IVDR Lab Readiness: Step-by-Step Transition Checklist

The IVDR Shift and What It Means for Clinical Laboratories

The in Vitro Diagnostic Regulation (IVDR) (EU) 2017/746 came into force on 26 May 2022, representing a paradigm shift for diagnostic testing in Europe. Its purpose is clear: ensure safety, traceability, and performance of all in vitro diagnostic devices (IVDs). Unlike its predecessor, the IVDD (98/79/EC), the IVDR applies far-reaching obligations not only to manufacturers but also to clinical laboratories that develop and use their own in-house IVDs (IH-IVDs).

A cornerstone of this new landscape is Article 5(5), which sets conditions under which health institutions may continue manufacturing and using in-house devices without CE marking. While this exemption acknowledges the clinical need for tailored diagnostics, it also imposes new responsibilities.

This blog provides a step-by-step readiness checklist for laboratories to guide you through the transition.

What exactly is an in-house IVD under the IVDR?

An in-house IVD (sometimes called a laboratory-developed test or LDT) is any in vitro diagnostic device manufactured and used only within a health institution, not supplied to another legal entity, and not manufactured on an industrial scale

Examples include:

  • PCR assays where the lab develops its own probes.
  • Custom-developed software tools for diagnostic interpretation.

Excluded are:

  • General laboratory supplies.
  • RUO (research use only) products – unless repurposed for diagnostic use. If an RUO product is used for diagnostic purposes (i.e., results are communicated to the patient for medical decision-making), it ceases to be RUO and must comply with IVDR Article 5(5), thereby becoming subject to the same obligations as an in-house IVD/LDT.
  • Commercially available CE-marked IVDs (which must be purchased and used as intended) – unless it is modified, combined or used outside it’s intended purpose.

You must determine whether you are using an in-house IVD. If you are modifying, combining, or using CE-marked diagnostic tests outside their intended purpose, or if you are repurposing RUO products for diagnostic use, you must ensure compliance with Article 5(5).

Who is entitled to the Article 5(5) exemption?

Only health institutions may use in-house IVDs. According to the IVDR, a health institution is an organization whose primary purpose is patient care or public health. This includes:

  • Hospitals
  • Clinical laboratories
  • Public health institutes

Importantly, the recognition of health institutions may depend on national legislation. For instance, some countries require formal registration or accreditation to benefit from Article 5(5).

Always check your national laws to confirm whether your laboratory qualifies as a “health institution” and whether additional national restrictions or obligations apply.

Should your lab buy CE-marked tests or continue with in-house ones?

Under IVDR, labs face a strategic decision:

  • Purchase CE-marked IVDs: These carry regulatory assurance but may not always exist for niche diagnostic needs, and market withdrawals could limit supply.
  • Develop and use in-house IVDs: Allowed under Article 5(5) if your lab demonstrates compliance with conditions (e.g., GSPR, QMS, technical documentation).

From 31 December 2030, labs must justify why an equivalent CE-marked device is not suitable if they want to continue using their in-house test (article 5(5)(g))

Begin analyzing your portfolio now. Which tests could be replaced by CE-IVDs, and which must remain in-house due to clinical need?

What technical documentation requirements already apply?

Since 26 May 2022, all in-house devices must comply with Annex I of the IVDR (GSPR). This includes:

  • Risk management system covering patient, user, and use error risks.
  • Performance evaluation based on scientific validity, analytical performance, and clinical performance.
  • Traceability and identification (lot numbers, production dates).
  • Appropriate instructions for use and safety information

Treat your in-house tests with the same rigor as CE-marked devices. Maintain documentation to always prove compliance with the GSPRs.

What does IVDR require for quality management when operating under article 5.5?

Since 26 May 2024, labs must manufacture and use in-house devices under an appropriate Quality Management System (QMS). For in-house IVDs, this generally means compliance with EN ISO 15189 or equivalent national provisions

However, note:

  • ISO 15189 covers quality in medical laboratories but not necessarily manufacturing processes.
  • Therefore, supplement with elements of ISO 13485 for design and production control.
  • In addition, laboratories must address the QMS requirements described in Article 10(8) IVDR, which outline the minimal aspects of a system covering risk management, manufacturing documentation, monitoring, corrective actions, and communication with authorities.

Expand your QMS to cover risk management, manufacturing documentation, monitoring, and corrective actions, and the additional QMS obligations set out in Article 10 IVDR. Note that ISO 15189 alone is not sufficient; relevant elements of design and manufacturing from ISO 13485 must also be considered, as the IVDR introduces further QMS requirements that must be fulfilled.

Do labs need to publish information about their in-house devices?

Article 5(5)(f) IVDR requires health institutions to draw up and make publicly available a declaration for each in-house device. This obligation has applied since 26 May 2024, following the end of the initial transition period.

What must the declaration contain? At minimum:

  • Name and address of the health institution manufacturing the device.
  • Details necessary to identify the device (e.g., designation, type, internal code).
  • A declaration of compliance with Annex I (GSPR), or where full compliance is not possible, a reasoned justification explaining the deviations.
  • Confirmation that the device is manufactured under an appropriate QMS.

This declaration must be kept up to date and made easily accessible, typically via the laboratory or hospital’s website This transparency ensures accountability and facilitates oversight.

Prepare standardized declarations for each in-house device. A practical tool exists: the IVDR Taskforce Guidance on LDTs (2020) provides a template (Appendix B) for the declaration that can be directly adapted by laboratories.

What role do regulators play?

