MDR 2017/745 Specialist
EU MDR compliance patterns for medical device classification, technical documentation, and clinical evidence.
Table of Contents
Clarify First
Before classifying the device or analyzing gaps, confirm these inputs. If any is unknown or vague, ASK — do not assume:
Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the classification.
Device Classification Workflow
Classify device under MDR Annex VIII:
- Identify device duration (transient, short-term, long-term)
- Determine invasiveness level (non-invasive, body orifice, surgical)
- Assess body system contact (CNS, cardiac, other)
- Check if active device (energy dependent)
- Apply classification rules 1-22
- For software, apply MDCG 2019-11 algorithm
- Document classification rationale
- Validation: Classification confirmed with Notified Body
Classification Matrix
| Factor |
Class I |
Class IIa |
Class IIb |
Class III |
| Duration |
Any |
Short-term |
Long-term |
Long-term |
| Invasiveness |
Non-invasive |
Body orifice |
Surgical |
Implantable |
| System |
Any |
Non-critical |
Critical organs |
CNS/cardiac |
| Risk |
Lowest |
Low-medium |
Medium-high |
Highest |
Software Classification (MDCG 2019-11)
| Information Use |
Condition Severity |
Class |
| Informs decision |
Non-serious |
IIa |
| Informs decision |
Serious |
IIb |
| Drives/treats |
Critical |
III |
Classification Examples
Example 1: Absorbable Surgical Suture
- Rule 8 (implantable, long-term)
- Duration: > 30 days (absorbed)
- Contact: General tissue
- Classification: Class IIb
Example 2: AI Diagnostic Software
- Rule 11 + MDCG 2019-11
- Function: Diagnoses serious condition
- Classification: Class IIb
Example 3: Cardiac Pacemaker
- Rule 8 (implantable)
- Contact: Central circulatory system
- Classification: Class III
Technical Documentation
Prepare technical file per Annex II and III:
- Create device description (variants, accessories, intended purpose)
- Develop labeling (Article 13 requirements, IFU)
- Document design and manufacturing process
- Complete GSPR compliance matrix
- Prepare benefit-risk analysis
- Compile verification and validation evidence
- Integrate risk management file (ISO 14971)
- Validation: Technical file reviewed for completeness
Technical File Structure
ANNEX II TECHNICAL DOCUMENTATION
├── Device description and UDI-DI
├── Label and instructions for use
├── Design and manufacturing info
├── GSPR compliance matrix
├── Benefit-risk analysis
├── Verification and validation
└── Clinical evaluation report
GSPR Compliance Checklist
| Requirement |
Evidence |
Status |
| Safe design (GSPR 1-3) |
Risk management file |
☐ |
| Chemical properties (GSPR 10.1) |
Biocompatibility report |
☐ |
| Infection risk (GSPR 10.2) |
Sterilization validation |
☐ |
| Software requirements (GSPR 17) |
IEC 62304 documentation |
☐ |
| Labeling (GSPR 23) |
Label artwork, IFU |
☐ |
Conformity Assessment Routes
| Class |
Route |
NB Involvement |
| I |
Annex II self-declaration |
None |
| Is/Im |
Annex II + IX/XI |
Sterile/measuring aspects |
| IIa |
Annex II + IX or XI |
Product or QMS |
| IIb |
Annex IX + X or X + XI |
Type exam + production |
| III |
Annex IX + X |
Full QMS + type exam |
Clinical Evidence
Develop clinical evidence strategy per Annex XIV:
- Define clinical claims and endpoints
- Conduct systematic literature search
- Appraise clinical data quality
- Assess equivalence (technical, biological, clinical)
- Identify evidence gaps
- Determine if clinical investigation required
- Prepare Clinical Evaluation Report (CER)
- Validation: CER reviewed by qualified evaluator
Evidence Requirements by Class
| Class |
Minimum Evidence |
Investigation |
| I |
Risk-benefit analysis |
Not typically required |
| IIa |
Literature + post-market |
May be required |
| IIb |
Systematic literature review |
Often required |
| III |
Comprehensive clinical data |
Required (Article 61) |
Clinical Evaluation Report Structure
CER CONTENTS
├── Executive summary
├── Device scope and intended purpose
├── Clinical background (state of the art)
├── Literature search methodology
├── Data appraisal and analysis
├── Safety and performance conclusions
├── Benefit-risk determination
└── PMCF plan summary
Qualified Evaluator Requirements
- Medical degree or equivalent healthcare qualification
- 4+ years clinical experience in relevant field
- Training in clinical evaluation methodology
- Understanding of MDR requirements
Post-Market Surveillance
Establish PMS system per Chapter VII:
- Develop PMS plan (Article 84)
- Define data collection methods
- Establish complaint handling procedures
- Create vigilance reporting process
- Plan Periodic Safety Update Reports (PSUR)
- Integrate with PMCF activities
- Define trend analysis and signal detection
- Validation: PMS system audited annually
PMS System Components
| Component |
Requirement |
Frequency |
| PMS Plan |
Article 84 |
Maintain current |
| PSUR |
Class IIa and higher |
Per class schedule |
| PMCF Plan |
Annex XIV Part B |
Update with CER |
| PMCF Report |
Annex XIV Part B |
Annual (Class III) |
| Vigilance |
Articles 87-92 |
As events occur |
PSUR Schedule
| Class |
Frequency |
| Class III |
Annual |
| Class IIb implantable |
Annual |
| Class IIb |
Every 2 years |
| Class IIa |
When necessary |
Serious Incident Reporting
| Timeline |
Requirement |
| 2 days |
Serious public health threat |
| 10 days |
Death or serious deterioration |
| 15 days |
Other serious incidents |
EUDAMED and UDI
Implement UDI system per Article 27:
- Obtain issuing entity code (GS1, HIBCC, ICCBBA)
- Assign UDI-DI to each device variant
- Assign UDI-PI (production identifier)
- Apply UDI carrier to labels (AIDC + HRI)
- Register actor in EUDAMED
- Register devices in EUDAMED
- Upload certificates when available
- Validation: UDI verified on sample labels
EUDAMED Modules
| Module |
Content |
Actor |
| Actor |
Company registration |
Manufacturer, AR |
| UDI/Device |
Device and variant data |
Manufacturer |
| Certificates |
NB certificates |
Notified Body |
| Clinical Investigation |
Study registration |
Sponsor |
| Vigilance |
Incident reports |
Manufacturer |
| Market Surveillance |
Authority actions |
Competent Authority |
UDI Label Requirements
Required elements per Article 13:
Reference Documentation
MDR Classification Guide
references/mdr-classification-guide.md contains:
- Complete Annex VIII classification rules (Rules 1-22)
- Software classification per MDCG 2019-11
- Worked classification examples
- Conformity assessment route selection
Clinical Evidence Requirements
references/clinical-evidence-requirements.md contains:
- Clinical evidence framework and hierarchy
- Literature search methodology
- Clinical Evaluation Report structure
- PMCF plan and evaluation report guidance
Technical Documentation Templates
references/technical-documentation-templates.md contains:
- Annex II and III content requirements
- Design History File structure
- GSPR compliance matrix template
- Declaration of Conformity template
- Notified Body submission checklist
Tools
MDR Gap Analyzer
# Quick gap analysis
python scripts/mdr_gap_analyzer.py --device "Device Name" --class IIa
# JSON output for integration
python scripts/mdr_gap_analyzer.py --device "Device Name" --class III --output json
# Interactive assessment
python scripts/mdr_gap_analyzer.py --interactive
Analyzes device against MDR requirements, identifies compliance gaps, generates prioritized recommendations.
