MDR 2017/745 and IVDR 2017/746: What requirements for what solutions?

The Regulations (EU) 2017/745 on medical devices (MDR) and (EU) 2017/746 on in vitro diagnostic medical devices (IVDR) represent a major milestone in the harmonization of European regulatory frameworks. Effective since May 2021 and May 2022 respectively, they introduce enhanced requirements throughout the lifecycle of medical devices (e.g., classification, clinical evaluation or performance evaluation, and post-market surveillance) with a clear goal: to strengthen patient safety. By imposing stricter quality criteria, these regulations aim to mitigate risks for patients, harmonize the European market, and foster trust among all stakeholders in European healthcare systems.

This article delves into these regulatory expectations and provides essential insights for navigating this reinforced framework.

I. The transitional period

Due to the COVID-19 pandemic and the resulting public health crisis, medical devices (MDs) and in vitro diagnostic devices (IVDs) Regulations had to be adjusted. To enable the organizations responsible for verifying the compliance of these devices to work effectively, new deadlines were established, providing manufacturers with additional time to meet the enhanced requirements of the regulations. These revised provisions extend until May 2029.

(*) Quality Management System

(**) Notified Body

(***) Medical Device Directive

(****) Formal Evaluation Request to a NB :

• 26/05/2025 for class D
• 26/05/2026 for class C
• 26/05/2027 for class A and B

IVDR Devices with certificates under the Directive: Valid under certain conditions until 31/12/2027

IVDR Devices with certificates under the Directive requiring a NB intervention under IVDR:

• 31/12/2027 for class D
• 31/12/2028 for class C
• 31/12/2029 for class A et B

II. What are the impacts of the regulations on medical devices and in vitro diagnostic medical devices?

The regulations have had a significant impact on medical devices, and here are some examples:

• Expansion of the scope: The regulation lists categories of products that do not have a direct medical purpose (e.g., contact lenses, equipment emitting high-intensity electromagnetic radiation, see MDR Annex XVI), but nonetheless fall under the MDR due to their characteristics and functionality. These products must therefore comply with the same requirements regarding safety, quality, clinical evaluation, vigilance, etc., as medical devices designed for medical purposes.
• Stricter safety requirements: Safety requirements have been reinforced, particularly for implantable devices and single-use devices.
• New risk classification: The regulations introduce a new risk classification approach based on more stringent and detailed criteria. This evolution has led many devices initially classified as Class I (under Directive 93/42/EEC) or Class A (under Directive 98/79/EC for IVDs) to be reclassified into higher risk classes (IIa, IIb, or III / B, C, or even D) under the new regulations. For instance, certain medical software previously categorized as Class I now falls under Class IIa or IIb according to Rule 11 of the MDR. Similarly, many genetic tests or in vitro companion diagnostics, formerly classified as Class A, are now categorized as C or D under the IVDR, requiring the involvement of a notified body (e.g., HIV test). These changes result in far more rigorous clinical, technical, and regulatory requirements, particularly for Class III and Class D devices, including clinical evaluation, traceability, post-market surveillance, and technical documentation.
• Enhanced post-market surveillance: Manufacturers are required to establish a more robust vigilance system to monitor incidents related to their products.
• Introduction of the Unique Device Identifier (UDI): Every medical device must now be identified by a UDI, facilitating traceability.

III. Mandatory procedures for manufacturers as defined by the regulations

The regulations outline mandatory requirements that every manufacturer must rigorously comply with to ensure regulatory conformity and product safety.

Article 10 of the regulations specifies these mandatory procedures (Figure 3), such as:

1. Regulatory compliance strategy: a crucial pillar for manufacturers

To ensure medical devices compliance with the European regulations, manufacturers must establish a comprehensive regulatory compliance strategy. This approach involves identifying all applicable requirements, planning necessary actions to address them, and maintaining rigorous oversight throughout the product’s lifecycle.

In practice, this entails:

• Continuous regulatory monitoring to anticipate changes and updates
• Clear definition of internal responsibilities.
• Integration of regulatory requirements during design and manufacturing phases.
• Implementation of robust risk management and ongoing quality control measures.
• Effective post-market surveillance through vigilance and incident management.

A documented and rigorously applied strategy serves not only to minimizes the risk of non-compliance but also to prevent significant costs associated with delays in market entry, product recalls, or potential penalties. Ultimately, it ensures patient safety while maintaining the manufacturer’s sustainability and reputation in the market.

