What EU MDR compliance costs for a software device: budget components

Why there is no single price

"How much does CE marking cost?" has no honest one-line answer. The class of your software decides whether you need a Notified Body at all. Classification is set by Rule 11 of Annex VIII. Class IIa, IIb and III need a Notified Body; Class I usually does not. Your starting point decides how much has to be built from scratch. Your clinical evidence decides whether you need new studies. Below are the components a software manufacturer should expect, and how to estimate each one without guessing.

1. Regulatory consulting

Consulting is optional, but most start-ups without in-house regulatory staff use some. These are our own published prices:

• EU MDR consulting support: €10,000–25,000 fixed fee, depending on device class, documentation complexity and QMS maturity. Details: EU MDR consulting.
• ISO 13485 QMS implementation: €20,000 for a tailored implementation (3 months) or €30,000 for a complete QMS built from scratch (6 months). Details: ISO 13485 QMS implementation.
• QMS template package: €5,000, 1 month.
• Gap analysis: about €3,000, 1–4 weeks depending on scope.
• Strategy call: €200 for a 1.5-hour workshop, or €1,000 with analysis of your input.
• Technical writing €35 per hour; ongoing support at any stage €50 per hour, time and materials. All prices: services and prices.

Other consultants price differently: by day rate, by deliverable or on retainer. Compare scope rather than totals. Check who writes the documents and who only reviews them. Check whether responding to Notified Body questions is included, and how many review rounds are covered. Third-party costs such as Notified Body fees, test labs, translations and authorised representative services are billed by those providers, so budget for them separately.

2. Notified Body fees

Article 50 MDR requires Notified Bodies to "establish lists of their standard fees for the conformity assessment activities that they carry out and … make those lists publicly available". The European Commission keeps a list of links to Notified Bodies' published fees.

MDCG 2023-2 provides a template for these lists, and it explains how the fees are built up:

• Flat fees versus time-based fees. Each item is either a flat fee or a time-based fee charged at an hourly or daily rate. Notified Bodies may show a range and name the factors that drive the cost.
• Categories. The template covers:
  • administrative charges: application, changes, annual certificate maintenance, travel
  • audits: certification, recertification, surveillance, supplier and unannounced audits
  • product testing
  • documentation review: technical documentation assessment, clinical evaluation assessment, PSUR evaluation and assessment of changes
• External costs. Justified external costs, such as travel or external testing, are charged on top as expenditure.
• SMEs. Notified Bodies should indicate how they take the interests of small and medium-sized enterprises into account.

Published lists follow this pattern. BSI's MDR fee schedule (effective 1 January 2026) is one example. Application, annual certificate maintenance and certificate decision are fixed amounts. Audits and technical documentation assessment are charged at daily rates, and travel is charged separately.

We do not quote Notified Body amounts here. They differ between Notified Bodies, they are revised over time, and the total depends on how many days of auditing and review your file needs. To get a figure you can budget against, ask for a written quote. Ask the Notified Body to state:

• the estimated audit days for the initial QMS audit and the basis for that estimate (such as headcount and number of sites)
• the estimated days for technical documentation assessment, and how many technical documentation files will be sampled (see MDCG 2019-13 Rev.1)
• annual fees, surveillance audits and how unannounced audits are charged (the Notified Body must carry these out at least once every five years under Annex IX Section 3.4)
• fees for assessing changes. Software teams release often, so this item matters more for you than for most hardware manufacturers
• travel policy and whether remote audits are possible
• recertification. A certificate is valid for at most five years and is extended after re-assessment (Article 56(2))

3. Quality management system

Every manufacturer needs a QMS (Article 10(9) MDR). For Class IIa and above, the Notified Body assesses it as part of conformity assessment under Annex IX. EN ISO 13485:2016 is the harmonised standard most manufacturers use. Budget for the following:

• Building the QMS: your internal effort, plus consulting or templates if you use them.
• Tools. This could be an eQMS, an ALM or test-management tool, or Jira and GitHub configured for design controls. Software used in the QMS has to be validated (ISO 13485, 4.1.6). See ISO 13485 design controls in Jira and GitHub.
• Running costs. This covers training, internal audits, management review, CAPA and supplier controls.
• A separate ISO 13485 certificate from a certification body, if customers or other markets ask for one. This is a separate service with its own fees. Ask whether audits can be coordinated with your Notified Body.

