How to choose a Notified Body for medical software certification

1. What a Notified Body actually does

A Notified Body (NB) is a conformity assessment organisation designated by an EU member state authority and notified to the European Commission. Under EU MDR, Class IIa, IIb, and Class III medical devices — including the vast majority of Software as a Medical Device at those risk classes — cannot obtain CE marking without a Notified Body conformity assessment. The NB reviews your technical documentation, audits your Quality Management System, and issues the certificate that underpins your CE mark.

This is not a rubber stamp. A thorough NB review typically generates 30–80 questions and clarification requests across multiple rounds. Your relationship with your NB will span the initial certification (often 9–18 months) and then continue indefinitely through annual surveillance audits, recertification every five years, and change notifications whenever you update your product significantly.

2. First filter: designated scope

Not every Notified Body is designated for every type of medical device. Before evaluating anything else, verify that the NB you are considering is designated under EU MDR for your specific device category and risk class. The European Commission's NANDO database lists every designated NB with their exact scope of designation.

For software specifically, look for NBs with explicit designation for:

• Software as a Medical Device (SaMD) — Rule 11 classifications
• Your specific risk class (IIa, IIb, or III)
• AI/ML-based devices, if your product uses machine learning
• The relevant MDR Annexes covering your conformity assessment route (typically Annex IX or Annex XI)

A NB designated for physical medical devices but not explicitly for SaMD will lack the internal expertise to review software-specific documentation efficiently. You will encounter reviewers unfamiliar with IEC 62304, IEC 62366, and software lifecycle concepts — leading to questions that reflect fundamental misunderstandings rather than genuine gaps in your documentation.

3. The capacity problem in 2026

EU MDR created a severe capacity bottleneck that has not fully resolved. The number of devices requiring Notified Body involvement increased dramatically under MDR compared to the previous MDD regime — but the number of designated NBs actually decreased in the transition period as many bodies failed or chose not to pursue MDR designation.

As of early 2026, the situation has improved from the worst of the backlog in 2023–2024, but wait times remain significant. The practical implications for SaMD startups:

• Pre-submission meetings (the first formal contact with the NB) typically take 6–12 weeks to schedule at most bodies.
• Application review (formal acceptance of your submission) takes 2–4 months at many bodies after receiving complete documentation.
• Full conformity assessment for a Class IIa SaMD ranges from 9 to 18 months from first contact to certificate issuance, depending on the body and documentation quality.

These timelines mean that contacting a Notified Body should happen significantly earlier than most startups expect — ideally 12–18 months before your target CE mark date, not 6 months before.

4. Five criteria that matter for SaMD

5. Questions to ask before you sign

The pre-submission meeting is your opportunity to evaluate the NB as much as it is their opportunity to evaluate your device. These questions give you the information you need and simultaneously signal that you are a prepared applicant — which affects how the NB prioritises your file:

• How many SaMD certifications have you completed under EU MDR? Can you share approximate numbers by risk class?
• Do you have reviewers with specific IEC 62304 and IEC 62366 expertise on staff, or do you use external subject matter experts?
• What is your current average timeline from signed contract to first technical questions on a Class IIa SaMD submission?
• How do you handle AI/ML-based SaMD? Are you integrating EU AI Act Annex IV requirements into your MDR assessments now?
• What does your review process look like — sequential rounds of questions, or consolidated feedback at defined milestones?
• Who will be our primary contact throughout the assessment, and what is your process if that person changes?
• What are your surveillance audit frequency and format for a Class IIa SaMD after initial certification?
• What is your fee structure — fixed project fee or hourly, and what triggers additional charges?

6. The most common selection mistakes

Choosing on price alone

The cheapest NB is rarely the cheapest path to certification. A lower upfront fee from a body with long wait times, inexperienced SaMD reviewers, or poor communication will cost more in consultant time, delayed revenue, and extended timelines than the fee differential. Total cost of certification includes your team's time responding to questions — a high-quality NB that asks fewer, better-targeted questions is often more economical than a cheap one that asks many unfocused ones.

Not checking scope in NANDO

We have seen startups spend months in pre-submission discussions with a Notified Body before discovering the body's scope did not cover their specific device type. The NANDO check takes five minutes and should be the first step, not an afterthought.

Contacting only one NB

Run pre-submission meetings with two or three bodies in parallel. This takes more time upfront but gives you meaningful comparison data on timelines, communication quality, and fees. It also creates competitive pressure that occasionally produces better terms. Most experienced regulatory consultants run parallel NB evaluations as a matter of course.

Underestimating the relationship component

Your NB is not a one-time vendor — it is a long-term regulatory partner. The person reviewing your initial submission will likely review your change notifications, conduct your surveillance audits, and handle your recertification five years from now. How they communicate, how quickly they respond, and how technically sophisticated their questions are matters well beyond the initial assessment.

Starting too late

The single most common mistake. Startups frequently begin NB outreach when their technical file is "almost ready" — typically 3–6 months before their target certification date. Given current wait times for pre-submission meetings and the realities of iterative document review, this timeline almost never works. Contact your target NBs 12–18 months before you need the certificate, even if your documentation is not yet complete. Early contact allows you to get in the queue, understand requirements, and build the relationship before your timeline is under pressure.

7. How the selection process works in practice

A typical NB selection process for a SaMD startup:

1. Scope verification — Check NANDO for all NBs designated for your device type and risk class. This typically reduces the field from 40+ to 10–15 relevant bodies.
2. Initial shortlist — Narrow to 3–5 based on reputation, geography, and visible SaMD track record (published case studies, contributions to SaMD technical guidance, presence at SaMD-specific conferences).
3. Pre-submission meetings — Request meetings with your top 2–3. Most NBs offer free or low-cost pre-submission consultations. Use the question list above.
4. Fee proposals — Request formal fee proposals from bodies that performed well. Compare total project fee, not just initial assessment cost — include estimated annual surveillance fees.
5. Reference check — Ask each NB for references from SaMD clients with similar device types. Speak to those clients. Ask specifically about communication quality, turnaround time, and whether they would choose the same NB again.
6. Decision and contract — Sign with your chosen NB and request a formal project plan with defined milestones and expected timelines.