Making IVDR Work in Combined Studies: Scientific & Operational Lessons from 40+ Programs

Combined studies, clinical trials that simultaneously investigate a medicinal product and an IVD under both the Clinical Trials Regulation (CTR) and the IVDR, are among the most complex regulatory challenges in precision medicine today. The lack of a coordinated EU assessment means sponsors face separate national submissions, divergent NCA interpretations, and timelines that can stretch 6-12 months beyond what was planned.

Last week, I presented at the 16th Clinical Biomarkers & Companion Diagnostics Summit Europe in London, sharing data and lessons from over 40 combined programs that MDx CRO has managed across 20+ EU countries. This article distils the key findings from that presentation: what triggers IVDR performance study requirements, why the same protocol can get three different answers from three NCAs, the top RFIs we see across programs, and how the regulatory landscape is evolving with MDCG 2025-5 and the December 2025 Health Services Pack.

Whether you are a pharmaceutical sponsor planning your first combined study, or a regulatory affairs professional navigating the dual-track CTR/IVDR submission process, this article gives you the operational intelligence that no guidance document provides.

Name
Checkboxes

The Combined Studies Bottleneck: Why This Matters Now

The numbers tell the story. According to the EU COMBINE Analysis Report 2024, there were 402 combined study applications across the EU, of which 343 were CTR/IVDR combinations, and 86% of those were multinational. The mean approval time was 137 days, but the range was enormous: 45 to 267 days depending on the country, the submission pathway, and the quality of the initial dossier.

The root cause is structural. There is no coordinated IVDR assessment across Member States. Each country evaluates the performance study component independently, using national portals, national forms, and critically, national interpretations of the same regulation. For sponsors running multinational oncology trials with a companion diagnostic, this means multiplicative complexity: every additional country adds not just a submission, but a potentially different regulatory conclusion about whether a Performance Study Application (PSA) is even required.

And the volume is growing. Industry estimates project over 3,000 IVD submissions expected by 2029 as more CDx-driven oncology programs reach the EU. The system is already under strain.

This is the environment in which every combined study sponsor now operates. The question is not whether you will encounter divergent NCA opinions, it is how you prepare for them.

Same protocol, same device, three different answers.

The case presented at CDx Europe involved a pharmaceutical sponsor planning a multinational Phase 1b/2 oncology trial across France, Germany, and Spain. The study used a CE-marked companion diagnostic to run central testing retrospectively on leftover tumour samples, after enrolment was complete, purely as exploratory biomarker analysis. No additional invasive procedures. No impact on protocol-mandated treatment decisions. The sponsor sought pre-submission advice from three Member State competent authorities, presenting the same protocol and the same scientific rationale to each.

The three responses were incompatible.

NCA 1 concluded that no PSA was required, it accepted the sponsor’s argument that the activity was purely exploratory and non-interventional.

NCA 2 took the opposite position: because the assay was being used outside the scope of its CE-marked intended purpose, and because discrepant results would be communicated to investigators who could potentially act on them, it classified the study as interventional and required full PSA authorisation.

NCA 3 had not issued a definitive answer within the consultation period. This authority lacks a formal structured consultation procedure for performance studies and typically responds by email without fixed timelines.

When we presented this at the conference, there was an audible reaction in the room. Several attendees nodded immediately, this clearly resonated with their own experience. The most revealing question came from a regulatory affairs director at a mid-size pharmaceutical company who asked: “If the strictest authority changes its mind on appeal and agrees with the others, do we then need to explain to the permissive authority why we did something they told us we didn’t need to do?”

That question captures the operational absurdity of the current system perfectly. Sponsors are caught between harmonising upward, following the strictest requirement everywhere, which creates unnecessary burden in permissive jurisdictions, and harmonising downward, which creates compliance risk in the strictest one.

How Was It Resolved?

No harmonised consensus was reached between the three authorities. The sponsor appealed to the strictest authority in late 2025, providing additional justification and citing the fact that the most permissive authority had accepted the same protocol without any submission. By early 2026, the sponsor was cautiously optimistic that the appeal would succeed.

In parallel, they prepared contingency documentation for a dual-track approach: a full PSA in the country requiring it, a Performance Study Notification (PSN) in the country where the outcome remained uncertain, and no submission in the country that had cleared the protocol outright. Each country would effectively follow its own regulatory requirement.

Timeline impact: The divergent opinions introduced approximately 4–6 months of delay to the diagnostic component of the trial, encompassing multiple pre-submission consultation rounds, country-specific dossier preparation, appeal proceedings, and the need to compile and translate Annex XIV documentation for each jurisdiction independently.

There is currently no formal escalation or conflict-resolution pathway for performance study assessments. This is precisely the structural gap the COMBINE programme’s coordinated assessment pilot is intended to address.

What Triggers IVDR Performance Study Requirements?

Understanding the regulatory pathways is critical for any combined study. The IVDR establishes three routes, and the distinction between them determines everything: your timeline, your documentation burden, and whether your study can start at all.

Article 58.1 Authorisation Required

This applies to non-CE-marked devices or devices used outside their intended purpose. The process involves a 25-day validation phase followed by a 45-day review. You need full PSA authorisation when the study involves surgically invasive sample-taking for study purposes only, when it is an interventional clinical performance study, or when there are additional invasive procedures or risks beyond standard care.

Article 58.2 Notification Pathway

This applies to companion diagnostics using leftover samples only, where results do not influence treatment during the trial. The pathway is immediate or NCA-dependent after validation, depending on the Member State.

Article 70 CE-Marked Devices

This is a 30-day notification route for CE-marked devices used within their intended purpose but involving additional invasive or burdensome procedures beyond normal use. A critical nuance: if a CE-marked IVD is studied outside its intended purpose, the Article 70 notification route does not apply, it must be assessed under Article 58 instead.

The Key Decision Factors

From our experience across 40+ combined programs, the questions that determine which pathway applies and where NCAs diverge, are consistent:

  • CE mark status: for the specific trial use (intended purpose) not just whether the device has a CE mark, but whether the trial use falls within the marked scope
  • Whether results impact medical management: this is the most contested threshold, as “interventional” in the IVDR context carries a different meaning from “interventional” in clinical trial legislation
  • Study design: interventional vs observational
  • Sample type: fresh vs leftover, and the level of invasiveness required to collect them
  • Risk profile: additional procedures vs standard care
  • Whether device endpoints are clearly distinguished: from drug endpoints

Top 12 RFIs From 40+ Combined Programs

This is the data MDCG guidance documents do not provide. Over 40 combined programs, these are the most frequent Requests for Information (RFIs) we have received from NCAs and Ethics Committees across Europe:

1. Insufficient analytical validation (GSPR 9.1a). The test is a clinical trial assay, prototype, or lab-developed test (LDT) and was not developed under full design control. This may be accepted in US early-phase trials but is a common reason for rejection in the EU.

2. Insufficient data supporting the chosen cut-off. A small number of samples were used for cut-off validation. NCAs expect robust, data-driven rationales, not theoretical arguments.

3. Lacking or vague definitions of primary endpoints related to IVD performance, and the absence of a statistical analysis plan for the device component.

4. Informed Consent Form (ICF) lacks performance study-specific content. This is extremely common in combined CT/PS ICFs. Authorities regularly request revision in lay-user language that clearly distinguishes participation in the drug trial from participation in the diagnostic study.

5. Inconsistent objectives between the clinical trial application and performance study documentation. When the CPSP says one thing and the CTA says another, expect an RFI.

6. Incomplete risk plans and reports, with insufficient evaluation in the Investigator’s Brochure of how inaccurate test results could impact the clinical trial, especially for high-toxicity therapies.

7. Investigator and site documentation lacking PS references, required translations, or country-specific insurance certificates.

8. Lack of consideration towards monitoring the IVD study under ISO 20916, especially in sponsor-CRO or multicentre settings.

9. Divergent views between Ethics Committees and NCAs on risk, burden, or benefit, sometimes within the same country.

10. Use of leftover samples for future research without clear documentation on traceability, consent, or ethical approval.

11. Safety monitoring procedures in the CPSP not aligned with IVDR Article 74 and MDCG 2024-4.

12. Scientific inaccuracies in the CPSP, IB, and technical documentation, simple errors that erode credibility and trigger additional scrutiny.

What “Device-Specific Endpoints” Actually Means

One of the most common mistakes we see in combined studies is sponsors relying solely on drug efficacy endpoints (ORR, PFS, OS) as evidence of IVD performance. Under the IVDR and MDCG 2025-5, performance studies must generate data that establish or confirm device performance, not drug performance.

Analytical Endpoints (Often Used in Phase 1/2 Studies)

These include reportable rate, invalid-result rate, repeat-test rate, and assay failure rate; precision and reproducibility in the clinical setting; and accuracy at clinically relevant cut-offs.

Clinical Endpoints (CDx-Type, Often Used in Phase 3 and Bridging)

These include concordance with a clinically valid reference assay (PPA, NPA, OPA); diagnostic sensitivity and specificity vs clinical status; clinical outcomes studies in the IVD-selected group linked to drug endpoints; and clinical bridging studies.

What Is Not Sufficient as a Sole Endpoint

Turnaround time alone, and drug efficacy endpoints (ORR, PFS, OS) without device-specific performance measures.

Case Study: From Rejection to 8-Country Approval

One of the programs presented in detail involved an NGS-based CDx used to detect a specific mutation for targeted therapy patient eligibility in a rare tumour indication. It was a Phase 3 global trial with an interventional combined performance study across 30+ EU sites.

The Initial Rejection

The first EU submission was rejected. The reasons were typical of what we see repeatedly:

  • Incomplete analytical performance data vs GSPR 9.1(a) at the mutation cut-off
  • Weak linkage between biomarker, clinical condition, and treatment, a scientific validity gap
  • Under-developed risk management for false negatives in a high-toxicity therapy

What We Did

MDx CRO conducted a full gap analysis and remediation covering the Scientific Validity Report (SVR), Analytical Performance Report (APR), CPSP, and risk file versus Annex XIII requirements. We rewrote the CPSP with device-specific treatment-decision endpoints, strengthened the analytical data at the decision threshold, and quantified the false-negative impact in the risk management file.

The Outcome

Harmonised resubmission to 8 Member States. All RFIs resolved. Approvals in all 8 countries, within 4 months.

This case illustrates a pattern we see consistently: the initial submission fails not because the science is weak, but because the documentation does not speak the language the NCAs expect. The same data, presented differently, achieves a completely different result.

The Most Costly Mistake Sponsors Make

The single most expensive mistake we have seen sponsors make in the IVDR portion of a combined study is treating the performance study application as an afterthought, something to be “bolted on” after the clinical trial application is already in motion.

In one program, the sponsor had not engaged with IVDR requirements until approximately three months before planned first-patient-in. At that point they discovered that a PSA was required in multiple Member States, that documentation requirements were not harmonised across those countries, and that each required different local forms, different ethics committee interactions, and in some cases certified translations.

The result was a nine-month delay to the European portion of the trial and an estimated additional cost in the range of €800,000-€1.2 million when accounting for CRO renegotiation, site re-engagement fees, amended contracts, and the opportunity cost of delayed clinical data.

This is not an outlier. Industry survey data shows that a significant proportion of sponsors experience 6–12 months of IVDR-related delay in combined programs, with some reporting delays beyond 12 months. The structural cause is always the same: the pharmaceutical team and the diagnostics team are operating on disconnected timelines, and the IVDR submission is not integrated into the master trial timeline from the outset.

Wave Planning: The Operational Playbook

Not all EU Member States are equal when it comes to combined study submissions. One of the practical tools shared at the conference was our wave planning approach, a strategic framework for sequencing country activations based on regulatory architecture, not just commercial priority.

Wave 1: Speed, Parallel/Combined Processes

Spain offers parallel review, with submission to both AEMPS via the portal and the Ethics Committee (usually via email). Total timeline: approximately 85 days.

Belgium uses a consolidated review via CESP where the NCA and EC coordinate and issue a single opinion. Timeline: approximately 60 days.

These are faster because the EC and NCA review simultaneously, not sequentially.

Wave 2: Sequential Requirements

Germany, Austria, and Hungary all require EC approval first, followed by NCA submission. This adds the full EC timeline (46–166 days) before the NCA clock even starts. Total timelines: 135–267 days.

Wave 3: Administrative Complexity

Bulgaria requires notarised and apostilled Powers of Attorney, sworn translations, and physical courier submissions.

Poland requires paper copy submissions to both the EC and NCA, including wet-ink signed site documents, sworn translations, and stricter requirements demonstrating the Sponsor’s business registration and Power of Attorney.

Ireland has non-harmonised reviewers, causing inconsistent RFI rounds.

Why Wave Planning Matters

Typically, it is strategic to avoid submitting to high-administrative-burden countries in Wave 1. For example, Poland necessitates that the entire submission package is delivered to the EC and NCA via courier in printed form with wet-ink signatures. It is more efficient to submit first to countries with accessible pathways so that feedback from RFIs and lessons learned can be incorporated from the start for the more labour-intensive submissions.

The strategy: stagger activation by submission architecture and administrative burden, not just by regulator consolidation.

Illustration of European map showing estimated PSA approval timelines and submission complexities for MedTech products in the context of IVDR compliance.
Visual overview of European regions highlighting approval timelines and submission challenges for MedTech companies navigating IVDR requirements in combined studies.

How MDCG 2025-5 Is Changing the Landscape

MDCG 2025-5, published in June 2025, is the first dedicated Q&A guidance specifically addressing IVDR performance studies comprehensively. It covers 54 questions across topics that sponsors and NCAs have been debating since 2022, including:

  • A regulatory pathway decision tree (Appendix I) providing a structured framework for determining whether a planned activity requires a PSA, a PSN, or no submission at all
  • Clarification that “interventional” in the IVDR context meaning the results may influence patient management carries a different meaning from “interventional” as used in clinical trial legislation. This conflation has caused significant confusion
  • A working definition of “leftover samples” and the conditions under which they trigger notification rather than full application requirements
  • Guidance on combined studies including sponsor responsibilities, substantial modification handling across both the CTR and IVDR pathways, and the role of the performance study investigator

Are NCAs Following It?

Partially, and unevenly. Some authorities have begun aligning their pre-submission guidance with the decision-tree logic. Others continue applying their own interpretations, particularly on the definition of “interventional” which remains the most contested threshold.

The guidance is explicitly non-binding: MDCG 2025-5 itself states it cannot be regarded as reflecting the official position of the European Commission and that only the Court of Justice of the EU can give binding interpretations. In practice, guidance adoption across Member States typically lags publication by 12–18 months before a clear majority are operating consistently with it.

The Health Services Pack and the Biotech Act: Will It Actually Simplify Combined Studies?

In December 2025, the European Commission proposed two complementary pieces of legislation as part of a broader health services package. The first is a targeted revision of the MDR and IVDR, aimed at simplifying the existing regulatory framework. The second is the Biotech Act, which proposes amendments to the Clinical Trials Regulation that are directly relevant to combined studies.

What the Biotech Act Changes for Combined Studies

This is the more consequential development. The Biotech Act explicitly introduces a single integrated application for combined studies. Under the current framework, sponsors must seek authorisation of the clinical trial under the CTR and the performance study under the IVDR entirely independently separate portals, separate assessments, separate timelines, separate Member State interactions.

The Biotech Act proposes to eliminate that dual-track requirement. Instead, the sponsor would submit a single application covering both the investigational medicine and the IVD through a combined authorisation process managed under the CTR. That assessment would be led and coordinated by a Reporting Member State (RMS), with coordinated approvals across participating countries.

The proposal also accelerates CTR timelines generally, reducing the multinational CTA review from 106 days to 75 days, and as low as 47 days when no information request is issued.

My Assessment

This is not wishful thinking for the first time, there is a concrete legislative mechanism on the table that directly addresses the structural root cause of combined study delays. If adopted as proposed, it would be a genuine step-change.

However, three cautionary notes:

Legislative timeline. Even with political priority, realistic adoption and implementation timelines are 18–24 months from proposal. Do not expect sponsors to be able to use the single-application pathway before late 2027 at the earliest.