4. Testing and evidence

• Software verification and validation (Annex II 6.1(b), IEC 62304). This is mostly internal effort and CI infrastructure, but it is the backbone of the technical file.
• Usability engineering (Annex I Section 5; IEC 62366-1:2015+AMD1:2020). Formative and summative evaluations with representative users. Costs include participant recruitment, facilitation and analysis, and possibly a usability lab. Get quotes if you outsource. Plan to repeat the evaluation when the user interface changes significantly.
• Cybersecurity (Annex I 17.2 and 17.4; MDCG 2019-16 Rev.1; IEC 81001-5-1). The guidance lists security feature testing, fuzz testing, vulnerability scanning and penetration testing as verification methods. External penetration tests are quoted per scope. Budget for retesting after significant changes. See our cybersecurity guide.
• Clinical evidence (Annex II 6.1(c) and (d); MDCG 2020-1). This is usually the widest range in the budget. A literature-based clinical evaluation with existing performance data is mostly writing and analysis effort. A new clinical performance study or clinical investigation needs a protocol, sites, data management and possibly ethics and competent authority steps. Get quotes from CROs or clinical sites. See clinical evaluation for SaMD.
• AI/ML-specific evidence. This can include data acquisition and annotation, an independent test dataset and performance analysis across subgroups. It is a mix of internal effort and external quotes.
• Hardware-related testing. Electrical safety and EMC are listed in Annex II 6.1(b) where relevant. Standalone software normally does not need them. If your software works with hardware, see MDCG 2023-4.

5. People and legal roles

• Person responsible for regulatory compliance (PRRC), Article 15. The PRRC needs one of two qualifications: a relevant degree plus at least one year of experience in regulatory affairs or QMS for medical devices, or four years of such experience. Micro and small enterprises (Recommendation 2003/361/EC) do not have to employ the PRRC. They must have one "permanently and continuously at their disposal". MDCG 2019-7 Rev.1 confirms they may subcontract the role to a third party, and the contract should mention the person's qualifications. Budget either part of an employee's time or a contracted service.
• EU authorised representative, Article 11. If you are not established in an EU Member State, you must designate a sole authorised representative before placing the device on the EU market. The mandate is valid only once the authorised representative has accepted it in writing. The authorised representative needs its own PRRC (Article 15(6)). Under MDCG 2019-7 Rev.1, the manufacturer's PRRC and the authorised representative's PRRC cannot be the same person. Fees are set by the provider, so get quotes.
• Internal QA/RA capacity. Someone has to own the QMS day to day. Before launch, a consultant can fill the gap. After launch, many small teams use part-time support. See ongoing QA/RA support.

6. Labelling, instructions for use and translations

The information in Annex I Section 23 must be provided in the official Union language(s) set by each Member State where the device is made available (Article 10(11)). For software, the IFU must include minimum requirements for hardware, IT network characteristics and IT security measures (Annex I 23.4(ab)). IFUs may be provided in electronic form under the conditions of the implementing rules (Annex I 23.1(f); Implementing Regulation (EU) 2021/2226). Budget for:

• translation and review per target language
• updates for each release that changes labelling
• UDI assignment. Check the terms of the issuing entity you use

7. Post-market costs (recurring)

• Post-market surveillance (Annex III). Collecting and analysing data, trend reporting and vigilance.
• PSUR (Article 86). For Class IIa it is updated when necessary and at least every two years; for Class IIb and III, at least annually. Notified Bodies list PSUR evaluation as a fee item. For Class I there is a PMS report instead (Article 85).
• PMCF. Post-market clinical follow-up activities under your PMCF plan, or a justification if PMCF is not applicable.
• Notified Body surveillance. Surveillance audits, unannounced audits, annual fees and assessment of changes. Recertification comes at the latest when the certificate expires (maximum five years).
• Change management. Each release needs a regulatory assessment. Some changes must be assessed by the Notified Body, which is why its fee list includes "assessment of changes". See change control for AI/ML SaMD and post-market surveillance for SaMD.

