CE approval for medical devices under the EU MDR explained

What CE approval really means under the EU MDR

CE approval for medical devices is a common search term, but the legal concept in the EU is CE marking. A device may bear the CE mark only after the manufacturer has demonstrated conformity with Regulation (EU) 2017/745, completed the applicable conformity assessment route, drawn up an EU declaration of conformity and, where required, obtained assessment by a designated notified body. The European Commission does not generally approve individual medical devices before market entry. For many higher-risk devices, the notified body certificate is the practical gatekeeper, but it is still only one part of a wider compliance system covering technical documentation, clinical evaluation, UDI, registration, vigilance and post-market surveillance. More regulatory background is available in the Regulatory section.

The distinction matters because CE approval can sound like a one-time permission granted at launch. Under the EU Medical Device Regulation, CE marking is an ongoing manufacturer responsibility. Evidence must be kept current, real-world device performance must be monitored, serious incidents must be reported, and changes that may affect safety, performance or intended purpose must be controlled.

The route starts with intended purpose and classification

The first practical step is not testing. It is defining the device’s intended medical purpose, user population, indications, operating principle, duration of contact with the body and whether the device is invasive, active, implantable, sterile or measuring. These details drive classification under Annex VIII of the MDR.

The MDR divides medical devices into Class I, IIa, IIb and III according to intended purpose and inherent risk. Classification then determines the conformity assessment route under Article 52. A low-risk Class I device may be self-declared by the manufacturer, while Class IIa, IIb and III devices normally require notified body involvement. Certain Class I devices also need notified body review for specific aspects, such as sterility, measuring function or reusable surgical instrument requirements.

For regulatory teams, classification is also where many later problems begin. If the intended purpose is written too broadly, the device may fall into a higher class or require stronger clinical evidence than expected. If new claims are added later in marketing materials, instructions for use or software functions, they may change the regulatory position. Article 7 of the MDR also prohibits misleading claims about intended purpose, safety or performance, so the commercial claim set should be controlled as carefully as the technical file.

When a notified body is required

A notified body is an independent organisation designated by an EU Member State to perform conformity assessment activities for defined device types and procedures. Choosing one is not only a procurement decision. The notified body must be designated for the relevant MDR codes, technologies and conformity assessment procedure. A certificate from an organisation that is not properly designated for the device route does not replace MDR conformity assessment.

Device category	Typical CE marking route	Practical implication
Class I, non-sterile, non-measuring and not a reusable surgical instrument	Manufacturer self-declaration after preparing technical documentation and meeting MDR obligations	No notified body certificate is normally required, but the device is still subject to MDR requirements and market surveillance.
Class I sterile, measuring or reusable surgical instruments	Manufacturer declaration plus notified body involvement limited to the relevant aspects	The notified body review is narrower than for higher-risk devices, but evidence for sterility, metrology or reuse must be robust.
Class IIa	Notified body conformity assessment, generally including quality management system review and representative technical documentation assessment	The manufacturer should plan for sampling of technical documentation and ongoing surveillance.
Class IIb	Notified body conformity assessment with stronger technical documentation expectations; certain implantable IIb devices receive device-level documentation assessment	Clinical evidence, risk management and manufacturing controls are usually major review areas.
Class III	Full notified body conformity assessment, with the highest MDR evidence expectations	Clinical evaluation, benefit-risk justification, post-market clinical follow-up and summary of safety and clinical performance are central to review.

Where a notified body is involved, its four-digit identification number appears next to the CE mark. Where no notified body is involved, the CE mark appears without such a number. Custom-made devices and investigational devices follow specific MDR routes and generally do not bear CE marking as ordinary commercial devices.

The evidence package behind CE marking

The MDR conformity file is broader than a test report. A manufacturer normally needs an integrated evidence package showing that the device meets the general safety and performance requirements in Annex I and that the evidence remains valid across the device lifecycle.

• Quality management system: Procedures should cover design control, supplier management, production, risk management, complaint handling, vigilance, post-market surveillance and corrective actions. ISO 13485 is often used as the quality management framework, but it must be mapped to MDR obligations rather than treated as a substitute for them.
• Technical documentation: Annexes II and III require documentation that allows conformity to be assessed. This includes device description, specifications, design and manufacturing information, general safety and performance requirement mapping, benefit-risk analysis, verification and validation, and post-market plans.
• Risk management: The risk file should connect hazards, foreseeable misuse, risk controls, residual risk acceptability and benefit-risk conclusions. It should also be linked to clinical evaluation and post-market data.
• Clinical evaluation: Article 61 and Annex XIV require clinical evidence appropriate to the device, its intended purpose and risk class. For legacy devices, guidance from the Medical Device Coordination Group has emphasised the need for sufficient clinical evidence rather than simple reliance on past market presence.
• Labelling and instructions for use: The label, IFU and promotional claims must remain aligned with the assessed intended purpose. The CE mark must be visible, legible and indelible where applicable.
• UDI and registration data: The Unique Device Identification system supports traceability and must be considered in labelling, documentation and EUDAMED workflows.
• Post-market surveillance and vigilance: Article 83 requires a post-market surveillance system proportionate to risk class and appropriate for the device type. Class IIa, IIb and III devices also require periodic safety update reports.

In practice, a successful CE marking project is less about producing separate documents and more about showing traceability. The intended purpose should connect to classification. Classification should connect to conformity assessment. Claims should connect to clinical evidence. Risk controls should connect to verification, labelling and post-market surveillance. Review delays often arise when these links are weak, incomplete or inconsistent across the file.

