EU MDR (2017/745) and EU IVDR (2017/726) Guide

EU MDR and IVDR Explained: A Complete Compliance Guide for Medical Device and IVD Manufacturers

For more than two decades, medical devices and in vitro diagnostics sold in the European Union operated under a directive-based system — the Medical Device Directive (MDD), the Active Implantable Medical Devices Directive (AIMDD), and the IVD Directive (IVDD). These directives gave individual member states considerable latitude in how they were implemented, which meant a device's path to market could look different depending on where a manufacturer's notified body was based. Following a series of high-profile safety failures, most notably the PIP breast implant scandal, EU lawmakers concluded that the system needed a fundamental overhaul rather than incremental amendment.

The result was two regulations, not directives: the EU Medical Device Regulation (MDR) 2017/745 and the EU In Vitro Diagnostic Regulation (IVDR) 2017/746. Unlike directives, regulations apply directly and uniformly across all EU member states, without needing to be transposed into national law first. That single structural change — from directive to regulation — is a large part of why compliance has become so much more demanding: there is no longer room for country-by-country interpretation, and the requirements are considerably more prescriptive than what came before.

This guide walks through what MDR and IVDR actually require, how the two regulations differ, where the current transition deadlines stand, and what a realistic compliance roadmap looks like for manufacturers navigating both.

The Road to MDR: What Changed and Why

The MDR entered into force on May 25, 2017, giving industry a three-year runway before it became fully applicable on May 26, 2021. That runway turned out to be too short for many manufacturers and notified bodies alike, but it did give the market time to absorb the scale of the change.

MDR did not simply tighten existing requirements — it expanded the scope of what counts as a “medical device” in the first place. Certain aesthetic products with no intended medical purpose, such as dermal fillers and colored contact lenses, were pulled into scope because they carry similar risks to devices with a therapeutic purpose. Software used for diagnostic or therapeutic purposes was given a much clearer, more rigorous classification pathway, reflecting how central software and digital health tools had become to modern healthcare. Reprocessed single-use devices, previously a regulatory gray area in many member states, were explicitly addressed for the first time.

Beyond scope, the substantive requirements were rewritten with a much stronger emphasis on lifetime accountability rather than a one-time approval event:

• Stricter clinical evidence requirements. A CE mark is no longer a static achievement. Manufacturers must maintain ongoing Post-Market Clinical Follow-up (PMCF) that continues generating clinical data throughout the device's commercial life, not just at the point of initial certification.
• A new device identification backbone. Unique Device Identification (UDI) requirements were introduced to give every device a traceable identity through the supply chain, supporting faster and more precise recalls when something does go wrong.
• A central EU database. EUDAMED was designed to give regulators, notified bodies, and eventually the public a single source of truth for device registrations, certificates, clinical investigations, and vigilance reports across all 27 member states.
• Sharper notified body oversight. Notified bodies themselves came under tighter scrutiny, including a requirement to conduct unannounced audits of manufacturing sites, closing a loophole where facilities could effectively prepare in advance for scheduled inspections.
• A named point of accountability. Every manufacturer must now designate a Person Responsible for Regulatory Compliance (PRRC) — an individual with defined qualifications who is personally accountable for ensuring the organization meets its regulatory obligations.

The Road to IVDR: A Much Larger Shift Than It First Appears

If MDR was a significant overhaul, IVDR represented something closer to a regulatory earthquake for the diagnostics industry. It became fully applicable a year after MDR, on May 26, 2022, replacing the IVD Directive (98/79/EC).

The scale of the change is best understood through classification. Under the old IVD Directive, the large majority of diagnostic products — by most estimates, around 90% — could be self-certified by the manufacturer with no external, independent review at all. IVDR flips that ratio almost entirely. It introduces a risk-based classification system running from Class A (lowest risk) through Class D (highest risk, such as tests for transmissible agents in blood donations), and the majority of devices in Classes B through D now require notified body involvement before they can be placed on the market.

For diagnostics manufacturers, many of whom had never worked with a notified body before, this meant building conformity assessment capability essentially from scratch — clinical performance studies, technical documentation practices, and quality management systems that simply hadn't been necessary under self-certification. It's a major reason why IVDR compliance timelines have proven even more difficult to hit than MDR's, and why the regulation has needed its own dedicated extension.

