# The EU shake-up: MDR, IVDR, and the CE mark reset
In 2017, a knee implant sold across Europe carried a CE mark and a stack of paperwork that had satisfied regulators for years. By 2024, that same implant risked being pulled from shelves unless its manufacturer rebuilt its entire clinical evidence file and requalified under a tougher law. No product recall. No safety scandal. Just a new regulation that reset the rules for tens of thousands of devices at once.
That regulation is the EU Medical Device Regulation. This lesson explains what it demands, why it caused a certification bottleneck, and the concrete steps to earn a CE mark today.
A CE mark is a symbol a manufacturer puts on a product to declare it meets EU health, safety, and performance requirements. For a medical device, the CE mark is the passport to sell in the European Economic Area. Without it, you cannot legally place the device on the market.
Crucially, the CE mark is not granted by a government agency the way the US FDA clears a device. Instead, for most medium and high-risk devices, a private, government-designated organization called a notified body audits your evidence and certifies the device. The manufacturer then affixes the CE mark itself.
Before 2021, devices were governed by two 1990s directives: the Medical Device Directive (MDD) and the Active Implantable Medical Device Directive. A directive is EU law that each member state translates into its own national rules, which created inconsistency across countries.
Then came high-profile failures. The most cited is the PIP breast implant scandal
The EU's response was to replace the directives with two regulations. A regulation applies directly and identically in all member states, no national translation needed.
You can read the official MDR text via EUR-Lex.
The core shock: MDR and IVDR did not grandfather old approvals. A device certified under the MDD had to be recertified under MDR, with evidence that often did not exist in the old file.
Three changes drove the workload.
Devices are sorted into risk classes that determine how much scrutiny they get.
Under MDR, medical devices run from Class I (lowest risk, like a bandage or reusable surgical instrument) to Class III (highest risk, like a heart valve or an implantable defibrillator), with Class IIa and IIb in between.
The IVDR change was dramatic. Under the old directive, roughly 80 percent of IVDs could self-certify with no notified body involved (a commonly cited estimate). IVDR introduced a rules-based system with Classes A, B, C, and D. Suddenly the majority of IVDs needed notified body review. A test that a company signed off itself for years now required an external audit.
MDR requires a clinical evaluation: a documented, ongoing assessment proving the device is safe and performs as claimed. Manufacturers can no longer lean heavily on "equivalence" to a similar existing device without strong justification and data access. For many, that meant running new clinical investigations, which take years and cost money.
IVDR's parallel concept is performance evaluation, covering scientific validity, analytical performance (does the test measure accurately?), and clinical performance (does the result mean something clinically?).
MDR demands post-market surveillance (PMS): structured, continuous collection of real-world data after launch. High-risk devices need a Periodic Safety Update Report (PSUR) and, for implantables and Class III, a public Summary of Safety and Clinical Performance (SSCP). Devices also need a Unique Device Identification (UDI) code for traceability, logged in the EU database EUDAMED.
Here is where theory met a wall. Every device needing recertification had to go through a notified body. But the number of MDR-designated notified bodies stayed low.
As of recent European Commission figures, there were roughly 50 notified bodies designated under MDR and around a dozen under IVDR (as-of 2024/2025 estimates; check the NANDO database for the current list). Tens of thousands of certificates needed renewal against that limited capacity.
The result: long queues, review times often quoted at 13 to 18 months, and a real risk that safe, useful devices would vanish from the market simply because no notified body could review them in time.
The EU blinked. Regulation (EU) 2023/607, passed in early 2023, extended the MDR transition deadlines: higher-risk legacy devices got until December 2027, and lower-risk ones until December 2028, provided the manufacturer had already taken concrete steps toward MDR compliance. This bought time but did not remove the requirements.
Here is the practical sequence for a manufacturer bringing a Class IIb or III device to the EU market.
1. Confirm it is a device and classify it. Apply the MDR classification rules (Annex VIII) to land on Class I, IIa, IIb, or III. A wound dressing that delivers a drug climbs in class. Software that informs treatment decisions is often IIa or higher.
2. Build a Quality Management System (QMS). Almost always certified to ISO 13485, the international standard for medical device quality systems. This governs design, manufacturing, and complaint handling.
3. Compile the technical documentation. Design specs, risk management (per ISO 14971), clinical evaluation, labeling, and verification and validation testing.
4. Run the clinical evaluation or investigation. Gather or generate the clinical data proving safety and performance.
5. Appoint a PRRC. MDR requires a Person Responsible for Regulatory Compliance, a named individual with defined qualifications accountable for compliance.
6. Engage a notified body. For everything above Class I, the notified body audits your QMS and reviews the technical file. (Pure Class I devices self-declare, no notified body needed, unless they are sterile, measuring, or reusable surgical instruments.)
7. Receive the CE certificate, affix the mark, register in EUDAMED. Get your UDI, appoint an EU Authorized Representative if you are based outside the EU, and begin post-market surveillance from day one.
Knowledge check
1. The lesson describes a knee implant that was compliant in 2017 but risked being pulled from the market by 2024 despite no recall or safety scandal. What core concept does this scenario illustrate?
2. How does the CE mark certification process fundamentally differ from FDA clearance in the US?
3. Why did the EU choose to replace the old directives with regulations rather than issuing updated directives?
4. Select ALL correct answers about the role and nature of the CE mark for medical devices.
Select all the correct answers.
5. Select ALL correct answers about why the PIP breast implant scandal is used to explain the shift to the new regulations.
Select all the correct answers.
A quick contrast sharpens the picture. In the US, the FDA is a single government agency. Most devices reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → market through 510(k) clearance (showing "substantial equivalence" to an existing device) or the stricter Premarket Approval (PMA) for high-risk devices. Notably, US 510(kkThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.View full definition →) still permits the equivalence route that MDR made much harder.
So a device can face very different burdens on each side of the Atlantic. A moderate-risk diagnostic might clear a US 510(kkThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.View full definition →) relatively quickly yet require fresh clinical performance data and a scarce notified body slot under IVDR. Many companies now sequence their launches accordingly, sometimes going to market in the US first.
For a product or business leader, the implications are direct.