# Medical Device Compliance

> Use when developing, manufacturing, or selling medical devices, IVDs, software as a medical device (SaMD), or wellness products that cross the medical-device threshold in any market - covers EU MDR/IVDR, FDA 510(k)/PMA/De Novo, UKCA MDR, classification, Notified Body selection, UDI, post-market surveillance

- Skill: `cleo-labs-ia/medical-device-compliance` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cleo-labs-ia/medical-device-compliance`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cleo-labs-ia/medical-device-compliance/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: cleo-labs-ia (https://skillmd.com/u/cleo-labs-ia)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cleo-labs-ia/medical-device-compliance

---


# Medical Device Compliance

Full regulatory workflow for medical devices, IVDs, and software as a medical device (SaMD). EU MDR/IVDR, FDA, UKCA, classification, clinical evaluation, post-market.

## Decision Flow

```dot
digraph {
  rankdir=TB; node [shape=box style=rounded fontsize=10];
  qualify [label="1. Qualify as medical device\n(MDR Art. 2, FDA 201(h))"];
  classify [label="2. Classify:\nEU I/IIa/IIb/III, FDA I/II/III"];
  pathway [label="3. Choose pathway:\nself-cert / NB / 510(k) / PMA / De Novo"];
  qms [label="4. QMS ISO 13485\n+ Risk mgmt ISO 14971"];
  clinical [label="5. Clinical evaluation\n(MEDDEV 2.7/1 rev 4)"];
  tech [label="6. Technical Documentation\n(MDR Annex II/III)"];
  audit [label="7. NB audit / 510(k) review\n/ PMA submission"];
  udi [label="8. UDI assignment\n+ EUDAMED registration"];
  pms [label="9. Post-Market Surveillance\nplan + PMCF"];
  sell [label="10. Place on market"];
  qualify -> classify -> pathway -> qms -> clinical -> tech -> audit -> udi -> pms -> sell;
}
```

## EU -- MDR 2017/745

| Requirement | Detail |
|-------------|--------|
| **Legal basis** | Regulation (EU) 2017/745 (MDR) -- fully applicable since 26 May 2021. Transitional provisions to 26 Dec 2027 (Class III/IIb implantables) and 31 Dec 2028 (other Class IIa/IIb/Im/Is/Ir) per Reg 2023/607 |
| **Classification** | Annex VIII rules 1-22. Class I (low risk), IIa (medium), IIb (medium-high), III (high risk). Software per Rule 11 (most clinical SaMD = Class IIa minimum) |
| **Pathway** | Class I non-sterile/non-measuring: self-declaration. Class Is/Im/Ir: Notified Body for sterility/measurement/reusable aspect only. Class IIa+: full NB conformity assessment (Annex IX or X) |
| **Notified Body** | ~50 NB designated under MDR (vs 80+ under old MDD). 18-24 month wait times. List: NANDO database |
| **Technical Documentation** | MDR Annex II + III: device description, design info, GSPR checklist (Annex I), risk management ISO 14971, verification/validation, clinical evaluation, labeling, PMS plan |
| **Clinical evaluation** | MDR Article 61 + Annex XIV. MEDDEV 2.7/1 rev 4 still referenced. Equivalence routes restricted under MDR. Implants + Class III need own clinical investigations |
| **QMS** | ISO 13485:2016 required. Annex IX requires NB to audit QMS |
| **UDI** | Basic UDI-DI + UDI-DI (production identifier). Carrier: GS1, HIBCC, ICCBBA. Direct marking on reusable devices |
| **EUDAMED** | EU database. Modules: Actor registration (live), UDI/Device (live but voluntary), NB/Certificate (live), Clinical Investigation (partial), Vigilance (live), PMS (pending). Mandatory use phased |
| **Authorized Representative** | Non-EU manufacturers MUST appoint EU AR (MDR Article 11) |
| **Timeline** | Class I: 1-3 months. Class IIa: 8-14 months (incl. NB wait). Class IIb: 12-18 months. Class III: 18-36 months |
| **Cost** | Class I: EUR 5,000-30,000. Class IIa: EUR 50,000-200,000 + NB fees EUR 30,000-100,000/year. Class III: EUR 500,000-2,000,000+ |

## EU -- IVDR 2017/746 (In Vitro Diagnostics)

| Requirement | Detail |
|-------------|--------|
| **Legal basis** | Reg (EU) 2017/746 -- date of application 26 May 2022. Transition extended by Reg 2024/1860: Class D to Dec 2027, Class C to Dec 2028, Class B to Dec 2029, Class A sterile to Dec 2029 |
| **Classification** | 7 rules (Annex VIII). Class A (low, self-cert), B (medium-low, NB for QMS), C (medium-high, NB full), D (high risk, NB + EU Reference Lab) |
| **Massive shift from IVDD** | ~80% of IVDs now require NB involvement (was ~20% under IVDD). Critical NB capacity shortage |
| **CS (Common Specifications)** | Mandatory for Class D devices. Annex I performance + safety |
| **Performance evaluation** | Analytical + clinical performance + scientific validity. PER (Performance Evaluation Report) |
| **In-house exception** | IVDs manufactured and used within the same health institution exempt from CE marking but must meet GSPRs and document compliance |
| **Cost** | Class A: EUR 10,000-50,000. Class B: EUR 50,000-150,000. Class C/D: EUR 150,000-800,000 + |