Output includes:
- Requirements checklist by category
- Gap identification with priorities
- Critical gap highlighting
- Compliance roadmap recommendations
Notified Body Interface
Selection Criteria
| Factor |
Considerations |
| Designation scope |
Covers your device type |
| Capacity |
Timeline for initial audit |
| Geographic reach |
Markets you need to access |
| Technical expertise |
Experience with your technology |
| Fee structure |
Transparency, predictability |
Pre-Submission Checklist
MDCG Guidance Documents Update (2024-2025)
Key MDCG Guidance Documents
| Document |
Title |
Status |
Key Impact |
| MDCG 2024-1 |
Transition provisions under MDR Art. 120 |
Final (2024) |
Extended transition deadlines for legacy devices |
| MDCG 2024-6 |
Clinical evidence needed for medical devices previously CE marked under Directives |
Final (2024) |
Reduced clinical evidence burden for well-established devices |
| MDCG 2023-4 Rev.1 |
Notified Body capacity and availability |
Revised (2024) |
NB capacity monitoring and optimization |
| MDCG 2022-18 Rev.1 |
Software qualification and classification under MDR |
Revised (2024) |
Updated software classification algorithm |
| MDCG 2020-1 Rev.1 |
Clinical evaluation — equivalence |
Revised (2024) |
Refined equivalence demonstration requirements |
| MDCG 2019-16 Rev.1 |
Cybersecurity for medical devices |
Revised (2024) |
Enhanced cybersecurity requirements for connected devices |
| MDCG 2019-11 Rev.1 |
Qualification and classification of software |
Active |
Software as medical device classification |
MDR Transition Timeline (Post-Amendment Regulation 2023/607)
| Device Category |
Transition Deadline |
Conditions |
| Class III and implantable |
26 May 2026 |
Valid MDD/AIMDD certificate + QMS application to NB by 26 May 2024 |
| Class IIb |
31 December 2027 |
Valid certificate + QMS application to NB |
| Class IIa and Class I (sterile/measuring) |
31 December 2028 |
Valid certificate + QMS application to NB |
| Class I (up-classified under MDR) |
31 December 2028 |
Previously exempt from NB involvement |
Conditions for extended deadlines:
- Device continues to comply with MDD/AIMDD
- No significant changes in design or intended purpose
- No unacceptable safety or performance risk
- Manufacturer has applied to Notified Body for MDR conformity assessment before applicable deadline
Software as Medical Device Under MDR (MDCG 2019-11 Rev.1)
Software Qualification Decision
Is the software a medical device?
│
▼
Does the software perform an action on data?
│
Yes─┴─No → NOT a medical device (data storage/communication only)
│
▼
Is the action for the benefit of individual patients?
│
Yes─┴─No → NOT a medical device (population health/admin)
│
▼
Is the action one of: treatment, diagnosis, monitoring, prediction?
│
Yes─┴─No → NOT a medical device (lifestyle/wellness)
│
▼
QUALIFIES AS MEDICAL DEVICE SOFTWARE → Apply classification rules
Software Classification Under MDR
| Decision Factor |
Class IIa |
Class IIb |
Class III |
| Provides information to inform clinical management |
Non-serious conditions |
Serious conditions |
N/A |
| Drives clinical management or diagnoses |
N/A |
Non-serious conditions |
Serious or critical conditions |
| Monitors physiological processes |
Non-vital parameters |
Vital parameters (not immediate danger) |
Vital parameters (immediate danger) |
Software Lifecycle Requirements Under MDR
| MDR Requirement |
IEC 62304 Mapping |
Documentation |
| GSPR 17.1 (repeatability, reliability) |
Software development process |
Software development plan |
| GSPR 17.2 (state of the art) |
Software architecture |
Architecture design document |
| GSPR 17.3 (minimum IT requirements) |
System requirements |
IT environment specification |
| GSPR 17.4 (foreseeable misuse) |
Risk management |
Software risk analysis |
| Annex II §6.5 (software verification) |
Software testing |
Test plans and reports |
| Annex I §23.4 (labeling for software) |
Release documentation |
Software release notes |
AI/ML Medical Devices Under MDR
AI/ML Classification Considerations
| AI/ML Capability |
MDR Classification Impact |
Regulatory Consideration |
| AI-assisted detection |
Typically Class IIa-IIb (Rule 11) |
Must demonstrate clinical performance per intended use |
| AI-driven diagnosis |
Typically Class IIb-III (Rule 11) |
Requires clinical investigation for novel indications |
| AI treatment optimization |
Typically Class IIb-III (Rule 11 + specific rules) |
Benefit-risk analysis must account for AI uncertainty |
| Continuously learning AI |
Classification per highest risk output |
Post-market monitoring must track algorithm evolution |
AI/ML-Specific Technical Documentation
In addition to standard Annex II requirements, AI/ML devices must document:
| Section |
Content |
MDCG Reference |
| Algorithm description |
Architecture, training approach, feature engineering |
MDCG 2019-11, IMDRF SaMD WG |
| Training data |
Sources, demographics, size, labeling methodology, quality |
MDCG 2020-1 (equivalence) |
| Validation methodology |
Test dataset independence, performance metrics, subgroup analysis |
Annex XIV |
| Clinical performance |
Sensitivity, specificity, AUC, PPV, NPV per intended population |
CER requirements |
| Change management |
How algorithm updates are validated and deployed |
GSPR 17 |
| Explainability |
How the AI's output can be understood by intended users |
GSPR 23 (labeling) |
EU AI Act Interaction with MDR
| EU AI Act Requirement |
MDR Equivalent |
Combined Approach |
| High-risk classification (Annex III, Point 10) |
Annex VIII classification rules |
Both classifications apply; meet stricter requirement |
| Conformity assessment (Art. 43) |
Annex IX/X/XI assessment |
MDR conformity assessment satisfies AI Act (Art. 120) |
| Technical documentation (Annex IV) |
Annex II technical documentation |
Extend MDR technical file with AI Act-specific elements |
| Risk management (Art. 9) |
ISO 14971 + GSPR |
ISO 14971 satisfies both when AI risks are included |
| Data governance (Art. 10) |
GSPR 17 + Annex XIV |
Add AI-specific data governance to clinical evaluation |
| Post-market monitoring (Art. 72) |
Chapter VII PMS |
Single PMS system covering both AI Act and MDR |
See also: ../risk-management-specialist/SKILL.md for AI-specific risk management under ISO 14971, and ../fda-consultant-specialist/SKILL.md for FDA's AI/ML SaMD framework and PCCP.
Eudamed Implementation Status and Requirements
Eudamed Module Deployment Status (as of 2025)
| Module |
Status |
Mandatory Date |
Content |
| Actor Registration |
Operational |
Available now |
Economic operator registration |
| UDI/Device Registration |
Operational |
6 months after Eudamed fully functional |
Device and UDI-DI data |
| Notified Body and Certificates |
Operational |
Available now |
Certificate data upload by NBs |
| Clinical Investigations |
Operational |
Available now |
Study registration and reporting |
| Vigilance |
Partially operational |
24 months after fully functional |
Incident reports, FSCAs, trend reports |
| Market Surveillance |
In development |
18 months after fully functional |
CA market surveillance activities |
Key consideration: Until Eudamed is declared fully functional by the European Commission, manufacturers must use existing national systems (e.g., BfArM in Germany, ANSM in France) for vigilance reporting.
