Question 1

Is my software a medical device under EU MDR?

Accepted Answer

Your software is a medical device under EU MDR if it has a medical purpose: diagnosing, preventing, monitoring, predicting, or treating disease, or informing such decisions. Pure wellness, fitness, or administrative software is out of scope — but the boundary is set by your intended purpose and marketing claims, not your technology.

Question 2

What is MDR Rule 11, and why does it make my software Class IIa?

Accepted Answer

Rule 11 is the MDR classification rule for software. Software providing information used for diagnostic or therapeutic decisions is at least Class IIa — higher if those decisions could cause serious harm or death. In practice, Rule 11 makes Class I rare for medical software, which means Notified Body involvement.

Question 3

What is the difference between Class I, IIa, IIb, and III?

Accepted Answer

EU MDR sorts devices into four risk classes. Class I (lowest risk) can mostly be self-certified — except sterile, measuring, or reusable-surgical sub-classes, which need Notified Body involvement; Class IIa, IIb, and III require a Notified Body, with scrutiny, cost, and clinical-evidence expectations rising by class. Your class is set by the 22 rules in MDR Annex VIII, based on intended purpose and risk.

Question 4

Do I need a Notified Body?

Accepted Answer

You need a Notified Body if your device is Class IIa or higher — which, under Rule 11, covers most medical software. Only Class I devices (non-sterile, non-measuring, non-reusable-surgical) can be self-certified. The Notified Body independently assesses your technical documentation and QMS before you can CE mark.

Question 5

How do I choose a Notified Body, given the backlog?

Accepted Answer

Choose a Notified Body designated for your device codes, with software and AI experience, realistic lead times, and language fit. Capacity is the binding constraint: backlogs commonly cited in the 6 to 12-plus month range for an initial application slot alone are typical, so approach candidates early — before your documentation is finished — and treat the application slot as part of your critical path.

Question 6

What is a PRRC, and do I really need one as a small team?

Accepted Answer

The PRRC (Person Responsible for Regulatory Compliance, MDR Article 15) is a qualified person accountable for device release, technical documentation, and post-market obligations. Every manufacturer needs one. Micro and small enterprises don't have to employ one in-house — but must have one permanently and continuously at their disposal, and auditors check.

Question 7

Can an external consultant act as my PRRC?

Accepted Answer

Yes — for micro and small enterprises. MDR Article 15(2) requires only that the PRRC is "permanently and continuously at their disposal" rather than within the organisation, and MDCG guidance (MDCG 2019-7) interprets this as permitting a contracted external person, provided they meet the qualification requirements. The accountability is real either way: the PRRC's name and responsibility are documented in your QMS.

Question 8

What is an EU Authorised Representative, and do I need one?

Accepted Answer

An EU Authorised Representative is an EU-based entity that acts for a manufacturer established outside the EU — verifying documentation, liaising with authorities, and sharing liability. You need one only if you have no legal entity in the EU. Its name appears on your label and in EUDAMED.

Question 9

What actually goes into a technical file?

Accepted Answer

An MDR technical file follows Annexes II and III: device description and intended purpose, design and manufacturing information, GSPR conformity mapping, risk management file, verification and validation evidence, the clinical evaluation report, and post-market surveillance planning. For software, that includes lifecycle documentation under IEC 62304 and usability evidence.

Question 10

What is a clinical evaluation report (CER)?

Accepted Answer

The CER is the document at the core of your technical file: a systematic appraisal of clinical evidence — your own data, equivalent-device data, and literature — demonstrating your device is safe and performs as intended. Notified Bodies read it critically; a weak CER is among the most common causes of findings.

Question 11

What is the GSPR checklist?

Accepted Answer

The GSPRs (General Safety and Performance Requirements, MDR Annex I) are the requirements every device must meet. The GSPR checklist maps each applicable requirement to the standard you applied and the evidence proving conformity. It functions as the spine of the technical file — the index a Notified Body reviews against.

Question 12

Do I need ISO 13485 as a startup?

Accepted Answer

If your device is Class IIa or higher you need a certified quality management system, and ISO 13485 is the practical standard for it — also now referenced by FDA's QMSR, so it serves both markets. Class I self-certifiers still need a QMS, just without the certification audit.

