MDR and CE marking

Your software is a medical device under EU MDR if it has a medical purpose: diagnosing, preventing, monitoring, predicting, or treating disease, or informing such decisions. Pure wellness, fitness, or administrative software is out of scope — but the boundary is set by your intended purpose and marketing claims, not your technology.

Rule 11 is the MDR classification rule for software. Software providing information used for diagnostic or therapeutic decisions is at least Class IIa — higher if those decisions could cause serious harm or death. In practice, Rule 11 makes Class I rare for medical software, which means Notified Body involvement.

EU MDR sorts devices into four risk classes. Class I (lowest risk) can mostly be self-certified — except sterile, measuring, or reusable-surgical sub-classes, which need Notified Body involvement; Class IIa, IIb, and III require a Notified Body, with scrutiny, cost, and clinical-evidence expectations rising by class. Your class is set by the 22 rules in MDR Annex VIII, based on intended purpose and risk.

You need a Notified Body if your device is Class IIa or higher — which, under Rule 11, covers most medical software. Only Class I devices (non-sterile, non-measuring, non-reusable-surgical) can be self-certified. The Notified Body independently assesses your technical documentation and QMS before you can CE mark.

The PRRC (Person Responsible for Regulatory Compliance, MDR Article 15) is a qualified person accountable for device release, technical documentation, and post-market obligations. Every manufacturer needs one. Micro and small enterprises don't have to employ one in-house — but must have one permanently and continuously at their disposal, and auditors check.

Yes — for micro and small enterprises. MDR Article 15(2) requires only that the PRRC is "permanently and continuously at their disposal" rather than within the organisation, and MDCG guidance (MDCG 2019-7) interprets this as permitting a contracted external person, provided they meet the qualification requirements. The accountability is real either way: the PRRC's name and responsibility are documented in your QMS.

Industry sources, including regulatory consultancies and market analysts such as posos.co, commonly put Class IIa–III software CE marking at roughly EUR 120,000–300,000 initial investment. This is a cited industry range, not a Venitara quote. The main drivers are the QMS build, clinical evaluation, and Notified Body fees. Class and clinical-evidence depth move the number more than any other factor.

Industry sources, including regulatory consultancies and market analysts, commonly cite 12–18 months for Class IIa–III software, measured from starting the QMS and technical file to certificate. Notified Body review and backlog are the least controllable part; documentation gaps found in review are the most common self-inflicted delay. Class I self-certification is substantially faster.

Choose a Notified Body designated for your device codes, with software and AI experience, realistic lead times, and language fit. Capacity is the binding constraint: backlogs commonly cited in the 6 to 12-plus month range for an initial application slot alone are typical, so approach candidates early — before your documentation is finished — and treat the application slot as part of your critical path.

An EU Authorised Representative is an EU-based entity that acts for a manufacturer established outside the EU — verifying documentation, liaising with authorities, and sharing liability. You need one only if you have no legal entity in the EU. Its name appears on your label and in EUDAMED.

An MDR technical file follows Annexes II and III: device description and intended purpose, design and manufacturing information, GSPR conformity mapping, risk management file, verification and validation evidence, the clinical evaluation report, and post-market surveillance planning. For software, that includes lifecycle documentation under IEC 62304 and usability evidence.

The CER is the document at the core of your technical file: a systematic appraisal of clinical evidence — your own data, equivalent-device data, and literature — demonstrating your device is safe and performs as intended. Notified Bodies read it critically; a weak CER is among the most common causes of findings.

The GSPRs (General Safety and Performance Requirements, MDR Annex I) are the requirements every device must meet. The GSPR checklist maps each applicable requirement to the standard you applied and the evidence proving conformity. It functions as the spine of the technical file — the index a Notified Body reviews against.

If your device is Class IIa or higher you need a certified quality management system, and ISO 13485 is the practical standard for it — also now referenced by FDA's QMSR, so it serves both markets. Class I self-certifiers still need a QMS, just without the certification audit.

MDR replaced the MDD with stricter classification (notably Rule 11 for software), deeper clinical-evidence expectations, mandatory PRRC and UDI, and tighter post-market surveillance. Legacy MDD certificates are in transition on two tiers under Regulation (EU) 2023/607: Class III and Class IIb implantable devices until 31 December 2027; other classes until 31 December 2028 — conditions attached. *Status as of 21 July 2026 — confirm current transition dates before relying on this for planning, as deadlines have been extended and revised before.*

EUDAMED is the EU's central medical-device database covering actor registration, UDI/device data, certificates, vigilance, and post-market surveillance. Manufacturers register as actors and obtain an SRN. Four of six modules — Actor Registration, UDI/Devices, Notified Bodies & Certificates, and Market Surveillance — became mandatory on 28 May 2026; Vigilance/PMS and Clinical Investigations follow later, unscheduled. *Status as of 21 July 2026.*

Post-market surveillance (PMS) is the umbrella system for collecting and acting on real-world data about your device after launch. Post-market clinical follow-up (PMCF) is its clinical sub-part: proactively gathering clinical evidence to keep the CER current. Both are planned before certification, not after.