Why 2026 timing still matters

Although the MDR has applied to medical devices since May 26, 2021, the EU has adopted transition measures because of notified body capacity constraints and the need to avoid device shortages. Regulation (EU) 2023/607 extended certain legacy device transition periods, but only where strict conditions were met. Those conditions included continued compliance with the former Directives, no significant change in design or intended purpose, no unacceptable risk, a quality management system by May 26, 2024, a formal notified body application by May 26, 2024 and a written agreement with a notified body by September 26, 2024.

Date or rule	Why it matters for CE marking
May 26, 2021	The MDR became applicable for medical devices, replacing the former medical device Directives for new MDR conformity routes.
May 26, 2024 and September 26, 2024	These were key prerequisite dates for many legacy devices relying on extended transition under Regulation (EU) 2023/607.
January 10, 2025	The supply interruption and discontinuation notification obligation introduced by Regulation (EU) 2024/1860 began to apply for certain devices where serious harm or a risk of serious harm is reasonably foreseeable.
May 26, 2026	The temporary transition window for Class III custom-made implantable devices without a notified body certificate ended.
May 28, 2026	The first four EUDAMED modules became mandatory: actor registration, UDI/devices registration, notified bodies and certificates, and market surveillance.
December 31, 2027	Transition ends for eligible Class III devices and certain Class IIb implantable devices, subject to the MDR transition conditions.
December 31, 2028	Transition ends for eligible lower-risk legacy categories such as certain Class IIb, IIa and Class I devices requiring notified body involvement, subject to conditions.
February 25, 2027	Commission Implementing Regulation (EU) 2026/977 is scheduled to apply, introducing uniform procedural and quality management requirements for notified body conformity assessment activities, with one provision applying from January 1, 2028.

The key point is that an extended transition date is not a general grace period for any device. It applies only where the device and manufacturer meet the legal conditions. A manufacturer that missed the 2024 application or written agreement deadlines cannot assume that a former Directive certificate remains usable simply because a later date appears in the transition rules.

Common reasons CE marking projects stall

Many CE marking projects slow down for predictable reasons. The first is treating CE marking as a documentation exercise after product design is finished. MDR evidence expectations affect design inputs, usability engineering, software lifecycle controls, biological evaluation, sterilisation validation, packaging validation, clinical strategy and supplier controls. Late remediation is usually slower than building these requirements into development. See also: Implants.

The second reason is insufficient clinical evidence. Under the MDR, clinical evaluation must be specific to the device, its intended purpose and its benefit-risk profile. Equivalence arguments are more constrained than under the former Directives, especially when access to equivalent device data is limited. For higher-risk or novel devices, teams should expect notified bodies to examine whether the clinical evidence supports each claimed indication and user population.

The third reason is misunderstanding change control. Legacy devices relying on transition rules must avoid significant changes in design or intended purpose. MDR-certified devices also need controlled change assessment because some changes require notified body notification or approval before implementation. A change that appears minor from an engineering view can be significant from a regulatory view if it affects clinical performance, risk controls, intended users or claims.

The fourth reason is weak EUDAMED and UDI preparation. Since the first four EUDAMED modules became mandatory from May 28, 2026, registration data quality is no longer a future housekeeping task. Actor data, device identifiers, certificate information and market surveillance interactions should be treated as controlled regulatory data.

Finally, manufacturers sometimes over-rely on voluntary certificates, test house reports or non-EU authorisations. These documents may support the evidence package, but they do not replace the MDR conformity assessment route. FDA clearance, approval or other national authorisations may be relevant background evidence, but they do not automatically grant CE marking.

Practical checklist before affixing the CE mark

1. Confirm that the product is a medical device or accessory under the MDR and define the intended purpose precisely.
2. Classify the device under Annex VIII and document the classification rationale.
3. Identify all applicable EU legislation, harmonised standards and common specifications relevant to the device.
4. Build technical documentation under Annexes II and III, including verification, validation, risk management and post-market plans.
5. Prepare a clinical evaluation that supports the intended purpose, indications, patient population and benefit-risk conclusion.
6. Establish the quality management system and assign regulatory responsibilities, including authorised representative arrangements where the manufacturer is outside the EU.
7. Select a notified body designated for the relevant MDR scope if the device route requires one.
8. Resolve notified body questions, audit findings and technical documentation findings before certification.
9. Draw up and maintain the EU declaration of conformity, then affix the CE mark correctly, including the notified body number where applicable.
10. Register required information in EUDAMED, maintain UDI controls and operate post-market surveillance and vigilance processes after launch.

Frequently asked questions

Is CE approval the same as CE marking?

No. CE approval is an informal phrase. The legal term is CE marking. For medical devices, CE marking means the manufacturer has demonstrated conformity with the MDR and other applicable EU rules through the correct conformity assessment route.

Can a medical device manufacturer self-certify in Europe?

Some Class I devices can be self-declared, provided they are not sterile, do not have a measuring function and are not reusable surgical instruments. Even then, the manufacturer must prepare technical documentation, meet MDR obligations and remain subject to competent authority market surveillance.

Does every CE-marked medical device have a notified body certificate?

No. A notified body certificate is typical for Class IIa, IIb and III devices and for limited aspects of certain Class I devices. A simple Class I device may bear the CE mark without a notified body number if the self-declaration route is legally available.

How long does CE marking take?

There is no universal timeline. Timing depends on device class, clinical evidence maturity, technical documentation quality, notified body capacity, audit findings and how quickly the manufacturer answers questions. The upcoming notified body procedural rules under Commission Implementing Regulation (EU) 2026/977 may improve predictability for certain assessment activities from 2027, but they do not remove the need for complete evidence.

Does a CE mark end the manufacturer’s regulatory duties?

No. CE marking begins the post-market phase. The manufacturer must maintain technical documentation, monitor safety and performance, update clinical evaluation where needed, manage complaints and vigilance, control changes and comply with EUDAMED and UDI obligations.