For example, a Small or Medium-sized Enterprise developing an IVD device can implement a rigorous regulatory strategy by appointing a regulatory monitoring officer, planning necessary clinical studies early in the design phase, and providing continuous training to quality teams resulting to:

• Timely CE marking
• Reduced requests for additional information from the notified body
• Efficient management of post-market surveillance.

2. Identification of general requirements: a key step for compliance

To comply with the regulations, manufacturers must identify the General Safety and Performance Requirements (GSPR) listed in Annex I that are applicable to their medical devices. This process is essential to demonstrate that a device is safe, effective, and compliant prior to its market release.

This involves:

• Analyzing each requirement in Annex I to determine its applicability to the product,
• Justifying the non-applicable requirements,
• Associating evidence of compliance (e.g., testing, risk assessments, validations) with each applicable requirement,
• Consolidating all this information into a traceability matrix, which is integrated into the technical documentation

This structured approach ensures that manufacturers effectively meet the expectations of notified bodies, but also it prevent the risk of technical documentations rejection by the notified body, and a market access in due time for their devices.

3. Resource management

Resource management is a mandatory procedure within the quality system, designed to ensure that manufacturers possess the human, technical, and material resources necessary to guarantee the compliance and safety of their devices.

This includes:

• Qualified and regularly trained teams,
• A designated and competent Person Responsible for Regulatory Compliance (PRRC),
• Properly maintained, controlled, and suitable equipment,
• A work environment that meets product-specific requirements (e.g., clean rooms, temperature controls, humidity levels, etc.).

For example, and in the case of a Class IIa medical device manufacturer audited for the renewal of its CE certificate. The audit highlighted the following discrepancies:

• The PRRC did not meet the required experience level (less than one year in regulatory affairs).
• Several production operators had not been trained on updated procedures following the MDR’s implementation.
• Equipment sterilization qualification records were incomplete or missing.

These gaps could have serious consequences for the manufacturer, such as :

• Temporary suspension of certification by the notified body until corrective measures are implemented.
• Delayed product market by up to 5 months.
• Additional costs incurred, including hiring a new PRRC, accelerated training, and follow-up audits.
• Loss of trust among certain European distributors.

4. Risk management and clinical/performance evaluation

The risk management procedure is designed to identify and control all risks associated with the design, manufacturing, usage, and disposal of a medical device or in vitro diagnostic medical device. When the complete elimination of a risk is not possible, a proper application of the risk management procedure helps minimize the likelihood of its occurrence, thus protecting patients, users, third parties, assets, and the environment that may come into contact with the product.

Moreover, while they are independent processes, the risk management procedure is closely interconnected with the clinical evaluation procedure (or performance evaluation for IVDs). This linkage arises because clinical risks identified during clinical investigations, clinical evaluation, and post-market clinical follow-up are incorporated into the risk management process.

The risk management procedure is structured as follows:

a. Risk management

Risk management must cover the entire lifecycle of the device, from design to post-market surveillance.

In practice this involves :

• Implementing a risk management plan
• Identifying and assessing hazards related to the product
• Implementing risk mitigation measures
• Conducting a benefit/risk analysis, demonstrating that the benefits for the patient outweigh the residual risks
• Continuously post market monitoring risks and update of the risk file as necessary.

This risk management process is typically conducted in accordance with ISO 14971:2019, which is recognized as the benchmark standard. It directly informs the technical documentation and supports the demonstration of compliance for CE marking.

Without rigorous risk management, a manufacturer risks certification rejections, product recalls, or even sanctions. As such, it is a critical tool for prevention, patient safety, and maintaining competitiveness.

b. Clinical evaluation or performance evaluation:

• Manufacturers must justify the necessity of a clinical evaluation or performance evaluation based on the device’s risk class and level of innovation.
• The clinical investigation protocol must be rigorous and approved by an ethics committee.
• The results of the clinical investigation must be documented in a detailed report.
• This detailed report is part of the clinical evaluation (Clinical Evaluation Report (CER) for MDs) or Performance Evaluation Report (PER for IVDs), which also includes risk analysis, biocompatibility testing, mechanical testing, usability evaluation, scientific state-of-the-art analysis, and more. The purpose is to assess the safety and performance of the device in question.