Question 13

How much does CE marking cost for software?

Accepted Answer

Industry sources, including regulatory consultancies and market analysts such as posos.co, commonly put Class IIa–III software CE marking at roughly EUR 120,000–300,000 initial investment. This is a cited industry range, not a Venitara quote. The main drivers are the QMS build, clinical evaluation, and Notified Body fees. Class and clinical-evidence depth move the number more than any other factor.

Question 14

How long does CE marking take?

Accepted Answer

Industry sources, including regulatory consultancies and market analysts, commonly cite 12–18 months for Class IIa–III software, measured from starting the QMS and technical file to certificate. Notified Body review and backlog are the least controllable part; documentation gaps found in review are the most common self-inflicted delay. Class I self-certification is substantially faster.

Question 15

What changed from MDD to MDR, and what are the transition deadlines?

Accepted Answer

MDR replaced the MDD with stricter classification (notably Rule 11 for software), deeper clinical-evidence expectations, mandatory PRRC and UDI, and tighter post-market surveillance. Legacy MDD certificates are in transition on two tiers under Regulation (EU) 2023/607: Class III and Class IIb implantable devices until 31 December 2027; other classes until 31 December 2028 — conditions attached.

Question 16

What is EUDAMED, and do I have to register?

Accepted Answer

EUDAMED is the EU's central medical-device database covering actor registration, UDI/device data, certificates, vigilance, and post-market surveillance. Manufacturers register as actors and obtain an SRN. Four of six modules — Actor Registration, UDI/Devices, Notified Bodies & Certificates, and Market Surveillance — became mandatory on 28 May 2026; Vigilance/PMS and Clinical Investigations follow later, unscheduled.

Question 17

What is the difference between PMS and PMCF?

Accepted Answer

Post-market surveillance (PMS) is the umbrella system for collecting and acting on real-world data about your device after launch. Post-market clinical follow-up (PMCF) is its clinical sub-part: proactively gathering clinical evidence to keep the CER current. Both are planned before certification, not after.

Question 18

Is my health AI a medical device under FDA rules?

Accepted Answer

If your software analyses patient data to diagnose, treat, monitor, or recommend care, it likely meets the FDA device definition. Exemptions exist for general wellness products and some clinical decision support — but they turn on your claims and the clinician's ability to independently review the basis for recommendations.

Question 19

Do I need FDA clearance for my health app?

Accepted Answer

Only if your app is a medical device: making disease-related claims or performing diagnosis, treatment, monitoring, or care recommendations. Wellness apps that avoid disease claims typically don't need clearance. If you do, the pathway — usually 510(k) or De Novo — depends on whether a predicate exists.

Question 20

Is my product "general wellness" or a medical device?

Accepted Answer

FDA's general wellness policy keeps low-risk products that promote healthy lifestyles without referencing disease out of active FDA oversight — as enforcement discretion, not a blanket statutory exemption. The test is claims plus risk — not technology. A wellness label does not override clinical marketing language: one disease claim in your copy, store listing, or investor deck framing can make you a device.

Question 21

What is the clinical decision support (CDS) exemption?

Accepted Answer

Software supporting clinician decisions can be exempt from FDA device regulation if it meets all four statutory criteria — including that the clinician can independently review the basis for its recommendations rather than relying on it. Opaque AI recommendations often still fail that criterion, but FDA's revised January 2026 guidance adds a narrow enforcement-discretion carve-out for software where only one recommendation is clinically appropriate — without waiving the independent-review criterion.

Question 22

Which FDA pathway applies: 510(k), De Novo, or PMA?

Accepted Answer

510(k) if a substantially equivalent predicate device exists; De Novo if your device is novel but low-to-moderate risk with no predicate; PMA if it is high-risk Class III. Most health software targets a 510(k) where a predicate exists — which makes predicate research the first real task.

Question 23

What is a predicate device, and how do I choose one?

Accepted Answer

A predicate is a legally marketed device your 510(k) claims substantial equivalence to — same intended use, comparable technological characteristics. Choose by matching intended use first, technology second, and checking the predicate's own history. Predicate mismatch is the most common cause of substantial-equivalence problems — the Additional Information requests and holds that stall 510(k)s.