Eudamed Registration Requirements for Manufacturers
| Data Element |
Required For |
Update Frequency |
| SRN (Single Registration Number) |
All manufacturers |
On change |
| Authorized representative details |
Non-EU manufacturers |
On change |
| Device identification (UDI-DI) |
All devices placed on market |
Before first placing on market |
| Basic UDI-DI |
Device model/family grouping |
Before first placing on market |
| GMDN code |
Device nomenclature |
On initial registration |
| Risk class |
Classification per Annex VIII |
On initial registration |
| NB certificate reference |
Class IIa and above |
When certificate issued |
| Clinical investigation registration |
Interventional studies |
Before study start |
UDI-DI and UDI-PI Detailed Requirements
UDI-DI (Device Identifier) — Static Information
| Element |
Description |
Example |
| Device identifier |
Unique code for device model/version |
04069876543219 (GS1 GTIN) |
| Issuing entity |
GS1, HIBCC, ICCBBA, or IFA |
Selected by manufacturer |
| Device model |
Specific device configuration |
"CardioMonitor X200" |
| Device version |
Software version (for SaMD) |
"v3.1.0" |
| Applicable regulations |
MDR or IVDR reference |
MDR 2017/745 |
| Risk class |
Per Annex VIII |
Class IIa |
| Basic UDI-DI |
Grouping identifier for device family |
04069876500001 |
UDI-PI (Production Identifier) — Variable Information
| PI Element |
When Required |
Format |
| Lot/batch number |
When tracking by lot |
Lot: ABC123 |
| Serial number |
When individual tracking required (Class III, implantable) |
SN: 2024-00001 |
| Manufacturing date |
When relevant to safety |
Mfg: 2024-06-15 |
| Expiry date |
When device has shelf life |
Exp: 2026-06-15 |
| Software version |
SaMD and software-driven devices |
SW: v3.1.0 |
UDI Carrier Requirements
| Carrier Type |
Format |
Where Applied |
| AIDC (barcode/2D code) |
GS1 DataMatrix, GS1-128, HIBC |
Device label, package label |
| HRI (human-readable) |
Plain text interpretation of AIDC |
Adjacent to AIDC on label |
| RFID |
GS1 EPC/RFID |
Optional, in addition to AIDC |
Labeling placement rules:
- UDI on each level of packaging (unit, intermediate, case)
- For reusable devices requiring sterilization: UDI on device itself (direct marking)
- Class III implantable: UDI on device or packaging that remains with patient record
- UDI must survive device lifecycle (including reprocessing cycles for reusable devices)
UDI Database Submission Timeline
| Device Class |
Submission Deadline |
| Class III and implantable |
Before placing on the market |
| Class IIb |
Before placing on the market |
| Class IIa |
Before placing on the market |
| Class I |
Before placing on the market |
Note: All timelines are contingent on Eudamed being declared fully functional. Until then, manufacturers should pre-register in Eudamed (available modules) and maintain data readiness.
Cross-Reference: NIS2 for Critical Infrastructure (Healthcare)
Healthcare organizations manufacturing or deploying medical devices may be classified as essential entities under NIS2:
| NIS2 Requirement |
MDR Impact |
Action for Manufacturers |
| Art. 21: Cybersecurity risk management |
MDCG 2019-16 cybersecurity guidance |
Align device cybersecurity with organizational NIS2 compliance |
| Art. 23: Incident reporting (24h/72h) |
Art. 87-92 vigilance reporting |
Unified incident reporting covering both device and infrastructure incidents |
| Art. 21(2)(d): Supply chain security |
Art. 11 authorized representatives, supply chain |
Assess cybersecurity of device component suppliers |
| Art. 20: Governance and accountability |
Art. 10 manufacturer obligations |
Senior management oversight of both NIS2 and MDR compliance |
See also: ../information-security-manager-iso27001/SKILL.md for ISO 27001 alignment with NIS2 requirements.
MDR Updates & Cross-Framework Integration
Latest MDCG Guidance Documents
- MDCG 2019-11 Rev.1: Qualification and classification of software — updated algorithm for SaMD
- MDCG 2020-1 Rev.1: Clinical evaluation (Annex XIV) — updated methodologies
- MDCG 2024-8: EU AI Act interaction with MDR for AI-enabled medical devices
- MDCG 2023-4: Legacy devices and Article 120 transition provisions
AI/ML Medical Devices Under MDR
- Classification: AI/ML-based SaMD typically Class IIa or higher (Rule 11)
- Clinical Evidence: Must demonstrate AI algorithm clinical performance (sensitivity, specificity, AUC)
- Continuous Learning: PCCP-equivalent under MDR for adaptive AI devices
- Post-Market: Enhanced PMCF for AI devices monitoring real-world algorithm performance
- EU AI Act Interaction: High-risk AI medical devices subject to BOTH MDR and EU AI Act
- Cross-reference: See
eu-ai-act-specialist for AI Act obligations
NIS2 Impact on Healthcare
- Healthcare entities are "Essential Entities" under NIS2 Directive
- Medical device manufacturers may be "Important Entities"
- NIS2 cybersecurity requirements supplement MDR cybersecurity expectations
- Cross-reference: See
nis2-directive-specialist for NIS2 compliance
EUDAMED Implementation Status
- Actor Registration Module: Operational — all economic operators must register
- UDI/Device Registration Module: Operational — mandatory device registration
- Notified Body Module: Operational — certificate information
- Clinical Investigation Module: Available
- Vigilance Module: Under development
- Market Surveillance Module: Under development
UDI Detailed Requirements
- UDI-DI (Device Identifier): Unique to device model — used for EUDAMED registration
- UDI-PI (Production Identifier): Identifies production unit — lot, serial, expiry, manufacturing date
- Issuing Entities: GS1, HIBCC, ICCBBA, IFA
- Carrier Types: AIDC (barcode/2D) + HRI (human readable)
- Implant Card: Required for Class III implantable devices (UDI + patient information)
Troubleshooting
| Problem |
Possible Cause |
Resolution |
| Device classification unclear -- rules yield different results |
Multiple classification rules apply; highest class must be selected per MDR Article 51(7) |
Apply all applicable rules from Annex VIII (Rules 1-22); use the implementing rule that gives the highest classification; for software, apply MDCG 2019-11 Rev.1 algorithm; document rationale for each rule considered |
| Notified Body rejects technical file for incompleteness |
GSPR compliance matrix gaps, missing clinical evaluation, or insufficient risk management documentation |
Review GSPR checklist in this skill; ensure Annex II technical file structure is complete; verify CER meets Annex XIV requirements; confirm ISO 14971 risk management file is current and comprehensive |
| EUDAMED registration delays blocking market access |
Module not operational or manufacturer SRN not obtained |
Check current EUDAMED module status; obtain SRN via actor registration module (operational); use national systems for vigilance reporting until Eudamed Vigilance module is fully functional |
| Clinical evidence insufficient for Class IIb/III device |
Equivalence route rejected by NB or clinical investigation not planned |
Reassess equivalence per MDCG 2020-1 Rev.1 (technical, biological, clinical equivalence with access to data); if equivalence fails, plan clinical investigation per Article 61; consider MDCG 2024-6 for reduced evidence burden on well-established devices |
| MDR transition deadline approaching with NB application pending |
Limited NB capacity (approximately 40 designated EU-wide as of 2025) |
Verify transition deadline for your device class (Class III: May 2026, Class IIb: Dec 2027, Class IIa: Dec 2028); ensure QMS application was submitted to NB by applicable deadline; maintain MDD/AIMDD compliance during transition |