8. The UK and other markets

• Great Britain. CE-marked devices that comply with the EU MDR may be placed on the GB market until 30 June 2030. On 21 October 2026 the government said it intends to recognise CE-marked MDR/IVDR devices indefinitely. That needs legislation and is not yet law. Manufacturers based outside the UK need a UK Responsible Person, and devices must be registered with the MHRA. MHRA fees are listed on GOV.UK. See UKCA and CE for medical software.
• ASEAN and Australia. These markets have separate registrations, local representatives and regulator fees. EU certification can support those applications. See our ASEAN and TGA guides.
• AI-based devices. Under the amended EU AI Act timeline, obligations for high-risk AI systems embedded in products apply from 2 August 2028. Plan the documentation effort early, but these requirements do not belong in this year's certification budget. See EU AI Act and medical devices.

A budgeting table without invented numbers

Use this as a template. Fill the last column with quotes and with your own internal effort estimates.

How to collect quotes you can compare

1. Write a one-page scope: intended purpose, class and rule, number of software products and variants, headcount and sites, target markets, release frequency.
2. Send the same scope to every provider, and ask them to list their assumptions and exclusions.
3. For Notified Bodies, ask for days per activity rather than only a total, so you can see what drives the number.
4. Add internal effort explicitly. For start-ups it is often the largest and least visible line.
5. Recheck the budget after the gap analysis, when the real scope of the remediation is known. See how long EU MDR certification takes for the matching timeline.

Sources

• Regulation (EU) 2017/745, Article 50 – List of standard fees (as adopted; legislation.gov.uk reproduction of the Official Journal text)
• European Commission – Notified bodies for medical devices
• European Commission – List of hyperlinks to Notified Bodies' published standard fees
• MDCG 2023-2 – List of standard fees (January 2023)
• BSI – MDR fees for conformity assessment activities (effective 1 January 2026), as an example of fee structure
• Regulation (EU) 2017/745, Article 10 (as adopted)
• Regulation (EU) 2017/745, Article 11 (as adopted)
• Regulation (EU) 2017/745, Article 15 (as adopted)
• Regulation (EU) 2017/745, Article 56 (as adopted)
• Regulation (EU) 2017/745, Article 85 (as adopted)
• Regulation (EU) 2017/745, Article 86 (as adopted)
• Regulation (EU) 2017/745, Annex I (as adopted)
• Regulation (EU) 2017/745, Annex II (as adopted)
• Regulation (EU) 2017/745, Annex III (as adopted)
• MDCG 2019-7 Rev.1 – Guidance on Article 15 MDR/IVDR (PRRC), December 2023
• European Commission – MDCG endorsed guidance documents (MDCG 2019-13 Rev.1, MDCG 2023-4, MDCG 2022-21)
• MDCG 2019-16 Rev.1 – Guidance on cybersecurity for medical devices
• MDCG 2020-1 – Clinical evaluation of medical device software
• TÜV SÜD (Notified Body 0123) – Unannounced audits under MDR Annex IX Section 3.4
• Commission Implementing Decision (EU) 2021/1182 – harmonised standards under the MDR (consolidated 9 April 2025)
• IEC 62366-1:2015+AMD1:2020 CSV – IEC Webstore
• IEC 81001-5-1:2021 – IEC Webstore
• GOV.UK – Regulating medical devices in the UK (last updated 20 February 2026)
• UK Government – Response to the consultation on indefinite recognition of CE marked medical devices (21 October 2026)
• Commission Implementing Regulation (EU) 2021/2226 – electronic instructions for use (EUR-Lex record)
• Council of the EU – Artificial intelligence act timeline