Competent authorities may request documentation or even audit your lab to verify compliance. Labs must be prepared to show:

  • Design, manufacturing, and performance documentation of their in-house devices.
  • Clinical justification for developing or using the test instead of a CE-marked alternative.
  • Ongoing performance review and vigilance records, including corrective actions and monitoring of clinical use.
  • Evidence of an appropriate Quality Management System (QMS), as required since 26 May 2024.

The degree of oversight varies across Member States. For example, Belgium and Ireland already operate registration portals where laboratories must register their in-house tests. In other countries, legislation is still under development (Spain) or practices remain vague.

Anticipate audits. Keep a compliance file for each in-house IVD.

What happens in 2030?

From 31 December 2030, labs must justify why the specific needs of their target patient group cannot be met by a CE-marked device – Article 5(5)(g).

This justification may be based on:

  • Technical aspects (e.g., higher sensitivity).
  • Biological aspects (e.g., pediatric vs adult reference ranges).
  • Clinical needs (e.g., unmet diagnostic gaps).

Start now by mapping your portfolio and identifying tests likely to face challenges in proving non-equivalence.

Why are many labs struggling?

Challenges highlighted in recent analyses include:

  • Lack of dedicated regulatory staff.
  • Limited time and budget for documentation.
  • Unfamiliarity with regulatory terminology.

Seek structured support, whether through consultants, digital tools, or peer networks, to avoid non-compliance.

Step 1: Perform a GAP Assessment

  • Map your current situation: List all in-house IVDs and how they are used in your lab.
  • Check national status: Verify if your institution qualifies as a “health institution” under national law, and review whether national legislation imposes additional obligations such as mandatory QMS accreditation (e.g., ISO 15189), registration of in-house IVDs with competent authorities, or other reporting requirements that go beyond the IVDR.
  • Compare requirements vs. practice: Review the IVDR Article 5(5) obligations and identify where your lab already complies (e.g., risk management, traceability) and where gaps exist (e.g., QMS documentation, technical documentation).
  • Prioritize risks: Highlight critical areas (such as missing QMS procedures or incomplete Annex I documentation) that could block compliance in an inspection.

Step 2 – Take Action to Close the Gaps

  • Strategic choice: Decide whether to replace tests with CE-IVDs or maintain in-house versions. Document the rationale.
  • Annex I (GSPR): Ensure all in-house IVDs comply with General Safety and Performance Requirements (effective since 26 May 2022).
  • Quality Management System: Implement or update your QMS to align with ISO 15189, supplemented with elements from ISO 13485 and Article 10(8) IVDR.
  • Compliance documentation & oversight readiness: Compile and maintain a compliance file for each in-house IVD, including full technical documentation (design, manufacturing, risk management, and performance evaluation). Ensure these files are audit-read and can be provided upon request by competent authorities.
  • Vigilance & corrective actions: Set up procedures for monitoring performance, handling incidents, and implementing corrective/preventive measures.
  • Public declaration: Draft and publish a declaration for each in-house device (mandatory since 26 May 2024). Use available templates from guidance.
  • 2030 justification: Start documenting why no equivalent CE-IVD meets the needs of your patient population to support continued in-house use after 31 December 2030.

Closing Thoughts

The IVDR sets high expectations for laboratory-developed in-house IVDs, transforming informal diagnostic practices into rigorously controlled processes. While compliance requires effort, resources, and cultural change, it also strengthens quality, safety, and patient trust. For laboratories, the transition is not optional, it is an opportunity to embed regulatory excellence into daily operations and secure the future of innovative diagnostics. Are you ready for the IVDR transition? Start today with a gap analysis, QMS reinforcement, and documentation plan. The earlier you act, the smoother your path to compliance will be.

At MDx CRO, we specialize in helping clinical laboratories navigate the IVDR, from gap assessments to QMS implementation and technical documentation. We support laboratories in demonstrating compliance with Article 5(5) for in-house IVDs by assisting with:

  • Gap assessments: Mapping all in-house IVDs, comparing current practice with IVDR Article 5(5) requirements, and identifying compliance gaps.
  • QMS alignment: Extending ISO 15189-based systems with manufacturing and design elements from ISO 13485, plus additional QMS obligations under IVDR.
  • Technical documentation: Preparing complete compliance files per device.
  • Public declarations: Drafting and publishing Article 5(5)(f) declarations using recognized templates, ensuring accessibility and consistency.
  • Regulatory readiness: Preparing for competent authority oversight, including audits and requests for documentation.
  • Strategic portfolio decisions: Advising whether to replace tests with CE-IVDs or justify continued in-house use, including preparing 2030 equivalence justifications.
  • Vigilance systems: Setting up monitoring, incident reporting, and corrective/preventive actions in line with IVDR obligations.

Our team knows the pitfalls and the solutions. Let us support you in achieving full compliance. Contact us today to discuss how we can help.

Written by:
Hugo Leis, PhD

Hugo Leis, PhD

Training & Quality Manager

Quality & Training Manager and Senior IVDR consultant with expertise in CE marking, Clinical Laboratories, SaMD, Precision Medicine, Quality Assurance, and academic lecturing.
Industry Insights & Regulatory Updates

ISO 13485 Implementation Guide: How to Stand Up a World-Class QMS (and Win Faster Market Access)

For MedTech and diagnostics companies, ISO 13485:2016 is the operating system for quality. It’s the globally recognized standard that regulators and notified bodies expect you to use to design, manufacture, and maintain safe, effective devices across the full lifecycle. Implement it well and you accelerate technical documentation, reduce rework, and shorten time-to-market. Implement it poorly and every audit, change, and submission becomes harder than it should be.