Implementation gap. CTIS will need to be updated to accept performance study documentation alongside the CTA, and Member State competent authorities will need to build assessment capacity for the IVD components within their CTR review teams.

The COMBINE pilot is the bridge. The COMBINE programme’s Project 1 pilot, launched on 13 June 2025, is already testing an “all-in-one” coordinated assessment approach. Sponsors who participate now are effectively rehearsing for the future framework.

The December 2025 package does have the potential to fundamentally simplify combined studies. But sponsors working in 2026 are still operating under the current framework. The practical advice remains: use the COMBINE pilot if you can, plan for Member State divergence if you can’t, and build your combined study submission strategy on the assumption that the current dual-track system will be in place until at least late 2027.

The #1 Mistake Sponsors Make in Their First Combined Study

They assume the IVDR performance study is the diagnostic manufacturer’s problem, not theirs.

The pharmaceutical sponsor designs the trial, defines the biomarker strategy, selects the assay, and writes the protocol. But when the conversation turns to the IVDR submission, they expect their diagnostic partner to handle it independently.

The reality is that under Article 2(57) of the IVDR, the “sponsor” is whichever entity takes responsibility for the initiation, management, and financing of the performance study and in a combined study, particularly in early-phase trials, that is often the pharmaceutical company itself.

This disconnect produces predictable failures:

  • The drug application is submitted through CTIS months before the PSA is even drafted
  • The diagnostic partner lacks access to the clinical trial protocol, site-level information, and country-specific documentation needed to complete the Annex XIV dossier
  • When an NCA issues an RFI at the interface between the two applications, neither team owns the response

MDCG 2022-10 is explicit: the clinical trial sponsor is responsible for overall compliance of products used in the trial, including the IVDR. Where a sponsor uses a CE-marked IVD outside its intended purpose, it assumes manufacturer responsibilities under Article 16(1).

The fix is straightforward: from Day 1 of trial design, the PSA workstream sits inside the integrated trial timeline, with a named owner, shared document management, and joint governance between pharmaceutical and diagnostics teams. Sponsors who do this avoid most problems. Sponsors who don’t are the ones calling us nine months before database lock.

How Much Time Does Expert Guidance Save?

Based on our experience across 40+ combined programs, working with a CRO that has specific IVDR and IVD regulatory expertise saves an average of 3 to 5 months compared to in-house teams or generalist CROs approaching combined studies for the first time.

The savings accumulate in three areas:

Pre-submission strategy (4–6 weeks saved). A specialist knows which Member States to sequence in Wave 1, what each authority actually expects beyond the statutory minimum, and which borderline classification questions need to be resolved before any dossier is submitted. Preventing a single misclassification avoids months of remediation.

Documentation preparation (4–8 weeks saved). Generalist CROs frequently prepare a single PSA dossier and submit it identically across all Member States. A specialist prepares country-adapted packages from the outset correct local forms, country-specific ethics committee requirements, certified translations, and portal-specific submission formats.

RFI management (2–4 weeks saved). When an NCA issues a request for information, a specialist drafts a response that also anticipates how the same question may be raised by other authorities whose reviews are still in progress preventing cascading delays across the wave.

Five Steps to De-Risk Your Next Combined Study

Based on the patterns from 40+ programs, these are the five actions that make the biggest difference:

1. Science first: do not underestimate analytical validation data. Analytical data should be traceable and robust, particularly around the cut-off. The APR and IB should be readable as standalone documents NCAs assess them that way.

2. Decide stakeholder ownership early. Sponsor vs Dx partner vs CRO for both the CTR and IVDR pathways. Ambiguous ownership is the single biggest source of delay.

3. Design device-specific endpoints upfront. Analytical and/or clinical, not just drug efficacy. If your performance study plan only lists ORR as an endpoint, expect a rejection.

4. Build the Annex XIII/XIV package early. SVR, APR, CPSP, risk management, GSPR logic evaluate internal capabilities and gaps before the submission clock starts.

5. Use structured tools for multi-country variation. Don’t rely on memory or email threads. Robust study design combined with an informed country strategy is what separates 60-day approvals from 267-day ones.

Looking Ahead: 2026–2027

From our experience, it will get slightly worse before it gets meaningfully better with the inflection point likely in late 2026 to early 2027.

The short-term pressure comes from volume. More sponsors are now aware of IVDR performance study requirements, which means more submissions entering the system. NCA capacity has not grown proportionally. Several smaller Member States still lack dedicated performance study reviewers.

The medium-term improvement will come from three converging developments: MDCG 2025-5 gradually reducing classification disputes, the COMBINE programme’s coordinated assessment pilot producing procedural lessons by mid-2026, and the December 2025 legislative revision proposal delivering structural changes by late 2027.

The biggest variable remains NCA behaviour. Regulatory guidance adoption is uneven and slow. It typically takes 12–18 months from MDCG publication before a clear majority of authorities are operating consistently with it.

For sponsors planning programs in 2026, the practical reality has not changed: plan for divergence between Member States, budget for country-specific regulatory strategies, engage the IVDR workstream at trial design not after the CTR is submitted and do not assume that what worked in one country will work in the next.

Name
Checkboxes

Need Help With Your Combined Study?

MDx CRO has managed 40+ combined programs across 20+ countries with a 100% approval rate and 90+ performance study submissions in the EU27. Our fastest program went from kick-off to full IVD Study Package Development and submission in 4 weeks.

If you are planning a combined study under the CTR and IVDR, talk to our team about how we can accelerate your path to first patient tested.

Frequently Asked Questions about IVDR Combined Studies

What triggers IVDR performance study requirements in a combined study?

IVDR performance study requirements are triggered through three pathways. Article 58.1 requires authorisation for non-CE-marked devices or devices used outside their intended purpose. Article 58.2 requires notification for companion diagnostics that use leftover samples only. Article 70 requires notification for CE-marked devices that involve additional burdensome procedures. Key decision factors include CE mark status for the specific trial use, whether results affect medical management, the study design, the sample type, and the risk profile.

How long does IVDR performance study approval take in a combined study?

Approval timelines vary by Member State. The EU COMBINE Analysis Report 2024 shows an average of 137 days, with a range of 45–267 days. Countries with parallel ethics committee and national authority review, such as Spain (~85 days) and Belgium (~60 days), are faster than those with sequential review, such as Germany, Austria, and Hungary (135–267 days).

What are the most common RFIs in IVDR combined studies?

Based on data from more than 40 combined programs, the most common RFIs include insufficient analytical validation under GSPR 9.1(a), insufficient data supporting the selected cut-off, missing device-specific endpoints in the CPSP, informed consent forms lacking performance study-specific content, and inconsistent objectives between the clinical trial application and performance study documentation.

What changed with MDCG 2025-5 for IVDR performance studies?

MDCG 2025-5, published in June 2025, is the first comprehensive Q&A guidance for IVDR performance studies. It introduces a regulatory pathway decision tree, clarifies that “interventional” in the IVDR context differs from the CTR definition, defines “leftover samples,” and addresses sponsor responsibilities in combined studies. Adoption by national authorities is uneven, and full alignment is expected within 12–18 months.

Will the December 2025 Health Services Pack simplify combined studies?

The Biotech Act proposed in December 2025 introduces a single integrated application for combined studies under the CTR framework. If adopted, it would remove the need for dual CTR and IVDR submissions. Realistic implementation is not expected before late 2027. The COMBINE programme pilot is currently testing coordinated assessment as a bridge to the future framework.

Written by:
Carlos Galamba

Carlos Galamba

CEO

Senior regulatory leader and former BSI IVDR reviewer with deep experience in CE marking high-risk IVDs, companion diagnostics, and IVDR implementation.
Industry Insights & Regulatory Updates

ISO 14155:2026 What’s Changed and What It Means for Your Clinical Investigation

The fourth edition of the international GCP standard for medical device clinical investigations is now in effect, with no transition period. Here is what sponsors, investigators, and CROs need to know.

A Standard That Has Been a Long Time Coming

ISO 14155 has been the GCP reference for medical device clinical investigations since its first edition in 2003. The third edition, published in July 2020, made significant strides in aligning the standard with the EU Medical Devices Regulation (MDR 2017/745) and the ICH E6(R2) framework. But five years of practical implementation exposed gaps, particularly around risk management, study oversight structures, and statistical planning.

The fourth edition directly addresses those gaps. It introduces more prescriptive requirements, clearer distinctions between types of risk, new formal oversight structures, and a statistical annex that brings medical device investigations much closer to the rigour expected in pharmaceutical trials.

⚠ No transition period, requirements apply immediately

One timing point worth noting: ISO 14155:2020 had only just achieved formal harmonisation with the EU MDR when the fourth edition arrived, an unusual situation that has created legitimate questions for sponsors about the harmonisation status of the new standard. As of publication, EN ISO 14155:2020 remains the harmonised standard for MDR conformity purposes. The harmonisation process for ISO 14155:2026 is ongoing. Sponsors should monitor the EU Official Journal for updates.

The Key Changes: What’s New in ISO 14155:2026

1. Risk Management: A Clearer, More Structured Framework

If applying ISO 14971 risk management principles to clinical investigations has been a grey area in your organisation, the fourth edition addresses this directly.

The key distinction introduced is the separation of two categories of risk:

Device-related risks: including residual risks relevant to the specific study population, sample size, and indication, must be evaluated using full ISO 14971 methodology. The standard recognises that adverse device effect rates during an investigation can differ from post-market use. A small trial population amplifies ethical impact; risks must be contextualised accordingly.

Procedure-related risks: arising from non-routine clinical procedures required by the Clinical Investigation Plan (CIP) but outside standard clinical practice, require a descriptive risk assessment.

A risk based monitoring approach should be defined to manage the oversight of risks associated with the clinical investigation.

The standard clarifies how general device risk management principles translate into study-specific considerations, with focus on investigational device risks, especially residual risks relevant to the study population, sample size, and indication. These updates will require greater rigour when conducting and documenting risk assessments, but the result will be sponsors having more robust, better-documented risk management files tailored to each investigation.

Kirsty Macleod, Head of Clinical Research, MDx CRO

2. Data Monitoring Committees and Clinical Events Committees: Formal Requirements for Both

Study oversight structures receive significant attention in the fourth edition.

For DMCs, ISO 14155:2026 provides further clarification on this requirement. Where a DMC is determined to be in place, sponsors must now pre-define, and document in the CIP, the specific conditions under which a study would be suspended or stopped.

CECs are introduced for the first time in ISO 14155:2026. A Clinical Events Committee is an independent group of clinical experts established by the sponsor to ensure consistent classification and assessment of clinical events across sites. In multi-centre studies, different investigators may characterise the same event type differently, a CEC reduces that variability and strengthens data reliability. Where a CEC is used, its independence, role, and conflict-of-interest management must be formally defined at the outset of the study.

3.Informed Consent: Strengthened Expectations and Ethics Committee Implications

The fourth edition introduces more operational requirements around ethics, subject rights, and consent.

Specific updates include a prohibition on deviations from eligibility criteria without a formal CIP amendment; clearer requirements for explaining future use of health data to subjects; and expanded protection requirements for vulnerable populations and cross-border studies.

Ethics committees will scrutinise these more closely. Sponsors referencing ISO 14155:2026 compliance in submissions should expect greater attention to consent documentation, the consent process itself, and how protocol deviations are governed.

Ethics committees will have altered expectations when sponsors state compliance with the revised standard. Any mismatches between the risk management file and the informed consent form, downplaying known residual risks, using generic language, are routinely flagged during ethics review. The risk file and the consent must tell the same story, in plain language.

Kirsty Macleod, Head of Clinical Research, MDx CRO

4. Design Considerations: The Estimand Framework Arrives

The introduction of Annex K, a new informative annex on clinical investigation design considerations, brings the device world significantly closer to the statistical expectations long standard in pharmaceutical development.

In practice, this means study protocols are expected to more precisely define the clinical question being answered, including how intercurrent events (patient dropouts, treatment switches, protocol deviations) are handled in the primary analysis. Missing data strategies must be planned prospectively, not fixed post-hoc.

For organisations working across both medical devices and pharmaceuticals, this alignment reduces friction. For teams accustomed to simpler device trial designs, it will require additional investment in biostatistics at the planning stage.

5. Clinical Performance: A Sharper Definition With Real Consequences

The definition of “clinical performance” has been updated to more explicitly link device performance to measurable clinical benefit resulting from technical or functional characteristics. This is not a minor editorial change. It has direct implications for how endpoints are selected and justified in the CIP, and how clinical evidence is structured in Clinical Evaluation Reports (CERs).

Sponsors designing new studies need to ensure their primary endpoints map directly to the updated definition. For CER authors, it adds another layer of alignment to consider when assessing clinical data generated under different versions of the standard.

The Most Common Mistakes Sponsors Make regarding ISO 14155, and How to Avoid Them

When running and overseeing clinical investigations, the same errors appear repeatedly when sponsors try to apply risk management requirements to active studies. The fourth edition makes some of these errors significantly harder to ignore during regulatory or ethics review.

The mistakeWhat is expected instead
Reusing the post-market risk file unchanged

Clinical investigations have different risk profiles, smaller populations, learning-curve users, investigational configurations. The ISO 14971 product risk file created for design verification does not translate directly.
A study-specific risk assessment clearly linked to the CIP, subject population, site capabilities, and operator experience. Justified differences between clinical investigation risk and intended-use risk.
Applying full ISO 14971 to procedure risks

Sponsors apply the full methodology to blood draws, biopsies, imaging, and extra clinic visits, logging these as device risks. Regulators increasingly challenge over-engineered risk files because they obscure actual device risk.
Clear separation in documentation: device-related risks, ISO 14971 process; procedure-related risks, descriptive assessment. Explicit statement in the CIP explaining this distinction.
Freezing the risk file once the study starts

Risk management is treated as a design artefact with no named responsibility during execution. Adverse events, near-misses, and protocol deviations that reveal new hazards are not fed back into risk assessment.
Defined triggers for risk review (SADEs, DMC recommendations, deviation trends). Documented updates showing how clinical findings feed back into hazard identification, risk estimation, and benefit-risk evaluation.
Weak linkage between risk file and consent form

The informed consent form downplays known residual risks, uses generic language, or is inconsistent with what appears in the risk management file. Ethics committees view this as a red flag.
Clear mapping between residual risks and subject-facing explanations. Justification where technical risks are simplified or grouped. Immediate consent updates if risk understanding changes.
Risk controls that exist on paper but not in the study

Controls are listed in the risk file but not implemented, training listed but not documented, IFU warnings not reflected in consent, monitoring controls not built into the protocol.
Traceability from risk, control, CIP section, training, monitoring. Cross-checks during monitoring that controls are actively applied. This is one of the most common audit findings.

What Happens to Studies Already Underway?

This is a frequently asked question by sponsors where the answer requires some nuance.

Studies initiated and approved under ISO 14155:2020 remain valid. The publication of the fourth edition does not retroactively invalidate work done in compliance with the previous version. A study designed, approved, and conducted in line with ISO 14155:2020 remains compliant with that version, and that data remains usable to support CE marking, clinical evaluation updates, and post-market evidence, provided it was compliant at the time of initiation.

Where things become more complex is with substantial amendments. If an ongoing study undergoes a significant change after March 2026, a protocol amendment, addition of new sites, introduction of a DMC or CEC, changes to the subject population, regulators and notified bodies may expect the affected areas to be brought into alignment with ISO 14155:2026. This is not a hard rule, but it is a risk-based expectation that should be assessed and documented.

In practice, authorities accept a clear, documented rationale: the clinical investigation was designed and initiated in compliance with ISO 14155:2020, which represented the state of the art at the time of study initiation. The publication of ISO 14155:2026 has been reviewed, and no changes were required that would materially impact subject safety, data integrity, or scientific validity. This approach is widely accepted, provided it is documented, risk-based, and justified.

