What is MDR?
MDR - the Medical Devices Regulation, formally Regulation (EU) 2017/745 - is the central EU framework governing the safety, performance and market access of medical devices. It applies to everything from adhesive plasters and contact lenses to surgical instruments, implants and MRI scanners. The regulation tightened the rules that previously applied under the old Medical Devices Directive, raised the bar for clinical evidence, and built a more transparent, traceable system around every device sold in the European market.
For manufacturers and the wider supply chain, MDR is not a paperwork formality. It determines whether a product can legally carry the CE marking and be placed on the EU market at all. Getting the risk classification, documentation and post-market obligations right is the difference between selling across 27 member states and facing a recall.
Official text - Read the full regulation on EUR-Lex: Regulation (EU) 2017/745 on medical devices (CELEX: 32017R0745).
Scope - what counts as a medical device
A medical device under MDR is, broadly, any instrument, apparatus, software, implant, reagent or material intended by the manufacturer for a medical purpose - such as diagnosis, prevention, monitoring, treatment or alleviation of disease or injury. The definition deliberately covers a wide spectrum, and MDR notably extended the regulatory net to certain products without a medical purpose (for example some aesthetic devices) and clarified that standalone software can itself be a medical device.
The regulation assigns clear responsibilities to each “economic operator” in the supply chain:
- Manufacturer - the party that develops or has a device made and markets it under its own name. The manufacturer carries the primary burden of compliance.
- Authorised representative - a person or company established in the EU appointed by a manufacturer based outside the Union to act on its behalf.
- Importer - the operator established in the EU that first places a device from a third country on the EU market.
- Distributor - any operator in the supply chain, other than the manufacturer or importer, that makes a device available on the market.
Each role has distinct verification and record-keeping duties, so identifying which hat you wear is the first compliance step.
Key dates
MDR entered into force in 2017 but became fully applicable on 26 May 2021, the date from which new devices must meet its requirements. It replaced the Medical Devices Directive 93/42/EEC (and the active implantable devices directive), ending the older certification regime.
Because the transition strained the capacity of notified bodies, the EU adopted amending Regulation (EU) 2023/607, which introduced extended transition periods for “legacy” devices - those certified under the old directives - allowing them to remain on the market for longer, subject to conditions, while manufacturers complete their MDR conformity work. The exact deadlines depend on a device’s risk class, so legacy-device holders should map their certificates against the staggered timeline rather than assume a single cut-off.
Core requirements
MDR builds compliance around several interlocking pillars.
Risk classification
Devices are sorted into four risk classes - I, IIa, IIb and III - according to factors such as how invasive they are, how long they contact the body and their intended purpose. Class I covers the lowest-risk devices; Class III covers the highest, such as implantable devices and those in contact with the heart or central nervous system. The class drives almost everything else, including whether a notified body must be involved.
Conformity assessment and notified bodies
For all classes above the lowest-risk Class I, manufacturers must undergo a conformity assessment involving a notified body - an independent organisation designated to audit quality systems and review technical documentation. Only after this assessment can the device bear the CE marking. Higher classes face deeper scrutiny, including review of clinical evidence.
Technical documentation
Manufacturers must compile and maintain comprehensive technical documentation demonstrating that the device meets the general safety and performance requirements, including design, manufacturing, risk management and verification data.
Clinical evaluation
MDR places strong emphasis on clinical evaluation - a systematic assessment of clinical data to confirm safety and performance, often requiring dedicated clinical investigations for higher-risk devices. Clinical evidence must be maintained throughout the device’s life.
UDI and EUDAMED
Every device must carry a Unique Device Identification (UDI) code, enabling traceability from production through the supply chain to the patient. Information about devices, operators, certificates and incidents is registered in EUDAMED, the EU’s central electronic database designed to improve transparency and coordination among authorities.
Post-market surveillance and vigilance
Compliance does not end at launch. Manufacturers must run a post-market surveillance system, proactively collecting and reviewing real-world performance data, and meet vigilance obligations by reporting serious incidents and field safety corrective actions to authorities.
CE marking
Once conformity is established, the manufacturer draws up an EU declaration of conformity and affixes the CE marking, the visible sign that the device may circulate freely in the EU market.
Obligations by role
- Manufacturer - classify the device, build technical documentation, conduct clinical evaluation, obtain conformity assessment, assign UDIs, register in EUDAMED, affix CE marking and operate post-market surveillance and vigilance.
- Authorised representative - verify the EU declaration and documentation exist, hold a mandate, and cooperate with authorities on behalf of a non-EU manufacturer.
- Importer - check that the device is CE-marked, that the manufacturer and (where relevant) representative are identified, and that registration and labelling are in order before placing it on the market.
- Distributor - verify CE marking and required documentation are present and ensure storage and transport conditions do not compromise the device.
Enforcement
Enforcement falls to national competent authorities. In Denmark this is the Danish Medicines Agency (Lægemiddelstyrelsen), which oversees market surveillance, handles vigilance reports and can act against non-compliant devices.
Consequences of non-compliance are significant in practice: authorities can require corrective action, restrict or prohibit a device, order withdrawals or recalls from the market, and pursue penalties under national law. Beyond the legal exposure, a loss of CE status removes a product’s right to be sold across the EU and can carry serious reputational and commercial costs.
Getting compliant - a checklist
- Confirm whether your product is a medical device and determine its risk class.
- Identify your role (manufacturer, authorised representative, importer or distributor) and the duties that follow.
- Build and maintain technical documentation and a clinical evaluation.
- Engage a notified body for conformity assessment where the class requires it.
- Assign UDIs and register your devices and operator data in EUDAMED.
- Establish post-market surveillance and a vigilance reporting process.
- Draw up the EU declaration of conformity and affix the CE marking.
- For legacy devices, map your certificates against the Regulation (EU) 2023/607 transition deadlines.
Related guides
How Conphora helps
Conphora continuously monitors MDR and matches your products against the relevant requirements, flagging gaps before they become market-access problems. The platform helps you organise documentation and conformity evidence and alerts you when rules - or transition deadlines - change. That turns a sprawling, evolving regulation into a clear, trackable workflow.
Sources
- EUR-Lex: Regulation (EU) 2017/745 on medical devices (CELEX: 32017R0745)
- Competent authority: Danish Medicines Agency (Lægemiddelstyrelsen)
This guide is for general information and is not legal advice.
Last updated: 12 June 2026