There’s an additional strategic reason to act now: the U.S. FDA’s Quality Management System Regulation (QMSR) formally converges 21 CFR 820 with ISO 13485:2016. The QMSR’s effective date is February 2, 2026, with a two-year transition from the legacy QS Reg—so a robust ISO 13485 QMS positions you for both EU and U.S. expectations. (QMSR overview PDF).

What ISO 13485 actually requires (and how to build it right)

At its core, ISO 13485 demands a documented, controlled set of interrelated processes that meet regulatory requirements for medical devices—from design and production to post-market activities. Success is not about templates; it’s about process architecture, risk-based decision-making, and evidence you can defend. (ISO 13485 handbook preview).

1) Map your process architecture

Start with a top-level map that shows how design & development, purchasing/supplier control, production & service provision, software validation (for QMS and process software), vigilance, and post-market processes interact. Keep ownership clear; keep inputs/outputs traceable.

2) Make risk management the backbone

ISO 13485 expects risk-based controls throughout realization and post-market feedback. Operationalize ISO 14971:2019 (and ISO/TR 24971 guidance) so hazards, risk controls, and residual risk tie directly into design inputs, verification/validation, and change control.

3) Design controls that satisfy NB and FDA reviewers

Build a single D&D framework that covers planning, inputs/outputs, reviews, verification, validation (including clinical/performance where applicable), transfer, and DHF/Design History File traceability. Link your design plans to intended purpose/indications so your technical documentation aligns with MDR/IVDR and (when applicable) FDA submissions.

4) Supplier & software rigor

Qualify and monitor critical suppliers with risk-based controls; embed incoming inspection and performance metrics. Validate QMS/production software proportional to risk and document configuration management so you can pass objective evidence reviews.

5) Document control that scales

Use a lean document hierarchy (policy → process → work instruction → form) and number it so auditors can navigate quickly. Automate change control and training effectiveness checks; link each controlled record to the process requirement it satisfies.

6) Post-market surveillance that drives improvement

Your PMS loop should systematically capture complaints, feedback, vigilance, field actions, and real-world performance. Close the loop with CAPA and management review using trend analysis and risk re-evaluation.

7) Internal audits and management review that add value

Audit for process performance (not just procedural conformance). Track effectiveness KPIs and feed them into management review alongside regulatory metrics (e.g., NB queries, submission outcomes, vigilance timelines).

EU alignment matters: harmonized EN ISO 13485 and MDR/IVDR

In Europe, EN ISO 13485:2016 (including A11:2021 and AC:2018) is recognized as a harmonized standard supporting MDR/IVDR requirements—useful for presumption of conformity where applicable. Aligning your QMS to the harmonized edition reduces friction in notified body assessments and surveillance.

Implementation roadmap (what works in the real world)

  • Phase 1 — Gap Assessment & Plan: Benchmark current practices against ISO 13485 clauses, ISO 14971 integration points, and your market strategy (EU MDR/IVDR, FDA QMSR). Produce a prioritized remediation plan with owners and dates.
  • Phase 2 — Process Build & Evidence: Draft/revise procedures; pilot them with one product line to generate real records (design plan, risk files, supplier files, software validation, training, internal audit).
  • Phase 3 — System Activation: Roll out across programs; execute internal audit cycle and management review with measurable outcomes.
  • Phase 4 — NB/FDA Readiness: Run a mock audit; fix systemic findings; align technical documentation index to QMS records; confirm personnel qualification and training effectiveness.

Avoid the top 5 pitfalls we see

  • Building dozens of procedures without a process map (auditors get lost; so do teams).
  • Treating risk management as a document, not a process that drives design and post-market decisions.
  • Weak supplier controls for critical components and software.
  • Software validation that stops at IQ/OQ and misses real-world configurations.
  • “One-and-done” internal audits that don’t test effectiveness or feed CAPA.

How MDx CRO makes ISO 13485 implementation faster (and audit-proof)

MDx CRO designs right-sized 13485 systems for MedTech and diagnostics teams—from first-time implementations to remediation before NB or FDA inspections. We build the process architecture, author and train on lean SOPs, integrate ISO 14971 risk into day-to-day decision-making, and generate submission-ready evidence. Then we run mock audits that mirror NB/FDA styles so you walk into the real thing prepared.

Explore Regulatory & Quality Services and Clinical & Post-Market Support, or contact MDx CRO to scope your ISO 13485 program.

Industry Insights & Regulatory Updates

A Step-by-Step Guide to IEC 62366 and Usability Engineering

The usability of medical devices is not just a matter of convenience. It is a matter of safety, effectiveness, and regulatory compliance. Poor design that confuses or frustrates users can lead to use errors, adverse events, and even patient harm. To address this, the international standard IEC 62366-1:2015/Amd 1:2020 establishes a structured framework for usability engineering in medical device development.

For medical device manufacturers, understanding and applying IEC 62366 is essential. Compliance demonstrates that usability risks have been identified, reduced, and documented, which is essential for all medical devices including IVDs and Software as a Medical Device (SaMD).

What Is IEC 62366?

IEC 62366 is the internationally recognised standard that defines how to integrate usability into the design and development process.

It has two main parts:

  • IEC 62366-1:2015/Amd 1:2020 Medical devices – Application of usability engineering to medical devices: The core standard describing the usability engineering process.
  • IEC/TR 62366-2:2016 Medical devices – Guidance on the application of usability engineering to medical devices: A technical report providing guidance and examples to support implementation.

The goal is to ensure that usability engineering is applied consistently so that devices can be used safely and effectively by intended users, in intended use environments, while ensuring that use errors that could lead to harm are identified, reduced, and controlled through structured usability activities.