Kirsty Macleod, Head of Clinical Research, MDx CRO

What Sponsors and Investigators Must Do Now

Given that there is no transition period, the question is not whether to act but how to prioritise. Here is a practical framework:

1. Run a formal gap analysis

Assess your current SOPs, CIP templates, risk management processes, and oversight structures against ISO 14155:2026. Focus first on risk management (device vs. procedure risk distinction), DMC/CEC governance, and statistical planning documentation.

2. Update your QMS and SOPs

Procedures, templates, and SOPs that reference ISO 14155:2020 need revision, particularly around CEC governance (new), DMC governance (strengthened), risk management integration, and informed consent processes.

3. Assess ongoing studies

Review active protocols or protocols in development. For studies with upcoming substantial amendments, prepare a documented assessment of whether and how ISO 14155:2026 requirements apply. Always document the rationale for decisions made, or not made.

4. Deliver structured training

Sharing the updated standard document is not sufficient. The risk management changes in particular require dedicated training for clinical affairs, regulatory affairs, and quality teams, not just a circulated PDF.

5. Monitor the harmonisation process

Keep an eye on the EU Official Journal for updates on the formal harmonisation of ISO 14155:2026 under the MDR. Until harmonised, EN ISO 14155:2020 remains the reference for MDR conformity presumption.

Frequently Asked Questions about ISO 14155:2026

When did ISO 14155:2026 come into effect?

ISO 14155:2026 (Edition 4) was published in March 2026 and replaced ISO 14155:2020 immediately, with no defined transition period. Any new clinical investigation initiated after publication is expected to reference ISO 14155:2026 or provide a clear justification for non-alignment.

Do studies already underway under ISO 14155:2020 need to be updated?

Studies initiated and approved under ISO 14155:2020 remain valid. However, any substantial amendment to an ongoing study after March 2026 may trigger an expectation to align affected parts with ISO 14155:2026, or provide a documented justification explaining why partial or full transition is not appropriate. Always document the rationale.

Is ISO 14155:2026 harmonised with the EU MDR?

Not yet. As of April 2026, EN ISO 14155:2020 remains the harmonised standard providing presumption of conformity with the EU MDR. The formal harmonisation process for ISO 14155:2026 is underway. Sponsors should monitor the EU Official Journal regularly for updates.

What is the difference between a DMC and a CEC under ISO 14155:2026?

A Data Monitoring Committee (DMC) oversees overall trial safety and has the authority to recommend stopping or modifying a study. ISO 14155:2026 requires sponsors to pre-define stopping conditions and justify the absence of a DMC. A Clinical Events Committee (CEC) newly introduced in the 2026 edition, is an independent panel of clinical experts that ensures consistent classification of events across sites in multi-centre studies, improving data reliability.

Does ISO 14155:2026 apply to PMCF studies?

Yes. ISO 14155 applies to post-market clinical investigations, including PMCF studies. Annex I of the standard defines the applicability of requirements to different types of post-market investigations. Some requirements may be modified or exempt for observational studies, but the core GCP principles, including risk management, monitoring, and data governance, apply.

What is the estimand framework introduced in Annex K?

The estimand framework (from ICH E9(R1)) provides a structured approach to defining exactly what clinical question the investigation is designed to answer, and how events that disrupt the intended treatment (dropouts, protocol deviations, treatment switches) should be handled in the primary analysis. It requires these decisions to be made and documented at the design stage, not resolved post hoc in statistical analysis.

Does ISO 14155:2026 apply to IVD clinical performance studies?

ISO 14155 applies to medical devices, not in vitro diagnostics (IVDs). IVD clinical performance studies are governed by ISO 20916:2019. However, where a medical device and an IVD are used in an integrated system, elements of both standards may apply. Sponsors of combination investigations should assess both standards.

    

Related Articles

ISO 14971 Applied to Clinical Investigations: A Practical Guide

PMCF Under MDR: What ISO 14155 Requires

Clinical Investigation Plan: What You Must Include (2026 Update)

EN ISO 14155:2020/A11:2024 and MDR Harmonisation

Written by:
Kirsty Macleod

Kirsty Macleod

Head of Clinical Research

Clinical Operations leader with IVD and CDx device expertise, delivering global clinical studies while establishing best practices and high performing teams.
Industry Insights & Regulatory Updates

Portugal’s New Clinical Trials Law No. 9/2026: What Sponsors Need to Know

Portugal has formally updated its national legal framework for clinical trials on medicinal products for human use through Law No. 9/2026 of 6 March, the third amendment to Law No. 21/2014 of 16 April, fully aligning it with the EU Clinical Trials Regulation (CTR) 536/2014. This update clarifies how clinical trials are authorized, conducted, and supervised across the country and provides sponsors with a clear and harmonized framework.

Here is what changes for sponsors.


Why Law No. 9/2026 Matters?

The EU Clinical Trials Regulation (CTR) 536/2014 has been in force since January 2022, and since January 2025 all new clinical trial applications in the EU must be submitted through the Clinical Trials Information System (CTIS). However, each Member State still needs national implementing legislation to define the specific roles of competent authorities and ethics committees, and to establish local rules on participant protection, insurance, and sanctions.

Portugal’s previous framework for clinical trials was built on Law No. 21/2014, the Clinical Research Law, which transposed the older EU Clinical Trials Directive (2001/20/EC). While the CTR itself is directly applicable across the EU, there were aspects of national implementation that remained unresolved in Portugal, until now.

Law No. 9/2026 constitutes the third amendment to the Clinical Research Law and establishes the complete legal framework for conducting clinical trials on medicinal products for human use in Portugal under the EU regulation.

“The new Clinical Trials Law updates the Portuguese framework to fully align with the EU Clinical Trials Regulation, reinforcing the roles of INFARMED and CEIC and requiring an integrated scientific and ethics assessment before trial authorization.”

Catarina Pragana, Clinical Research Manager, MDx CRO

Importantly, this is not an isolated development. In December 2025, Portugal also approved Law No. 71/2025, which transposes the MDR (Regulation 2017/745) and IVDR (Regulation 2017/746) into national law for all matters relating to clinical investigations of medical devices and performance studies of IVDs. Together, these two laws signal Portugal’s intention to modernize its entire clinical research ecosystem.

Key Provisions of Law No. 9/2026

1. INFARMED and CEIC: Roles Formalized

The law formally establishes the dual-authority model that the CTR requires at the national level:

Regulatory Responsibilities Under Law No. 9/2026

  • INFARMED (Autoridade Nacional do Medicamento e Produtos de Saúde) is designated as the competent authority responsible for scientific and technical assessment, the national point of contact under the CTR, and the entity issuing the final authorization decision.
  • CEIC (Comissão de Ética para a Investigação Clínica) is designated as the ethics committee responsible for assessing ethical aspects of clinical trial applications, including recruitment materials, informed consent procedures, and evaluation of the study team. CEIC issues a binding opinion.

INFARMED consolidates both assessments and makes the final authorization decision, which must be based on the results of the scientific evaluation and CEIC’s binding ethics opinion.

CEIC may also delegate certain assessments to local Health Ethics Committees that are part of the national network, as long as the requirements of Article 9 of the CTR are observed.

According to Ana Sofia Silva, Clinical Research Specialist at MDx CRO, this clearer structure is a positive development:

“This new structure could speed things up by reducing duplicated communication and paperwork between CEIC and INFARMED. A clearer division of responsibilities usually helps streamline the process”.

2. Submission Through CTIS

All clinical trial applications, including requests for substantial amendments, must be submitted through the EU CTIS portal. As Catarina Pragana notes, “For clinical trials involving medicinal products, all submissions now run through CTIS, the central European system. INFARMED reviews the scientific and technical components, while CEIC is responsible for the ethics assessment.”

INFARMED is responsible for ensuring the coordination between CTIS and Portugal’s existing Registo Nacional de Estudos Clínicos (RNEC), so that national clinical trial information remains integrated and publicly accessible.

For sponsors already familiar with CTIS from other EU markets, this is a familiar process. The key point is that Portugal’s national validation and assessment procedures now fully align with the timelines and workflows established in the CTR.

3. Participant Protection and Informed Consent

Law No. 9/2026 establishes detailed provisions for protecting trial participants that go beyond the general CTR framework:

Informed Consent Rules

  • Minors aged 16+: Their written assent is required in addition to consent from a legal representative. For minors under 16 who can understand the information, their assent must also be obtained (in any form).
  • Emergency inclusion: Participants facing serious or immediate risk to life may be enrolled without prior consent if the research directly relates to their clinical situation, the protocol has been pre-approved by an ethics committee, additional risks are minimal, and consent is obtained as soon as possible afterwards.
  • Incapacitated adults and minors in institutional care: Cannot be enrolled in clinical trials except when non-participation would result in a potential disadvantage to them.
  • Cluster trials (mononational only): Simplified consent procedures may be used for Portugal-only trials, subject to CEIC approval, when the conditions of Article 30 of the CTR are met.

4. Post-Trial Access Obligations

One of the most sponsor-relevant provisions of the new law is Article 14, which establishes a legally binding obligation for sponsors to continue providing investigational medicinal products free of charge after the trial ends.

This obligation applies only if the investigator considers that continued treatment is indispensable for the participant and no therapeutically equivalent alternatives of comparable efficacy and safety are available. The obligation continues until the product becomes accessible through Portugal’s National Health Service (SNS).

Ana Sofia Silva offers a nuanced perspective on what this means in practice:

“Although Article 14 introduces post-trial access requirements, these apply only when the investigator considers that continued treatment is indispensable and no equivalent alternatives exist. This approach is stricter than in most EU countries, where post-trial access is generally addressed through ethics guidance rather than binding national legislation. Since the continuation only applies in clinically justified scenarios, I do not expect it to be a major setback for most sponsors.”

5. Liability Insurance

Sponsors and investigators bear joint and strict liability (independent of fault) for both material and non-material damages caused to trial participants. The law requires mandatory civil liability insurance, though CEIC may waive the requirement of a trial-specific policy for low-intervention trials if the sponsor can demonstrate existing coverage.

An important provision establishes a presumption of causality: any adverse health effects experienced by a participant during the trial or within one year after the end of participation are presumed to be related to the trial, unless proven otherwise. CEIC may extend this period depending on the nature and risk profile of the study.

6. Language Requirements

Understanding the language rules is critical for sponsors preparing their dossier:

Document Type Language Required
Technical dossier (scientific sections) Portuguese or English
Informed consent forms & participant-facing materials Portuguese (mandatory)
Lay summary of trial results Portuguese (mandatory)
Protocol synopsis (Annex I, Section D.24) Portuguese (mandatory)
IMP / auxiliary medicinal product labeling Portuguese (mandatory); English accepted if products are only handled on-site

7. Penalty Framework

The law establishes a sanctions regime that sponsors should factor into their compliance planning:

Key Penalties Under Law No. 9/2026

  • Individuals: Fines from €500 to €50,000
  • Companies: Fines from €5,000 to €750,000
  • Additional sanction: Suspension or prohibition of conducting clinical trials for up to 2 years

Violations include: conducting a trial without authorization, failing to report safety events, non-compliance with GCP, conducting a trial without mandatory insurance, and failing to comply with post-trial access or language requirements.

“Sponsors should always factor potential penalties into their risk planning. But the violations mentioned, running a trial without authorization or not reporting safety events, are serious deviations that should never occur in a well-managed study. Although Portugal’s maximum fines are higher than in many EU countries, similar penalty systems exist across the EU, since all Member States must establish sanctions under the Clinical Trials Regulation.”

Ana Sofia Silva, Clinical Research Specialist, MDx CRO

Practical Impact for Sponsors: What This Means on the Ground

The Approval Workflow

Under the new law, the end-to-end authorization process for a clinical trial in Portugal follows a clearly defined path:

Step-by-Step: Clinical Trial Authorization in Portugal

  • Step 1. Submission via CTIS: The sponsor submits the application dossier through the EU portal, including all elements required by Annex I of the CTR.
  • Step 2. Validation: INFARMED validates the dossier completeness, consulting CEIC on the elements within its scope (sections K, L, M, N, O, P, and R of Annex I).
  • Step 3. Assessment: INFARMED assesses the scientific/technical aspects (Part I). CEIC assesses the ethical aspects (Part I ethical elements + Part II).
  • Step 4. Consolidation: INFARMED consolidates both assessments within CTR timelines.
  • Step 5. Decision: INFARMED issues the final authorization decision, based on the consolidated assessment and CEIC’s binding opinion.

Contract Requirements

The law requires sponsors to execute a contract with each clinical trial site that covers the financial arrangements and other terms referenced in Section P of Annex I of the CTR. These terms are assessed as part of the authorization procedure. The contract can be finalized before, during, or immediately after the authorization notification, but it only takes effect after authorization is granted.

A Competitive Edge: Shorter Timelines for Mononational Trials

Article 30 of Law No. 9/2026 authorizes the Portuguese government to set maximum timelines that are shorter than those established in the CTR for clinical trials conducted exclusively in Portugal. While the specific reduced timelines are yet to be defined by ministerial order, this provision creates a potential competitive advantage for attracting single-country studies to Portugal.

“I think shorter timelines for mononational trials could be seen as a competitive advantage for Portugal.”

Ana Sofia Silva, Clinical Research Specialist, MDx CRO

Fee Exemptions

Non-commercial clinical trials and investigator-initiated trials are exempt from the assessment fees. Until the new fee schedule is published (expected via ministerial order within 30 days of the law’s entry into force), the existing fees from Portaria 63/2015 remain applicable.

Portugal as a Clinical Trial Destination: The Bigger Picture

Law No. 9/2026 does not exist in isolation. Over the past two years, Portugal has been building a more comprehensive and attractive framework for clinical research:

April 2014
Law 21/2014: Portugal’s original Clinical Research Law enacted
January 2022
EU Clinical Trials Regulation (536/2014) became applicable and CTIS was lauched
January 2025
CTIS mandatory for all new clinical trial applications in the EU
December 2025
Law 71/2025 National implementation of MDR and IVDR for clinical investigations of medical devices and IVD performance studies
February 2026
CEIC publishes new Financial Agreement Template for medical device clinical investigations
March 2026
Law 9/2026 National implementation of EU CTR for clinical trials of medicinal products
April 5, 2026
Law 9/2026 enters into force

The pattern is clear: Portugal is modernizing its regulatory infrastructure across both pharmaceuticals and medical devices simultaneously. The creation of AICIB (Agência de Investigação Clínica e Inovação Biomédica) and the launch of the Portugal Clinical Studies platform are additional signals that the country is actively positioning itself to attract more international clinical research.

“Interest seems to be increasing compared to a few years ago, although there is still work to do to make the country more competitive overall.”

Ana Sofia Silva, Clinical Research Specialist, MDx CRO

Practical Considerations: What Sponsors Should Know

Portugal is becoming an increasingly attractive destination for clinical trials thanks to a more streamlined and transparent regulatory framework. However, beyond regulatory improvements, sponsors should carefully consider key operational factors to ensure successful study execution.

According to Ana Sofia Silva, the Portuguese clinical research landscape still shows a stronger familiarity with traditional drug trials compared to medical device (MD) and in vitro diagnostic (IVD) investigations. This means that when MD or IVD studies are introduced, clinical sites may require additional guidance and support, as these types of studies are less common in the local market.

Another important factor is the contracting process with Portuguese hospitals, which can be slower than expected. This can have a direct impact on study timelines, making early planning essential for sponsors aiming to avoid delays.

Our Clinical Research Specialist highlights three key recommendations for sponsors planning clinical trials in Portugal under the new regulatory framework:

  • Take advantage of a more efficient approval process: The updated INFARMED and CEIC structure is designed to streamline submissions and accelerate approvals.
  • Start site selection and contracting early: Given the potential delays in hospital agreements, early initiation of these processes is critical.
  • Plan realistic budgets and site support: Many clinical sites face staffing constraints, so adequate compensation per participant and proper resource allocation are essential to maintain engagement and performance.

By aligning regulatory expectations with operational realities, sponsors can better position their clinical trials for success in Portugal, optimizing both timelines and site collaboration.