Question 24

How long does a 510(k) really take?

Accepted Answer

FDA's review goal for a 510(k) is 90 "FDA days," but that clock pauses during additional-information holds — which most first submissions hit. Total elapsed time from project start to clearance commonly runs 6–12 months, per industry-cited estimates from regulatory consultancies. Preparation quality — predicate fit and documentation completeness — is what moves the total.

Question 25

How much does a 510(k) cost?

Accepted Answer

Industry-cited figures for preparing a first 510(k) run from the low tens of thousands of USD for a simple software 510(k) with a strong predicate, up to roughly USD 150,000–350,000 for complex, consulting-heavy submissions — on top of FDA user fees (reduced for qualifying small businesses). Testing — bench, software V&V, cybersecurity — is usually the largest variable. Figures are industry-cited ranges, not quotes.

Question 26

Why do so many 510(k)s face friction in review?

Accepted Answer

Industry estimates vary by definition: roughly 10–15% of 510(k)s face final rejection, while broader figures — counting any Additional Information request or hold at any point — run as high as 64–69% by some industry estimates. Predicate mismatch and documentation gaps are the most common causes, and both are preventable before submission.

Question 27

What is an FDA Pre-Submission (Q-Sub), and should I do one?

Accepted Answer

A Pre-Submission is a free, formal way to get FDA's written feedback on your pathway, predicate logic, or testing plan before you submit. For novel devices, AI/ML functions, or contested predicates it is usually worth the added calendar time — it converts guesswork into documented agency feedback.

Question 28

What software documentation does FDA expect?

Accepted Answer

FDA expects software documentation scaled to risk (basic or enhanced level), covering architecture, requirements, V&V, and lifecycle processes — plus, since Section 524B, cybersecurity documentation including an SBOM for connected devices. AI/ML functions add data, performance, and change-management expectations on top.

Question 29

What is a PCCP?

Accepted Answer

A Predetermined Change Control Plan is FDA's mechanism for updating AI-enabled devices without a new submission: you pre-specify anticipated model changes, the protocol for making them, and the impact assessment, and FDA authorizes the plan with your original clearance. Only changes within the plan's bounds are covered.

Question 30

What is QMSR, and how does it affect me?

Accepted Answer

The Quality Management System Regulation replaced FDA's QSR in February 2026, incorporating ISO 13485 by reference. US-facing manufacturers now run an ISO 13485-aligned QMS with FDA-specific additions. Teams already building a 13485 QMS for CE marking are largely covered; QSR-era documentation needs updating.

Question 31

Does FDA clearance help me in Europe (or a CE mark in the US)?

Accepted Answer

No. The frameworks are legally separate: FDA clearance grants nothing in the EU, and a CE mark grants nothing with FDA. What transfers is the underlying evidence — testing, clinical data, QMS work — which is why sequencing and dossier design matter more than which badge comes first.

Question 32

What is a 513(g) request?

Accepted Answer

A 513(g) is a formal, fee-based request asking FDA how it would classify your product and which regulatory requirements apply. It is useful when device status is genuinely unclear, but slower and less interactive than a Pre-Submission — many teams get more value from a Q-Sub.

Question 33

Does the EU AI Act apply to my medical device?

Accepted Answer

If your device contains an AI system and requires Notified Body conformity assessment under MDR or IVDR — in practice Class IIa and above — it is automatically high-risk under the AI Act via Article 6(1), and the Act's requirements apply on top of MDR. Non-AI devices and most Class I software sit outside this particular route — though stand-alone AI can still be caught by Annex III.

Question 34

When do the AI Act deadlines hit medical devices?

Accepted Answer

Under the Digital Omnibus package — published in the Official Journal on 24 July 2026 and in force from 27 July 2026 — Annex III general high-risk obligations move to 2 December 2027 and Article 6(1) medical-device obligations to 2 August 2028, roughly 16 months and a full year later than the Act's original dates. From entry into force, the deferred dates are the legally binding ones; the original dates (2 August 2026 and 2 August 2027) are superseded. Article 4 AI literacy has applied since 2 February 2025 already, regardless of the Omnibus, with no grace period.

Question 35

Is my healthcare AI "high-risk" under the AI Act?