5. Product realization

Product realization begins by the conception phase. The product’s feasibility is assessed, prototyped, tested, and refined before transitioning to production. From this point, the manufacturing environment is established (though subject to continuous improvement), suppliers are managed, and storage and distribution processes are defined:

a. Design and development:

• A documented design procedure is mandatory

Manufacturers must establish and maintain a formalized design and development procedure within their QMS. This procedure should include:

• The development phases (from concept to final product)
• Validation criteria at each stage of development.
• Management of design changes.
• Identification of responsibilities.
• Integration of risk management and regulatory compliance verification.

Note: This procedure is an explicit requirement to demonstrate compliance with Annexes IX and XI under the MDR, and Annexes IX and XI under the IVDR.

• A design file required for all devices

Regardless of the type of device, manufacturers must create and maintain a design file (also referred to as the Technical Design File). This file must:

• Be an integral part of the technical documentation (Annex II MDR/IVDR).
• Include the results of each design and development phase.
• Document verifications, validations, and evidence of performance and safety.
• Incorporate proof of compliance with applicable harmonized standards or common specifications.

b. Manufacturing:

• Manufacturers must implement a system that encompasses all aspects of production, from the receipt of raw materials to the delivery of the finished product, as outlined in Article 10 of Regulations (EU) 2017/745 and (EU) 2017/746.
• Rigorous quality controls must be applied at every stage of production to ensure product compliance.
• Each MD or IVD device must be traceable throughout its lifecycle, from manufacturing to market release, primarily through the use of a Unique Device Identifier (UDI). The UDI system enables clear identification, enhanced traceability, and improved post-market surveillance.

6. Unique Device Identifier

Before the publication and implementation of the Regulations, manufacturers had relatively flexible options for ensuring the traceability of their products. While lot numbers and/or serial numbers were the default choice for many, there was no standardized format in place. Heavily inspired by the U.S. traceability system, the European Regulations now mandate the use of a universal, standardized, and information-rich format (including lot number, serial number, manufacturing date, expiration date, etc.) that is understandable by both humans and digital interfaces. This system aims to enhance the traceability, transparency, and safety of medical devices, which must now all bear a UDI.

The UDI must be presented in both human-readable text and a machine-scannable code on the product label, its packaging, and, in some cases, directly on the device itself (e.g., implants or reusable devices).

Manufacturers must also register UDI-related data in the European database, EUDAMED, and integrate the UDI into their regulatory documentation, including the Basic UDI-DI.

As a result, manufacturers are required to establish quality documents to address this obligation by creating procedures and/or detailed instructions to meet these requirements and align with the company’s new processes (e.g., developing an instruction guide for registration in EUDAMED).

Poor UDI management can result in delays in bringing products to market, technical documentation rejections, or audits non-conformities. UDI is thus a central element of regulatory compliance and plays a key role in recall management.

7. Post market surveillance system

The post-market surveillance (PMS) system involves the continuous collection and analysis of data regarding the safety and performance of devices once they are on the market. To achieve this, manufacturers must:

• Implement a Post-Market Surveillance Plan (PMSP) that defines the methods for collecting and analyzing feedback,
• Regularly produce PMS reports assessing residual risks and validating the benefit/risk ratio,
• Respond promptly in the event of detected issues (e.g., corrective actions, communication, recalls),
• Comply with specific requirements based on the device’s class (e.g., periodic safety update reports for higher-class devices).

A rigorous PMS system strengthens patient safety, enables proactive risk management, and ensures compliance with European requirements, thereby avoiding sanctions and commercial losses.

8. Communication management

Effective communication management ensures the rapid, clear, and traceable dissemination of information between the manufacturer, authorities, notified bodies, and end users.

Key aspects include:

• Prompt reporting of incidents and corrective actions to competent authorities,
• Transparent exchanges with notified bodies regarding compliance and modifications,
• Providing clear and accessible information to users via the product itself, its packaging, and the European Commission’s digital platform EUDAMED,
• Ensuring efficient internal communication to align actions and maintain consistency.

A rigorous approach to communication management helps prevent delays, sanctions, and loss of trust, while strengthening patient safety and enhancing the manufacturer’s reputation.

9. Vigilance 

As part of market surveillance, manufacturers must establish a vigilance system to detect, assess, report, and address any serious incidents or malfunctions that may impact the health or safety of patients or users.

In compliance with Articles 87 to 92 of the MDR (and Articles 82 to 87 of the IVDR), any serious incident or device recall must be reported to the competent authorities through EUDAMED within strict timeframes.

In cases of confirmed risk, the manufacturer must also implement Field Safety Corrective Actions (FSCA) to mitigate the issue, accompanied by a Field Safety Notice (FSN) to notify affected users and healthcare professionals.

