMED) and a cycle that never stops (surveillance, periodic safety update reports and vigilance).
Current text. Regulation (EU) 2017/745 has applied since 26 May 2021. Regulation (EU) 2023/607 of 15 March 2023 extended the transition for devices still on Directive certificates to 31 December 2027 or 31 December 2028 by class, under conditions, and deleted the sell-off date. Regulation (EU) 2024/1860 of 13 June 2024 introduced the module-by-module roll-out of EUDAMED, whose first four modules have been mandatory since 28 May 2026, and the Article 10a duty, applicable since 10 January 2025, to give six months' notice of a supply interruption that could cause serious harm. On 16 December 2025 the European Commission proposed a targeted simplification of the MDR and IVDR; as of September 2026 it is before the European Parliament and the Council and is not law, so the current text applies in full.
Who it is for
Who needs to comply with the EU MDR?
The Regulation binds the legal manufacturer wherever it sits, and gives separate duties to the authorised representative a non-EU manufacturer must appoint, to importers and to distributors. An importer or distributor that rebrands, repurposes or modifies a device takes on the manufacturer's obligations under Article 16. Organisations come to Sterling from four starting points:
- You want to place a device on the EU market for the first time. A manufacturer in Manila, Dubai or Bengaluru needs the class settled, technical documentation and a clinical evaluation, an Article 10(9) quality management system, a PRRC, an authorised representative, UDIs, an EUDAMED registration and, for most classes, a notified body with capacity.
- Your devices still trade on a Directive certificate. The extended deadlines of Regulation (EU) 2023/607, 31 December 2027 for class III and implantable class IIb devices and 31 December 2028 for the rest, apply only where the MDR quality system and the notified body application were in place by May 2024. What remains is the file, the evidence and the audit.
- The notified body has said no, or nothing. Technical documentation returned with pages of deficiencies, a clinical evaluation judged insufficient, a stalled application, or a device moved up a class by the Annex VIII rules, such as software needing a notified body for the first time.
- You supply a manufacturer whose notified body audits through you. Contract manufacturers, sterilisers and software developers are increasingly asked for their own ISO 13485 system and MDR-ready records.
Business benefits
How EU MDR compliance supports market access and patient safety
An MDR programme is judged at three moments: when the notified body opens the technical documentation, when a competent authority asks about an incident, and when a purchaser checks the certificate. We build the system for those moments.
- Technical documentation that passes reviewAnnex II files with a requirements trail, a live risk management file and a clinical evaluation a reviewer can follow, so deficiency rounds are short.
- One system for every regulatorA QMS on EN ISO 13485:2016 with A11:2021 and the Article 10(9) additions, mapped once to MDSAP and the FDA's QMSR, so a new market adds a dossier, not a second system.
- Surveillance that protects the certificateComplaints, feedback and literature gathered on a plan, periodic safety update reports delivered on time and trends caught before they become field safety corrective actions.
- Vigilance decisions made in hoursA reportability procedure that meets the 15-day, 2-day and 10-day clocks of Article 87, with the record trail an authority expects.
- Traceability from label to consigneeUDIs assigned and verified in the QMS, devices registered in EUDAMED and distribution records linked, so a recall reaches the right units and no others.
- Suppliers and partners under controlContract manufacturers, sterilisers, software houses and authorised representatives evaluated and monitored in proportion to what their failure would do to the device.
Measure the programme by what it is for: deficiencies per submission, vigilance decision times, PSURs delivered on schedule, days to close a recall. A thicker file is not a result.
Requirements
What are the main EU MDR requirements?