Key Differences Between MDR and IVDR

Current MDR and IVDR Transition Deadlines

Neither regulation's original transition timeline survived contact with reality. Notified body capacity proved far too limited to review the sheer volume of legacy devices before their original deadlines, and there was a genuine risk that safe, well-established devices would simply disappear from the EU market — not because they were unsafe, but because there weren't enough auditors and reviewers to process the paperwork in time. In response, the EU adopted Regulation (EU) 2023/607 to extend MDR transition periods, and later Regulation (EU) 2024/1860 to extend IVDR deadlines and introduce a phased rollout of EUDAMED.

As of mid-2026, the operative deadlines are as follows.

MDR legacy device deadlines:

• May 26, 2026 — Class III and Class IIb implantable custom-made devices
• December 31, 2027 — Class III and implantable Class IIb devices (with limited exceptions such as sutures, staples, and dental fixtures, which follow the later deadline)
• December 31, 2028 — All remaining Class IIb, Class IIa, and Class I sterile/measuring devices

IVDR legacy device deadlines (self-declared/legacy devices):

• December 31, 2027 — Class D devices
• December 31, 2028 — Class C devices
• December 31, 2029 — Class B and Class A sterile devices

EUDAMED: Following Commission Decision (EU) 2025/2371, four EUDAMED modules — Actor Registration, UDI/Device Registration, Notified Bodies and Certificates, and Market Surveillance — became mandatory as of May 28, 2026, for both MDR and IVDR.

It's worth emphasizing that these dates are not automatic. To benefit from an extended transition period, a device generally must continue complying with its original MDD/AIMDD/IVDD certificate, must not have undergone significant changes to its design or intended purpose, and — critically — the manufacturer must have a signed written agreement with a notified body in place before the applicable cutoff. A device that technically “qualifies” for a 2027 or 2028 deadline on paper can still lose market access earlier if the manufacturer hasn't lined up notified body capacity. Manufacturers should treat these dates as the outer boundary of a process that, in practice, needs to start years in advance — not as a deadline to work backward from at the last minute.

It's also worth noting that this is not necessarily the final word. The European Commission has signaled it is considering a further targeted revision of the framework, including pilot pathways for orphan devices, pediatric devices, and breakthrough innovations, and postponed recertification requirements to avoid a repeat of the 2028 bottleneck. Manufacturers should keep an eye on developments rather than treating current deadlines as permanently fixed.

Core Compliance Requirements Under MDR and IVDR

Regardless of device class, manufacturers should expect to build and maintain the following, each of which is a substantial body of work rather than a single document to be filed away:

1. Technical Documentation. This is the backbone of the entire submission — design specifications, manufacturing process descriptions, risk management outputs, and performance data, all organized to satisfy Annex II and III (MDR) or the equivalent IVDR annexes. Notified bodies will scrutinize not just whether the data exists, but whether it is internally consistent and traceable across every document.
2. Quality Management System (QMS). Typically built around ISO 13485, a compliant QMS has to demonstrate real operational control over design, supplier qualification, production, and corrective/preventive action (CAPA) processes — not just a set of written procedures that exist on paper.
3. Clinical or Performance Evaluation. Under MDR, this takes the form of a Clinical Evaluation Report supported by literature review, clinical investigation data, and, where applicable, a documented equivalence argument to a predicate device. Under IVDR, the equivalent is a Performance Evaluation Report built on analytical performance, clinical performance, and scientific validity data. For many legacy devices, this is where the gap between what already exists and what's now required is widest.
4. Risk Management File. Aligned with ISO 14971, this documents the systematic identification of hazards, estimation and evaluation of risks, and the controls put in place to mitigate them — maintained as a living file across the device's entire lifecycle, not a one-time exercise.
5. Post-Market Surveillance (PMS) and Vigilance. This includes a formal PMS plan, Periodic Safety Update Reports (PSURs) or Post-Market Performance Follow-up (PMPF) reports for IVDs, and defined procedures for detecting, investigating, and reporting incidents to competent authorities.
6. Labeling and UDI Compliance. Every device needs correct UDI assignment, a Basic UDI-DI, and accurate registration of that identifying data in EUDAMED, in addition to standard labeling requirements.
7. PRRC Designation. The named individual accountable for regulatory compliance must meet defined qualification criteria and have genuine authority within the organization to fulfill that role.
8. Notified Body Conformity Assessment. Required for most device classes above the lowest risk tier, this is the external, independent review that ultimately determines whether a CE certificate is issued.

Why MDR and IVDR Compliance Is So Resource-Intensive

Manufacturers who have gone through recertification consistently point to the same three pressure points.

