Do I need a Notified Body for EU MDR certification?

Only Class I non-sterile, non-measuring devices can self-declare conformity without a Notified Body. All Class IIa, IIb, and III medical software requires a Notified Body. Most SaMD — particularly any software that influences clinical decision-making — falls into Class IIa or higher. We help you determine the correct classification and select the right Notified Body for your product.

What is the difference between EU MDR Class I, IIa, IIb for software?

Under Rule 11 of EU MDR, software classification depends on the severity of the condition it addresses and its intended purpose. Software intended to provide information used for decisions with serious consequences (e.g., diagnosis, treatment decisions) classifies as Class IIa or IIb. Software for monitoring or managing less serious conditions may be Class I. The classification determines whether a Notified Body is required and which conformity assessment route applies.

Do you support companies transitioning from MDD to MDR?

Yes. Legacy devices certified under MDD must be recertified under EU MDR. The transition requires a full technical documentation update to MDR Annex II and III format, clinical evaluation update to MDCG 2020-1 requirements, and QMS update to cover new MDR post-market obligations. We manage the full transition process and have done so for several clients ahead of the May 2024 and 2026 transition deadlines.

EU MDR Certification for Medical Software — CE Mark Consultant

Context

What EU MDR means for your medical software

EU MDR 2017/745 replaced the Medical Device Directive (MDD) and introduced stricter requirements specifically for software as a medical device. If your software processes patient data to support or make clinical decisions, you need CE marking under MDR before selling in the EU.

Who this applies to: Any software that qualifies as a medical device under Rule 11 of Annex VIII — including diagnostic apps, clinical decision support, AI-powered analysis tools, monitoring software, and telehealth platforms with a medical intended purpose.

What changed from MDD to MDR

Stricter clinical evidence requirements — the CER now requires a systematic literature search, clinical investigation data, or equivalent scientific validity evidence. Legacy "equivalence" arguments are much harder to sustain.
Post-market surveillance obligations — MDR mandates ongoing PMS, annual PSURs (for Class IIa+), and a proactive PMCF plan. Certification is not a one-time event.
New software-specific requirements — Rule 11 classification is specific to software. Cybersecurity (MDCG 2019-16), AI/ML change management, and IEC 62304 compliance are now explicitly expected by Notified Bodies.
Notified Body capacity issues — there are fewer designated NBs under MDR than under MDD, and wait times have increased significantly. Early engagement is critical.
Extended technical documentation — Annex II and III requirements are significantly more detailed than MDD Annex III/VII. A typical SaMD technical file under MDR runs 300–600 pages.

Who we certify

AI-powered diagnostic and imaging software
Clinical decision support systems (CDSS)
Remote patient monitoring platforms
Telehealth applications with clinical functions
SaMD in nephrology, dentistry, cardiology
Software components of combination devices
National eHealth platforms (regulatory pathway)

Markets we cover

European Union (27 states)CE Mark

United Kingdom (GB)UKCA

Singapore / ASEANHSA MDD

Australia / New ZealandTGA / Medsafe

Service scope

Everything included in EU MDR certification support

We embed with your team and own the regulatory workstream from kick-off to CE mark. No handoffs, no junior consultants — your project is managed directly by Lizaveta Dabrynskaya.

Technical & Regulatory

Rule 11 device classification — detailed written justification based on intended use, indications, and contraindications, defensible to NB scrutiny
Technical Documentation (Annex II & III) — complete technical file including all required sections, formatted to NB expectations
Clinical Evaluation Report (CER) — MDCG 2020-1 compliant, including literature search, clinical data analysis, and benefit-risk assessment
Risk Management File (ISO 14971) — risk management plan, risk analysis, evaluation, control measures, residual risk assessment
Software Lifecycle documentation (IEC 62304) — software development plan, architecture documentation, V&V protocols, maintenance processes
Usability Engineering File (IEC 62366) — use specification, formative and summative evaluation documentation
Cybersecurity documentation (MDCG 2019-16) — security risk management, vulnerability disclosure, patch management process
Declaration of Conformity — drafted and reviewed for accuracy before signature

Process & Audit Support

Regulatory strategy session — alignment on classification, conformity assessment route, Notified Body selection
Notified Body selection guidance — matching your device type, timeline, and budget to available designated NBs
Pre-submission review — simulated NB audit to identify gaps before formal submission
Notified Body audit support — on-site or remote presence, real-time response to NB queries and findings
Non-conformity response — drafting and managing responses to NB audit findings
Post-market surveillance setup — PMS plan, PSUR template, PMCF plan, vigilance reporting procedures
EU MDR Article 10 obligations — post-certification responsibilities, EUDAMED registration guidance
AI Act overlap assessment — gap analysis for EU AI Act obligations applicable from August 2026

How it works

The EU MDR certification process

A structured 6–9 month journey with clear milestones, fixed deliverables at each phase, and no surprises.

Week 1–4 · Discovery

Gap analysis & regulatory strategy

Review existing documentation, software architecture, and QMS. Determine device classification under Rule 11. Define the conformity assessment route and Notified Body requirements. Deliver written regulatory strategy document.