The Regulation runs to 123 articles and seventeen annexes; the obligations that shape a manufacturer's programme sit in a dozen of them, mapped to practice below. Your system and files are checked against the Regulation's text, the harmonised standards and the MDCG guidance notified bodies follow.
| Article or Annex | What it requires of you | What it looks like in practice |
|---|---|---|
| Annex VIII · Classification | Classify each device as class I, IIa, IIb or III under the twenty-two rules of Annex VIII, by intended purpose and inherent risk; the class fixes the route and whether a notified body is involved | A classification rationale per family citing the rule; plain class I self-declares, while sterile, measuring and reusable surgical class I devices need a notified body |
| Article 10(9) and Annex IX · Quality management system | Establish, implement, maintain and continually improve a QMS covering at least thirteen aspects, from the regulatory compliance strategy, suppliers and risk management to clinical evaluation, product realisation, UDI verification, surveillance, vigilance, CAPA and monitoring | EN ISO 13485:2016 with A11:2021, the harmonised standard, plus MDR-specific procedures; above basic class I the notified body audits it and issues an EU quality management system certificate valid for up to five years, with surveillance at least every twelve months and unannounced audits |
| Article 10(4), Annexes I, II, III and XIV · Technical documentation | Keep clear, organised, readily searchable and unambiguous documentation: device description, design and manufacturing information, the Annex I general safety and performance requirements, risk management, verification and validation including the clinical evaluation under Article 61 and Annex XIV, and the Annex III surveillance plan and reports | An Annex I checklist naming the evidence for each requirement, a risk management file to EN ISO 14971:2019 with A11:2021, a clinical evaluation report and PMCF plan, test reports, labels and instructions, kept ten years after the last device, fifteen for implantables |
| Article 15 · Person responsible for regulatory compliance | At least one PRRC with the Article 15(1) qualifications (a relevant degree plus a year's device regulatory or QMS experience, or four years' experience), responsible for release checks, a current documentation and declaration, surveillance and vigilance; micro and small enterprises may use a person permanently and continuously at their disposal | A documented appointment, a role description against Article 15(3) and sign-offs the PRRC actually gives |
| Articles 27, 29 and 31 · UDI, registration and EUDAMED | Assign a Basic UDI-DI, UDI-DI and UDI-PI through an issuing entity, put the UDI carrier on labels, register for a single registration number and register devices in EUDAMED | UDI carriers due for class III and implantables since 26 May 2021, class IIa and IIb since 26 May 2023, class I since 26 May 2025; EUDAMED mandatory since 28 May 2026, with devices already on the market registered within twelve months of the November 2025 notice |
| Article 52, Annexes IX to XII, Articles 19 and 20 · Conformity assessment, declaration and CE mark | Class III and IIb: Annex IX (QMS plus technical documentation assessment) or Annex X type-examination with Annex XI; class IIa: Annex IX with documentation sampled per category, or Annex XI Part A; class I: own documentation, with a notified body only for sterile, metrological or reuse aspects; then the EU declaration of conformity and the CE mark with the notified body's number | The Annex XII certificates (EU quality management system, EU technical documentation assessment, EU type-examination, EU quality assurance or EU product verification certificate), each valid for no more than five years, and a declaration listing the devices |
| Articles 83 to 86 and Annex III · Post-market surveillance | A surveillance system within the QMS that gathers and analyses quality, performance and safety data through the device's lifetime; class I keep a surveillance report, class IIa, IIb and III a periodic safety update report, at least every two years for IIa and annually for IIb and III, submitted to the notified body for class III and implantables | A PMS plan per family with data sources, indicators and thresholds, complaint logs, a PSUR calendar and PMCF running |
| Articles 87 to 89 · Vigilance | Report serious incidents and field safety corrective actions immediately and no later than 15 days after awareness, within 2 days for a serious public health threat and 10 days for a death or unanticipated serious deterioration; report trends; investigate and act | A tested vigilance procedure with reportability decisions recorded either way, forms and field safety notice templates ready and an incident register |
What does useful EU MDR evidence look like?
A classification rationale per family, procedures that name each Article 10(9) aspect, technical documentation with an Annex I checklist behind every claim, a risk management file engineers update, a clinical evaluation with data behind it, labels with UDI carriers, the notified body's certificates, the last PSUR and a vigilance register. We build these from your real devices, and they live in Effivity from the first workshop, so the notified body reviews a system that runs.