Why Usability Engineering Matters

Use-related errors are a leading cause of device-related adverse events. By embedding usability engineering into product development, manufacturers can:

  • Reduce use errors that could lead to harm
  • Improve patient safety and treatment outcomes
  • Satisfy regulatory requirements from the MDR, IVDR, and FDA
  • Increase user acceptance and market success
  • Lower long-term costs by avoiding redesigns or recalls

In short, usability is both a compliance requirement and a competitive advantage.

Step-by-Step Guide to Applying IEC 62366

The usability engineering process defined in IEC 62366 is systematic and iterative. It integrates into the overall product development lifecycle and risk management process in line with ISO 14971. Below is a step-by-step breakdown.

Step-by-step visual guide illustrating the IEC 62366 usability engineering process for medical devices, covering intended use definition, hazard identification, risk analysis, user interface requirements, formative evaluations, and summative usability validation, aligned with EU MDR and FDA human factors guidelines.

The UEF is the central documentation repository for all usability activities. It includes intended use, user profiles, use scenarios, hazard analysis, test results, and risk control measures. In practice, the records and other documents that form the UEF may also form part of the product design file (ISO 13485) or the risk management file (ISO 14971).

Think of the UEF as both a project management tool and evidence for regulators.

Prepare the Use Specification. This is where you define:

  • The intended medical purpose of the device
  • The user groups (e.g. clinicians, patients, laypersons, caregivers)
  • The use environments (hospitals, homes, ambulances, clinics)
  • Any training or expertise required

This forms the foundation of all subsequent usability activities.

Once you know who will use your device and where, the next step is to analyse how things could go wrong.

Activities include:

  • Identifying safety-related user interface characteristics (e.g. readability of displays, button layout, alarm visibility).
  • Reviewing post-production data and public databases for known usability issues with similar devices.
  • Identifying hazards and hazardous situations.
  • Identifying and describing hazard-related use scenarios, which describe exactly how use errors might occur and what consequences they could have.
  • Selecting hazard-related use scenarios for Summative Evaluation.

These scenarios are then prioritised to decide which will be evaluated in summative testing.

This is where design and usability testing happen in iterative cycles.

Key steps:

  1. Establish the User Interface Specification – the blueprint of all UI elements.
  2. Develop the User Interface Evaluation Plan – define how formative and summative testing will be performed.
  3. Iterative cycles of concept, prototype, and testing

The point of formative evaluation is to find usability issues early, before final validation, so changes are cheaper and less disruptive.

The final stage is a summative usability validation. This is a formal test that demonstrates to regulators that the device can be used safely and effectively by the intended users.

  • Test the hazard-related use scenarios identified earlier.
  • Use representative users in realistic environments.
  • Collect both objective performance data (task completion, error rates) and subjective feedback (ease of use, confidence).
  • Confirm that residual risks are acceptable in line with ISO 14971.

This stage provides the objective evidence regulators require to ensure compliance.

Usability engineering does not end at product launch. Post-market surveillance should collect feedback on usability issues, adverse events, and complaints. Updates or design changes may be required if new risks emerge.

Common Challenges in Applying IEC 62366

Many manufacturers encounter difficulties such as:

  • Underestimating resources needed for usability testing
  • Recruiting representative users for formative and validation studies
  • Defining realistic use scenarios that reflect actual clinical environments
  • Integrating usability with development timelines
  • Documenting evidence properly in the UEF

Failing to address these challenges can result in regulatory rejection, delays, or costly redesigns.

Best Practices for Success

  1. Start usability engineering early in the design process
  2. Involve multidisciplinary teams including engineers, clinicians, and usability experts
  3. Use a mix of qualitative and quantitative methods in evaluations
  4. Prioritise hazard-related use scenarios in validation testing
  5. Document everything thoroughly in the Usability Engineering File
  6. Where possible involve regulators early for alignment
  7. Leverage specialist expertise such as a Medical Device and IVD Consultancy with usability engineering experience

How MDx CRO Can Help

Implementing IEC 62366 in-house can strain resources. At MDx CRO we can provide:

  • Protocol development and study design for usability testing
  • Recruitment of representative users across geographies
  • Moderation of formative and validation studies
  • Integration of usability engineering with regulatory strategy
  • Preparation of all usability documentation required for submissions including FDA submissions

As a trusted Medical Device and IVD consultancy, we support manufacturers in implementing IEC 62366, running usability studies, and preparing documentation that satisfies both EU and US regulators. Whether you are starting a new project or updating an existing device, our team helps you achieve compliance and deliver safer devices to market.

Does the FDA also recognise IEC 62366?

Yes. The latest versions of the IEC 62366 standards are recognised by the FDA as consensus standards. However, the FDA has also published specific human factors engineering guidances with minor differences to IEC 62366 so it is recommended that these are also considered for FDA submissions.

When should usability testing be performed?

Throughout development. Formative evaluations identify and correct issues early, while summative validation confirms safe and effective use before market approval.

Can simulated environments be accepted in usability validation?

Yes, provided they are representative of real-world conditions and cover all critical tasks and hazard-related use scenarios.

Written by:
Floella Otudeko

Floella Otudeko

Senior QARA Specialist

Senior QA/RA consultant with MDR, IVDR, Usability/Human Factors and MDSW expertise, supporting MedTech and IVD innovation globally.
Industry Insights & Regulatory Updates

SaMD Compliance Guide: Navigating Regulations for Software as a Medical Device

In an era where digital health, telemedicine, and AI-driven diagnostics are becoming mainstream, Software as a Medical Device (SaMD) is no longer a niche concept; it stands as a core pillar of modern healthcare innovation. Yet, delivering a safe, effective, and compliant SaMD product in Europe requires careful navigation of complex regulatory regimes.