10. Corrective and preventive actions

The procedure for Corrective and Preventive Actions (CAPA), as required by the MDR and IVDR, involves identifying, analyzing, and addressing non-conformities while implementing corrective and/or preventive measures to ensure these issues do not recur.

To achieve this, manufacturers must:

• Quickly detect problems through customer feedback, audits, or post-market surveillance,
• Analyze root causes to effectively target actions,
• Plan and implement clear corrective and preventive measures,
• Verify the effectiveness of the actions taken,
• Document all steps within their quality management system.

Poor management of CAPA can lead to:

• Continued incidents and increased risks for patients,
• Non-conformities detected during audits, which may result in sanctions,
• Costly product recalls and loss of user trust,
• Delays in bringing new products to market.

IV. Responsibilities of notified bodies

Compliance with these requirements is overseen by one or more Notified Bodies (NB). These independent entities are responsible for verifying that all regulatory conditions are met before authorizing a product’s placement on the market.

More specifically, Notified Bodies are tasked with assessing the compliance of medical devices (MDs) and in vitro diagnostic devices (IVDs) with prevailing legal and regulatory requirements.

It is important to note that the choice of the certifying NB lies with the manufacturer. This decision can be influenced by factors such as the type of MD or IVD being marketed or the NB’s ability to provide timely assessments. While GMED historically held the position as the sole French NB, AFNOR Certification was designated as an NB by the ANSM in 2024. Finally, it is not mandatory for French MD or IVD manufacturers to select a French NB for their certification.

V. Tips and advice

As explored throughout this article, the MDR and IVDR introduce numerous essential requirements to ensure patient safety and the performance of medical devices and in vitro diagnostic medical devices. Implementing these regulations poses a complex and ongoing challenge, and mere rigorous application is not always sufficient to achieve compliance.

It is therefore crucial for each manufacturer to clearly define the key steps to follow and plan them strategically, while mobilizing the necessary financial and human resources. The roadmap outlined below highlights these steps, which should be tailored to the specific circumstances and realities of each manufacturer:

However, while effective planning is essential to achieve compliance within the expected timelines and to manage financial impact, it is equally critical to pay close attention to the following elements, which must not be underestimated under any circumstances:

• Ensure that all team members are fully committed to the compliance project to prevent any resistance to change. This requires a pedagogical approach, taking the time to explain the goals and benefits of the initiative—from top management to operators.

• Maintain clear and regular communication with stakeholders to ensure the smooth execution of the compliance project. Certain aspects of the regulations, such as the distinction between clinical evaluation and clinical investigation, can be confusing. Precise communication helps eliminate ambiguity and prevent misinterpretations that could lead to delays in the certification process.

• Identify training needs related to the technical aspects of the regulations. If internal expertise is insufficient, these trainings can be outsourced. It is essential to account for these training costs in the overall planning to ensure effective project management.

• Assign clearly defined roles, considering both the expertise and availability of each stakeholder, to ensure an appropriate and efficient distribution of responsibilities.

• Maintain strict control over costs while planning for a financial buffer to address unforeseen expenses. Elements such as additional laboratory testing, the involvement of external consultants, or the need for internal audits can quickly escalate expenses and exceed the initial budget allocation.

Compliance with MDR and IVDR largely depends on effective project management. Task and action planning is essential to stay on track while adhering to both budget constraints and deadlines. Additionally, the human dimension must not be overlooked: securing employee engagement and leveraging their full potential is critical to achieving compliance objectives. Consequently, it is advisable to pair a compliance project with a robust change management policy, driven by leadership, to ensure its success and sustainability.

VI. Conclusion

The quality requirements outlined in the MDR and IVDR regulations are crucial to ensuring the safety and performance of medical devices and in vitro diagnostic devices. While they pose significant challenges for manufacturers (in terms of costs, human resources, and complexity), they are indispensable for safeguarding patient health.

Need assistance?

Our teams are here to guide you in implementing a QMS that is perfectly aligned with your applicable requirements.

What we offer:

• Comprehensive analysis of your current documentation
• Practical training sessions, available online or in-person
• Drafting and optimization of your regulatory documents and deliverables
• Personalized support from our expert consultants, supervised by a Technical Manager
• Technical assistance provided on-site, remotely, or via hotline for rapid and targeted responses

Contact us today at TechnicalDivision@efor-group.com to move forward together on your projects!