EU MDR requirements explained, article by articleCE marking process
How do you get CE marked under the EU MDR?
Build the system and the files, then submit to a notified body designated for the MDR whose scope covers your device. Sterling prepares the QMS, the technical documentation and your team; the notified body assesses and certifies; you declare conformity and affix the CE mark.
- 01Define the devices, the classes, the roles and the route.Confirm each device's intended purpose, its Annex VIII class and rule, whether an authorised representative is needed, the Article 52 route and any legacy deadline.
- 02Gap analysis: test the system and the files against the Regulation.The gap analysis checks the QMS against Article 10(9) and EN ISO 13485, the technical documentation against Annexes I, II and III, the clinical evaluation, surveillance, vigilance, UDI and the PRRC; what works is kept and actions, owners and dates are agreed.
- 03Build the QMS and the technical documentation, and put them into daily use.Procedures, the risk management file, the clinical evaluation, labelling and the PMS plan written with your engineers; the PRRC appointed; UDIs assigned; the organisation registered in EUDAMED.
- 04Audit internally, review and close the findings.An internal audit against the Regulation and the standard, a management review and a mock technical documentation review, with nonconformities raised by us first and closed.
- 05Complete the notified body's assessment, then declare and mark.Application, the QMS audit, technical documentation assessment sampled per category or group or, for class III and implantable class IIb devices, per device, deficiencies answered, certificates issued; then the EU declaration of conformity, the CE mark and device registration in EUDAMED.
- 06Keep the CE mark alive.Surveillance, PSURs and vigilance run on their calendars; the notified body audits at least every twelve months and unannounced; changes are assessed before they are made; certificates are renewed within their five-year limit.
Check who will actually assess your devices before you pay anyone. A notified body must be listed for Regulation (EU) 2017/745 in the Commission's NANDO database with a scope covering your device type; a "CE certificate" from anyone else has no legal standing, and an ISO 13485 certificate is not a CE certificate. How to choose a credible EU MDR provider · The certification buyer's checklist
Cost
How much does EU MDR compliance cost?
The price follows the class and number of your devices, the state of your files and the route the notified body must take. One class IIa device on an existing ISO 13485 system needs a different programme from a class III implant with no clinical data. What is constant: every component visible, the fee fixed.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Device classes and families, the technical documentation to build or repair, the state of the QMS, sites, and how much of the work your team takes on (Design™ or Drive™) |
| Notified body assessment | The body's own fees for the application, QMS audit days, technical documentation assessment per device or group, surveillance and unannounced audits, shown separately |
| Testing, clinical and regulatory | Laboratory testing, biocompatibility, electrical safety, software and usability work, clinical data, PMCF, the authorised representative's fees and translations |
| Internal resources | Engineering and regulatory time on files and evidence, the PRRC's capacity, validation runs and labelling changes |
| Software and learning | Included in a Sterling engagement: Effivity for the system and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | PSUR and PMCF support, surveillance-audit preparation, internal audits, regulatory watch and refresher learning under Sustain™ |
What moves the price
- Device class and route, and how many technical documentation files are needed
- Sterile, implantable, software-driven or drug-combination devices
- Whether clinical evidence exists, and whether a certified ISO 13485 system already runs
- A manufacturer outside the EU, needing an authorised representative
- The deadline: a legacy cut-off, a launch, a distributor's qualification date
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Notified body, laboratory and authorised representative fees identified separately
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does EU MDR compliance take?
Plan on nine to eighteen months to be ready for the notified body, then the notified body's own review, which for a first application runs to many months more and depends on its capacity. A manufacturer with a certified ISO 13485 system, existing test reports and a defensible clinical evaluation sits at the short end; one that must generate clinical evidence or rebuild a design history sits at the long end. The plan is built backwards from the evidence, with milestones in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to engineering records, existing files and the classification decisions |
| Build, test and document | Laboratory and clinical lead times, the state of the design history and risk file, and engineering capacity |
| Evidence, internal audit and review | The QMS running long enough to generate complaint, CAPA and training records, then internal audit and management review |
| Notified body assessment and CE marking | Application acceptance, audit scheduling, documentation review rounds and the time to answer deficiencies, then certificates and the declaration |
If a legacy deadline, a launch or a tender drives the programme, share it at the first call. We will say what is achievable and where the notified body's calendar is the constraint. A CE-marking date promised before anyone has opened your file is a sales tactic, not a plan.