For companies and regulatory affairs teams, successful market access in the European Union means meeting the demands of the EU Medical Device Regulation (MDR, Regulation (EU) 2017/745) and, increasingly, the EU Artificial Intelligence Act (AI Act, Regulation (EU) 2024/1689). Together, this combined regime shapes how developers design, validate, monitor, and maintain software with medical functionality.

This SaMD Compliance Guide presents a concise, European-focused overview. You’ll find:

  • How to determine if your software qualifies as SaMD
  • Key requirements under the MDR (classification, conformity, clinical evaluation, post-market)
  • Best practices, pitfalls, and strategic recommendations

1. Defining SaMD: What Qualifies?

What is SaMD?

The International Medical Device Regulators Forum (IMDRF) defines SaMD as:
“Software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device.”

In the EU context, and based on MDCG 2019-11, software qualifies as a medical device when the manufacturer’s intended purpose includes diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of disease.

Key determinants

  • Intended medical function (not administrative, not purely wellness)
  • Standalone operation; the software does not need to embed in medical hardware
  • Potentially autonomous action (e.g., cloud-based analysis)

Examples (and non-examples)

Typical SaMD examples

  • An AI-based image analysis tool that assists radiologists in detecting tumors
  • A mobile app that predicts hypoglycemic events for diabetic patients
  • A cloud algorithm that classifies ECG signals to detect arrhythmias

Non-SaMD (or out-of-scope) software

  • A healthcare facility’s scheduling or billing software
  • A fitness tracker app for general wellness (unless marketed for disease diagnosis)
  • A general-purpose image viewer used in the clinic but not intended for diagnosis

Because the line can be subtle, regulatory teams should document a short justification for whether software is—or is not—a medical device, supported by functional claims, labeling, and architecture.

2. The EU MDR Framework for SaMD

Classification: Rule 11 for Software

Annex VIII of MDR includes Rule 11, which addresses software risk classification. Under Rule 11:

  • If the software informs decisions for diagnostic or therapeutic purposes, it often lands in Class IIa, IIb, or even Class III, depending on risk and the consequences of error.
  • If the software monitors physiological processes, it may fall in Class IIa or IIb.
  • Software intended for administrative or non-medical functions typically falls in Class I.

Because many advanced SaMD tools now trigger Notified Body oversight, developers should plan conformity assessments, clinical evaluation, and documentation accordingly.

The MDR Compliance Roadmap

To achieve CE marking under MDR, follow these essential steps:

  • Intended Purpose & Use Context – Define the intended medical purpose, user groups, environment, contraindications, and usage scenarios with precision.
  • Risk Management (ISO 14971) – Identify hazards and mitigate risks, including software bugs, algorithm drift, cybersecurity intrusion, and data errors. Manage risk across the full lifecycle (design, validation, deployment, maintenance).
  • Quality Management (ISO 13485) – Operate under a QMS that addresses design control, configuration management, change control, CAPA, and supplier management.
  • Software Lifecycle (IEC 62304 / 82304-1) – Use recognized lifecycle standards to structure architecture, module-level design, verification and validation, maintenance, and configuration.
  • Clinical Evaluation (MDCG 2020-1) – Demonstrate clinical benefit and performance with fit-for-purpose evidence.
  • Technical Documentation (Annex II/III) – Include architecture, risk analysis, verification, usability, labeling, and performance claims.
  • Conformity Assessment – For Class I(s/m/r), IIa and above, a Notified Body reviews your QMS and technical documentation and performs audits.
  • CE Marking & Declaration of Conformity – Once you demonstrate conformity, apply the CE mark and sign the DoC to enter the EU market.
  • Post-Market Surveillance – Maintain PMS and PSUR, and integrate performance data and AI monitoring logs.
  • Software Updates and Change Control – Analyze each change—functional, algorithmic, or data-driven—to decide whether it represents a significant change that requires re-assessment.

3. Cybersecurity and Lifecycle Protection

Cybersecurity should start at design and continue through maintenance. The main requirements include:

  • Ensure confidentiality, integrity, and availability (CIA) throughout the lifecycle
  • Define minimum IT requirements and secure configurations
  • Implement verification and validation of security controls
  • Provide clear IFU instructions on data protection, updates, and secure disposal (GSPR 13.6)
  • Maintain a post-market security plan to track vulnerabilities and manage patches

4. Challenges, Risks & Strategic Recommendations

ChallengeMitigation / Best Practice
Unclear intended purpose or software classificationDefine the medical purpose at project initiation. Align IFU, labeling, marketing, and technical files with intended use and Rule 11 logic.
Insufficient clinical/performance evidenceUse prospective studies or robust real-world performance evaluations aligned with MDR Annex XIV and, where applicable, AI Act testing provisions.
Data quality and representativenessImplement data governance for acquisition, preprocessing, and validation. Ensure datasets represent the intended patient population and use context.
Transparency and user comprehensionProvide clinically interpretable outputs. Explain functionality, limitations, and user responsibilities in the IFU and training materials.
Traceability gaps between requirements, risks, and testsMaintain a requirements-to-verification traceability matrix that links requirements, risk controls, verification results, and clinical claims.
Software updates and regulatory impactEstablish change management to evaluate whether updates are significant and require re-assessment. Integrate these controls into the QMS.
Regulatory and Notified Body capacity constraintsEngage early with a qualified Notified Body. Provide clear, harmonized documentation to streamline assessments.
Evolving standards and regulatory guidanceMonitor new EU and MDCG guidance and standards (ISO 14971, ISO 13485, IEC 62304, IEC 81001-5-1) and the EU AI Act. Review QMS procedures periodically to stay aligned.