| UDI labeling rejected by NB or competent authority |
UDI-DI/UDI-PI format incorrect, AIDC carrier unreadable, or missing elements |
Verify all required UDI elements per Article 27; ensure AIDC format (GS1 DataMatrix preferred) is scannable; include HRI adjacent to barcode; for reusable devices, apply direct marking that survives reprocessing |
| AI/ML medical device faces dual regulatory obligations |
Device classified under both MDR and EU AI Act as high-risk |
Assess both MDR Annex VIII classification and EU AI Act Annex III categorization; MDR conformity assessment may satisfy AI Act per Art. 120; extend technical documentation with AI-specific elements per MDCG 2024-8 |
Success Criteria
- Device correctly classified with documented rationale -- classification per Annex VIII with all applicable rules evaluated, highest class selected, and rationale documented for NB review
- Complete technical file per Annex II structure -- device description, labeling/IFU, design and manufacturing info, GSPR compliance matrix, benefit-risk analysis, verification and validation, and clinical evaluation report all present and current
- GSPR compliance matrix fully addressed -- all applicable General Safety and Performance Requirements mapped to evidence with cross-references to risk management file, biocompatibility reports, sterilization validation, software documentation, and labeling
- Clinical evaluation report meets Annex XIV requirements -- literature search methodology documented, data appraised and analyzed, safety and performance conclusions stated, benefit-risk determined, and PMCF plan included
- PMS system operational -- PMS plan per Article 84, complaint handling procedures, vigilance reporting process, PSUR schedule defined by class, and PMCF activities integrated with CER
- UDI system fully implemented -- UDI-DI assigned per device variant, UDI-PI applied (lot/serial/dates), AIDC and HRI carriers on all packaging levels, EUDAMED registration complete (when applicable)
- MDR gap analysis shows zero critical gaps -- as measured by
mdr_gap_analyzer.py, with all requirements addressed or in-progress with documented timeline
Scope & Limitations
In Scope:
- Device classification per MDR Annex VIII (Rules 1-22) including software classification per MDCG 2019-11 Rev.1
- Technical documentation structure and requirements per Annex II and Annex III
- GSPR compliance matrix with evidence mapping
- Clinical evidence strategy including equivalence assessment, CER structure, and PMCF planning
- Post-market surveillance system design including PMS plan, PSUR schedule, and vigilance reporting timelines
- EUDAMED and UDI system implementation guidance
- Conformity assessment route selection by device class
- MDR transition timeline tracking (post-Amendment Regulation 2023/607)
- AI/ML medical device considerations including EU AI Act interaction
Out of Scope:
- Clinical investigation protocol design, execution, or statistical analysis
- Biocompatibility testing per ISO 10993 (beyond evidence mapping in GSPR)
- Sterilization validation per ISO 11135/11137 (beyond evidence mapping)
- Notified Body selection, engagement, or commercial negotiation
- Quality Management System implementation -- use
quality-manager-qms-iso13485 for ISO 13485 QMS
- Risk management process implementation -- use
risk-management-specialist for ISO 14971
Important Notes:
- EUDAMED's first four modules became mandatory from May 28, 2026; manufacturers must have SRN and device registrations ready
- Only approximately 40 Notified Bodies are designated EU-wide as of 2025, creating capacity constraints; early NB engagement is critical
- The European Commission published updated transition timelines in December 2025 extending deadlines for certain device categories
- Manufacturers must adopt recently harmonized standards with no formal transition period (Decision EU 2025/2078)
Integration Points
| Skill |
Integration |
When to Use |
fda-consultant-specialist |
Cross-framework mapping for dual US/EU market; FDA QMSR aligns with ISO 13485 used by MDR |
When device requires both FDA clearance/approval and EU MDR CE marking |
quality-manager-qms-iso13485 |
ISO 13485 QMS is prerequisite for MDR conformity assessment (Annex IX, XI) |
When establishing or auditing QMS for MDR compliance |
risk-management-specialist |
ISO 14971 risk management file is core component of MDR technical documentation |
When developing risk management file, FMEA, and benefit-risk analysis |
eu-ai-act-specialist |
AI medical devices subject to both MDR and EU AI Act; classification and conformity assessment interaction |
When AI-enabled medical device requires dual regulatory compliance |
capa-officer |
CAPA process supports MDR vigilance obligations and FSCA implementation |
When post-market surveillance identifies safety or performance issues requiring corrective action |
infrastructure-compliance-auditor |
Cybersecurity validation per MDCG 2019-16 Rev.1 for connected medical devices |
When connected device requires cybersecurity documentation for technical file |
Tool Reference
mdr_gap_analyzer.py
Analyzes device against MDR requirements, identifies compliance gaps, and generates prioritized recommendations.
| Flag |
Required |
Description |
--device <name> |
Yes (unless --interactive) |
Device name for gap analysis |
--class <class> |
Yes (unless --interactive) |
Device classification: I, Is, Im, IIa, IIb, III |
--output <format> |
No |
Output format: json for machine-readable output; default is human-readable text |
--interactive |
No |
Launch interactive assessment mode with guided questions |
Analysis Categories: Technical documentation (Annex II), GSPR compliance, clinical evidence (Annex XIV), post-market surveillance (Chapter VII), UDI/EUDAMED, labeling (Article 13), quality management system, risk management, and conformity assessment route.
Output: Requirements checklist with per-item status (Not Started/In Progress/Complete/N/A), gap identification with priority (Critical/High/Medium/Low), critical gap highlighting, completion percentage, and compliance roadmap recommendations.
1---2name: mdr-745-specialist3description: EU MDR 2017/745 compliance specialist for medical device classification, technical documentation, clinical evidence, and post-market surveillance. Use for Annex VIII classification, GSPR, clinical evaluation, EUDAMED, and UDI.4license: MIT + Commons Clause5---6# MDR 2017/745 Specialist
7
8EU MDR compliance patterns for medical device classification, technical documentation, and clinical evidence.
9
10---
11
12## Table of Contents
13
14- [Device Classification Workflow](#device-classification-workflow)
15- [Technical Documentation](#technical-documentation)
16- [Clinical Evidence](#clinical-evidence)
17- [Post-Market Surveillance](#post-market-surveillance)
18- [EUDAMED and UDI](#eudamed-and-udi)
19- [Reference Documentation](#reference-documentation)
20- [Tools](#tools)
21
22---
23
24## Clarify First
25
26Before classifying the device or analyzing gaps, confirm these inputs. If any is unknown or vague, ASK — do not assume:
27
28- [ ] **Device characteristics** — duration, invasiveness, body-system contact, and whether it is active/software (drives the Annex VIII classification)
29- [ ] **Intended purpose** — the device's claimed clinical purpose (sets the applicable rule and clinical-evidence level)
30- [ ] **Software/AI nature** — whether it is software as a medical device (MDCG 2019-11) or AI/ML (changes classification and the documentation set)
31
32Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the classification.