The first is notified body capacity. Even manufacturers with strong technical files often face lead times of twelve to twenty-four months simply waiting for a notified body to complete its review, a bottleneck created by the small number of bodies designated under the new regulations relative to the volume of devices needing assessment.

The second is the depth of clinical and performance evidence now expected. Many legacy devices were cleared decades ago under far lighter evidentiary standards, and the gap between what exists in an old technical file and what MDR or IVDR now requires can be substantial — sometimes requiring new clinical investigations rather than a desk-based update.

The third is internal coordination. A compliant submission touches quality, regulatory affairs, clinical, manufacturing, and post-market teams simultaneously, and inconsistencies between what each team has documented are one of the most common reasons submissions stall during notified body review.

A Practical Compliance Roadmap

• Classify accurately. Confirm device classification under MDR/IVDR rules early, since classification determines every downstream requirement — from the depth of clinical evidence needed to whether notified body involvement is required at all.
• Gap-assess the technical file. Compare existing documentation line by line against current Annex requirements to identify exactly where legacy files fall short.
• Secure notified body capacity early. Given multi-year review queues, engagement should begin well ahead of the applicable deadline — waiting until the year of the deadline is, in most cases, already too late.
• Strengthen clinical and performance evidence. Identify gaps in existing clinical or performance data and plan PMCF or PMPF activities to close them systematically rather than reactively.
• Align the QMS to ISO 13485. Ensure design controls, supplier oversight, and CAPA processes reflect actual practice, not just documented intent.
• Register in EUDAMED. Complete Actor and device registration ahead of mandatory module deadlines, since delays here can hold up other regulatory milestones.
• Build a PRRC-led governance structure. Assign clear, documented ownership of regulatory compliance activities so that accountability doesn't dissolve across multiple departments.

Frequently Asked Questions

Is MDR replacing IVDR, or are they separate regulations? They are separate, parallel regulations. MDR (2017/745) covers medical devices; IVDR (2017/746) covers in vitro diagnostics. A company producing both device types must comply with both frameworks independently, including maintaining separate technical documentation and, in most cases, working with notified bodies for each.

Do all legacy devices need a new notified body certificate? Most do, unless they qualify for narrow exemptions. Devices previously self-certified under the old directives but reclassified as requiring notified body involvement under MDR or IVDR must undergo full conformity assessment for the first time, which is often the single largest driver of workload for diagnostics manufacturers in particular.

What happens if a device misses its transition deadline? Devices that fail to achieve certification by their applicable deadline generally cannot continue to be placed on the EU market after that date. The removal of the earlier “sell-off” provision means devices already legally placed on the market can typically continue to be made available to end users without an additional time limit, but new placement on the market after the deadline is not permitted without a valid certificate.

How long does MDR or IVDR certification typically take? Timelines vary widely by device complexity and notified body workload, but manufacturers should generally plan for twelve to twenty-four months from application submission to certificate issuance, on top of the internal preparation time needed to get technical documentation and clinical evidence audit-ready before that clock even starts.

How FDAmedix Can Help

Navigating MDR and IVDR is rarely a documentation exercise alone — it's a cross-functional program that touches quality, regulatory, clinical, and manufacturing teams at once, against a backdrop of limited notified body capacity and a regulatory framework that continues to evolve. FDAmedix works alongside medical device and IVD manufacturers to turn that complexity into a structured, manageable plan.

FDAmedix's quality and regulatory consulting services include:

• Gap analyses against current MDR/IVDR requirements and MDCG guidance, benchmarking existing technical files against what notified bodies expect today
• Technical documentation and clinical/performance evaluation support, including identifying and closing evidence gaps in legacy device files
• ISO 13485-aligned QMS design and implementation, built for real operational use rather than audit-only compliance
• Notified body liaison and submission strategy, helping manufacturers sequence their applications to make the most of available capacity
• Post-market surveillance and vigilance system design, covering PSUR, PMCF, and PMPF planning
• EUDAMED registration support, ensuring Actor and device data is accurate and submitted ahead of mandatory deadlines

Whether you're approaching a 2026, 2027, or 2028/2029 transition deadline, or building a compliance program for a new device from the ground up, FDAmedix's team can help you assess where you stand and build a realistic path to certification.

This article is for general informational purposes and does not constitute legal or regulatory advice. Requirements and deadlines under EU MDR and IVDR are subject to ongoing regulatory revision.