5. Conclusion

Delivering safe and compliant Software as a Medical Device (SaMD) requires a structured approach that integrates regulatory, technical, and quality considerations across the lifecycle. Compliance with the EU MDR ensures that safety, performance, and clinical benefit remain clear and consistently supported.

Advanced technologies, including AI, can enhance SaMD functionality; however, they should not overshadow the core principles of safety, effectiveness, and human oversight. The same regulatory rigor and lifecycle management practices apply to all SaMD, regardless of the underlying technology.

Manufacturers should:

  • Define a clear intended purpose aligned with clinical benefit
  • Maintain a QMS that addresses MDR and, where relevant, AI Act obligations
  • Engage early with Notified Bodies and keep documentation, risk, and cybersecurity controls consistent
  • Treat post-market surveillance and maintenance as continuous improvement

By embedding these principles, manufacturers can reach compliance efficiently and deliver trustworthy, clinically valuable SaMD solutions.

Written by:
Diego Rodrigues, PhD

Diego Rodrigues, PhD

RA Specialist

Regulatory affairs specialist with expertise in EU MDR/IVDR, CE marking, SaMD & AI for MDs & IVDs.
Industry Insights & Regulatory Updates

MDR Compliance Checklist: What You Need Before Submitting

A Comprehensive Pre-Submission Readiness Guide

Navigating the European Union’s (EUs) Medical Device Regulation (Regulation [EU] 2017/745; MDR) demands meticulous preparation. Submitting incomplete technical documentation to a Notified Body (NB) for review triggers lengthy review cycles and costly delays. This guide serves as a final gap analysis to ensure a robust, coherent, and compliant submission, paving a smoother path to Conformité Européenne (CE) marking.

Your technical documentation is an output of your quality management system (QMS). The NB will review your technical file and your QMS, in accordance with the requirements of Annex IX of the MDR. Other conformity assessment routes, such as those outlined in Annex X (based on type-examination) or Annex XI (based on product conformity verification), may also be selected, although they are less commonly used.

The foundational systems and roles required of all manufacturers, regardless of device classification, are as follows:

  • MDR-compliant QMS: Per MDR Article 10(9), a QMS for developing, manufacturing, and post-market monitoring is mandatory. Although certification to ISO 13485:2016 is not mandatory, it is commonly used to demonstrate compliance and is considered the most effective way to fulfil the requirements of Article 10(9) of the MDR. For all devices, the QMS should incorporate MDR-specific processes such as post-market surveillance (PMS), vigilance, and unique device identification (UDI) management.

For Class IIa, IIb, and III devices, as well as certain Class I devices placed on the market in sterile condition, with a measuring function, or intended to be reused, the QMS is typically assessed by a Notified Body as part of the conformity assessment. For other Class I devices, while a QMS is still required under Article 10(9), it does not require Notified Body involvement.

  • Risk management system: Mandated by MDR Annex I, risk management per ISO 14971 must be a continuous process implemented throughout the entire product lifecycle, ensuring risks are controlled and an acceptable benefit-risk ratio.
  • Person Responsible for Regulatory Compliance (PRRC): MDR Article 15 obliges manufacturers to designate at least one qualified PRRC permanently and continuously at their disposal. This ensures technical documentation and declarations of conformity (DoC) are prepared and maintained in compliance with the Regulation.
  • Understanding stakeholder obligations: Ensure that your organisation understands, and has communicated, the necessary information to distributors and importers, who have specific obligations under MDR Articles 13 and 14 regarding verification, storage, and complaint handling.

Your technical documentation is the core evidence dossier for your device, structured in accordance with MDR Annexes II (Technical Documentation) and III (Technical Documentation on PMS).

Technical documentation (Annex II)

Must provide comprehensive evidence that all General Safety and Performance Requirements (GSPRs) from Annex I are met.

  • Device description & specifications: Detailed description of the device, including trade name, intended purpose, users, patient population, principles of operation, and key functional elements (components, materials, software). Identification via Basic UDI-DI (per MDR Article 27 and Annex VI, Part C) or other traceable identifiers. Justification of device qualification, risk class, and applied classification rules in accordance with MDR Annex VIII. Overview of previous and similar generations of the device
  • Labelling & Instructions for Use (IFU): All labelling must comply with MDR Annex I, Chapter III. Claims made in the IFU or labelling must be consistent with, and supported by, the clinical evaluation, GSPRs, and RMF. Labels and Instructions for Use (IFU) in all applicable EU languages
  • Design and Manufacturing Information: Description of design stages, manufacturing processes, validation data, and control of critical suppliers/subcontractors.
  • GSPR checklist: Links each applicable safety and performance requirement of the device to the source of objective evidence (ie, verification & validation [V&V] reports, test data, or procedures); GSPRs not considered applicable should be justified. Reference to applied harmonised standards, common specifications (CS), or equivalent solutions.
  • Risk management file (RMF): Must demonstrate a complete lifecycle approach to risk per ISO 14971, including analysis, evaluation, control, and a report concluding a favourable benefit-risk profile.
  • V&V reports: Data supporting device safety and performance, including
    • Biocompatibility (ISO 10993 series)
    • Electrical Safety & electromagnetic compatibility (IEC 60601 series)
    • Software V&V (IEC 62304 for lifecycle processes)
    • Stability and shelf-life testing
    • Sterilisation validation
    • Performance and safety testing relevant to intended use

Clinical Evaluation (Annex XIV)

Includes a clinical evaluation report (CER) based on a compliant clinical evaluation plan (CEP), providing sufficient clinical evidence to demonstrate device safety, performance, and a favourable benefit-risk ratio. It must also:

  • critically appraise data from manufacturer clinical investigations or an equivalent device (if claimed according to strict MDR criteria);
  • be updated continuously throughout the device’s lifecycle with post-market data.

