Frequently asked questions on medical device regulation

The class (I, IIa, IIb or III) is determined using the 22 rules in Annex VIII of Regulation (EU) 2017/745. They take into account the device’s intended purpose, the duration of contact with the body (transient, short-term or long-term), whether it is invasive or implantable, any energy source and the part of the body concerned.

If several rules apply, the strictest one prevails. Classification is the manufacturer’s responsibility and must be justified in the technical documentation; guidance document MDCG 2021-24 explains how to apply it.

As a rule, no: the manufacturer draws up the technical documentation and then issues the EU declaration of conformity itself.

There are three exceptions: devices placed on the market in sterile condition (Is), devices with a measuring function (Im) and reusable surgical instruments (Ir). A notified body is then involved, but only for those aspects.

No. ISO 13485:2016 structures the quality management system and, in its harmonised version, gives a presumption of conformity for the requirements it covers.

The Regulation requires more: a regulatory compliance strategy, clinical evaluation, risk management, technical documentation, unique device identification (UDI), post-market surveillance, vigilance and a person responsible for regulatory compliance. CE marking is based on the conformity assessment of the device itself.

The Regulation has applied since 26 May 2021. Regulation (EU) 2023/607 extended the transitional period for devices covered by a certificate issued under the Directives: until 31 December 2027 for Class III and most Class IIb implantable devices, and until 31 December 2028 for other Class IIb, IIa and Class I devices requiring a notified body.

The extension is conditional: the device must still comply with the Directive, with no significant change in design or intended purpose; the manufacturer had to have a quality management system compliant with the Regulation in place and lodge an application with a notified body before 26 May 2024, then sign a written agreement with it before 26 September 2024.

With a gap assessment: the class of each device under the new rules, gaps in the technical documentation and clinical evaluation, adaptation of the quality management system and the role of each economic operator. This analysis makes it possible to prioritise the work and anticipate the notified body’s timetable.

There is no standard timeframe: it depends on the size of the company, what is already in place and the complexity of the products. Implementation usually takes several months, because the system must have been running long enough to generate records (internal audit, management review, handling of nonconformities).

The certification audit takes place in two stages, a documentation review followed by an on-site audit. The certificate is valid for three years, with a surveillance audit every year and a recertification audit at the end of the cycle.

Article 15 of the Regulation requires manufacturers to have at least one person with the requisite expertise, demonstrated by a qualification and experience in regulatory affairs or quality management systems for medical devices. This person ensures in particular that products are compliant before release, that the technical documentation is kept up to date and that surveillance and vigilance obligations are met.

Micro and small enterprises are not required to employ this person directly, but must have them permanently and continuously at their disposal.

Manufacturers must operate a post-market surveillance system proportionate to the device class: a surveillance plan, then a post-market surveillance report for Class I or a periodic safety update report (PSUR) for Classes IIa, IIb and III, updated at least every two years for Class IIa and every year for Classes IIb and III.

Vigilance requires serious incidents to be reported to the competent authority (ANSM in France) no later than 15 days after becoming aware of them, reduced to 10 days in the event of death or an unanticipated serious deterioration in health, and to 2 days in the event of a serious public health threat.

Articles 13 and 14 of the Regulation require you to check, before making a device available, the CE marking, the EU declaration of conformity, the labelling, the instructions for use and the unique device identification, as well as EUDAMED registration for importers. You must also respect storage and transport conditions, record complaints and inform the manufacturer.

Note that a distributor or importer who markets a device under its own name, changes its intended purpose or modifies it significantly takes on the obligations of a manufacturer (Article 16).

Yes, as early as possible. The claimed intended purpose determines the class, and therefore the certification route, the clinical evaluation strategy and the timetable. Controlling design (clause 7.3 of ISO 13485), risk management (ISO 14971) and, depending on the product, usability or software from the first prototypes avoids having to repeat tests or documentation later.

The start-up pathway describes this support, and Bpifrance’s Diag Dispositif Médical can fund part of it.

The first conversation is about understanding your device, your situation and your deadlines. A tailored proposal is then sent to you. The steps are described in the How an engagement works section, and you can tell me about your project from the Contact page.