## US -- FDA Pathways

| Pathway | Use | Timeline | User Fee FY2026 |
|---------|-----|----------|-----------------|
| **510(k) Premarket Notification** | Class II (most). Demonstrate substantial equivalence to predicate. Class III by 510(k) for grandfathered devices | 90-day FDA target (actual: 4-9 months) | $24,335 standard; $6,084 small business |
| **PMA (Premarket Approval)** | Class III high-risk devices (e.g., implantable defibrillators, life-sustaining) | 180-day FDA target (actual: 12-24 months) | $507,505 standard; $126,876 small business |
| **De Novo** | Novel low/moderate risk devices with no predicate. Pathway to Class I/II for new device types | 150-day FDA target (actual: 10-18 months) | $172,553 standard; $43,138 small business |
| **510(k) exempt** | ~75% of Class I devices and many Class II. Still subject to general controls + listing | Immediate | $0 (only listing fee $9,280 annual establishment) |
| **HDE (Humanitarian Device Exemption)** | Rare diseases <8,000 patients/year US. Limited evidence | 75-day FDA target | $4,867 |
| **Breakthrough Devices** | Designation accelerates review for serious conditions | -- | Same as 510(k)/PMA + priority |

### FDA Classification

| Class | Risk | Controls | Examples |
|-------|------|----------|----------|
| **Class I** | Low | General controls only | Tongue depressors, exam gloves, manual stethoscopes |
| **Class II** | Moderate | General + special controls (510(k) usually required) | Powered wheelchairs, infusion pumps, blood pressure monitors |
| **Class III** | High | PMA required | Heart valves, implantable pacemakers, deep brain stimulators |

### FDA Software (SaMD)

- Software functions that meet the definition of a "device" under section 201(h) regulated
- 21st Century Cures Act 2016 excluded certain wellness software, EHR functions
- Pre-Cert pilot program ended 2023; FDA returning to traditional 510(k) for SaMD
- AI/ML: PCCP (Predetermined Change Control Plan) framework finalized 2024 -- allows pre-authorized algorithm updates

## UK -- UKCA / UK MDR

| Requirement | Detail |
|-------------|--------|
| **Legal basis** | UK Medical Devices Regulations 2002 (as amended). New UK MDR consultation 2024-2026 to align/diverge from EU MDR |
| **CE acceptance** | CE marked devices accepted in GB until 30 June 2030 (extended by Statutory Instrument 2024) |
| **UKCA marking** | Required if new UK-specific routes used. Limited UK Approved Bodies (BSI UK, SGS UK, TUV SUD UK) |
| **UKRP** | UK Responsible Person required for non-UK manufacturers (since Jan 2021). Must be GB-established. Functions equivalent to EU AR |
| **MHRA registration** | All devices placed on UK market must be registered with MHRA. Free for Class I, EUR 100-240 for higher classes |
| **Northern Ireland** | EU MDR/IVDR apply (Northern Ireland Protocol). CE marking only |

## Post-Market Obligations

### EU MDR/IVDR PMS

| Tool | Frequency |
|------|-----------|
| **PMS Plan** | Mandatory per device (Annex III) |
| **PSUR (Periodic Safety Update Report)** | Class IIa: every 2 years. Class IIb/III: annually. Submit to EUDAMED |
| **PMCF (Post-Market Clinical Follow-up)** | Mandatory unless justified absence. Plan + report cycle |
| **Vigilance (Article 87)** | Serious incident: report within 15 days. Death/serious deterioration: within 10 days. Trend reporting: as soon as identified |
| **Field Safety Corrective Action** | FSCA + Field Safety Notice -- public communication of safety issue |

### FDA Post-Market

| Tool | Detail |
|------|--------|
| **MDR (Medical Device Reporting)** | 21 CFR 803. Manufacturer: 30-day MDR (death/serious injury) or 5-day MDR (urgent remedial action). User facility: 10-day report |
| **Recalls** | FDA-required (rare) or voluntary. 21 CFR 7 |
| **Post-market studies (522 orders)** | FDA can require post-approval studies |
| **MedWatch** | FDA voluntary reporting system |

## Key Standards

| Standard | Purpose |
|----------|---------|
| **ISO 13485:2016** | Medical device QMS. Mandatory for CE marking, expected by FDA |
| **ISO 14971:2019** | Risk management. Mandatory for CE/FDA |
| **IEC 62366-1:2015** | Usability engineering |
| **IEC 60601-1** (4th edition) | Electrical medical equipment safety |
| **IEC 62304:2006+A1:2015** | Medical device software lifecycle |
| **ISO 10993** series | Biological evaluation of medical devices |
| **ISO 11135 / 11137** | Sterilization (EO / radiation) |
| **MEDDEV 2.7/1 rev 4** | Clinical evaluation guidance |