33
34## Device Classification Workflow
35
36Classify device under MDR Annex VIII:
37
381. Identify device duration (transient, short-term, long-term)
392. Determine invasiveness level (non-invasive, body orifice, surgical)
403. Assess body system contact (CNS, cardiac, other)
414. Check if active device (energy dependent)
425. Apply classification rules 1-22
436. For software, apply MDCG 2019-11 algorithm
447. Document classification rationale
458. **Validation:** Classification confirmed with Notified Body
46
47### Classification Matrix
48
49| Factor | Class I | Class IIa | Class IIb | Class III |
50|--------|---------|-----------|-----------|-----------|
51| Duration | Any | Short-term | Long-term | Long-term |
52| Invasiveness | Non-invasive | Body orifice | Surgical | Implantable |
53| System | Any | Non-critical | Critical organs | CNS/cardiac |
54| Risk | Lowest | Low-medium | Medium-high | Highest |
55
56### Software Classification (MDCG 2019-11)
57
58| Information Use | Condition Severity | Class |
59|-----------------|-------------------|-------|
60| Informs decision | Non-serious | IIa |
61| Informs decision | Serious | IIb |
62| Drives/treats | Critical | III |
63
64### Classification Examples
65
66**Example 1: Absorbable Surgical Suture**
67- Rule 8 (implantable, long-term)
68- Duration: > 30 days (absorbed)
69- Contact: General tissue
70- Classification: **Class IIb**
71
72**Example 2: AI Diagnostic Software**
73- Rule 11 + MDCG 2019-11
74- Function: Diagnoses serious condition
75- Classification: **Class IIb**
76
77**Example 3: Cardiac Pacemaker**
78- Rule 8 (implantable)
79- Contact: Central circulatory system
80- Classification: **Class III**
81
82---
83
84## Technical Documentation
85
86Prepare technical file per Annex II and III:
87
881. Create device description (variants, accessories, intended purpose)
892. Develop labeling (Article 13 requirements, IFU)
903. Document design and manufacturing process
914. Complete GSPR compliance matrix
925. Prepare benefit-risk analysis
936. Compile verification and validation evidence
947. Integrate risk management file (ISO 14971)
958. **Validation:** Technical file reviewed for completeness
96
97### Technical File Structure
98
99```
100ANNEX II TECHNICAL DOCUMENTATION
101├── Device description and UDI-DI
102├── Label and instructions for use
103├── Design and manufacturing info
104├── GSPR compliance matrix
105├── Benefit-risk analysis
106├── Verification and validation
107└── Clinical evaluation report
108```
109
110### GSPR Compliance Checklist
111
112| Requirement | Evidence | Status |
113|-------------|----------|--------|
114| Safe design (GSPR 1-3) | Risk management file | ☐ |
115| Chemical properties (GSPR 10.1) | Biocompatibility report | ☐ |
116| Infection risk (GSPR 10.2) | Sterilization validation | ☐ |
117| Software requirements (GSPR 17) | IEC 62304 documentation | ☐ |
118| Labeling (GSPR 23) | Label artwork, IFU | ☐ |
119
120### Conformity Assessment Routes
121
122| Class | Route | NB Involvement |
123|-------|-------|----------------|
124| I | Annex II self-declaration | None |
125| Is/Im | Annex II + IX/XI | Sterile/measuring aspects |
126| IIa | Annex II + IX or XI | Product or QMS |
127| IIb | Annex IX + X or X + XI | Type exam + production |
128| III | Annex IX + X | Full QMS + type exam |
129
130---
131
132## Clinical Evidence
133
134Develop clinical evidence strategy per Annex XIV:
135
1361. Define clinical claims and endpoints
1372. Conduct systematic literature search
1383. Appraise clinical data quality
1394. Assess equivalence (technical, biological, clinical)
1405. Identify evidence gaps
1416. Determine if clinical investigation required
1427. Prepare Clinical Evaluation Report (CER)
1438. **Validation:** CER reviewed by qualified evaluator
144
145### Evidence Requirements by Class
146
147| Class | Minimum Evidence | Investigation |
148|-------|------------------|---------------|
149| I | Risk-benefit analysis | Not typically required |
150| IIa | Literature + post-market | May be required |
151| IIb | Systematic literature review | Often required |
152| III | Comprehensive clinical data | Required (Article 61) |
153
154### Clinical Evaluation Report Structure
155
156```
157CER CONTENTS
158├── Executive summary
159├── Device scope and intended purpose
160├── Clinical background (state of the art)
161├── Literature search methodology
162├── Data appraisal and analysis
163├── Safety and performance conclusions
164├── Benefit-risk determination
165└── PMCF plan summary
166```
167
168### Qualified Evaluator Requirements
169
170- Medical degree or equivalent healthcare qualification
171- 4+ years clinical experience in relevant field
172- Training in clinical evaluation methodology
173- Understanding of MDR requirements
174
175---
176
177## Post-Market Surveillance
178
179Establish PMS system per Chapter VII:
180
1811. Develop PMS plan (Article 84)
1822. Define data collection methods
1833. Establish complaint handling procedures
1844. Create vigilance reporting process
1855. Plan Periodic Safety Update Reports (PSUR)
1866. Integrate with PMCF activities
1877. Define trend analysis and signal detection
1888. **Validation:** PMS system audited annually
189
190### PMS System Components
191
192| Component | Requirement | Frequency |
193|-----------|-------------|-----------|
194| PMS Plan | Article 84 | Maintain current |
195| PSUR | Class IIa and higher | Per class schedule |
196| PMCF Plan | Annex XIV Part B | Update with CER |
197| PMCF Report | Annex XIV Part B | Annual (Class III) |
198| Vigilance | Articles 87-92 | As events occur |
199
200### PSUR Schedule
201
202| Class | Frequency |
203|-------|-----------|
204| Class III | Annual |
205| Class IIb implantable | Annual |
206| Class IIb | Every 2 years |
207| Class IIa | When necessary |
208
209### Serious Incident Reporting
210
211| Timeline | Requirement |
212|----------|-------------|
213| 2 days | Serious public health threat |
214| 10 days | Death or serious deterioration |
215| 15 days | Other serious incidents |
216
217---
218
219## EUDAMED and UDI
220
221Implement UDI system per Article 27:
222
2231. Obtain issuing entity code (GS1, HIBCC, ICCBBA)
2242. Assign UDI-DI to each device variant
2253. Assign UDI-PI (production identifier)
2264. Apply UDI carrier to labels (AIDC + HRI)
2275. Register actor in EUDAMED
2286. Register devices in EUDAMED
2297. Upload certificates when available
2308. **Validation:** UDI verified on sample labels
231
232### EUDAMED Modules
233
234| Module | Content | Actor |
235|--------|---------|-------|
236| Actor | Company registration | Manufacturer, AR |
237| UDI/Device | Device and variant data | Manufacturer |
238| Certificates | NB certificates | Notified Body |
239| Clinical Investigation | Study registration | Sponsor |
240| Vigilance | Incident reports | Manufacturer |
241| Market Surveillance | Authority actions | Competent Authority |
242
243### UDI Label Requirements
244
245Required elements per Article 13:
246
247- [ ] UDI-DI (device identifier)
248- [ ] UDI-PI (production identifier) for Class II+
249- [ ] AIDC format (barcode/RFID)
250- [ ] HRI format (human-readable)
251- [ ] Manufacturer name and address
252- [ ] Lot/serial number
253- [ ] Expiration date (if applicable)
254
255---
256
257## Reference Documentation
258
259### MDR Classification Guide
260
261`references/mdr-classification-guide.md` contains:
262
263- Complete Annex VIII classification rules (Rules 1-22)
264- Software classification per MDCG 2019-11
265- Worked classification examples
266- Conformity assessment route selection
267
268### Clinical Evidence Requirements
269
270`references/clinical-evidence-requirements.md` contains:
271
272- Clinical evidence framework and hierarchy
273- Literature search methodology
274- Clinical Evaluation Report structure
275- PMCF plan and evaluation report guidance
276
277### Technical Documentation Templates
278
279`references/technical-documentation-templates.md` contains:
280
281- Annex II and III content requirements
282- Design History File structure
283- GSPR compliance matrix template
284- Declaration of Conformity template
285- Notified Body submission checklist
286
287---
288
289## Tools
290
291### MDR Gap Analyzer
292
293```bash
294# Quick gap analysis
295python scripts/mdr_gap_analyzer.py --device "Device Name" --class IIa
296
297# JSON output for integration
298python scripts/mdr_gap_analyzer.py --device "Device Name" --class III --output json
299
300# Interactive assessment
301python scripts/mdr_gap_analyzer.py --interactive
302```
303
304Analyzes device against MDR requirements, identifies compliance gaps, generates prioritized recommendations.