Month 2–3 · Foundation

QMS alignment & technical documentation structure

Align your ISO 13485 QMS with MDR requirements. Build the technical documentation structure per Annex II. Start risk management file and software lifecycle documentation.

Month 3–6 · Documentation

Full technical documentation development

Complete all technical file sections: device description, design outputs, clinical evaluation report, risk management, software documentation, labelling, post-market documentation. Iterative reviews with your team.

Month 6–7 · Pre-submission

Internal pre-audit & NB submission

Conduct a simulated Notified Body audit to find and fix gaps. Prepare and submit the technical documentation package to the Notified Body. Manage the application process.

Month 7–9 · Audit

Notified Body audit & CE mark

Support during the NB document review and audit. Respond to queries and non-conformities. Obtain the EU Certificate of Conformity and issue the Declaration of Conformity. Register in EUDAMED.

Service details

RegulationEU MDR 2017/745

Timeline6–9 months

Device classesClass I, IIa, IIb

DeliveryRemote or on-site

PricingFixed-price project

Success rate100% ✓

Why early NB engagement matters in 2026

There are only ~40 Notified Bodies designated under EU MDR. Intake queues at major NBs like BSI, TÜV SÜD, and DEKRA can run 6–12 months just to accept your application. Starting the NB relationship at the beginning of your project — not the end — is essential to avoid timeline delays.

Ready to start? Book a free 30-minute call and get your certification roadmap.

Book free consultation →

2026 Update

EU MDR + EU AI Act: what AI medical software needs in 2026

From August 2026, the EU AI Act's high-risk AI provisions apply to AI medical devices. If your software uses machine learning or AI algorithms, you need to comply with both frameworks simultaneously.

⚖️

Dual compliance: MDR + AI Act

Many MDR obligations for AI SaMD overlap with EU AI Act requirements — risk management, clinical evidence, human oversight. We map what counts for both and what is genuinely new, avoiding duplication of effort.

🔄

Change management for ML models

Continuously learning AI models create unique MDR challenges around change classification (substantial vs non-substantial) and post-market obligations. We implement robust change control processes that satisfy both MDR and AI Act auditors.

📋

Technical documentation for AI

AI SaMD requires additional technical documentation: algorithm validation data, training and test datasets description, performance metrics, explainability documentation. We know what Notified Bodies look for.

→ Read our guide: EU AI Act & EU MDR — what changes for AI medical devices in 2026

FAQ

EU MDR certification — common questions

What is EU MDR and does my medical software need it? +

EU MDR 2017/745 is the European Union's Medical Device Regulation that replaced the MDD in 2021. If your software qualifies as a medical device under Rule 11 — meaning it processes patient or physiological data to make or inform clinical decisions — it requires CE marking under EU MDR before you can sell or distribute it in the EU. This includes diagnostic apps, clinical decision support software, AI-powered diagnostic tools, and any software with a medical intended purpose that influences diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of disease.

How long does EU MDR certification take for medical software? +

For Class IIa SaMD, the typical timeline from kick-off to CE mark is 6–9 months: 1–2 months for gap analysis and classification, 3–4 months for technical documentation development, and 2–3 months for Notified Body review. Class I self-declaration can be achieved in 3–4 months. The biggest variable is NB queue time — some NBs have intake queues of 6–12 months in 2026, which is why we engage them from day one of the project.

Do I need a Notified Body for my medical software? +

Only Class I non-sterile, non-measuring devices can self-declare conformity without a Notified Body. All Class IIa, IIb, and III medical software requires a Notified Body. Under Rule 11, most SaMD that influences clinical decision-making classifies as IIa or higher. We determine the correct classification in the first phase of every engagement.

How much does EU MDR certification cost? +

Our consulting fee for full EU MDR certification support ranges from €10,000 to €25,000 depending on device class, documentation complexity, and existing QMS maturity. This is separate from Notified Body fees, which typically range from €15,000–€40,000 for Class IIa software. We always provide a fixed-price proposal after the free discovery call — no hourly billing, no scope creep surprises.

Can you certify AI/ML medical software under EU MDR? +

Yes — AI/ML SaMD is a core speciality. We've certified AI-powered diagnostic tools, machine learning monitoring systems, and clinical decision support software using AI. We address the specific challenges: algorithm validation, clinical evaluation with AI performance metrics, change management for continuously learning models, explainability documentation, and the overlap with EU AI Act requirements from August 2026.

We already have MDD certification — do we need to recertify under MDR? +

Yes. MDD certificates have transitional validity but all devices must be fully certified under EU MDR. The transition requires updating your technical documentation to MDR Annex II/III format, updating the Clinical Evaluation Report to MDCG 2020-1 requirements, and potentially updating your QMS to cover new MDR post-market obligations. We manage the full MDD-to-MDR transition and have done so for several clients ahead of the applicable transition deadlines.

→ Not sure if your software qualifies as a medical device? Read our classification guide.

EU MDR Certification for Medical Software