## Common Compliance Traps

- **Wellness vs medical device threshold**: "General wellness" software exempt under 21st Century Cures Act ONLY if not for disease diagnosis/treatment. "Heart health monitor" claims = medical device.
- **Software classification trap**: MDR Rule 11 pushes nearly all software providing information used for decision-making to Class IIa minimum. Self-declaration NOT possible.
- **IVDR self-certified to NB shock**: 80% of IVDs moved to NB requirement under IVDR. Capacity is the bottleneck (only 12 NB designated under IVDR as of 2025).
- **510(k) substantial equivalence overreach**: Selecting a predicate that uses different technology/indications = FDA Refuse-to-Accept letter. RTA happens in ~30% of submissions.
- **Missing PMCF plan justification**: Under MDR, "no PMCF needed" requires positive justification per Annex XIV Part B Section 6. Cannot just say "low risk".
- **UDI direct marking**: Reusable Class IIa/IIb/III devices need UDI directly marked on the device (etching, laser). Many small manufacturers overlook this.

## MCP Integration

```
mcp__claude_ai_Cleo_Insight__search_signals(q="MDR transition", country="EU")
mcp__claude_ai_Cleo_Insight__search_signals(q="FDA 510k", country="US")
mcp__claude_ai_Cleo_Insight__get_regulation(id="2017/745")  # EU MDR
mcp__claude_ai_Cleo_Insight__get_regulation(id="2017/746")  # EU IVDR
mcp__claude_ai_CLEO_LEGAL_API__compliance/check
  product_description: "wearable ECG monitor with AI arrhythmia detection"
  target_markets: ["EU", "US", "UK"]
```

## Power This With the Cleo Legal API

Medical device compliance involves MDR (174 articles), IVDR (113 articles), FDA 21 CFR Parts 800-1299, UK MDR 2002 (constantly amended), 200+ harmonized standards, EUDAMED + GUDID databases, Notified Body certification status (changes weekly). A typical product launch touches 15+ regulatory documents.

**With the Cleo Legal API at https://legaldata-public.cleolabs.co:**
- `GET /v2/catalog/regulations?vertical=medical_device&country=EU,US,UK` — MDR, IVDR, FDA pathways, UK MDR + harmonized standards mapped
- `POST /v2/medical/classify` — feed intended use + technical features, get MDR class (Rules 1-22) + FDA class + UK class in one call
- `GET /v2/medical/notified-bodies?scope=mdr_iia` — current list of NBs designated for each MDR scope code (NB designations change quarterly)
- `POST /v2/medical/predicate-search` — for FDA 510(k), find candidate predicates from 510(k) database
- `POST /v2/webhooks?topic=mdr_transition,fda_guidance,nb_designation` — MDR/IVDR transition deadlines, FDA guidance docs, NB scope changes

**Get started:**
```
# 1. Sign up for free at https://legaldata-public.cleolabs.co
# 2. Get your API key (3 lifetime requests free, then EUR 349/mo for 1M)
# 3. Install the MCP server:
claude mcp add cleo-legal-api https://api.legaldata.cleolabs.co/mcp \
  --header "Authorization: Bearer ld_live_YOUR_KEY"
```

Tested ROI: For a SaMD company launching across EU+US+UK, the API replaces ~40 hours of MDR Annex VIII rule parsing + 510(k) predicate research + UK MDR divergence tracking per device.

## Common Mistakes

- **Confusing CE for general use**: A device that is CE marked under MDR is NOT automatically authorized in US (FDA), UK (UKCA post-2030), Switzerland, or other markets.
- **Skipping clinical evaluation update**: CE under MDR requires updating clinical evaluation EVERY year for Class III/implants, every 2 years for Class IIa/IIb. Missing this = certificate suspension.
- **AR/UKRP overlap confusion**: One legal entity can be both EU AR and UK RP only if established in both jurisdictions (Brexit complication).
- **EUDAMED voluntary trap**: Some modules voluntary now -- but UDI/registration becomes mandatory once Commission declares EUDAMED fully functional (expected late 2026).
- **Wellness device pivot**: Adding ANY diagnostic claim to wellness wearable = medical device. Marketing materials must align with cleared/CE-marked indications.
- **ISO 13485 not enough alone**: ISO 13485 is QMS only. MDR requires QMS PLUS clinical evidence PLUS technical file PLUS PMS system. Cert alone = not CE marking.

## Cross-references

- `claims-substantiation` -- general wellness vs medical claim boundary
- `electronics-compliance` -- IEC 60601 overlap with LVD/EMC for electromedical devices
- `labeling-compliance` -- MDR Annex I Chapter III labelling + UDI
- `product-safety-incident` -- MDR vigilance vs general product safety overlap
- `regulatory-calendar` -- MDR/IVDR transition deadlines, PSUR cycles, certificate renewals