Challenges
Common EU MDR implementation challenges
Most MDR programmes stall on the same five problems. Each has a practical answer.
The technical documentation is a folder of test reports with no trail to the requirements.
We rebuild the file to Annex II with your engineers: an Annex I checklist naming the evidence behind every requirement, design and manufacturing information that matches the plant, and verification evidence indexed so a reviewer can find it.
The clinical evaluation is a literature list, and the notified body wants evidence.
We set up clinical evaluation as a process under Article 61 and Annex XIV: a plan, an equivalence or own-data strategy, a search and appraisal method, a report linked to the risk file and a PMCF plan that collects data. Where a clinical investigation is unavoidable, we say so early.
ISO 13485 is certified, and everyone assumed that was the MDR.
The standard is the backbone of the Article 10(9) system, not the whole of it. We add what the Regulation requires beyond it: the regulatory strategy, the Annex I requirements process, UDI verification, the PRRC, PSURs, vigilance timelines and EUDAMED.
Nobody owns post-market surveillance until a complaint becomes an incident.
One PMS plan per family with data sources, indicators and thresholds; one feedback process that records every complaint, decides reportability under Article 87 and feeds risk management and the PSUR; and a vigilance rehearsal for the 2-day, 10-day and 15-day clocks.
Legacy devices are running out of time and the notified body has no slot.
We check that the Regulation (EU) 2023/607 conditions were met, build the review-ready file, sequence the families by deadline and risk and prepare the deficiency responses so each review round is the last.
Your engagement
What your EU MDR engagement includes
Many providers write the procedures and leave the technical documentation and the notified body to you; a Sterling engagement covers the whole journey, one team, one all-inclusive proposal.
Scope, classification, gap analysis and plan
Devices, classes, routes, roles and deadlines mapped; every obligation tested against the current position; actions, owners and dates agreed.
QMS and technical documentation
Procedures on EN ISO 13485 with the MDR additions, Annex II and III files, the risk management file and the clinical evaluation, built with your engineers on Sterling's template sets.
Effivity ISO & GRC software
Your QMS, files and registers run in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review before the notified body
Conducted or facilitated as agreed, covering the Regulation and the standard, with findings closed before the application is lodged.
Notified body readiness and support
Application preparation, responses to nonconformities and deficiencies, coaching for the PRRC, and support until the certificates are issued and the CE mark is affixed.
Certification decisions remain with the notified body. The EU declaration of conformity and the CE mark are the manufacturer's own.
How we deliver
How Sterling supports your EU MDR implementation
Every EU MDR engagement runs on Sterling OS™, our delivery operating system: five phases with defined deliverables, decision owners and evidence at each stage. You choose how much of the work your team carries.
- 01Design™Guided implementation: your regulatory and engineering team builds the system and the files with Sterling's structure, templates, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants carry the agreed documentation, file-building and submission preparation with your process owners.
- 03Sustain™Operation after CE marking: PSUR and PMCF support, surveillance and unannounced-audit readiness, internal audits, regulatory watch and refresher training.
- 04Automate™The programme in Effivity: procedures, technical documentation, risk and clinical files, UDI and certificate registers, complaints, vigilance, CAPA and audits in one workspace.
- 05Revise™Change in the rules and in your range: the legacy transition, each EUDAMED module as it becomes mandatory, the simplification regulation if and when adopted, new device families and class changes.
In the first week we agree the engagement team, the weekly working session, the deliverables and the decision owners, and progress is measured against them, so a missing test report shows up in week six rather than in a deficiency letter.