PMS & vigilance (Annex III)

The Post-Market Surveillance (PMS) Documentation ensures continuous evaluation of device performance and compliance throughout its lifecycle, through the following documents.

  • A PMS plan: Proactively and systematically collects and analyses post-market data on device quality, performance, and safety.
  • A post-market clinical follow-up (PMCF) plan: Actively gathers clinical data post-market, required unless exclusion is justified.
  • Vigilance System: Robust procedures for reporting Serious Incidents and Field Safety Corrective Actions to competent authorities per MDR Article 87.
  • PMS reporting: Preparation of a Periodic Safety Update Report (PSUR) (Article 86) or Post-Market Surveillance Report (PMSR) (Article 85), depending on device class

Step 3: Pre-Submission – Administrative and Conformity Assessment Planning

Final checks before NB engagement.

  • Conformity assessment: Based on device classification, the correct conformity assessment procedure (detailed in MDR Annexes IX-XI) must be followed.
  • EU DoC (Annex IV): A draft DoC must be prepared, listing all applicable regulations and standards, signed after the NB grants CE certification.
  • Summary of Safety and Clinical Performance (SSCP): For implantable and Class III devices; must be written in clear, layperson language and must be consistent with the CER and IFU.
  • CRITICAL STEP – Internal Consistency Review: A cross-functional review to ensure the device name, intended purpose, indications, and key performance claims are consistent across documentation.
  • NB Engagement:
    • Designation Scope: Confirm your chosen NB is officially designated for your device type and classification.
    • HIGHLY RECOMMENDED – Pre-Submission Meeting: Discuss your strategy and the NB’s expectations through structured dialogues, de-risking the formal submission process.

Supporting Documents and Guidance

  • ISO 13485:2016 (QMS)
  • ISO 14971:2019 (Risk Management)
  • ISO 14155:2020 (Clinical Investigations)
  • MEDDEV 2.7/1 Rev. 4 (Clinical Evaluation: A Guide for Manufacturers and Notified Bodies)
  • MDCG 2020-6 (Clinical evidence needed for medical devices previously CE marked under Directives 93/42/EEC or 90/385/EEC: A guide for manufacturers and notified bodies)
  • MDCG 2020-7 (Post-market clinical follow-up [PMCF] Plan Template: A guide for manufacturers and notified bodies)
  • MDCG 2020-8 (Post-market clinical follow-up [PMCF] Evaluation Report Template: A guide for manufacturers and notified bodies)
  • MDCG 2019-9 (Summary of safety and clinical performance: A guide for manufacturers and notified bodies)

Key Takeaway

MDR compliance transcends document creation. It is about building a coherent, evidence-based narrative weaving together quality management, risk analysis, clinical data, and post-market vigilance into a single, compelling story of your device’s safety and performance. Using this comprehensive checklist to perform a final, critical gap analysis ensures your story is not only complete but also clear, consistent, and readily verifiable, paving a smoother path to successful CE marking under the MDR.

Contact us today for a consultation with our medical devices team.

Written by:
Grace Chia, PhD

Grace Chia, PhD

RA Specialist

Regulatory Affairs Specialist in MDR & IVDR with expertise in CERs, SVRs, literature review, and regulatory compliance.
Industry Insights & Regulatory Updates

Clinical Development for Medical Devices: From Strategy to Submission

Clinical development for medical devices is a complex and continuous process under Regulation (EU) 2017/745 (MDR), requiring robust clinical evidence to demonstrate safety and performance. Regardless of whether your product is a novel technology or an updated version of an existing device, regulators demand comprehensive evaluation across every phase. This guide walks you through the key steps, from early strategy to final submission, to help you achieve MDR compliance.

To begin with, this phase is critical for defining the scope, evidence routes, and overall resource allocation for your clinical efforts. A well-constructed strategy at this stage prevents costly errors and oversights, setting the trajectory for a successful submission. As a result, this phase produces the clinical evaluation plan (CEP), your core strategic document.

Key strategic actions:

Comprehensive gap analysis: Assess all existing data against the MDR requirements applicable to your device’s risk class and intended purpose. This includes preclinical data (biocompatibility, electrical safety, software validation, usability engineering) and potential sources of clinical data.

Defining the evidence route map: Decide if conformity with the general safety and performance requirements (GSPRs) set out in Annex I of the MDR can be demonstrated through existing data or if a new clinical investigation is required.

  • Waiver of clinical data: Under MDR Article 61(10), a justification for omitting clinical data may be possible if deemed “not appropriate.” This is reserved for low-risk devices where safety and performance can be demonstrated through comprehensive preclinical testing (e.g., bench testing, non-clinical performance evaluation). You must justify the waiver through risk management and support it with clear technical documentation.
  • Clinical investigation route: For novel devices or when equivalence cannot be sufficiently proven, a new clinical investigation is unavoidable, especially for Class IIb implantable and all Class III devices.
  • Equivalence route: Alternatively, if you rely on data from another device, you must provide rigorous proof of technical, biological, and clinical equivalence as per the MDR’s strict criteria. Notified Bodies (NBs) apply these requirements strictly, which makes this path to clinical evidence more difficult.

Developing the Clinical Development Plan (CDP): This overarching document integrates pre-market and post-market clinical activities, ensuring a seamless transition from pre-market approval to post-market surveillance.