305
306**Output includes:**
307- Requirements checklist by category
308- Gap identification with priorities
309- Critical gap highlighting
310- Compliance roadmap recommendations
311
312---
313
314## Notified Body Interface
315
316### Selection Criteria
317
318| Factor | Considerations |
319|--------|----------------|
320| Designation scope | Covers your device type |
321| Capacity | Timeline for initial audit |
322| Geographic reach | Markets you need to access |
323| Technical expertise | Experience with your technology |
324| Fee structure | Transparency, predictability |
325
326### Pre-Submission Checklist
327
328- [ ] Technical documentation complete
329- [ ] GSPR matrix fully addressed
330- [ ] Risk management file current
331- [ ] Clinical evaluation report complete
332- [ ] QMS (ISO 13485) certified
333- [ ] Labeling and IFU finalized
334- [ ] **Validation:** Internal gap assessment complete
335
336---
337
338## MDCG Guidance Documents Update (2024-2025)
339
340### Key MDCG Guidance Documents
341
342| Document | Title | Status | Key Impact |
343|----------|-------|--------|------------|
344| MDCG 2024-1 | Transition provisions under MDR Art. 120 | Final (2024) | Extended transition deadlines for legacy devices |
345| MDCG 2024-6 | Clinical evidence needed for medical devices previously CE marked under Directives | Final (2024) | Reduced clinical evidence burden for well-established devices |
346| MDCG 2023-4 Rev.1 | Notified Body capacity and availability | Revised (2024) | NB capacity monitoring and optimization |
347| MDCG 2022-18 Rev.1 | Software qualification and classification under MDR | Revised (2024) | Updated software classification algorithm |
348| MDCG 2020-1 Rev.1 | Clinical evaluation — equivalence | Revised (2024) | Refined equivalence demonstration requirements |
349| MDCG 2019-16 Rev.1 | Cybersecurity for medical devices | Revised (2024) | Enhanced cybersecurity requirements for connected devices |
350| MDCG 2019-11 Rev.1 | Qualification and classification of software | Active | Software as medical device classification |
351
352### MDR Transition Timeline (Post-Amendment Regulation 2023/607)
353
354| Device Category | Transition Deadline | Conditions |
355|----------------|--------------------|-----------|
356| Class III and implantable | 26 May 2026 | Valid MDD/AIMDD certificate + QMS application to NB by 26 May 2024 |
357| Class IIb | 31 December 2027 | Valid certificate + QMS application to NB |
358| Class IIa and Class I (sterile/measuring) | 31 December 2028 | Valid certificate + QMS application to NB |
359| Class I (up-classified under MDR) | 31 December 2028 | Previously exempt from NB involvement |
360
361**Conditions for extended deadlines:**
362- Device continues to comply with MDD/AIMDD
363- No significant changes in design or intended purpose
364- No unacceptable safety or performance risk
365- Manufacturer has applied to Notified Body for MDR conformity assessment before applicable deadline
366
367---
368
369## Software as Medical Device Under MDR (MDCG 2019-11 Rev.1)
370
371### Software Qualification Decision
372
373```
374Is the software a medical device?
375 │
376 ▼
377Does the software perform an action on data?
378 │
379 Yes─┴─No → NOT a medical device (data storage/communication only)
380 │
381 ▼
382Is the action for the benefit of individual patients?
383 │
384 Yes─┴─No → NOT a medical device (population health/admin)
385 │
386 ▼
387Is the action one of: treatment, diagnosis, monitoring, prediction?
388 │
389 Yes─┴─No → NOT a medical device (lifestyle/wellness)
390 │
391 ▼
392QUALIFIES AS MEDICAL DEVICE SOFTWARE → Apply classification rules
393```
394
395### Software Classification Under MDR
396
397| Decision Factor | Class IIa | Class IIb | Class III |
398|----------------|-----------|-----------|-----------|
399| Provides information to inform clinical management | Non-serious conditions | Serious conditions | N/A |
400| Drives clinical management or diagnoses | N/A | Non-serious conditions | Serious or critical conditions |
401| Monitors physiological processes | Non-vital parameters | Vital parameters (not immediate danger) | Vital parameters (immediate danger) |
402
403### Software Lifecycle Requirements Under MDR
404
405| MDR Requirement | IEC 62304 Mapping | Documentation |
406|----------------|-------------------|---------------|
407| GSPR 17.1 (repeatability, reliability) | Software development process | Software development plan |
408| GSPR 17.2 (state of the art) | Software architecture | Architecture design document |
409| GSPR 17.3 (minimum IT requirements) | System requirements | IT environment specification |
410| GSPR 17.4 (foreseeable misuse) | Risk management | Software risk analysis |
411| Annex II §6.5 (software verification) | Software testing | Test plans and reports |
412| Annex I §23.4 (labeling for software) | Release documentation | Software release notes |
413
414---
415
416## AI/ML Medical Devices Under MDR
417
418### AI/ML Classification Considerations
419
420| AI/ML Capability | MDR Classification Impact | Regulatory Consideration |
421|-----------------|--------------------------|-------------------------|
422| AI-assisted detection | Typically Class IIa-IIb (Rule 11) | Must demonstrate clinical performance per intended use |
423| AI-driven diagnosis | Typically Class IIb-III (Rule 11) | Requires clinical investigation for novel indications |
424| AI treatment optimization | Typically Class IIb-III (Rule 11 + specific rules) | Benefit-risk analysis must account for AI uncertainty |
425| Continuously learning AI | Classification per highest risk output | Post-market monitoring must track algorithm evolution |
426
427### AI/ML-Specific Technical Documentation
428
429In addition to standard Annex II requirements, AI/ML devices must document:
430
431| Section | Content | MDCG Reference |
432|---------|---------|----------------|
433| Algorithm description | Architecture, training approach, feature engineering | MDCG 2019-11, IMDRF SaMD WG |
434| Training data | Sources, demographics, size, labeling methodology, quality | MDCG 2020-1 (equivalence) |
435| Validation methodology | Test dataset independence, performance metrics, subgroup analysis | Annex XIV |
436| Clinical performance | Sensitivity, specificity, AUC, PPV, NPV per intended population | CER requirements |
437| Change management | How algorithm updates are validated and deployed | GSPR 17 |
438| Explainability | How the AI's output can be understood by intended users | GSPR 23 (labeling) |
439
440### EU AI Act Interaction with MDR
441
442| EU AI Act Requirement | MDR Equivalent | Combined Approach |
443|----------------------|----------------|-------------------|
444| High-risk classification (Annex III, Point 10) | Annex VIII classification rules | Both classifications apply; meet stricter requirement |
445| Conformity assessment (Art. 43) | Annex IX/X/XI assessment | MDR conformity assessment satisfies AI Act (Art. 120) |
446| Technical documentation (Annex IV) | Annex II technical documentation | Extend MDR technical file with AI Act-specific elements |
447| Risk management (Art. 9) | ISO 14971 + GSPR | ISO 14971 satisfies both when AI risks are included |
448| Data governance (Art. 10) | GSPR 17 + Annex XIV | Add AI-specific data governance to clinical evaluation |
449| Post-market monitoring (Art. 72) | Chapter VII PMS | Single PMS system covering both AI Act and MDR |
450
451> **See also:** `../risk-management-specialist/SKILL.md` for AI-specific risk management under ISO 14971, and `../fda-consultant-specialist/SKILL.md` for FDA's AI/ML SaMD framework and PCCP.
452
453---
454
455## Eudamed Implementation Status and Requirements
456
457### Eudamed Module Deployment Status (as of 2025)
458
459| Module | Status | Mandatory Date | Content |
460|--------|--------|----------------|---------|
461| Actor Registration | Operational | Available now | Economic operator registration |
462| UDI/Device Registration | Operational | 6 months after Eudamed fully functional | Device and UDI-DI data |
463| Notified Body and Certificates | Operational | Available now | Certificate data upload by NBs |
464| Clinical Investigations | Operational | Available now | Study registration and reporting |
465| Vigilance | Partially operational | 24 months after fully functional | Incident reports, FSCAs, trend reports |
466| Market Surveillance | In development | 18 months after fully functional | CA market surveillance activities |
467
468**Key consideration:** Until Eudamed is declared fully functional by the European Commission, manufacturers must use existing national systems (e.g., BfArM in Germany, ANSM in France) for vigilance reporting.
469
470### Eudamed Registration Requirements for Manufacturers
471
472| Data Element | Required For | Update Frequency |
473|-------------|-------------|-----------------|
474| SRN (Single Registration Number) | All manufacturers | On change |
475| Authorized representative details | Non-EU manufacturers | On change |
476| Device identification (UDI-DI) | All devices placed on market | Before first placing on market |
477| Basic UDI-DI | Device model/family grouping | Before first placing on market |
478| GMDN code | Device nomenclature | On initial registration |
479| Risk class | Classification per Annex VIII | On initial registration |
480| NB certificate reference | Class IIa and above | When certificate issued |
481| Clinical investigation registration | Interventional studies | Before study start |
482
483---
484
485## UDI-DI and UDI-PI Detailed Requirements
486
487### UDI-DI (Device Identifier) — Static Information
488
489| Element | Description | Example |
490|---------|-------------|---------|
491| Device identifier | Unique code for device model/version | 04069876543219 (GS1 GTIN) |
492| Issuing entity | GS1, HIBCC, ICCBBA, or IFA | Selected by manufacturer |
493| Device model | Specific device configuration | "CardioMonitor X200" |
494| Device version | Software version (for SaMD) | "v3.1.0" |
495| Applicable regulations | MDR or IVDR reference | MDR 2017/745 |
496| Risk class | Per Annex VIII | Class IIa |
497| Basic UDI-DI | Grouping identifier for device family | 04069876500001 |
498
499### UDI-PI (Production Identifier) — Variable Information
500
501| PI Element | When Required | Format |
502|-----------|---------------|--------|
503| Lot/batch number | When tracking by lot | Lot: ABC123 |
504| Serial number | When individual tracking required (Class III, implantable) | SN: 2024-00001 |
505| Manufacturing date | When relevant to safety | Mfg: 2024-06-15 |
506| Expiry date | When device has shelf life | Exp: 2026-06-15 |
507| Software version | SaMD and software-driven devices | SW: v3.1.0 |
508
509### UDI Carrier Requirements
510
511| Carrier Type | Format | Where Applied |
512|-------------|--------|---------------|
513| AIDC (barcode/2D code) | GS1 DataMatrix, GS1-128, HIBC | Device label, package label |
514| HRI (human-readable) | Plain text interpretation of AIDC | Adjacent to AIDC on label |
515| RFID | GS1 EPC/RFID | Optional, in addition to AIDC |
516
517**Labeling placement rules:**
518- UDI on each level of packaging (unit, intermediate, case)
519- For reusable devices requiring sterilization: UDI on device itself (direct marking)
520- Class III implantable: UDI on device or packaging that remains with patient record
521- UDI must survive device lifecycle (including reprocessing cycles for reusable devices)
522
523### UDI Database Submission Timeline
524
525| Device Class | Submission Deadline |
526|-------------|-------------------|
527| Class III and implantable | Before placing on the market |
528| Class IIb | Before placing on the market |
529| Class IIa | Before placing on the market |
530| Class I | Before placing on the market |
531
532> **Note:** All timelines are contingent on Eudamed being declared fully functional. Until then, manufacturers should pre-register in Eudamed (available modules) and maintain data readiness.
533
534---
535
536## Cross-Reference: NIS2 for Critical Infrastructure (Healthcare)
537
538Healthcare organizations manufacturing or deploying medical devices may be classified as essential entities under NIS2:
539
540| NIS2 Requirement | MDR Impact | Action for Manufacturers |
541|-----------------|-----------|--------------------------|
542| Art. 21: Cybersecurity risk management | MDCG 2019-16 cybersecurity guidance | Align device cybersecurity with organizational NIS2 compliance |
543| Art. 23: Incident reporting (24h/72h) | Art. 87-92 vigilance reporting | Unified incident reporting covering both device and infrastructure incidents |
544| Art. 21(2)(d): Supply chain security | Art. 11 authorized representatives, supply chain | Assess cybersecurity of device component suppliers |
545| Art. 20: Governance and accountability | Art. 10 manufacturer obligations | Senior management oversight of both NIS2 and MDR compliance |
546
547> **See also:** `../information-security-manager-iso27001/SKILL.md` for ISO 27001 alignment with NIS2 requirements.
548
549---
550
551## MDR Updates & Cross-Framework Integration
552
553### Latest MDCG Guidance Documents
554
555- **MDCG 2019-11 Rev.1:** Qualification and classification of software — updated algorithm for SaMD
556- **MDCG 2020-1 Rev.1:** Clinical evaluation (Annex XIV) — updated methodologies
557- **MDCG 2024-8:** EU AI Act interaction with MDR for AI-enabled medical devices
558- **MDCG 2023-4:** Legacy devices and Article 120 transition provisions
559
560### AI/ML Medical Devices Under MDR
561
562- **Classification:** AI/ML-based SaMD typically Class IIa or higher (Rule 11)
563- **Clinical Evidence:** Must demonstrate AI algorithm clinical performance (sensitivity, specificity, AUC)
564- **Continuous Learning:** PCCP-equivalent under MDR for adaptive AI devices
565- **Post-Market:** Enhanced PMCF for AI devices monitoring real-world algorithm performance
566- **EU AI Act Interaction:** High-risk AI medical devices subject to BOTH MDR and EU AI Act
567- **Cross-reference:** See `eu-ai-act-specialist` for AI Act obligations
568
569### NIS2 Impact on Healthcare
570
571- Healthcare entities are "Essential Entities" under NIS2 Directive
572- Medical device manufacturers may be "Important Entities"
573- NIS2 cybersecurity requirements supplement MDR cybersecurity expectations
574- **Cross-reference:** See `nis2-directive-specialist` for NIS2 compliance
575
576### EUDAMED Implementation Status
577
578- **Actor Registration Module:** Operational — all economic operators must register
579- **UDI/Device Registration Module:** Operational — mandatory device registration
580- **Notified Body Module:** Operational — certificate information
581- **Clinical Investigation Module:** Available
582- **Vigilance Module:** Under development
583- **Market Surveillance Module:** Under development
584
585### UDI Detailed Requirements
586
587- **UDI-DI (Device Identifier):** Unique to device model — used for EUDAMED registration
588- **UDI-PI (Production Identifier):** Identifies production unit — lot, serial, expiry, manufacturing date
589- **Issuing Entities:** GS1, HIBCC, ICCBBA, IFA
590- **Carrier Types:** AIDC (barcode/2D) + HRI (human readable)
591- **Implant Card:** Required for Class III implantable devices (UDI + patient information)
592
593---
594
595## Troubleshooting
596
597| Problem | Possible Cause | Resolution |
598|---------|---------------|------------|
599| Device classification unclear -- rules yield different results | Multiple classification rules apply; highest class must be selected per MDR Article 51(7) | Apply all applicable rules from Annex VIII (Rules 1-22); use the implementing rule that gives the highest classification; for software, apply MDCG 2019-11 Rev.1 algorithm; document rationale for each rule considered |
600| Notified Body rejects technical file for incompleteness | GSPR compliance matrix gaps, missing clinical evaluation, or insufficient risk management documentation | Review GSPR checklist in this skill; ensure Annex II technical file structure is complete; verify CER meets Annex XIV requirements; confirm ISO 14971 risk management file is current and comprehensive |
601| EUDAMED registration delays blocking market access | Module not operational or manufacturer SRN not obtained | Check current EUDAMED module status; obtain SRN via actor registration module (operational); use national systems for vigilance reporting until Eudamed Vigilance module is fully functional |
602| Clinical evidence insufficient for Class IIb/III device | Equivalence route rejected by NB or clinical investigation not planned | Reassess equivalence per MDCG 2020-1 Rev.1 (technical, biological, clinical equivalence with access to data); if equivalence fails, plan clinical investigation per Article 61; consider MDCG 2024-6 for reduced evidence burden on well-established devices |
603| MDR transition deadline approaching with NB application pending | Limited NB capacity (approximately 40 designated EU-wide as of 2025) | Verify transition deadline for your device class (Class III: May 2026, Class IIb: Dec 2027, Class IIa: Dec 2028); ensure QMS application was submitted to NB by applicable deadline; maintain MDD/AIMDD compliance during transition |
604| UDI labeling rejected by NB or competent authority | UDI-DI/UDI-PI format incorrect, AIDC carrier unreadable, or missing elements | Verify all required UDI elements per Article 27; ensure AIDC format (GS1 DataMatrix preferred) is scannable; include HRI adjacent to barcode; for reusable devices, apply direct marking that survives reprocessing |
605| AI/ML medical device faces dual regulatory obligations | Device classified under both MDR and EU AI Act as high-risk | Assess both MDR Annex VIII classification and EU AI Act Annex III categorization; MDR conformity assessment may satisfy AI Act per Art. 120; extend technical documentation with AI-specific elements per MDCG 2024-8 |
606
607---
608
609## Success Criteria
610
611- **Device correctly classified with documented rationale** -- classification per Annex VIII with all applicable rules evaluated, highest class selected, and rationale documented for NB review
612- **Complete technical file per Annex II structure** -- device description, labeling/IFU, design and manufacturing info, GSPR compliance matrix, benefit-risk analysis, verification and validation, and clinical evaluation report all present and current
613- **GSPR compliance matrix fully addressed** -- all applicable General Safety and Performance Requirements mapped to evidence with cross-references to risk management file, biocompatibility reports, sterilization validation, software documentation, and labeling
614- **Clinical evaluation report meets Annex XIV requirements** -- literature search methodology documented, data appraised and analyzed, safety and performance conclusions stated, benefit-risk determined, and PMCF plan included
615- **PMS system operational** -- PMS plan per Article 84, complaint handling procedures, vigilance reporting process, PSUR schedule defined by class, and PMCF activities integrated with CER
616- **UDI system fully implemented** -- UDI-DI assigned per device variant, UDI-PI applied (lot/serial/dates), AIDC and HRI carriers on all packaging levels, EUDAMED registration complete (when applicable)
617- **MDR gap analysis shows zero critical gaps** -- as measured by `mdr_gap_analyzer.py`, with all requirements addressed or in-progress with documented timeline
618
619---
620
621## Scope & Limitations
622
623**In Scope:**
624- Device classification per MDR Annex VIII (Rules 1-22) including software classification per MDCG 2019-11 Rev.1
625- Technical documentation structure and requirements per Annex II and Annex III
626- GSPR compliance matrix with evidence mapping
627- Clinical evidence strategy including equivalence assessment, CER structure, and PMCF planning
628- Post-market surveillance system design including PMS plan, PSUR schedule, and vigilance reporting timelines
629- EUDAMED and UDI system implementation guidance
630- Conformity assessment route selection by device class
631- MDR transition timeline tracking (post-Amendment Regulation 2023/607)
632- AI/ML medical device considerations including EU AI Act interaction
633
634**Out of Scope:**
635- Clinical investigation protocol design, execution, or statistical analysis
636- Biocompatibility testing per ISO 10993 (beyond evidence mapping in GSPR)
637- Sterilization validation per ISO 11135/11137 (beyond evidence mapping)
638- Notified Body selection, engagement, or commercial negotiation
639- Quality Management System implementation -- use `quality-manager-qms-iso13485` for ISO 13485 QMS
640- Risk management process implementation -- use `risk-management-specialist` for ISO 14971
641
642**Important Notes:**
643- EUDAMED's first four modules became mandatory from May 28, 2026; manufacturers must have SRN and device registrations ready
644- Only approximately 40 Notified Bodies are designated EU-wide as of 2025, creating capacity constraints; early NB engagement is critical
645- The European Commission published updated transition timelines in December 2025 extending deadlines for certain device categories
646- Manufacturers must adopt recently harmonized standards with no formal transition period (Decision EU 2025/2078)
647
648---
649
650## Integration Points
651
652| Skill | Integration | When to Use |
653|-------|-------------|-------------|
654| `fda-consultant-specialist` | Cross-framework mapping for dual US/EU market; FDA QMSR aligns with ISO 13485 used by MDR | When device requires both FDA clearance/approval and EU MDR CE marking |
655| `quality-manager-qms-iso13485` | ISO 13485 QMS is prerequisite for MDR conformity assessment (Annex IX, XI) | When establishing or auditing QMS for MDR compliance |
656| `risk-management-specialist` | ISO 14971 risk management file is core component of MDR technical documentation | When developing risk management file, FMEA, and benefit-risk analysis |
657| `eu-ai-act-specialist` | AI medical devices subject to both MDR and EU AI Act; classification and conformity assessment interaction | When AI-enabled medical device requires dual regulatory compliance |
658| `capa-officer` | CAPA process supports MDR vigilance obligations and FSCA implementation | When post-market surveillance identifies safety or performance issues requiring corrective action |
659| `infrastructure-compliance-auditor` | Cybersecurity validation per MDCG 2019-16 Rev.1 for connected medical devices | When connected device requires cybersecurity documentation for technical file |
660
661---
662
663## Tool Reference
664
665### mdr_gap_analyzer.py
666
667Analyzes device against MDR requirements, identifies compliance gaps, and generates prioritized recommendations.
668
669| Flag | Required | Description |
670|------|----------|-------------|
671| `--device <name>` | Yes (unless `--interactive`) | Device name for gap analysis |
672| `--class <class>` | Yes (unless `--interactive`) | Device classification: `I`, `Is`, `Im`, `IIa`, `IIb`, `III` |
673| `--output <format>` | No | Output format: `json` for machine-readable output; default is human-readable text |
674| `--interactive` | No | Launch interactive assessment mode with guided questions |
675
676**Analysis Categories:** Technical documentation (Annex II), GSPR compliance, clinical evidence (Annex XIV), post-market surveillance (Chapter VII), UDI/EUDAMED, labeling (Article 13), quality management system, risk management, and conformity assessment route.
677
678**Output:** Requirements checklist with per-item status (Not Started/In Progress/Complete/N/A), gap identification with priority (Critical/High/Medium/Low), critical gap highlighting, completion percentage, and compliance roadmap recommendations.