How Sterling OS™ worksOften combined with
Standards organisations pair with EU MDR 2017/745
- 21 CFR Part 11 / EU Annex 1121 CFR Part 11 and Annex 11 compliance for GxP systems: requirements, validation, audit trails and e-signatures, with evidence ready for FDA and EU inspectors.
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- CAP accreditationCAP accreditation readiness for laboratories: checklist gap analysis, method records, self-inspection and peer inspection support.
- CE markingCE marking compliance support for manufacturers: EU rules, technical files, declaration of conformity and quality systems.
- EN 1090EN 1090 certification for steel and aluminium fabricators: factory production control, welding, execution records and support through the notified body's audit.
- EN 71 / ASTM F963EN 71 and ASTM F963 toy safety compliance for manufacturers: product and market mapping, material control, test planning and records that keep lots conforming.
Effivity · EU MDR quality management software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of Regulation (EU) 2017/745.
Every Sterling EU MDR engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope, so procedures, technical documentation, risk and clinical files, UDI and certificate registers, complaints, vigilance, PSUR calendars, CAPA and audits live in one place and the notified body reviews a live system rather than a binder. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
The Article 10(9) system, aspect by aspect
Each of the thirteen QMS aspects mapped to its procedure, owner and records, so the notified body's audit follows a map.
Annex II files with a requirements trail
Device description, design and manufacturing information, the Annex I checklist, risk management and verification evidence held as controlled, versioned sets per family.
Release and sign-off with a record
Pre-release checks, documentation approvals and vigilance reports routed to the PRRC, each sign-off dated and traceable.
UDI register and EUDAMED tracking
Basic UDI-DI, UDI-DI and UDI-PI assignments per device and packaging level, label verification records, and the status of EUDAMED registrations with their deadlines.
Applications, certificates and their expiry
Each notified body application, audit, deficiency letter and response tracked to closure; every EU certificate with its scope, devices and five-year limit; declarations of conformity issued.
PMS plans, data and PSURs
The PMS plan per family with its data sources, indicators and thresholds; feedback, complaints and literature findings logged against it; the PSUR calendar with its inputs.
Vigilance with the clocks built in
Every incident assessed for reportability with the decision recorded, the 15-day, 2-day and 10-day timelines counting from awareness, and reports generated from the record.
Suppliers, training, audits and CAPA
Supplier evaluation, competence records linked to Sterling Academy, internal audits, management review and CAPA closed with proof of effectiveness; forms and reports adapted to your work, without code.
What this means at the audit
The notified body auditor asks for the procedures against Article 10(9), the technical documentation for the sampled devices, the last PSUR, the vigilance register and the supplier evaluations. In Effivity every one of those is a live screen with its dates, owners and evidence attached. Sustain™ then runs in the same workspace, so the surveillance audit and the unannounced one find a system that never stopped.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your procedures, files and registers migrated, not retyped
- Admin and user training for your quality, engineering and regulatory teams
- Modules for ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001 and more when you integrate other standards
EU MDR client experience
Client letters on file, available on request.
Signed client letters for EU MDR are available on request. The client feedback wall lists every letter by standard.
Programmes with the EU MDR in scope
How the EU MDR fits a device quality programme.
- 01Integrated management systems
Medical devices: ISO 13485, the EU MDR and MDSAP as one quality system
How a programme of this kind runs: EN ISO 13485:2016 with A11:2021 supplies the quality management system the notified body audits; the Article 10(9) additions, the Annex II and III technical documentation, the PRRC, UDI and EUDAMED and the vigilance procedures sit on top of it; the same system, with each jurisdiction's requirements mapped, is then audited once under MDSAP for five regulators, so one evidence base serves every market.
Sterling Academy · EU MDR e-learning
Train the whole company on the EU MDR, from the production line to the PRRC.