Accepted Answer

Two routes make healthcare AI high-risk: Article 6(1), automatically capturing AI that is a Notified-Body-assessed medical device, or an Annex III listed use case (such as emergency triage). Most clinical AI is caught by the first route. Wellness and purely administrative AI generally is not high-risk.

Question 36

Do I need a separate conformity assessment for the AI Act?

Accepted Answer

No — not a second procedure. For AI that is a medical device, AI Act Article 43(3) builds the AI Act conformity check into your existing MDR Notified Body assessment: the single-procedure design is settled in law. What isn't yet settled is which overlapping requirements get formally exempted — the Commission has authority to adopt delegated acts to do that, and none has been adopted so far. Expect one procedure, but a fuller file.

Question 37

What is the AI literacy obligation (Article 4)?

Accepted Answer

Article 4 requires providers and deployers of AI systems to ensure staff have sufficient AI literacy for their role — understanding the systems they build or operate, their limits, and their risks. It has applied since 2 February 2025, with no grace period and no exemption tied to the Digital Omnibus reform, and it applies well beyond high-risk systems.

Question 38

What does AI Act Article 10 (data governance) require?

Accepted Answer

Article 10 requires high-risk AI training, validation, and test data to be governed: relevant, sufficiently representative, examined for bias, and managed under documented practices covering provenance and preparation. For medical AI, this formalises what good ML development and MDR clinical evidence expectations already push toward.

Question 39

Does GDPR apply to my medical device data?

Accepted Answer

Almost certainly yes: health data is special-category data under GDPR Article 9, so processing needs an explicit legal basis, strong security, and usually a data protection impact assessment. GDPR runs alongside MDR and the AI Act as a third parallel obligation — same evidence, three regulators.

Question 40

Can I reuse my CE technical file for FDA?

Accepted Answer

Partially. The evidence layer — bench testing, software V&V, clinical data, risk management, QMS — substantially reuses. The submission logic does not: FDA needs a pathway (usually 510(k) with a predicate and substantial-equivalence argument), which is built differently from an MDR conformity case. Plan the file for reuse from the start.

Question 41

Can I reuse my CE file for Saudi Arabia (SFDA)?

Accepted Answer

Yes, to a large degree: SFDA's technical framework closely mirrors EU MDR, so much of a CE technical file transfers directly to an MDMA application. Since January 2022 SFDA has required a complete technical file for every registration (set out in its MDS-REQ 1 requirements document) — and a CE mark still carries formal recognition weight in the review. A CE-shaped file is the strongest starting point.

Question 42

Do I need an in-country representative in Saudi Arabia?

Accepted Answer

Yes. Foreign manufacturers must appoint an in-country Authorised Representative in Saudi Arabia to hold the registration and liaise with SFDA — the requirement is mandatory under the current framework. Choosing the AR is a strategic decision: it controls your licence, so contract terms matter.

Question 43

Does SFDA approval help me elsewhere in the GCC?

Accepted Answer

GCC states are commonly described in industry commentary as giving weight to SFDA approval, alongside other reference-country approvals, when reviewing their own registrations — a pattern that would make Saudi Arabia a practical anchor market for the region. We haven't found a specific citable SFDA or GCC document confirming this as a formal rule, so treat it as a plausible, commonly cited pattern rather than a settled fact, and verify current status per target state before relying on it.

Question 44

Where should I launch first: EU, UK, or US?

Accepted Answer

It depends on your class in each system, not on market size alone. Standalone software that is Class IIa under EU MDR can, for now, remain self-certified Class I in the UK under the legacy framework — a faster first launch — while US timing hinges on predicate availability. Sequence by class, evidence, and revenue.

Question 45

Is the UK really faster for lower-class software?

Accepted Answer

The UK never adopted an equivalent to EU MDR Rule 11, so standalone software that needs Notified Body review in the EU can frequently still qualify for Class I self-certification in Great Britain. That is faster and cheaper, and it is not obligation-free: you still need a compliant technical file, a UK Responsible Person, MHRA registration, and post-market surveillance under the PMS Regulations 2024.

FAQ

MDR and CE marking

FDA and US pathway

EU AI Act and data

Multi-market and sequencing

See where you stand, in about ten minutes.