What Sponsors Should Do Now Portugal’s New Clinical Trials Law

With the law entering into force on April 5, 2026, sponsors planning or conducting clinical trials in Portugal should take several practical steps:

  1. Review your internal procedures to ensure alignment with the new dual-authority model (INFARMED for scientific assessment, CEIC for ethics).
  2. Ensure your CTIS workflows account for Portugal-specific validation requirements, particularly CEIC’s role in validating Annex I sections K through R.
  3. Check your insurance coverage mandatory civil liability insurance is required, with a one-year post-trial presumption of causation.
  4. Prepare Portuguese translations of all participant-facing materials, including informed consent forms, lay summaries, and labeling.
  5. Budget for post-trial access obligations particularly when no suitable therapeutic alternatives to the investigational product are available in Portugal.
  6. Begin site qualification and contracting early hospital contracting in Portugal can be slow, and many sites face resource constraints.
  7. Monitor secondary legislation the new fee schedule and IMP manufacturing requirements are expected via ministerial order in the coming weeks.

Frequently Asked Questions

When does Portugal’s new clinical trials law enter into force?

Law 9/2026 was published on March 6, 2026 and enters into force 30 days later, on April 5, 2026.

Which authority approves clinical trials in Portugal?

INFARMED issues the final authorization decision, based on its own scientific/technical assessment and the binding ethics opinion from CEIC. All applications must be submitted through the EU CTIS portal.

Are sponsors required to provide post-trial access to investigational products?

Under Article 14, sponsors must continue providing investigational medicinal products free of charge when the investigator considers continued treatment indispensable and no equivalent alternatives are available. This obligation continues until the product is commercially accessible through Portugal’s National Health Service.

What are the penalties for non-compliance?

Fines range from €500 to €50,000 for individuals and from €5,000 to €750,000 for companies. Authorities may also suspend or prohibit a company from conducting clinical trials for up to two years.

Can clinical trial documents be submitted in English?

The technical dossier can be submitted in Portuguese or English. However, all participant-facing documents (informed consent, lay summaries, protocol synopsis) must be in Portuguese.

Does Portugal offer faster timelines for local-only trials?

Yes. Article 30 allows the government to set shorter maximum timelines for trials conducted exclusively in Portugal. The specific reduced timelines are pending a ministerial order.

Does this law affect medical device clinical investigations?

No. Law No. 9/2026 applies specifically to clinical trials on medicinal products for human use. Clinical investigations of medical devices and performance studies of in vitro diagnostic devices are governed primarily by the EU Medical Device Regulation (MDR) 2017/745 and the EU In Vitro Diagnostic Regulation (IVDR) 2017/746, which are implemented in Portugal through Law No. 71/2025.

Planning a Clinical Trial in Portugal?

MDx CRO supports sponsors with regulatory strategy, clinical trial submissions, and clinical research management across the EU. Get in touch to discuss how we can help you navigate Portugal’s regulatory framework.

Contact Our Team
Written by:
Ana Sofia Silva PhD.

Ana Sofia Silva PhD.

Clinical Research Specialist

Ana Sofia Silva joins MDx as a Clinical Research Specialist, bringing a strong scientific background and hands‑on experience in clinical operations across Europe.
Industry Insights & Regulatory Updates

IMDRF Draft N91 2026: New Clinical Evidence Requirements for IVDs Explained

The International Medical Device Regulators Forum (IMDRF) has released a significant new draft guidance, IMDRF/CEIVD WG/N91: Clinical Evidence for IVD Medical Devices, Definitions and Principles of Performance Evaluation, open for public consultation from 4 March to 5 May 2026. For IVD manufacturers, regulatory affairs teams, and companion diagnostic developers, this is not a minor update. It is a comprehensive reset of the global reference framework for how clinical evidence is defined, generated, documented, and defended.

This article breaks down what N91 actually changes, what it means for different types of manufacturers, and based on Carlos Galamba’s experience supporting IVDR submissions and CDx programs at MDx CRO, what practical steps teams should be taking right now.

Why this matters now?

The IMDRF consultation opened on 4 March 2026 and closes on 5 May 2026. Manufacturers with products in development, legacy portfolios under review, CDx programs in progress, or AI-based IVDs in any stage should read this draft carefully, and consider submitting comments before the deadline.

IMDRF N91 is A Framework Reset, Not Just a Revision

IMDRF N91 is a draft guidance document developed by the IMDRF Clinical Evidence for IVD Devices Working Group. Its full title is Clinical Evidence for IVD Medical Devices, Definitions and Principles of Performance Evaluation, and it represents the most significant update to the global IVD clinical evidence framework since the original GHTF documents were published.

The document runs to 31 pages and introduces 17 defined terms, consolidating vocabulary that has historically been inconsistent across jurisdictions. More importantly, it establishes a lifecycle-based model for clinical evidence that goes beyond premarket evidence generation and explicitly links performance evaluation to intended purpose, state of the art, and post-market updates.

What it supersedes

IMDRF N91 replaces both:

  • GHTF/SG5/N6:2012 Clinical Evidence for IVD Medical Devices: Scientific Validity Determination and Performance Studies for IVD Medical Devices
  • GHTF/SG5/N7:2012 Clinical Evidence for IVD Medical Devices: Key Definitions and Concepts

These two documents have been the global reference point for IVD clinical evidence since 2012. Replacing them with a single updated framework is a significant consolidation.

IMDRF’s role in the regulatory landscape

IMDRF is not a legislative body. Its guidance documents are not legally binding. However, they carry significant weight because they are developed by the regulatory agencies of major markets, including the European Commission, the FDA, Health Canada, the TGA (Australia), PMDA (Japan), and others. MDCG documents (which govern EU IVDR interpretation) explicitly reference IMDRF concepts, and regulatory reviewers at Notified Bodies and competent authorities routinely use IMDRF frameworks as reference benchmarks.

In practice, this means that once an IMDRF guidance is finalized, manufacturers that are not aligned with it will increasingly face questions during technical reviews, audits, and submissions, even if the guidance is not formally cited as a legal requirement.

“In my experience, serious regulatory teams start aligning almost immediately, even before formal citation becomes routine. Active referencing in reviewer templates, training, and audit language often takes somewhere between 6 and 18 months, depending on jurisdiction and organization. My advice is not to wait for formal enforcement language, if the direction is clear, start aligning your evidence strategy now”.

Carlos Galamba, CEO MDx

The Three Pillars of Clinical Evidence Under IMDRF N91

N91 formalizes and aligns with the three-pillar structure already embedded in EU IVDR: scientific validity, analytical performance, and clinical performance. Together, these constitute the clinical evidence that manufacturers must generate, document, and maintain across the device lifecycle.

Understanding each pillar, and where manufacturers routinely fall short, is essential for teams planning their evidence strategy.

Scientific Validity: Establishing the Biomarker Association

Scientific validity addresses whether the analyte being measured is genuinely associated with the clinical condition or physiological state the device is intended to detect. For many established biomarkers, this is largely a literature-based exercise. For novel biomarkers, it is a substantial research task that must begin much earlier than most teams expect.

As Carlos Galamba notes: “In the context of CDx, this work should start as early as biomarker selection and intended-use definition. Under IVDR, the performance evaluation plan is supposed to map the development phases and the sequence for establishing scientific validity, analytical performance, and clinical performance, so this work really starts at the translational stage, not at the submission stage.”

N91 makes clear that scientific validity cannot be assumed. It must be documented, and for novel analytes without established clinical consensus, the absence of scientific validity will block the entire evidence pathway.

Analytical Performance: what IVD manufacturers Most Often Underestimate

Analytical performance covers the device’s ability to accurately and reliably detect or measure the analyte, including precision, reproducibility, cut-off justification, specimen stability, pre-analytical factors, interference, and comparability.

According to Carlos Galamba, this is the pillar that IVD manufacturers most frequently underprepare: “When dealing with clinical trial assays or CDx, teams are usually very focused on the biomarker story and the drug program, so they assume the assay can be optimized later. In reality, regulators often scrutinize analytical robustness first. IVDR itself already requires manufacturers to build the evidence case across all three pillars, not just clinical performance.”

This is a pattern MDx CRO encounters regularly, particularly in CDx programs where the clinical hypothesis is well-developed but the analytical package is treated as an afterthought. N91 reinforces that regulators, including Notified Bodies and the FDA, will assess analytical performance in depth, not simply accept it as a technical formality.

Clinical Performance: What Documentation Is Required vs. What Evidence Must Be Generated

Clinical performance refers to the device’s ability to yield results that correlate with a clinical condition in the intended patient population. N91 clarifies an important distinction that has significant operational implications: manufacturers must always document clinical performance, but they do not always need to generate new evidence through a prospective study.

Whether new evidence is required depends on the device’s risk class, novelty of the analyte, intended use population, and available published data. This mirrors the IVDR framework, where existing literature, registry data, and published experiences from routine diagnostic use can contribute to the clinical performance evidence base, if they are sufficient and methodologically sound.

For more detail on how clinical performance studies are designed and conducted under IVDR, see our guide: Running Clinical Studies Under IVDR: What You Need to Know.

Software as an IVD (SaIVD) and AI/ML: What IMDRF N91 Changes

One of the most substantive additions in N91 is its dedicated section on Software as an IVD (SaIVD), including IVDs that incorporate AI and machine learning. This reflects a genuine regulatory gap: the 2012 GHTF documents predated the widespread deployment of AI-based diagnostics, and manufacturers have been operating without a clear global framework for what clinical evidence looks like for these products.

N91 requires manufacturers of AI-based SaIVDs to address: data lifecycle traceability, performance drift monitoring, transparency of AI outputs, and documentation of the transition point at which AI recommendations are reviewed by qualified healthcare professionals. Critically, N91 affirms that final clinical decisions must always rest with qualified healthcare professionals, not with the AI system itself.

The Most Common Mistake in AI-Based IVD Evidence Packages

Carlos Galamba identifies a pattern he sees repeatedly in AI-based IVD programs: “The most common mistake is treating algorithm accuracy as if that alone were clinical evidence. For AI-based IVDs, you also need to show data provenance, representativeness, version control, performance across real-world input scenarios, monitoring for drift, and transparency about limitations. The IMDRF draft is quite clear that for AI-based SaIVD, manufacturers should document the whole data lifecycle, manage AI-specific failure modes, monitor post-market drift, and make outputs interpretable enough for human oversight.”

This is a significant operational gap for many software and AI companies entering the IVD space. Algorithm performance metrics, sensitivity, specificity, AUC, are necessary but not sufficient. N91 signals that regulators will expect a much broader evidence architecture for these products.

For related reading on IMDRF’s approach to AI in medical devices, see: IMDRF Machine Learning-enabled Medical Devices: Key Terms and Definitions.

IMDRF N91 and Companion Diagnostics: Co-Development, Cut-Off Locking, and Clinical Bridging

Companion diagnostics (CDx) receive dedicated and substantially more detailed treatment in N91 than in the 2012 GHTF documents. This reflects both the growing regulatory complexity of CDx programs globally and the specific challenges that arise when an IVD must be co-developed alongside, and validated in the context of, a therapeutic clinical trial.

N91 explicitly addresses the relationship between the CDx and its linked drug program, including clinical trial design considerations (therapy stratification vs. therapy selection), the role of the companion diagnostic in defining the eligible patient population, and the use of bridging studies to establish comparability between a clinical trial assay and the final commercial CDx.

The Hardest Practical Challenge in CDx development: Timeline Alignment

The core operational difficulty in CDx development is well-known to anyone who has run a real program. As Carlos Galamba describes it: “The hardest part is usually locking the assay and its cut-off early enough for the drug trial, while still leaving room to evolve toward the final commercial CDx. In practice, teams want flexibility during early clinical development, but regulators want traceability, reproducibility, and a defensible bridge to the final device. That tension is what makes CDx programs operationally difficult.”

N91 does not resolve this tension, but it does provide a clearer framework for documenting the development pathway, which is ultimately what Notified Bodies and regulatory authorities are looking for.

Clinical Bridging Studies: Where Evidence Packages Break Down

When a bridging study is required, linking a clinical trial assay to a subsequent commercial CDx, manufacturers frequently arrive at submission with incomplete packages. Based on Carlos Galamba’s experience with CDx submissions: “The common gaps are weak analytical comparability, poor justification for cut-off transfer, insufficient specimen representativeness, and incomplete explanation of discordant results. IMDRF N91 now directly recognizes bridging from a clinical trial assay to a subsequent CDx and says the study should establish clinical comparability using direct or indirect data.”

N91’s explicit recognition of bridging is significant because it gives regulatory teams a defined framework to reference, and it sets expectations that regulators in IMDRF member jurisdictions will increasingly apply.

For a step-by-step guide to CDx performance studies under IVDR, see: IVDR Annex XIV Performance Studies for Companion Diagnostics: A Step-by-Step Guide 2026.

IMDRF N91 vs. IVDR: What Changes for EU-Compliant Manufacturers?

A practical question for manufacturers already operating under IVDR: does N91 require significant additional work?

The short answer, according to Carlos Galamba, is no, with important nuances: “For a manufacturer that is genuinely IVDR-compliant, N91 should not feel like a reinvention. IVDR already requires clinical evidence based on scientific validity, analytical performance, and clinical performance, supported by a continuous performance-evaluation process tied to intended purpose and updated over the lifecycle. The additional work is mostly in tightening structure, terminology, and rationale, especially for software, AI, and CDx.”

The key phrase here is “genuinely IVDR-compliant.” Many manufacturers have documentation that is technically complete but not logically structured around intended use, clinical benefit, and lifecycle evidence updates, the elements N91 makes more central. For those teams, N91 is a useful diagnostic tool for identifying where their evidence architecture needs strengthening.

For EU manufacturers, it is also worth noting that IMDRF is referenced in MDCG documents, and MDCG has in some cases explicitly built on or endorsed IMDRF concepts. While IVDR remains the legally binding framework in the EU, alignment with IMDRF guidance is increasingly reflected in Notified Body expectations.

For clinical evidence requirements under IVDR specifically, see: MedTech Europe IVDR Clinical Evidence Requirements

Where additional work may be required

AreaLikely additional work for IVDR-compliant manufacturers
SaIVD / AI-based IVDsN91 adds specificity on data lifecycle documentation, drift monitoring protocols, and transparency requirements that may exceed current IVDR technical file scope
Companion diagnosticsBridging study documentation and cut-off transfer justification may need to be more formally structured against N91 requirements
Legacy portfoliosEvidence packages that are technically complete but not logically structured around intended use and clinical benefit may need restructuring
Terminology alignmentN91 introduces 17 defined terms. Ensuring internal documentation uses consistent, N91-aligned terminology will reduce reviewer friction

Who Is Most Exposed by IMDRF N91?

Not all manufacturers face the same level of exposure from N91’s new requirements. Based on Carlos Galamba’s assessment: “The most exposed are probably legacy portfolio holders and AI/software IVD developers. Legacy manufacturers often have evidence packages that are technically complete but not logically structured around intended use, clinical benefit, and lifecycle updates. AI and software companies face extra complexity because N91 explicitly addresses data lifecycle, drift, transparency, and the need for ongoing re-verification. CDx developers are also highly exposed because of the added bridging and co-development challenges.”

Startups building new products from scratch arguably face less disruption, if they build their evidence strategy around N91 from day one, they are building to the standard rather than retrofitting to it.

3 Actions to Take Before IMDRF Consultation Closes on 5 May 2026

N91 is unambiguous: clinical evidence is a lifecycle activity, not a premarket deliverable. If your organization’s evidence strategy is still organized around submission milestones rather than continuous performance evaluation and intended-use discipline, this is the moment to change that.

The IMDRF consultation for N91 is open until 5 May 2026. This is a genuine opportunity for IVD manufacturers to shape the final guidance. Carlos Galamba’s recommendation for teams reading N91 today:

“First, run a structured gap assessment against the draft using your current intended uses, performance evaluation reports, and evidence-generation plans. Second, identify where the draft creates operational friction for your products, especially if you work in CDx, AI/software, NGS, decentralized testing, or legacy portfolios, and submit concrete comments. Third, check whether your evidence strategy is truly lifecycle-based, or whether it is still a premarket-only mindset.”

