The MDR Compliance Process: 8 Steps to CE Marking
Short answer: Affixing the CE mark to a medical device under the EU MDR (Regulation (EU) 2017/745) runs through eight core steps: (1) qualify the device, (2) classify it, (3) implement an ISO 13485-based quality management system, (4) build the GSPR conformity and risk management file, (5) compile the technical documentation and complete the clinical evaluation, (6) choose the conformity assessment route and (above Class I) apply to a notified body, (7) pass the QMS audit and technical documentation review, (8) sign the declaration of conformity, affix the CE mark, register in EUDAMED/ÜTS, and start post-market surveillance. For a Class IIa/IIb device the typical timeline is 12–24 months.
Key takeaways
- The process is not linear — it is iterative: risk management, clinical evaluation and design verification feed each other.
- The notified body queue is the biggest schedule risk; apply early.
- The most common causes of delay are insufficient clinical evidence and weak GSPR justification.
- Class I devices (except Is/Im/Ir) have no notified body; steps 6–7 shorten.
This article is part of the What is the EU MDR? pillar guide.
Step 1 — Qualify the device and write the intended purpose
What to do: determine whether your product is a medical device (or accessory) within the meaning of MDR Article 2(1). Write the intended purpose with target condition, user, body site, use environment and claimed clinical benefit. For borderline products, use the MDCG borderline manual and, if needed, the competent authority's opinion.
Output: intended purpose statement, qualification rationale. Typical duration: 1–3 weeks. For software: is your software a medical device? (cluster link)
Step 2 — Classify the device (Annex VIII)
What to do: apply the 22 rules in Annex VIII; if several apply, take the highest. The class drives the conformity route, the clinical evidence threshold and the NB scope.
Output: a reasoned classification file (a note for each rule applied or excluded). Typical duration: 1–2 weeks. Detail: medical device classification (cluster link)
Step 3 — Implement the quality management system (ISO 13485 + MDR)
What to do: implement an ISO 13485:2016-based QMS and add MDR-specific procedures: UDI/EUDAMED, PMS/PMCF, vigilance, PRRC, significant-change management, supplier and subcontractor control, and a clinical evaluation procedure.
Output: approved QMS documentation, internal audit and management review records. Typical duration: 4–8 months from scratch. Detail: ISO 13485 and its relationship with the MDR (cluster link)
Step 4 — GSPR conformity and risk management
What to do: for each General Safety and Performance Requirement in Annex I, state applicability, the method of conformity (standard/solution applied) and the evidence (test report, analysis, document reference). In parallel, build the ISO 14971 risk management plan, risk analysis, risk control measures and benefit–risk evaluation. Plan usability (IEC 62366-1) and — where relevant — software (IEC 62304), electrical safety (IEC 60601 series) and biocompatibility (ISO 10993) work.
Output: GSPR checklist, risk management file, verification/validation plan. Typical duration: 3–9 months (depends on testing). Common mistake: generic "complies" statements in the GSPR; an un-updated risk file.
Step 5 — Technical documentation and clinical evaluation
What to do: compile the technical documentation per Annexes II and III: device description and variants, design and manufacturing information, GSPR, benefit–risk and risk management, product verification/validation results, labelling and IFU, PMS/PMCF plan. Conduct the clinical evaluation per Annex XIV and prepare the Clinical Evaluation Report (CER); where equivalence is not defensible, plan a clinical investigation.
Output: complete technical file + CER + PMCF plan. Typical duration: 3–12 months (depends on clinical data need). Common mistake: relying on equivalence without proving contractual access and the technical–biological–clinical equivalence triad.
Step 6 — Conformity route and notified body application
What to do: choose the conformity assessment route by class:
| Class | Typical route |
|---|---|
| I (not Is/Im/Ir) | Self-declaration — no NB |
| Is / Im / Ir | Annex IX Chapters I+III or Annex XI — NB assesses only the relevant aspect |
| IIa | Annex IX (QMS + technical documentation assessment, sampling) or Annex XI |
| IIb | Annex IX or Annex X (type examination) + Annex XI |
| IIb implantable / III | Annex IX (technical documentation/design review per device) or Annex X + XI |
Select a notified body designated under the MDR (confirm its scope covers your device code), obtain a quote, and submit the application file.
Output: signed NB agreement, application package. Typical duration: NB selection + agreement 1–4 months; then audit scheduling. Note: start this step early because of the queue.
Step 7 — QMS audit, technical documentation review and certificate
What to do: the NB reviews your QMS (Stage 1 + Stage 2 audit) and the relevant technical files. You respond to non-conformities (major/minor) and technical documentation deficiencies. For Class III and implantable IIb, a design dossier review is done per device; for certain high-risk devices there is also an expert panel (scrutiny) and — for devices with a medicinal substance — an EMA/competent authority opinion.
Output: MDR certificates (QMS + design/type where required). Typical duration: 3–9 months from audit to certificate, depending on deficiency cycles.
Step 8 — Declaration of conformity, CE mark, registration and post-market surveillance
What to do: draw up and sign the EU Declaration of Conformity, affix the CE mark (with the NB identification number where required). Assign Basic UDI-DI/UDI-DI, update labels, and complete EUDAMED and — in Türkiye — ÜTS registrations. For Class III/implants, publish the SSCP. Run post-market surveillance: PMS plan/report, PSUR, PMCF report, vigilance (serious incident and FSCA reporting), trend reporting.
Output: signed DoC, CE-marked product, completed registrations, a running PMS system. Typical duration: 2–6 weeks (registrations) + ongoing.
Typical timeline (Class IIa/IIb, from scratch)
| Phase | Duration |
|---|---|
| Qualification + classification | 1 month |
| QMS implementation | 4–8 months (parallel) |
| GSPR + risk + testing/validation | 3–9 months |
| Technical file + clinical evaluation | 3–12 months |
| NB application + agreement | 1–4 months (start early) |
| Audit + review + deficiencies + certificate | 4–9 months |
| Total (with overlaps) | ~12–24 months |
Class III or devices needing a clinical investigation take longer. Cost drivers and budget: MDR compliance cost and timeline (cluster link).
Frequently asked questions
Which step slips the most? Usually clinical evaluation (data collection) and notified body deficiency cycles.
Do I need a consultant? Not mandatory. But for teams doing the MDR process for the first time, external expertise for gap analysis and the CER noticeably shortens the timeline. What does an MDR consultant do? (cluster link)
What steps apply to my Class I device? Steps 1–5 are the same; 6–7 do not apply (except Is/Im/Ir); step 8 is self-declaration + registration + PMS.
My test reports were done under the old directive — are they valid? If the test scope and the current version of the standard meet MDR expectations, they are largely usable; gaps may require additional testing.
How MEGACERT helps
We run the whole route end to end: gap analysis, QMS implementation, GSPR and risk file, CER/PMCF and notified body management. Let us draft an 8-step roadmap for your device in a free 30-minute call. → Contact
Sources
- Regulation (EU) 2017/745, in particular Articles 10, 52 and Annexes I, II, III, VIII, IX–XI, XIV. EUR-Lex.
- MDCG 2019-11 (software), MDCG 2020-1 (software clinical evaluation), MDCG 2022-2 (clinical evidence).
- ISO 13485:2016, ISO 14971:2019, IEC 62366-1, IEC 62304, ISO 10993-1.
- European Commission. Medical devices — Getting ready for the new regulations. https://health.ec.europa.eu/medical-devices-sector/new-regulations_en
Last updated: 30 August 2026. General information only; a device-specific roadmap is required.