Sterling Academy trains the whole workforce and the people who run the system: video lessons, a final exam and a numbered Certificate of Completion per learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- EU MDR awareness for every employee, with the competence evidence a notified body asks for
- Practitioner courses for regulatory affairs and process owners
- Internal auditor training for the people who will audit the system, as applicable to your standard, as part of the engagement
- Learner progress by department and a training report for auditors
- New hires trained as they arrive, so evidence is current at every surveillance audit
- A Sterling consultant reachable when a learner needs one
Keep exploring
Explore more about EU MDR 2017/745
Watch a video on how to comply with EU MDR here.
Watch a video on EU MDR requirements here.
Why Sterling
Want successful EU MDR compliance? Come to Sterling.
Whether you are a European manufacturer repairing a file the notified body sent back or a company in Asia, the Gulf or the Americas placing a device on the EU market for the first time, Sterling builds one system that answers the Regulation and the standard together.
Regulated sectors in 60+ countries since 2003
Management systems implemented for device manufacturers, distributors, laboratories and healthcare organisations across every region we serve, with one engagement team accountable wherever you design, make or sell.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with notified body, laboratory and authorised representative fees identified separately. No surprises, ever.
Files a reviewer can follow
Technical documentation, risk files and clinical evaluations built from the way your device is really designed and made, indexed the way a notified body reads them.
Expert and experienced consultants
Consultants who have advised on quality management systems in regulated sectors since 2003, know what a notified body auditor looks for, and build your system properly the first time.
The Sterling Promise
What our EU MDR compliance success guarantee means
We stay with you until your agreed EU MDR outcome is achieved: the system operating, the technical documentation review-ready, the notified body's findings answered, the certificates issued and the CE mark affixed under your declaration. Clear explanations, practical delivery, included software and workforce learning turn the investment into a lasting capability.
The engagement names the devices, the scope, the outcome and who does what. Your organisation supplies accurate information about its devices and processes and puts the agreed controls into use. The notified body assesses conformity and retains its certification decision; the EU declaration of conformity is yours to sign. Our commitment concerns the agreed compliance support, not any notified body's timetable or an incident-free device.
After CE marking
What happens after CE marking under the EU MDR?
Surveillance runs continuously and feeds the risk file; PSURs fall due at least every two years for class IIa and at least annually for class IIb and III; vigilance clocks start the moment anyone becomes aware of an incident; the notified body returns at least every twelve months and, at least once in five years, unannounced; and since 10 January 2025 a foreseeable supply interruption that could cause serious harm must be notified six months ahead under Article 10a.
Under Sterling OS™ Sustain™ we run that cycle with you: PSUR and PMCF support, vigilance reviews, internal audits, surveillance preparation and a regulatory watch, so the system the notified body certified is the system the inspector finds.
FAQs
Frequently asked questions about the EU MDR
Is there such a thing as EU MDR certification?
Not in the way ISO certification exists. The outcome is the CE mark, affixed by the manufacturer under its own EU declaration of conformity. Where a notified body is involved it issues the EU certificates listed in Annex XII. An "MDR certificate" from a consultant or a certification body is not one of them.
Does our ISO 13485 certificate make us MDR compliant?
No. EN ISO 13485:2016 with A11:2021 is harmonised under the MDR, so conformity gives a presumption of conformity for the requirements it covers. It does not cover the regulatory strategy, the Annex I requirements, UDI, the PRRC, PSURs, vigilance timelines or EUDAMED, and it is certified by an accredited certification body, not a notified body.
Which devices need a notified body?
Every class IIa, IIb and III device, and class I devices placed on the market sterile, with a measuring function or as reusable surgical instruments, for those aspects. Only plain class I devices are self-declared. Classification under Annex VIII is the manufacturer's responsibility; get it wrong and the whole route is wrong.
What is a notified body, and how do we choose one?
A conformity assessment body designated by an EU Member State to audit quality systems and assess technical documentation under the MDR; the designated bodies and their scopes are listed in the Commission's NANDO database. Choose one whose scope covers your device codes and whose capacity matches your deadline. Sterling is not a notified body.
Do we need a person responsible for regulatory compliance, and can it be outsourced?
