Do I need a Notified Body?

In short: You need a Notified Body if your device is Class IIa or higher — which, under Rule 11, covers most medical software. Only Class I devices (non-sterile, non-measuring, non-reusable-surgical) can be self-certified. The Notified Body independently assesses your technical documentation and QMS before you can CE mark.

What a Notified Body actually does

A Notified Body is an organisation designated by an EU member state to assess conformity of medium- and higher-risk devices against MDR. For Class IIa and above, it reviews your technical file — device description, risk management, clinical evaluation, verification and validation evidence — and, depending on class, samples your design and manufacturing records. Only once that review is complete can you affix the CE mark. This is a real, independent gate: no amount of internal confidence substitutes for it.

Why most software ends up needing one

Under Rule 11, software providing information used in diagnostic or therapeutic decisions is classified Class IIa or higher unless it falls clearly outside decision-support territory. That makes Class I self-certification the exception for medical software, not the default it was under the old Medical Devices Directive. If your product has cleared the medical-purpose threshold and provides genuine decision-support output, plan for Notified Body involvement from the outset rather than discovering it late.

The practical implication

Notified Body capacity is the binding constraint on your timeline, not your own documentation speed alone — backlogs of many months are common across the system. That makes the choice of which Notified Body to approach, and when, a strategic decision in its own right, not an administrative afterthought once your file is finished.

Where next: MDR Annex VIII: How Device Classes Are Set · How do I choose a Notified Body, given the backlog?

Talk to us before you approach a Notified Body. Book an expert conversation →