How to prepare Before IMDRF Consultation Closes

  1. Run a structured gap assessment

    Map your current intended uses, performance evaluation reports, and evidence-generation plans against the N91 draft. Focus specifically on: how your three-pillar evidence is documented and whether it is genuinely tied to intended purpose; whether your SaIVD or AI products have data lifecycle and drift monitoring documentation; and whether your CDx bridging evidence is structured in a way that satisfies the comparability requirements in N91’s Section 7.

  2. Identify operational friction and submit comments

    The public consultation is a genuine opportunity to shape the final guidance. Manufacturers should identify where N91 creates operational friction for their specific product types, particularly in CDx, AI/software, NGS, decentralized testing, or legacy portfolios, and submit concrete, technically grounded comments to IMDRF before 5 May 2026

  3. Audit your evidence mindset

    N91 is unambiguous: clinical evidence is a lifecycle activity, not a premarket deliverable. If your organization’s evidence strategy is still organized around submission milestones rather than continuous performance evaluation and intended-use discipline, this is the moment to change that.

The consultation period closes 5 May 2026. Feedback can be submitted via the IMDRF consultation page.

If your team needs support conducting a structured gap assessment or preparing a pre-submission technical review, MDx CRO’s IVDR Pre-Submission Assessment service is designed exactly for this type of exercise.

How MDx Can Help

MDx CRO combines 18+ years of IVD regulatory expertise with hands-on experience at Notified Bodies, European Commission advisory roles, and operational leadership across Class C/D IVDs, CDx, NGS, and AI-based diagnostic software. Our team has supported hundreds of IVDR submissions and continues to track global regulatory developments including IMDRF consultations in real time.

Whether you are running a gap assessment against the N91 draft, building your CDx evidence strategy, preparing for IVDR submission, or developing a clinical evidence plan for an AI-based IVD, our team can provide the regulatory depth and operational experience to move efficiently.

Ready to align with IMDRF N91?

Contact MDx CRO to discuss a structured gap assessment against the N91 draft, or to review your current clinical evidence strategy before the consultation closes on 5 May 2026.

Frequently Asked Questions

What is IMDRF N91 and why does it matter for IVD manufacturers?

IMDRF N91 is the 2026 draft document Clinical Evidence for IVD Medical Devices, Definitions and Principles of Performance Evaluation. Open for public consultation from 4 March to 5 May 2026, it supersedes the 2012 GHTF N6 and N7 documents. It matters because it updates the global reference framework for how manufacturers should define, generate, document, and defend IVD clinical evidence, including for modern areas like software, AI, and companion diagnostics.

Does IMDRF N91 replace IVDR clinical evidence requirements?

No. EU IVDR 2017/746 remains the legally binding framework in the EU. IMDRF N91 is best understood as a global convergence guidance document that is highly relevant to IVDR because the core architecture is already aligned: intended purpose, scientific validity, analytical performance, clinical performance, lifecycle updating, and state of the art. IMDRF is referenced in MDCG documents, and the binding framework in the EU remains MDR/IVDR, not IMDRF itself.

What are the three pillars of clinical evidence in IMDRF N91?

Scientific validity (establishing the association between the analyte and a clinical condition), analytical performance (the ability of the IVD to detect or measure the analyte correctly), and clinical performance (the ability of the IVD to yield results that correlate with a clinical condition in the target population). All three must be addressed in an integrated performance evaluation strategy tied to the device’s intended purpose.

Does IMDRF N91 apply to AI-based diagnostic software?

Yes. N91 includes a dedicated section on Software as an IVD (SaIVD) that explicitly addresses AI and machine learning-based devices. Requirements include data lifecycle documentation, performance drift monitoring, AI transparency, version control, and the principle that final clinical decisions must rest with qualified healthcare professionals.

What is a clinical bridging study and why does N91 address it?

A clinical bridging study is used to link a new commercial CDx to an existing clinical trial assay that was used during a drug’s pivotal study. N91 formally recognizes this approach and requires that bridging studies establish clinical comparability using direct or indirect comparability data. This addresses a significant gap in the existing regulatory framework for CDx development.

When does IMDRF N91 come into effect?

N91 is currently in public consultation, which closes on 5 May 2026. The guidance will be finalized after comments are reviewed. It is not currently in force, but manufacturers who align with it proactively will be better positioned as Notified Bodies and regulatory agencies begin referencing it in reviews, training, and audit frameworks, which typically occurs 6 to 18 months after finalization.

What is a scientific validity report and is it required under IMDRF N91?

A scientific validity report (SVR) documents the established association between an analyte and a specific clinical condition, physiological state, or intended use. It forms the foundation of the clinical evidence package. Under IVDR Annex XIII, an SVR is already a mandatory component of technical documentation for IVDs. N91 reinforces this requirement globally and provides updated definitions and expectations for how scientific validity should be determined and documented.

Written by:
Carlos Galamba

Carlos Galamba

CEO

Senior regulatory leader and former BSI IVDR reviewer with deep experience in CE marking high-risk IVDs, companion diagnostics, and IVDR implementation.
Industry Insights & Regulatory Updates

EU AI Act and Medical Devices: What SaMD Developers Need to Know (2026)

The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and is being phased in progressively through 2026 and beyond. For companies developing AI-powered Software as a Medical Device (SaMD), it introduces a second, overlapping regulatory obligation that runs alongside, and interacts with, the existing requirements of EU MDR and IVDR.

This is not a distant compliance horizon. The provisions most relevant to medical device AI became applicable from August 2026. Companies that have not yet assessed their AI systems against the AI Act risk gaps in their technical documentation and conformity processes at exactly the moment Notified Bodies are beginning to incorporate AI Act considerations into their assessments.

This guide explains what the AI Act requires from SaMD developers, how it interacts with MDR and IVDR, and what practical steps manufacturers should be taking now.

For general SaMD MDR compliance, see our SaMD EU MDR Compliance Guide

1. Does the AI Act Apply to Your Software?

The AI Act applies to AI systems placed on the market or put into service in the EU. An AI system is defined as a machine-based system that, given explicit or implicit objectives, infers from inputs how to generate outputs such as predictions, content, recommendations, or decisions that can influence real or virtual environments.

This definition is intentionally broad. It covers:

  • Machine learning models (supervised, unsupervised, reinforcement learning)
  • Deep learning systems including convolutional neural networks used in medical imaging
  • Natural language processing tools used in clinical documentation or decision support
  • Bayesian classifiers and other probabilistic inference systems

It does not cover:

  • Traditional rule-based software with no learning or inference component
  • Software that executes fixed logic without adaptive behaviour

If your SaMD uses any form of machine learning or statistical inference to generate clinical outputs, the AI Act almost certainly applies.

2. High-Risk AI Classification for Medical Devices

The AI Act categorises AI systems by risk level. For medical device manufacturers, the critical category is high-risk AI.

Under Annex III of the AI Act, AI systems intended to be used as safety components of medical devices, or which are themselves medical devices regulated under MDR or IVDR, are automatically classified as high-risk AI.

This means: if your SaMD is a CE-marked medical device or IVD, or is a software component that performs a safety function within one, it is high-risk AI under the AI Act. There is no further classification analysis required, the medical device status determines it.

High-risk AI systems are subject to the full obligations of the AI Act, including:

  • Risk management system: an AI-specific risk management process, documented and integrated with the ISO 14971 risk management already required under MDR
  • Data and data governance: training, validation, and testing datasets must be relevant, representative, free of errors, and sufficiently complete; demographic and geographic representativeness must be documented
  • Technical documentation: a detailed record of the AI system’s design, development process, training methodology, validation approach, and performance characteristics
  • Transparency and instructions for use: users must be provided with clear information about the AI system’s capabilities, limitations, accuracy metrics, and circumstances under which human oversight is required
  • Human oversight: the system must be designed to allow human oversight and intervention; it must not undermine the ability of the operator or user to override, disregard, or reverse outputs
  • Accuracy, robustness, and cybersecurity: performance must be declared and validated; the system must be resilient to errors, faults, and adversarial manipulation
  • Conformity assessment: high-risk AI systems must undergo a conformity assessment before being placed on the market

3. How the AI Act Interacts with MDR and IVDR

This is where the compliance picture becomes complex, and where early planning pays off.

The AI Act does not replace MDR or IVDR. Both regulatory frameworks apply simultaneously to AI-powered SaMD. However, the EU has designed a streamlined pathway for medical devices that are already subject to Notified Body review under MDR or IVDR.

Under Article 11 and Annex II of the AI Act, AI systems that are regulated as medical devices benefit from a single technical documentation approach meaning the AI Act technical documentation requirements can be integrated into the existing MDR/IVDR technical file rather than creating a separate document set.

Similarly, for Class IIb and III medical devices (MDR) and Class C and D IVDs (IVDR) which are the most likely to contain high-risk AI the Notified Body involvement already required under MDR/IVDR can cover the AI Act conformity assessment. The Notified Body acts as the relevant conformity assessment body for both frameworks.

In practice this means:

What changes for AI-powered SaMD under the AI Act:

  • Technical documentation must now explicitly address AI-specific elements: training data governance, model validation across subgroups, bias assessment, explainability approach, and human oversight mechanisms
  • Post-market monitoring must include AI performance monitoring tracking model drift, accuracy degradation over time, and distribution shift in real-world data
  • Transparency obligations require new IFU content describing AI limitations and human oversight requirements
  • A fundamental rights impact assessment may be required for certain high-risk AI applications in healthcare

What does not change:

  • The MDR/IVDR conformity assessment route remains the primary pathway
  • The Notified Body relationship established for MDR/IVDR CE marking remains the relevant body
  • ISO 14971 risk management, IEC 62304 lifecycle management, and clinical evaluation requirements are unchanged AI Act risk management is additive, not a replacement

4. General Purpose AI (GPAI) Models in Medical Devices

A separate and increasingly relevant category is General Purpose AI (GPAI) large foundation models or multimodal AI systems that can be adapted or fine-tuned for specific applications.

If a SaMD developer is building on top of a GPAI model: for example, fine-tuning a large language model for clinical documentation, or adapting a vision foundation model for medical image analysis both the GPAI model provider and the SaMD developer have obligations under the AI Act.

GPAI model providers must publish technical documentation and comply with copyright and transparency requirements. SaMD developers who deploy or fine-tune GPAI models are responsible for ensuring the resulting system meets all high-risk AI obligations, including data governance, validation, and clinical performance claims. The validation methodology for fine-tuned GPAI models in medical contexts is an area where regulatory guidance is still developing, early engagement with your Notified Body is strongly recommended.

5. Key Timelines

August 2024: AI Act enters into force.

February 2025: Prohibitions on unacceptable-risk AI systems apply. Not directly relevant for medical SaMD, but important for any AI used in patient-facing administrative processes.

August 2025: GPAI model obligations apply. SaMD developers building on foundation models must assess their exposure now.

August 2026: High-risk AI obligations fully apply. This is the key deadline for medical device AI. From this date, new AI-powered SaMD placed on the EU market must comply with all high-risk AI requirements.

Post-2026: Notified Bodies designated under the AI Act will begin conducting AI Act-specific conformity assessments. The intersection with MDR/IVDR NB assessments will become a standard part of the conformity process.

6. What to Do Now: A Practical Checklist

Classify your AI systems. Identify every AI component in your SaMD portfolio and confirm whether it meets the EU’s definition of an AI system. For each, document the risk classification and the rationale.

Assess your technical documentation gaps. Review your existing MDR/IVDR technical files against the AI Act Annex IV requirements. Identify where AI-specific content, training data documentation, bias assessment, explainability approach, is missing or insufficient.

Review your data governance. The AI Act’s requirements for training data representativeness and bias documentation are more explicit than anything in MDR. If your training data governance is not documented at the level the AI Act requires, this is a gap that needs addressing before your next Notified Body audit.

Update your IFU and labelling. Transparency obligations mean users must be explicitly informed about AI limitations, performance metrics across relevant subgroups, and circumstances requiring human override. Most current SaMD IFUs are not written to this standard.

Engage your Notified Body. Ask your NB directly how they are approaching AI Act integration into MDR/IVDR assessments. Different NBs are at different stages of readiness, and early clarity on what they will expect prevents last-minute documentation gaps.

Build AI performance monitoring into your PMS. Post-market surveillance for AI-powered SaMD must now track model performance over time. If your PMS plan does not include AI-specific monitoring metrics, update it before August 2026.

Read more about Software, Digital Health and AI services.

Frequently Asked Questions: EU AI Act and Medical Devices

What is the difference between the EU AI Act and the MDR for medical device AI?

The MDR (Medical Device Regulation) governs the safety, efficacy, and quality of medical devices, including those powered by AI. The EU AI Act is a separate regulatory framework that addresses the risks and accountability of AI systems themselves. The AI Act focuses on how the AI system was built, trained, validated, and deployed, while MDR focuses on the clinical performance of the device. Both apply simultaneously to AI-powered SaMD from August 2026 onwards.

Does the AI Act apply to all machine learning models in medical devices?

Yes, if you use any form of machine learning, deep learning, or statistical inference to generate clinical outputs, the AI Act applies. This includes supervised learning, convolutional neural networks for medical imaging, natural language processing for clinical documentation, and Bayesian classifiers. It does NOT apply to traditional rule-based software with fixed logic and no learning or inference capability

What does ‘high-risk AI’ mean under the EU AI Act?

High-risk AI includes AI systems that are themselves medical devices or safety components of medical devices regulated under MDR, or AI systems regulated under IVDR. If your SaMD is CE-marked or classified as a medical device, it is automatically classified as high-risk AI. High-risk AI must comply with all AI Act obligations: risk management, data governance, technical documentation, transparency, human oversight, and conformity assessment.

What are the data governance requirements under the AI Act?

The AI Act requires explicit documentation that training, validation, and testing datasets are relevant, representative, free of errors and bias, and sufficiently complete. Demographic and geographic representativeness must be documented, particularly important for medical AI to ensure performance across age, sex, ethnicity, and geography. This is more explicit than MDR alone.

What are the human oversight requirements under the AI Act?

High-risk AI systems must be designed to enable human oversight and intervention. Users must be able to override, disregard, or reverse the AI’s decision, and the system must not undermine this ability. For clinical SaMD, this typically means the AI operates in decision-support mode and clinicians retain authority to override recommendations.

When do I need to comply with the AI Act?

August 2026 is the key deadline for medical device AI. From this date, all new AI-powered SaMD placed on the EU market must comply with high-risk AI requirements, Notified Bodies will incorporate AI Act assessments into MDR/IVDR reviews, and technical documentation must include AI-specific content.

Medical professionals at a webinar discussing AI in medical devices, focusing on clinical evaluation, evidence, and regulatory compliance for SaMD development.
Written by:
Diego Rodríguez Muñoz, PhD

Diego Rodríguez Muñoz, PhD

RA Specialist

Regulatory affairs specialist & CRA with expertise in EU MDR/IVDR, CE marking, Biological Evaluations (dental), and clinical investigations & technical documentation for MDs & IVDs.
Industry Insights & Regulatory Updates

EU MDR 2017/745 for Dental Devices: Complete Guide (2026)

Dental device regulation under EU MDR 2017/745 has increased the level of scrutiny applied to manufacturers, particularly in three areas: classification decisions, clinical evidence, and Notified Body (NB) review readiness. The practical consequence is simple: submissions that lack internal consistency generate more questions, longer review cycles, and avoidable delays.

In the 2026 webinar delivered by regulatory experts from MDx CRO, the discussion focused on the most common challenges and the most reliable strategies for dental device manufacturers. The insights were grounded in real-world regulatory work supporting more than 500 CE-marked devices, with an emphasis on reducing regulatory risk and building submissions that remain defensible under NB assessment.