Every manufacturer needs at least one PRRC with the Article 15 qualifications. Micro and small enterprises need not employ the person but must have one permanently and continuously at their disposal. Whoever holds the role signs off release, documentation, surveillance and vigilance, so the arrangement has to be real.
What are the legacy device deadlines?
Under Regulation (EU) 2023/607 a device on a Directive certificate may stay on the market until 31 December 2027 if it is class III or an implantable class IIb device (except well-established products such as sutures and staples), and until 31 December 2028 for other class IIb, class IIa and sterile or measuring class I devices and for class I devices needing a notified body for the first time, provided it still complies with the Directive, has no significant change in design or intended purpose, and the manufacturer had an MDR quality management system and a notified body application by 26 May 2024 and a written agreement by 26 September 2024. The sell-off date was deleted.
What do we have to do in EUDAMED now?
The Commission declared the first four modules functional in a decision published on 27 November 2025, and they have been mandatory since 28 May 2026: actor registration, UDI and device registration, notified bodies and certificates, and market surveillance. Devices already on the market, including legacy devices, must be registered within twelve months of the notice; notified bodies have eighteen months for earlier certificates.
The Commission has proposed simplifying the MDR. Should we wait?
No. The proposal of 16 December 2025 aims at more proportionate and predictable conformity assessment, wider digital labelling and electronic instructions for use, a stronger coordinating role for the European Medicines Agency and one framework for AI-enabled devices. It is before the European Parliament and the Council and, as of September 2026, has not been adopted; the current text applies in full.
Does Sterling issue certificates or affix the CE mark?
No. Sterling builds the quality management system, the technical documentation and the post-market procedures with you and prepares your team. A notified body audits, assesses and issues the EU certificates; you sign the declaration of conformity and affix the CE mark. Sterling is not a notified body, an authorised representative or a laboratory.
Before the first call
Prepare a useful EU MDR readiness brief
You do not need a finished technical file before the first discussion. Bring a short account of what you make and where you sell it. Seven questions are enough:
- Which devices are involved, what is their intended purpose, and what class do you believe they fall in under Annex VIII?
- Are you the legal manufacturer, and are you established in the EU? If not, who is or will be your authorised representative?
- What exists today: an ISO 13485 certificate, Directive certificates, technical documentation, a clinical evaluation, a risk management file?
- Which notified body, if any, have you approached, and what has it said?
- Who is, or will be, your person responsible for regulatory compliance, and how are complaints and incidents handled now?
- Which other markets and regulators matter in the next two years?
- Is there a legacy deadline, a launch date, a tender or a distributor's qualification date to plan around?
With these answers the scope and the all-inclusive proposal can be set realistically. They prepare a conversation; they are not a classification decision or regulatory advice.
Don’t be fooled by certification scams
If it takes ten days, it is not EU MDR compliance.
Because the Regulation issues no certificate of its own, the market sells substitutes: "MDR certificates" and "CE certificates" from bodies that appear nowhere in NANDO, technical file templates with another company's device still in them, and self-declaration packages for devices that are not class I. They cost less, until the notified body opens the file.
How to choose a credible EU MDR provider
- Ask who will assess your devices and check it in NANDO. The notified body must be designated for Regulation (EU) 2017/745 with a scope covering your device type; nobody else can issue the certificates behind a CE mark.
- Ask what any offered "certificate" actually is. An ISO 13485 certificate is a quality system certificate from an accredited certification body; an "MDR certificate" from a consultant is paper.
- Ask how the technical documentation and clinical evaluation will be built from your device, with your engineers and your data.
- Identify who carries each task, which notified body and laboratory costs are separate, and what support exists when a deficiency letter arrives.
- Ask what your people will learn and where the system will live. A technical file on the consultant's laptop leaves with the consultant.
- Walk away from "CE marked in 10 days", from a PRRC who signs but never reviews, and from self-declaration offered for a class IIa device. The system has to run before a notified body can assess it.
Keep exploring
More on EU MDR 2017/745 and related standards
More in Healthcare, medical devices & life sciences
Talk to a consultant
Plan your EU MDR compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice