Medical Device Compliance

Medical Device Compliance

Full regulatory workflow for medical devices, IVDs, and software as a medical device (SaMD). EU MDR/IVDR, FDA, UKCA, classification, clinical evaluation, post-market.

Decision Flow

digraph {
  rankdir=TB; node [shape=box style=rounded fontsize=10];
  qualify [label="1. Qualify as medical device\n(MDR Art. 2, FDA 201(h))"];
  classify [label="2. Classify:\nEU I/IIa/IIb/III, FDA I/II/III"];
  pathway [label="3. Choose pathway:\nself-cert / NB / 510(k) / PMA / De Novo"];
  qms [label="4. QMS ISO 13485\n+ Risk mgmt ISO 14971"];
  clinical [label="5. Clinical evaluation\n(MEDDEV 2.7/1 rev 4)"];
  tech [label="6. Technical Documentation\n(MDR Annex II/III)"];
  audit [label="7. NB audit / 510(k) review\n/ PMA submission"];
  udi [label="8. UDI assignment\n+ EUDAMED registration"];
  pms [label="9. Post-Market Surveillance\nplan + PMCF"];
  sell [label="10. Place on market"];
  qualify -> classify -> pathway -> qms -> clinical -> tech -> audit -> udi -> pms -> sell;
}

EU -- MDR 2017/745

EU -- IVDR 2017/746 (In Vitro Diagnostics)

US -- FDA Pathways

FDA Classification

FDA Software (SaMD)

• Software functions that meet the definition of a "device" under section 201(h) regulated
• 21st Century Cures Act 2016 excluded certain wellness software, EHR functions
• Pre-Cert pilot program ended 2023; FDA returning to traditional 510(k) for SaMD
• AI/ML: PCCP (Predetermined Change Control Plan) framework finalized 2024 -- allows pre-authorized algorithm updates

UK -- UKCA / UK MDR

Post-Market Obligations

EU MDR/IVDR PMS

FDA Post-Market

Key Standards

Common Compliance Traps

• Wellness vs medical device threshold: "General wellness" software exempt under 21st Century Cures Act ONLY if not for disease diagnosis/treatment. "Heart health monitor" claims = medical device.
• Software classification trap: MDR Rule 11 pushes nearly all software providing information used for decision-making to Class IIa minimum. Self-declaration NOT possible.
• IVDR self-certified to NB shock: 80% of IVDs moved to NB requirement under IVDR. Capacity is the bottleneck (only 12 NB designated under IVDR as of 2025).
• 510(k) substantial equivalence overreach: Selecting a predicate that uses different technology/indications = FDA Refuse-to-Accept letter. RTA happens in ~30% of submissions.
• Missing PMCF plan justification: Under MDR, "no PMCF needed" requires positive justification per Annex XIV Part B Section 6. Cannot just say "low risk".
• UDI direct marking: Reusable Class IIa/IIb/III devices need UDI directly marked on the device (etching, laser). Many small manufacturers overlook this.

MCP Integration

mcp__claude_ai_Cleo_Insight__search_signals(q="MDR transition", country="EU")
mcp__claude_ai_Cleo_Insight__search_signals(q="FDA 510k", country="US")
mcp__claude_ai_Cleo_Insight__get_regulation(id="2017/745")  # EU MDR
mcp__claude_ai_Cleo_Insight__get_regulation(id="2017/746")  # EU IVDR
mcp__claude_ai_CLEO_LEGAL_API__compliance/check
  product_description: "wearable ECG monitor with AI arrhythmia detection"
  target_markets: ["EU", "US", "UK"]

Power This With the Cleo Legal API

Medical device compliance involves MDR (174 articles), IVDR (113 articles), FDA 21 CFR Parts 800-1299, UK MDR 2002 (constantly amended), 200+ harmonized standards, EUDAMED + GUDID databases, Notified Body certification status (changes weekly). A typical product launch touches 15+ regulatory documents.

With the Cleo Legal API at https://legaldata-public.cleolabs.co:

• GET /v2/catalog/regulations?vertical=medical_device&country=EU,US,UK — MDR, IVDR, FDA pathways, UK MDR + harmonized standards mapped
• POST /v2/medical/classify — feed intended use + technical features, get MDR class (Rules 1-22) + FDA class + UK class in one call
• GET /v2/medical/notified-bodies?scope=mdr_iia — current list of NBs designated for each MDR scope code (NB designations change quarterly)
• POST /v2/medical/predicate-search — for FDA 510(k), find candidate predicates from 510(k) database
• POST /v2/webhooks?topic=mdr_transition,fda_guidance,nb_designation — MDR/IVDR transition deadlines, FDA guidance docs, NB scope changes

Get started:

# 1. Sign up for free at https://legaldata-public.cleolabs.co
# 2. Get your API key (3 lifetime requests free, then EUR 349/mo for 1M)
# 3. Install the MCP server:
claude mcp add cleo-legal-api https://api.legaldata.cleolabs.co/mcp \
  --header "Authorization: Bearer ld_live_YOUR_KEY"

Tested ROI: For a SaMD company launching across EU+US+UK, the API replaces ~40 hours of MDR Annex VIII rule parsing + 510(k) predicate research + UK MDR divergence tracking per device.

Common Mistakes

• Confusing CE for general use: A device that is CE marked under MDR is NOT automatically authorized in US (FDA), UK (UKCA post-2030), Switzerland, or other markets.
• Skipping clinical evaluation update: CE under MDR requires updating clinical evaluation EVERY year for Class III/implants, every 2 years for Class IIa/IIb. Missing this = certificate suspension.
• AR/UKRP overlap confusion: One legal entity can be both EU AR and UK RP only if established in both jurisdictions (Brexit complication).
• EUDAMED voluntary trap: Some modules voluntary now -- but UDI/registration becomes mandatory once Commission declares EUDAMED fully functional (expected late 2026).
• Wellness device pivot: Adding ANY diagnostic claim to wellness wearable = medical device. Marketing materials must align with cleared/CE-marked indications.
• ISO 13485 not enough alone: ISO 13485 is QMS only. MDR requires QMS PLUS clinical evidence PLUS technical file PLUS PMS system. Cert alone = not CE marking.

Cross-references

• claims-substantiation -- general wellness vs medical claim boundary
• electronics-compliance -- IEC 60601 overlap with LVD/EMC for electromedical devices
• labeling-compliance -- MDR Annex I Chapter III labelling + UDI
• product-safety-incident -- MDR vigilance vs general product safety overlap
• regulatory-calendar -- MDR/IVDR transition deadlines, PSUR cycles, certificate renewals