Manufacturer priorities under EU MDR: what drives timelines and outcomes

EU MDR does not typically create delays because manufacturers do not have documents. Delays occur when documentation does not form a single, defensible position. Notified Bodies escalate questions when claims, classification rationale, risk controls, clinical evidence, and post-market plans do not support the same intended purpose and performance narrative.

Key priorities for dental device manufacturers under EU MDR:

  • Establish and maintain a consistent intended purpose and claim set across the file (labeling, IFU, CER, and technical documentation).
  • Build a classification rationale that is explicit, referenced, and difficult to misinterpret.
  • Demonstrate clinical evidence proportionality, clearly linked to risk, novelty, and claims.
  • Prepare for NB review with a coherent evidence package, including traceability from hazards to controls to verification.
  • Ensure PMS and PMCF are designed to confirm performance and safety in real use, not to satisfy a formal requirement.

A submission is reviewed as an argument supported by evidence. When the argument changes between sections of the file, the NB must resolve the conflict through questions. That process is where time is lost.

Step 1. Classify your dental device correctly (Annex VIII)

Classification under Annex VIII is the point where regulatory strategy becomes operational. A small change in intended purpose or in device characteristics can shift the class and materially change clinical evidence expectations, NB involvement, and post-market obligations.

In the webinar, the discussion repeatedly returned to the importance of early discipline around intended purpose. Dental manufacturers often broaden claims for commercial reasons (for example, broad “compatibility” claims or biologically ambitious performance language). Under MDR, that approach frequently increases the burden of proof.

Practical classification anchors in dental:

  • Implants and implantable devices frequently fall under Rule 8, with class outcomes dependent on specific characteristics and risk context.
  • Resorbable materials often face elevated scrutiny because performance and safety evolve as the product degrades and interacts with tissue.
  • Custom-made versus patient-matched frequently causes misclassification and incorrect pathway selection, particularly in digital workflows.
  • Software classification under Rule 11 can change significantly based on clinical impact and decision influence.

A defensible classification process typically answers these questions explicitly:

  • What is the intended purpose and what claims are being made?
  • Is the device invasive, and if so, what level of invasiveness applies?
  • What is the duration of use and the relevant contact type?
  • Is the device implantable, resorbable, or otherwise associated with long-term biological interaction?
  • Does the device incorporate a medicinal substance with an ancillary action?
  • Is any element of the product regulated as software influencing clinical decisions?

Classification is assessed as a justification, not a label. A strong justification reduces NB discretion and stabilises the remainder of the submission.

Step 2. Conformity assessment route by class, and how Notified Bodies evaluate risk

Manufacturers often plan around the conformity assessment route, but Notified Bodies allocate effort based on what drives residual risk and uncertainty. Under MDR, two devices of the same class can attract different levels of scrutiny when novelty, claim strength, or evidence quality differs.

In dental, common drivers of NB scrutiny include:

  • Novel materials and surface treatments particularly where particulate generation, chemical residues, coating stability, or long-term performance need stronger justification.
  • Compatibility and system claims, especially for implant components and abutments, where broad claims are difficult to support without precise system definition and evidence.
  • Borderline product categorisation, such as semi-finished CAD/CAM materials, where intended purpose determines medical device status.
  • Digital workflows, where the manufacturer controls design parameters and outputs are patient-specific within defined constraints.

From a submission strategy perspective, the objective is to reduce uncertainty for the reviewer. That is achieved by ensuring the file communicates a consistent position:

  • The intended purpose and claims are consistent and reflected in labeling and IFU.
  • The classification rationale is explicit and mapped to Annex VIII logic.
  • Risk controls are linked to verification and validation evidence.
  • Clinical evaluation is proportionate and aligned to claims.
  • PMS and PMCF demonstrate control over real-world performance.

The NB review process accelerates when the documentation structure allows rapid verification of consistency. It slows down when the reviewer has to reconcile contradictions between sections.

Step 3. Clinical evidence strategy for dental devices: CER, PMCF, and clinical investigations.

Clinical evidence is typically the largest schedule and cost driver under MDR. The core issue is not volume; it is relevance and alignment to the intended purpose, claims, and risk profile.

A manufacturer-ready clinical evidence strategy generally combines:

  • A Clinical Evaluation Report (CER) anchored to intended purpose and claims.
  • Literature appraisal aligned with state of the art and device technology.
  • Post-market surveillance (PMS) data, including complaint trending and failure mode monitoring.
  • A PMCF approach proportionate to risk and uncertainty, designed to confirm performance and safety in clinical use.

The webinar highlighted a recurring decision point for manufacturers: when “well-established technology” is an appropriate foundation for clinical justification, and when novelty requires additional clinical evidence.

Practical examples discussed in dental context:

  • Implantables may be approached differently depending on the maturity of the technology, materials, and the presence of novel surface engineering or expanded clinical claims.
  • Resorbable grafting materials and membranes often require particular attention to degradation behaviour, degradation by-products, biological response, and performance endpoints over time.
  • Legacy devices require a structured assessment of whether existing data remains fit for MDR expectations and current clinical practice.

Notified Bodies evaluate clinical evidence against the totality of the file. Evidence is rarely accepted in isolation if risk management, claims, and verification logic do not support it.

How to pass a Notified Body Assessment as a dental device manufacturer

In practice, manufacturers do not lose time because they miss a single document. They lose time when their file is not reviewable as a system. Notified Bodies move more efficiently when traceability is clear and when the submission reads as one coherent position.

A practical Assessment-readiness checklist:

  • Intended purpose and claims are consistent across IFU, labeling, CER, and technical documentation.
  • Classification is justified with explicit Annex VIII logic and references.
  • Risk management is device-specific and connects hazards to controls and to verification evidence.
  • Verification and validation are planned around worst cases, critical characteristics, and real-use conditions.
  • Clinical evaluation is aligned to claims and supported by appropriate PMS/PMCF.
  • PMS/PMCF plans are measurable, realistic, and proportionate.

The NB-ready evidence pack (manufacturer checklist)

For internal alignment and faster NB interaction, a compact evidence pack is often effective. A practical NB-ready pack includes:

  • Device description, intended purpose, and claim list (single source of truth)
  • Annex VIII classification memorandum (rule logic and rationale)
  • GSPR checklist with clear evidence references
  • Risk management file (ISO 14971) and traceability to controls
  • Verification and validation plan and reports (including worst-case rationale)
  • Biological evaluation strategy (ISO 10993) and, where relevant, extractables and leachables considerations
  • Mechanical performance evidence, acceptance criteria, and justification of test conditions
  • Clinical evaluation (CER), literature strategy, and equivalence rationale when applicable
  • PMS plan and PMCF plan/report (tailored to failure modes and risk profile)
  • Labeling and IFU, including UDI readiness and EUDAMED considerations as applicable

The evidence pack is not a marketing summary. It is a reviewer tool. Its value is to reduce time spent locating and reconciling information across the file.

How to categorise dental devices under EU MDR (classification shortcuts by product type)

Dental manufacturers rarely struggle with the existence of Annex VIII. The difficulty is applying it consistently across a portfolio that mixes implantables, materials, digital workflows, and patient-specific outputs. A practical way to reduce ambiguity is to group dental devices by product type first, then confirm the applicable MDR rules and evidence expectations.

  • Dental implants and abutments
    Typical focus areas include the Annex VIII rationale (often centred on implantability), the scope of compatibility claims (system-specific definition), mechanical performance evidence, and the regulatory impact of surface treatments and coatings.
  • Resorbable grafting materials, membranes, and hemostats
    These products often require careful justification of degradation behaviour, degradation by-products, biological response over time, and clinically relevant endpoints. Evidence expectations frequently increase with resorption and biological interaction.
  • Restoratives and CAD/CAM materials (including semi-finished products)
    Categorisation often depends on intended purpose and how the manufacturer positions the product (medical device versus material). Performance claims, manufacturing controls, and labeling language typically drive both classification stability and clinical evidence requirements.
  • Custom-made versus patient-matched devices
    The practical distinction is design control. Custom-made devices require a prescription-led pathway with specific documentation, while patient-matched outputs often operate within a validated design envelope controlled by the manufacturer. This distinction materially affects technical documentation and lifecycle obligations.
  • Dental software, AI, and digital workflows
    Software categorisation under Rule 11 depends on how the software influences clinical decisions and outcomes. Validation, cybersecurity, and change control become central, and AI governance requirements can intersect with technical documentation expectations.

Common dental device categories to review:

A structured categorisation approach helps manufacturers align intended purpose, classification rationale, verification planning, and clinical evidence strategy across the full file, which reduces clarification cycles during review.

To learn more about dental device regulation and compliance support, read: Regulatory Compliance for Dental Products.

PMS, PMCF, UDI/EUDAMED, and legacy devices: maintaining market access

Under MDR, post-market obligations are part of the evidence lifecycle. PMS and PMCF support the ongoing demonstration of safety and performance and can become decisive during renewals and significant changes.

Practical PMS and PMCF considerations in dental:

  • Define and monitor meaningful signals: failures, revisions, fractures, loosening, complaint patterns, and trends linked to known failure modes.
  • Ensure PMCF is proportionate and focused on remaining uncertainty, rather than generic data collection.
  • Maintain a controlled approach to labeling updates, complaint handling, and vigilance reporting.

For legacy devices, manufacturers should perform a structured assessment of whether existing clinical and post-market data remains sufficient for current claims, current clinical practice, and MDR expectations. Where gaps exist, a targeted plan that links risk management to clinical evaluation and post-market follow-up reduces uncertainty and supports continuity of market access.

MDR transition in practice: Argen dental alloys case study

Many MDR transitions fail for predictable reasons: legacy documentation does not meet MDR expectations, clinical evaluation lacks alignment to intended purpose and risk management, and post-market systems are not mature enough to support lifecycle obligations. A recent example from dental materials demonstrates what a structured transition can look like in practice.

Argen transitioned a legacy dental alloy portfolio to Regulation (EU) 2017/745 for use in fabricating full-cast and ceramic-veneered restorations (including crowns, bridges, and removable partial dentures). The project required closing historical Notified Body non-conformities and strengthening core regulatory processes to achieve an audit-ready MDR position

What the work focused on:

  • Strengthening the clinical evaluation framework
  • Structuring the PMS system
  • Aligning risk management with MDR and ISO 14971
  • Establishing MDR-compliant biological evaluation
  • Aligning essential technical documentation

To read the full case study, click here: Case Study: How MDx Enabled Argen’s Successful Transition to MDR CE Marking for Dental Alloys.

Frequently Asked Questions About Dental Device Regulation

Do legacy (MDD) dental devices require new clinical data under EU MDR 2017/745?

Not automatically. The decision depends on risk profile, intended purpose, claims, and whether the technology can be justified as well established using appropriate literature, PMS data, and alignment with the state of the art.

Custom-made vs patient-matched in dentistry: what is the practical difference, and what does it change?

The practical difference is design control. Custom-made devices rely on a written prescription and patient-specific specifications defined by the healthcare professional. Patient-matched devices are typically produced within a validated “design envelope” controlled by the manufacturer. This distinction affects documentation expectations, validation logic, and lifecycle obligations.

What validation evidence is expected for patient-matched dental devices?

Manufacturers should define a validated design envelope, identify worst-case configurations within that envelope, and validate the worst case in its final condition. This approach supports a defensible argument that the full envelope remains safe and performs as intended.

Why do resorbable grafts and membranes face higher scrutiny, and what evidence is usually questioned?

Because risk and performance evolve over time as the device degrades. Evidence discussions often focus on degradation behaviour, degradation by-products, biological response, and clinically relevant performance endpoints across the functional period.

When does dental software fall under MDR Rule 11, and what is the fastest way to reduce Notified Body back-and-forth?

When software influences clinical decisions or outcomes, Rule 11 can apply and classification may increase, triggering stronger validation and control expectations. To reduce review cycles, manufacturers should maintain consistency across intended purpose and claims, classification rationale, risk management, verification evidence, clinical evaluation, and PMS/PMCF. Inconsistencies are a major driver of clarification rounds and timeline slippage

Written by:
Alberto Bardají

Alberto Bardají

Head of Medical Devices

Senior med-tech expert & ex-Notified Body reviewer with deep experience in high-risk implants, orthopedics, dental & neurology.
Industry Insights & Regulatory Updates

FDA QMSR: How the 2026 Regulation Shift Transforms MDSAP Audits and FDA Compliance Inspections

On February 2, 2026, the U.S. Food and Drug Administration (FDA) implemented the new Quality Management System Regulation (QMSR), formally replacing the former Quality System Regulation (21 CFR Part 820). With this transition, the FDA incorporated ISO 13485:2016 by reference into U.S. law and introduced a new inspection model under Compliance Program 7382.850.

This article explains what the FDA QMSR changes in practical terms.

Specifically, it clarifies:

  • How the updated MDSAP Audit Approach aligns with QMSR
  • How FDA inspections now operate under CP 7382.850
  • Which documentation areas receive increased inspection attention
  • How manufacturers can structure a QMSR gap assessment
  • What inspection exposure points regulatory teams should proactively address

These changes are particularly relevant for manufacturers operating in complex regulatory environments, including companies developing FDA companion diagnostics. In these companies design controls, labeling, clinical evidence, and post-market monitoring must operate as an integrated lifecycle system.

Why the FDA QMSR Matters Now?

The FDA QMSR represents more than structural alignment with ISO 13485. It modernizes inspection methodology, expands documentation accessibility, and reinforces a lifecycle-based, risk-driven enforcement approach.

Under the former QSR model, inspections often focused on subsystem compliance using QSIT checklists. Under QMSR, investigators evaluate how quality processes function collectively across the total product lifecycle.

MDSAP Audit Approach 2026: How It Differs from FDA Inspections Under QMSR

MDSAP audits and FDA inspections are frequently discussed together. However, they serve fundamentally different regulatory functions.

An MDSAP audit is conducted by an FDA-recognized Auditing Organization. It provides a structured, scheduled, and standardized assessment covering ISO 13485 and the regulatory requirements of participating authorities, including the FDA. The audit focuses on conformity with harmonized quality management system requirements. Participation remains voluntary.

An FDA inspection, by contrast, is a statutory enforcement activity conducted directly by FDA investigators. Its objective is not certification, but the evaluation of compliance with U.S. legal requirements and the identification of potential violations, systemic weaknesses, or public health risks.

Under the FDA QMSR framework, this distinction remains critical.

In practical terms:

  • MDSAP is conformity-focused, scheduled, and audit-driven.
  • FDA inspections are compliance-driven, investigative, and enforceable.

Because of these structural differences:

  • MDSAP does not replace FDA’s legal authority to inspect.
  • FDA inspections are not limited by the MDSAP task structure.
  • A successful MDSAP audit does not guarantee a favorable FDA inspection outcome.

While strong MDSAP performance may influence FDA surveillance planning, it does not eliminate the possibility of routine, risk-based, or for-cause inspections.

Common Industry Assumptions That Elevate Inspection Risk Under QMSR

Despite years of MDSAP implementation and increasing alignment with ISO 13485, several structural misunderstandings remain common within regulatory teams. Under the FDA QMSR framework, these assumptions may create unintended inspection exposure.

Among the most frequent are:

“MDSAP replaces FDA inspections.”
MDSAP may inform FDA’s surveillance planning. However, it does not limit FDA’s statutory authority to conduct routine, risk-based, or for-cause inspections.

“If the MDSAP auditor did not identify it, FDA will not pursue it.”
FDA investigators are not constrained by MDSAP audit depth, sampling methodology, or task sequencing. They may pursue any line of inquiry necessary to evaluate U.S. compliance.

“MDSAP and FDA inspections evaluate the same criteria.”
MDSAP assesses conformity to harmonized quality system requirements. FDA inspections evaluate compliance with U.S. law and potential public health impact.

“ISO 13485 certification ensures FDA compliance.”
Although ISO 13485 is incorporated by reference into QMSR, FDA-specific statutory and regulatory requirements remain fully enforceable.

“MDSAP covers all U.S.-specific expectations.”
While the audit model maps U.S. requirements, FDA inspections may extend beyond mapped tasks and request additional evidence where risk or compliance concerns arise.