Using the CEP as the roadmap:

The CEP must define the device and its intended purpose. It should also establish specific clinical safety and performance objectives that are aligned with the device’s intended clinical benefits and risk profile. It must outline clear clinical questions, list relevant data sources, and explain the literature search strategy. A well-crafted CEP is the strategic backbone of clinical development for medical devices, ensuring your evidence generation aligns with MDR expectations.

Need expert guidance navigating MDR clinical development? Partner with MDx CRO to streamline your clinical strategy, generate robust evidence, and ensure regulatory success. Contact us today.

While the clinical evaluation identifies evidence gaps, a clinical investigation may be required to generate the data needed to address them.

Clinical investigation set-up and conduct:

  • Investigation plan and protocol development: You must ensure the protocol is scientifically rigorous and ethically sound, in line with ISO 14155:2020. It should clearly define endpoints, sample size, and study methodology.
  • Navigating regulatory approvals: Secure necessary approvals from Competent Authorities and favourable opinions from Ethics Committees in each target member state.
  • Trial conduct, monitoring and oversight: Additionally, ensure all sites are adequately trained and monitored in study procedures. Use robust data systems to ensure data integrity and accuracy.
  • Vigilance and Safety Reporting: Establish clear processes for capturing, assessing, and reporting all adverse events and device deficiencies in accordance with regulatory timelines. You must ensure these processes comply with MDR requirements, particularly Articles 80–89 and Annex III Section 1.1(c). In addition, where applicable to clinical investigations, compliance with ISO 14155:2020 is also required.

At this stage, you must transform raw data into compelling evidence. The data must be critically appraised, synthesised, and contextualised within the current state of the art.

Understanding clinical data:

Per MDR Article 2(48), clinical data are information concerning safety or performance of a device that are generated from the use of a device, and are sourced from one or more of the following:

  • Clinical investigations of the device under evaluation (DuE).
  • Clinical investigation(s) or other studies reported in scientific literature, involving a device for which equivalence to the device in question can be demonstrated.
  • Peer-reviewed scientific literature reporting other clinical experience with the device in question or with a device for which equivalence can be demonstrated.
  • Clinically relevant information from post-market surveillance (PMS), particularly post-market clinical follow-up (PMCF).

Core components of data analysis and compiling the clinical evaluation report (CER):

  • Systematic literature review and data appraisal: Execute the literature search as defined in the CEP. The process must be fully transparent, systematic, and reproducible. Evaluate each data source critically for validity, quality, and relevance—whether from your study or existing literature. Standardised appraisal tools should be used to assess the risk of bias and the strength of the evidence.
  • Demonstrating conformity with GSPRs: You must clearly link your clinical evidence to the GSPRs in the CER. It should clearly state how the collected data verifies that each applicable clinical requirement is met.
  • State-of-the-art comparison: Compare your device’s performance, safety, and benefit-risk profile against the current standard of care and available alternatives. This contextualises your device’s value within the medical landscape.
  • Writing a comprehensive and well-structured CER: The final report should clearly justify the device’s clinical safety and performance. It must affirm that the overall benefit-risk conclusion is favourable for the intended target population and clinical setting. Your evaluator(s) must sign the CER to confirm responsibility, and all data, appraisals, and conclusions must be traceable.

Synthesising data into a Clinical Evaluation Report (CER) is a critical milestone in clinical development for medical devices, connecting raw data to a clear regulatory conclusion.

Under MDR, clinical evaluation is a continuous process. In fact, certification is not the finish line—it’s the midpoint of an ongoing cycle of evidence generation.

Ongoing post-market obligations:

  • PMS: Proactively collect and evaluate real-world data from various sources, including user feedback, complaint handling, literature screening, and registries. This system helps detect emerging risks or performance issues.
  • PMCF studies: Where required by the risk profile or as outlined in the CDP, conduct targeted PMCF studies to investigate the long-term performance and safety of the device, or to address any residual uncertainties from pre-market clinical evaluation.
  • CER updates: Treat the CER as a living document. Therefore, update it annually for Class III and implantable devices, or every 2–5 years for lower-risk classes. An immediate update is warranted upon the discovery of significant new information that could impact the benefit-risk assessment, such as newly available clinical data, emerging risks, or advancements in the state-of-the-art.

Navigating Challenges

  • Data quantity and quality: Data must be sufficient for statistical significance and come from reputable sources. Manufacturers must demonstrate a thorough search of relevant databases (e.g., PubMed, EMBASE) and a critical appraisal of the data’s scientific validity.
  • Justifying a waiver: However, waiving clinical data is risky. You must justify it scientifically and ethically, rooted in strong risk management
  • Proving equivalence: The bar for demonstrating technical, biological, and clinical equivalence is high. Because NBs assess equivalence strictly, a new clinical investigation is often the better option.

Supporting Documents and Guidance

Regulations

Harmonised Standards:

  • ISO 14155:2020 (Clinical investigation of medical devices for human subjects — Good clinical practice)

Guidance Documents:

  • MDCG 2020-13 (Clinical evaluation assessment report template)

Key Takeaway

Successful clinical development for MDR compliance is not a series of isolated tasks but an integrated, lifecycle-spanning process with clinical evaluation as its continuous core. To sum up, by planning strategically with a thorough gap analysis and a robust CEP, executing clinical investigations with rigor, synthesising data into compelling evidence in the CER, and embracing the ongoing cycle of PMS and CER updates, you demonstrate more than just compliance. You build and maintain a strong, evidence-based case for your device’s enduring value, safety, and performance in the marketplace.

Written by:
Grace Chia, PhD

Grace Chia, PhD

RA Specialist

Regulatory Affairs Specialist in MDR & IVDR with expertise in CERs, SVRs, literature review, and regulatory compliance.
Industry Insights & Regulatory Updates