Collectively, these assumptions overlook a central element of the FDA QMSR transition.

QMSR vs QSR vs ISO 13485: What Actually Changed

Many organizations assume that QMSR simply “equals ISO 13485.” However, that interpretation is incomplete.

Although ISO 13485:2016 is incorporated by reference into U.S. law, FDA-specific statutory and regulatory requirements remain fully enforceable. Therefore, obligations related to UDI, Medical Device Reporting (MDR), device listing, and labeling controls continue to apply.

As a result, companies that focus solely on ISO 13485 conformity may overlook additional documentation, traceability, and enforcement expectations that FDA investigators apply during inspections.

Comparison: QSR vs QMSR vs ISO 13485

Key takeaway:
ISO 13485 alignment does not eliminate FDA-specific compliance obligations. FDA retains enforcement authority under U.S. law.

FDA Compliance Program 7382.850: How Inspections Work Under QMSR

As of February 2, 2026, FDA retired QSIT and implemented Compliance Program 7382.850.

Inspections now organize around:

Six Quality Management System (QMS) Areas:

  • Change Control
  • Design & Development
  • Management Oversight
  • Outsourcing & Purchasing
  • Production & Service Provision
  • Measurement, Analysis & Improvement

Four Other Applicable FDA Requirements (OAFRs):

  • Tracking
  • Corrections & Removals
  • Medical Device Reporting (MDR)
  • Unique Device Identification (UDI)

Under this model, FDA evaluates how quality subsystems operate as an interconnected framework rather than as isolated elements. Inspectors assess whether risk information, design decisions, post-market data, and management oversight are aligned throughout the product lifecycle.

For manufacturers of companion diagnostics, this system-level evaluation is particularly significant, as design inputs, labeling claims, clinical performance data, and post-market monitoring directly influence one another.

What FDA Inspectors Scrutinize Most Under QMSR

Based on regulatory inspection support experience, three documentation areas now present heightened exposure.

1. Internal Audits, Supplier Audits, and Management Review Records

Under QMSR, FDA inspectors may review:

  • Internal audit reports
  • Supplier audit outcomes
  • Management review records

As our QA/RA Specialist Joana Martins notes from inspection support experience, investigators increasingly evaluate whether quality processes function effectively in practice, not merely whether procedures formally exist.

Records must clearly demonstrate:

  • Identified issues
  • Root cause analysis
  • Corrective actions
  • Follow-up and documented closure

Incomplete or draft audit records increase inspection risk.

2. Design Controls and Traceability (ISO 13485 Clause 7.3)

QMSR aligns with ISO 13485 clause 7.3. However, manufacturers must demonstrate full traceability across:

  • User needs
  • Design inputs
  • Design outputs
  • Verification and validation
  • Residual risks

Traceability weaknesses frequently arise between:

  • Risk management files
  • Labeling claims
  • UDI triggers
  • MDR criteria

Inspectors expect objective evidence that these elements remain consistently aligned across documentation and decision-making processes.

For companion diagnostics, this alignment is especially critical because intended use, biomarker claims, and clinical evidence directly impact regulatory risk classification.

3. CAPA and Effectiveness Verification

CAPA remains one of the most enforcement-sensitive areas under QMSR.

A recurring weakness observed during inspection preparation is the absence of documented effectiveness verification following corrective actions. Closing a CAPA administratively is insufficient. Investigators expect objective evidence demonstrating that actions eliminated root causes and prevented recurrence.

Documented effectiveness checks are not procedural formalities, they serve as evidence that the quality system operates as intended.

Inspection Risk Indicators Under FDA QMSR

The transition to the FDA QMSR has altered not only inspection structure but also inspection depth. Under Compliance Program 7382.850, FDA investigators apply a lifecycle and risk-based model that prioritizes system effectiveness, data integrity, and management oversight.

For this reason, manufacturers should not wait until an inspection is scheduled to evaluate potential vulnerabilities. Identifying structural weaknesses in advance is critical because inspection findings under the QMSR framework increasingly derive from systemic inconsistencies rather than isolated documentation gaps.

Proactive identification of inspection risk indicators allows organizations to:

  • Reduce the likelihood of Form 483 observations
  • Prevent escalation to warning letters or enforcement action
  • Shorten remediation timelines
  • Demonstrate mature quality governance

Below are recurring inspection risk indicators observed in practice under the evolving QMSR inspection model:

Examples of Documentation Weaknesses Observed During Inspections

Risk AreaTypical Vulnerability
CAPARepeated issues without documented effectiveness verification
Design ControlsIncomplete traceability between risk analysis and design inputs
Management ReviewMinutes lacking documented decisions, metrics, or follow-up actions
Supplier OversightAbsence of risk-based justification for audit scope
Post-Market SurveillanceComplaint trends not connected to CAPA or design updates

Documentation Areas Receiving Increased Inspection Attention Under QMSR

The transition to QMSR expands the practical scope of documentation that investigators may review.

Under the former QSR, certain internal records were less frequently examined due to inspection structure and interpretative practice. Under QMSR, those same records may serve as direct evidence of whether management oversight, supplier controls, and internal audit processes operate effectively.

Investigators assess whether:

  • Issues are identified systematically
  • Root causes are documented clearly
  • Decisions are traceable
  • Corrective actions are verified for effectiveness

Inconsistent documentation, incomplete audit closure, or lack of traceability between systems may now carry greater inspection consequences than under the previous model.

QMSR Gap Assessment Framework

ISO 13485 certification does not automatically confirm FDA QMSR compliance. A structured gap assessment helps identify regulatory overlays and inspection exposure points.

A practical QMSR gap assessment should include:

1. Clause Mapping

Map ISO 13485 clauses to QMSR references and confirm terminology alignment.

2. FDA-Specific Overlay Identification

Verify incorporation of:

  • UDI requirements
  • MDR reporting triggers
  • Labeling obligations
  • Device listing controls

3. Documentation Exposure Review

Assess:

  • Internal audit completeness
  • CAPA effectiveness evidence
  • Management review decision traceability
  • Supplier risk classification

4. Inspection Simulation

Conduct mock inspections aligned with CP 7382.850 to test system coherence.

Even when corrective actions remain in progress, documented identification and remediation planning demonstrate regulatory control and transparency.

Illustration of FDA inspection process emphasizing quality management systems, risk-based audits, and manufacturer readiness in MedTech industry.

What the QMSR Means for U.S. Manufacturers and FDA Inspections

The most important U.S.-specific change is the removal of references to the former FDA Quality System Regulation (21 CFR 820). These have been replaced with references aligned to the QMSR, under which ISO 13485:2016 is now incorporated by reference into U.S. law. This does not mean that all FDA-specific requirements disappear. U.S. statutory and regulatory obligations continue to apply where relevant.

The updated MDSAP Audit Approach also reflects several U.S. regulatory updates that have been in effect since March 2024:

  • Device listing updates: Manufacturers must confirm or update their device listing information annually between October 1 and December 31, or whenever a relevant change occurs (21 CFR 807).
  • Predetermined Change Control Plans (PCCPs): The audit model now clarifies how PCCPs are assessed, particularly for software-based and AI-enabled devices, aligning with FDA’s existing change control requirements under 21 CFR 807.81 and 21 CFR 814.39.

These requirements are not new, but the 2026 MDSAP update removes inconsistencies between what auditors assess and what FDA expects.

Beyond the U.S.-specific updates, there is also a broader change that affects all participating jurisdictions. The term “critical supplier” has been removed and replaced with more practical language referring to “suppliers that should be considered for audit as part of the MDSAP audit of the organization.” This better reflects ISO 13485 risk-based thinking and reduces ambiguity around supplier oversight across different regulatory systems.

Other international changes Under the FDA’s QMSR Framework

While this article focuses on the U.S. regulatory framework, the updated audit approach also incorporates important revisions from other participating regulatory authorities:

  • Australia (TGA): Alignment with the Procedure for Recalls, Product Alerts and Product Corrections (PRAC), which came into effect in March 2025.
  • Brazil (ANVISA): Updated references to RDC 830/2023 (IVDs) and RDC 751/2022 (medical devices).

These changes ensure the audit model reflects current regulatory frameworks across all participating jurisdictions.

Practical implications for medical device manufacturers

FDA’s new compliance program significantly raises expectations for how manufacturers demonstrate quality system effectiveness during inspections:

  • FDA inspectors are evaluating how quality processes work together in practice. Making a strong emphasis on risk management, data integrity, and decision-making across the total product lifecycle.
  • Previously “internal” records are now fair game. Internal audit reports, supplier audit outcomes, and management review records may be reviewed during inspections. These documents must clearly reflect issues identified, decisions made, and actions taken.
  • Risk management must be continuous and demonstrable. FDA expects risk to be actively monitored and linked to CAPA, design changes, supplier controls, and post-market surveillance, and not treated as a static or one-time exercise.
  • Post-market data is a primary inspection focus. Complaint trends, medical device reporting, recalls, UDI, and tracking data are increasingly used to assess whether the quality system is effective and responsive to real-world performance.
  • Inspection scope may be driven by data. FDA may use pre-inspection data reviews or remote assessments to target areas of concern, increasing scrutiny where trends or inconsistencies are identified.

To summarize, manufacturers should ensure their quality systems tell a coherent, data-supported story and demonstrate not just compliance, but control and effectiveness.

What medical device manufacturers should do before their next audit or inspection

Manufacturers should:

  • Strengthen internal audits to test effectiveness, not just compliance
  • Ensure management review and CAPA are data-driven and risk-focused
  • Prepare clear inspection narratives, not just procedures
  • Train teams on inspection behavior and communication

By strengthening these foundations, manufacturers can approach their next audit or inspection with clarity, confidence, and control.

Key takeaways for companies targeting the US market

  • MDSAP remains valuable, but it is no longer sufficient on its own
  • FDA inspections are becoming more structured, consistent, and data-driven
  • Early alignment with QMSR expectactions reduces inspection risk, delays and remediation costs
Medical device quality management and inspection process with team training, data-driven review, and inspection narratives for FDA compliance.
Strategies for Modern and effective compliance.

How MDx Supports FDA QMSR Readiness: Expert Insight

Transitioning from QSR to FDA QMSR requires more than updating terminology. It demands structural alignment, inspection-oriented preparation.

Based on field experience supporting manufacturers through inspection preparation and regulatory alignment projects, Joana Martins, QA/RA Specialist at MDx, emphasizes that the most frequent vulnerabilities do not stem from missing procedures, but from insufficiently demonstrated system effectiveness.

According to Joana’s inspection readiness experience, organizations often underestimate three exposure points during FDA inspection preparation:

  • The depth of documentation review now permitted under QMSR
  • The need for traceability between risk management, design controls, and post-market data
  • The importance of documented effectiveness verification within CAPA systems

To address these exposure points, MDx supports medical device manufacturers through:

  • Independent QMSR-aligned readiness assessments focused on inspection exposure
  • Structured QMSR gap analysis incorporating FDA-specific regulatory overlays
  • Mock FDA inspections aligned with Compliance Program 7382.850
  • Strategic support for companies developing FDA companion diagnostics, where design traceability, labeling controls, and lifecycle data integration require heightened regulatory coherence

Rather than approaching FDA QMSR as a documentation update, MDx works with organizations to ensure their quality systems demonstrate operational integrity, risk-based decision-making, and inspection resilience.

Organizations preparing for FDA inspection or evaluating their QMSR alignment can benefit from early, structured assessment. Proactive evaluation reduces remediation timelines, minimizes inspection disruption, and strengthens regulatory confidence.

Frequently Asked Questions About FDA QMSR, MDSAP, and Inspections

What is the main difference between QSR and QMSR?

The main difference is structural alignment. Under QSR, FDA requirements were written directly into 21 CFR Part 820. Under QMSR, the FDA incorporates ISO 13485:2016 by reference into U.S. law while keeping FDA-specific obligations in force. In short, QMSR harmonizes structure with ISO 13485. However, it does not reduce FDA enforcement authority or eliminate U.S.-specific requirements such as MDR, UDI, or device listing.

Does ISO 13485 certification guarantee FDA compliance under QMSR?

No, it does not. Although ISO 13485 forms the backbone of QMSR, FDA-specific statutory requirements still apply. Manufacturers must comply with MDR, UDI, corrections and removals, and other U.S. obligations. Based on regulatory experience, companies often assume ISO certification closes all gaps. In practice, a targeted QMSR gap assessment is necessary to confirm full FDA alignment.

What replaced QSIT in FDA inspections?

FDA replaced QSIT with Compliance Program 7382.850, effective February 2, 2026. This new program aligns inspections with the QMSR framework. Instead of subsystem checklists, FDA now organizes inspections around six QMS areas and four Other Applicable FDA Requirements (OAFRs). As a result, inspections follow a more integrated, risk-based, lifecycle-focused approach.

Can FDA inspect internal audit reports under QMSR?

Yes. Under QMSR, FDA investigators may review internal audit reports, supplier audits, and management review records.
In practice, inspectors now verify whether issues were identified, documented, and effectively closed. They no longer focus only on whether procedures exist, they assess whether the system works as intended.
Incomplete or unverified audit actions may increase inspection risk.

What records are now receiving greater scrutiny during FDA inspections?

FDA now places greater scrutiny on:
– Internal and supplier audit reports
– Management review documentation
– Design control traceability records
– CAPA procedures and effectiveness checks
From inspection experience, CAPA effectiveness verification is a frequent weak point. Companies often implement corrective actions but fail to document objective evidence that the action resolved the root cause.
Under QMSR, effectiveness matters as much as documentation.

Why are companies that passed MDSAP still receiving FDA 483 observations?

Because MDSAP and FDA inspections serve different purposes. MDSAP evaluates conformity. FDA inspections assess legal compliance and public health risk. FDA investigators are not bound by MDSAP sampling methods or audit scope. If inspectors identify ineffective CAPA, weak traceability, or gaps between procedures and actual practice, they may issue Form 483 observations, even after a successful MDSAP audit.

How should manufacturers prepare for FDA inspections under QMSR?

Start early. Preparation often takes longer than expected. Then conduct a structured QMSR gap assessment. ISO 13485 compliance alone does not confirm full FDA alignment. Finally, train teams on Compliance Program 7382.850. Mock interviews and inspection simulations help identify weaknesses. Even documented remediation in progress demonstrates system control and reduces inspection risk.

When does FDA QMSR enforcement begin?

FDA QMSR enforcement began on February 2, 2026, when the new Quality Management System Regulation officially replaced the former Quality System Regulation (21 CFR Part 820). From that date, FDA inspections operate under Compliance Program 7382.850.

What are the FDA QMSR and ISO 13485 harmonization requirements for 2026?

Under the 2026 QMSR, ISO 13485:2016 is incorporated by reference into U.S. law. This means manufacturers must meet ISO 13485 requirements as part of FDA compliance. However, harmonization is not complete equivalence, FDA-specific obligations such as UDI, MDR reporting, device listing, and labeling controls remain fully enforceable and are not covered by ISO 13485 alone. See the QSR vs QMSR vs ISO 13485 comparison table above for a detailed breakdown.

Written by:
Joana Martins

Joana Martins

QARA Specialist

QA/RA Specialist supporting teams in clinical evaluations and regulatory compliance with ISO 13485, MDR, and international medical device requirements (FDA, Health Canada, ANVISA).
Industry Insights & Regulatory Updates

IVDR Annex XIV Performance Studies for Companion Diagnostics: A Step-by-Step Guide 2026

This IVDR Annex XIV clinical performance study guide explains how you can plan and obtain authorisation for performance studies under Annex XIV of the IVDR when it involves a companion diagnostic. It aims to be practical and aligned with current expectations of ethics committees and competent authorities in the European Union.

If you require a structured checklist, you can download the Annex XIV Performance Study Authorisation (PSA) Toolkit, including an ISO 20916 monitoring checklist, templates, and a pre-submission workplan.


IVDR Annex XIV Clinical Performance Study: When PSA vs PSN Applies for Companion Diagnostics

Companion diagnostics (CDx) often require an IVDR Annex XIV clinical performance study because these tests directly influence patient management. Therefore, understanding when a Performance Study Authorisation (PSA) or a Performance Study Notification (PSN) applies is critical for effective regulatory planning and avoiding unnecessary delays.

Why Companion Diagnostics Often Fall Under Annex XIV

Companion diagnostics frequently fall under Annex XIV of the IVDR because the test result guides key treatment decisions, including:

  • Patient selection
  • Treatment allocation
  • Therapy continuation or discontinuation

If the study design allows test results to influence clinical decisions, regulators consider the study interventional, and this classification triggers the need for a Performance Study Authorisation (PSA). In addition, if you use the device outside its intended purpose as defined in the Instructions for Use (IFU), the IVDR framework also requires a PSA.

When Does a PSA Apply Under Article 58(1)?

For any IVDR Annex XIV clinical performance study, Article 58(1) serves as the key provision to determine whether a PSA is required. A PSA becomes mandatory if you meet any of the following three criteria:

  • You perform surgically invasive sample collection specifically for the clinical performance study (CPS).
  • You design the study as interventional in nature.
  • You introduce additional invasive procedures or other risks for participants.

If even one of these criteria applies, you must obtain a Performance Study Authorisation before starting the study.

When Does a PSN Apply Under Article 58(2)?

If you do not meet any of the Article 58(1) criteria, Article 58(2) may apply instead. In that case, you may submit a Performance Study Notification (PSN) when:

  • The study uses leftover samples only
  • The study includes no additional invasive procedures
  • Test results do not influence patient management
  • The design remains strictly non-interventional

However, even when these conditions apply, you must carefully evaluate national requirements and specific study design details to confirm that a PSN remains appropriate.

Combined Medicinal Product and Diagnostic Studies

An IVDR Annex XIV clinical performance study that involves both a companion diagnostic and a medicinal product requires structured coordination from the outset. When both regulatory frameworks apply, the Clinical Trials Regulation (CTR) governs the medicinal product, while the IVDR governs the diagnostic. Consequently, you must align timelines, documentation, and regulatory strategy under both frameworks to avoid inconsistencies and delays.

Step-by-Step: from planning to PSA approval

1. IB and CPSP Essentials, and the Link Between Endpoints, Intended Use, and Cut-off Strategy

Begin with a coherent Investigator’s Brochure (IB) and Clinical Performance Study Plan (CPSP). Every claim in the CPSP should trace to the intended purpose of the device and to analytical and clinical evidence that is sufficient for that claim. Endpoints must align with the intended clinical decision.

Based on our experience with more than 100 projects, the following two review findings occur repeatedly:

  • Analytical cut-off and validation. Authorities closely examine how the assay cut-off has been defined and supported. Sensitivity, precision, and accuracy should demonstrate that the device performs in a way that supports safe clinical decisions. Weak justification invites questions about patient misclassification risk, which frequently leads to requests for information.
  • Endpoints not aligned with intended use. Reviewers frequently question primary endpoints that are not clearly tied to clinical performance or to the intended use of the device. The endpoint should map directly to the decision being made for the patient.

Practical measures we have implemented in more than 100 projects:

  • Draft the statistical analysis plan early and show a clear line from intended use to endpoint to success criteria.
  • Map each analytical study (limit of detection, limit of quantitation, precision, interference, cut-off justification) to the clinical claim it supports.

2. Country Submissions: ethics committees, competent authorities, portals, translations, and fees

Plan both the ethics and competent authority pathways, including accounts for national portals, translation policies, and fee payments. Country-specific requirements can change timelines and logistics.

Some examples of country-specific requirements:

  • France requires an IDRCB registration code. The protocol, informed consent form, and insurance certificate must display this code. Missing or inconsistent use of the code commonly triggers requests for information.
  • Poland may require a physical submission package rather than a fully electronic file. Plan accordingly all documents that require original signatures. Courier time, notarised copies where applicable, and signature sequencing should also be built into the schedule.

A brief pre-submission checklist:

  • Identification of country EC-NCA submission approach (sequential, parallel, combined) and EC meeting schedules
  • Portal access verified and roles assigned for both ethics committees and competent authorities.
  • National identifiers obtained and propagated consistently across documents.
  • Translation scope defined and quality-controlled, particularly for patient-facing materials.
  • Insurance certificates aligned with the study footprint and national expectations.
  • Fee tables confirmed and purchase orders in place.

3. Timelines, Clock-Stops, and Expert Consultations

Validation and assessment phases of review often include clock-stops for clarification, where the reviewing authority can ask for further information, known as Request for Informations (RFIs). You should define internal service levels for responses in advance, and topic ownership should be clear across analytical, clinical, and biostatistics contributors. A master cross-reference that links CPSP, IB, risk management, and statistical sections reduces the risk of inconsistent responses. In Pickett’s assessment, assigning topic ownership for analytical, clinical, and statistical responses before submission helps keep clock-stops short and prevents inconsistent answers across documents.

IVDR Annex XIV Clinical Performance Study: How to Build a Robust Dossier?

A strong IVDR Annex XIV clinical performance study dossier reduces the risk of Requests for Information (RFIs), clock-stops, and approval delays.

Analytical Validation and Cut-Off Justification

For an IVDR Annex XIV clinical performance study, cut-off justification must go beyond presenting a single threshold value or ROC curve.

A robust dossier should:

  • Explain the clinical consequences of the selected cut-off
  • Describe how sensitivity and specificity change if the threshold shifts
  • Address false positives and false negatives at clinically relevant prevalence
  • Link analytical performance directly to the primary endpoint
  • Demonstrate how the device supports a safe clinical decision

Authorities frequently focus on misclassification risk. If the cut-off rationale does not clearly support safe decision-making, this section becomes a major driver of RFIs.

Best practice according to Callum Pickett Clinical Alliance Lead at MDx
Treat cut-off justification with the same rigor as a safety argument. Provide both statistical evidence and a clear clinical narrative.

Informed Consent Strategy Aligned With the CPSP

Misalignment between the Clinical Performance Study Plan (CPSP) and the informed consent form is a common cause of delay in an IVDR Annex XIV clinical performance study.

To reduce risk:

  1. Finalize the CPSP first.
  2. Draft the informed consent to mirror procedures, visit schedules, and risks.
  3. Use clear, plain language that accurately reflects the protocol.

Reviewers assess whether participants are properly informed. If the consent document does not reflect the study design, an RFI is likely.

We recommend to include the following in the Informed Consent:

  • Clear summary of procedures and assessment schedule
  • Device-specific risks, including sample handling and possible retesting
  • Explanation of invalid or indeterminate results and participant implications

Consistency between the CPSP and consent documentation strengthens credibility during assessment.

Cross-Referencing: CPSP, IB, GSPR, and Study Reports

A cross-reference matrix improves both internal quality control and external review efficiency.

Your matrix should demonstrate:

  • Where each General Safety and Performance Requirement (GSPR) is addressed
  • How CPSP procedures are monitored and documented
  • Where statistical commitments are supported by analysis
  • How risk management links to study controls

For a successful IVDR Annex XIV clinical performance study submission, document traceability is critical.

Frequent RFI Drivers in IVDR Annex XIV Clinical Performance Studies

Below are common deficiencies and practical mitigation strategies:

RFI DriverHow to Address It
Primary endpoint not aligned with intended useRedefine or restate the endpoint so it directly supports the clinical decision
Cut-off justification insufficientProvide complete analytical data and explain clinical impact
Sample representativeness unclearJustify matrix type, disease stage, prior therapy, and relevant variables
Misclassification of study type (leftover samples)Clarify whether the design remains non-interventional and whether PSN is appropriate
Monitoring plan not aligned with ISO 20916Define adverse event categories, roles, and timelines
Informed consent inconsistent with CPSPAlign language and procedural details precisely
Statistical assumptions not clinically justifiedLink alpha and power to meaningful clinical differences
Device deficiency reporting unclearDefine detection, escalation, and reporting mechanisms
Risk management not connected to study controlsTrace risks to mitigation and monitoring activities
Combined CTR–IVDR governance unclearDefine roles, responsibilities, and decision pathways
Incomplete or low-quality translationsPlan professional review and back-translation
National identifiers or insurance mismatchedEnsure consistent codes and appropriate coverage limits

Country Playbook: How to plan Performance Study Applications to EU Member States

1. Identify the PSA submission approach adopted by the EU member state.

There are three models adopted by EU countries which will impact your submission strategy:

  • Sequential – the EC is submitted to first and NCA submission can only occur once an EC approval has been issued.
  • Parallel – the EC and NCA submissions can be submitted around or at the same time allowing for a “parallel” review process. However, the NCA will only approve the study once a positive EC opinion has been granted
  • Combined – a single PSA submission is sent to one authority which serves as the EC and NCA, a single positive opinion will be issued.

2. Choose your Ethics Committee:

  • It is highly recommended to submit the PSA to the same EC reviewing the associated Clinical Trial Application
  • Identify any EC specific templates, this may include EC-specific application forms and site document templates
  • Identify the EC meeting schedule and the deadlines for PSA submission to achieve review at the EC meeting date
  • Use the EC meeting schedule to inform your submission strategy, different ECs will meet at different frequencies.

3. Identify any specific requirements set by the National Competent Authority:

  • Are there any NCA specific templates to be filed with the PSA?
  • Is there anything that can gate submission to this country? For example, does the NCA mandate that the final Clinical Trial protocol is submitted with the submission.

4. Identify any specific laws and requirements for the EU member state being submitted to:

  • The EU is governed by GDPR laws, but national laws on data protection add an additional layer of requirements. Ensure that your study is developed with the national data protection requirements in mind.
  • EU member states have different requirements for the insurance documentation, this may include reference to national laws, inclusion of national study codes, and extra details on the number of participants.

5. Use all these points to create your submission strategy, informed by the following:

  • Submission approach: countries with sequential review approaches take longer on average than countries with parallel and combined review approaches.
  • Clinical Priority: what countries are priority for enrolment? Which countries will have the most sites and therefore need to be activated earlier? 
    • How often do the chosen ECs meet according to their meeting schedule?
    • Are there any NCA or EC document requirements which aren’t yet available, and might delay submission?

Monitoring in Line with ISO 20916

ISO 20916 introduces additional classification categories for adverse events compared with the base IVDR text. Sites need clear training on event taxonomy, responsibilities for classification, and reporting timelines.

Content to include in the monitoring plan and site training:

  • Definitions and examples for adverse events and serious adverse events as used in the study.
  • Roles for initial classification, medical review, and final assessment.
  • Specific clocks for reporting from site to sponsor and from sponsor to authorities.
  • How to capture assess and report device deficiencies.

As our clinical team has observed under Annex XIV submissions, early training on adverse event taxonomy and reporting timelines is essential. Misclassification in the first reported case often leads to corrective actions and schedule impact.

IVDR Annex XIV clinical performance study Advanced MedTech Performance Study Workflow.

Scientific Validity within Annex XIV Performance Evaluation

From PSA to Market: coordination with the notified body and medicines regulators

For a true companion diagnostic approval, align analytical validity, clinical performance, and scientific validity with post-market plans. Label language and evidence expectations should be coordinated with the Notified Body and, where applicable, medicines regulators. Plan the handover from study evidence to post-market performance follow-up.

According to Callum Pickett, maintaining a single evidence map that links analytical validity, clinical performance, and scientific validity to the eventual label language streamlines Notified Body review and reduces post-submission clarification rounds.

Resources

  • Guidance from the Medical Device Coordination Group (MDCG) and the European Commission on performance studies, including Q&A on Article 58 pathways.
  • National guidance such as the Belgian Federal Agency for Medicines and Health Products (FAMHP) on dossier structure, timelines, and fees for performance studies.
  • Consultancy overviews such as DLRC Group (DLRC Group) for pan-EU context.
  • Standards published by the International Organization for Standardization (ISO), notably ISO 20916 for clinical performance studies of in vitro diagnostic medical devices.

Expert insight by Callum Pickett

Success with Annex XIV studies for companion diagnostics depends on alignment. Intended use, endpoints, analytical validation and cut-off, consent, and monitoring must be consistent and mutually supportive. Careful attention to country-specific requirements and early planning for CTR-IVDR coordination reduces the likelihood of clock-stops and requests for information. A structured checklist and disciplined cross-referencing improve dossier quality and assessment efficiency.

Read more about IVD clinical studies services.

Frequently Asked Questions (FAQ)

Performance Study Authorisation (PSA) is required for an IVDR Annex XIV clinical performance study?

A PSA is required under Article 58(1) if the study includes surgically invasive sample collection specifically for the study, uses an interventional design where test results influence patient management, or introduces additional invasive procedures or risks. In practice, companion diagnostics often trigger a PSA because their results guide treatment decisions. Therefore, as soon as one of these criteria applies, you must obtain a PSA before starting the study. For broader context on running studies under IVDR, read the following article on Running Clinical Studies Under IVDR

When can a Performance Study Notification (PSN) be used instead of a PSA?

You can use a PSN under Article 58(2) when the study remains strictly non-interventional. For example, the study may rely only on leftover samples, avoid additional invasive procedures, and ensure that test results do not influence clinical decisions. However, you must assess the design carefully, because misclassifying a study as non-interventional frequently leads to delays and reclassification requests.

How do IVDR and the Clinical Trials Regulation (CTR) interact in combined CDx–medicinal product studies?

In combined studies, you must comply with both frameworks simultaneously: the CTR governs the medicinal product, while the IVDR governs the companion diagnostic. As a result, you should align endpoints, intended use, and patient population across both submissions from the outset. Otherwise, inconsistencies between the CTR and IVDR dossiers often trigger Requests for Information and clock-stops. A structured gap analysis can help you identify and resolve these risks early. Read the article about pre submission assessment here.

What are the most common reasons authorities issue RFIs in Annex XIV studies?

Authorities typically issue RFIs when sponsors fail to align primary endpoints with the intended use, provide insufficient analytical validation or cut-off justification, or clearly explain misclassification risk. In addition, inconsistencies between the CPSP and informed consent, or weak traceability between risk management and statistical assumptions, often raise concerns. Therefore, you should build a clear cross-reference structure across all documents to reduce review friction.
For more detail on documentation expectations, read IVD technical documentation.

How can sponsors reduce approval timelines for IVDR Annex XIV performance studies?

To reduce timelines, you should define endpoints early and link them directly to intended use, justify analytical cut-offs with both statistical evidence and clinical rationale, and align the informed consent precisely with the CPSP. At the same time, confirm national submission models, ethics committee schedules, translation scope, and insurance requirements before submission. By assigning clear internal ownership for analytical, clinical, and statistical responses, you can also shorten clock-stops and maintain consistency during review.

Written by:
Callum Pickett

Callum Pickett

Clinical Alliance Lead

Experienced clinical affairs professional specialising in performance study submissions and management under IVDR, with a focus on CDx and Precision Medicine.
Industry Insights & Regulatory Updates

MDR Annex XVI: Regulating Products Without an Intended Medical Purpose Under the MDR

How Are Medical Devices Regulated Under MDR Annex XVI?

How does MDR Annex XVI regulate products without an intended medical purpose that fall within the scope of the MDR? This question has become increasingly relevant for manufacturers seeking EU market access.

The Medical Devices Regulation (MDR) 2017/745 has transformed the European Union (EU) regulatory framework. It replaced the previous Medical Devices Directive (MDD) and introduced stricter requirements for manufacturers, notified bodies, and competent authorities.

One of the most significant changes is the expanded scope under MDR Annex XVI. The regulation now includes certain products that do not have a medical purpose but may still present similar safety risks. As a result, these products are subject to the MDR regulatory requirements, even though they are not medical devices by definition.

What Is New Under MDR Annex XVI in 2026?

Recent regulatory developments continue to clarify how MDR Annex XVI applies in practice. Authorities expect manufacturers to align with Common Specifications, updated classification rules, and strengthened clinical evaluation requirements.

This expanded scope marks a clear departure from traditional definitions of medical devices. Certain aesthetic or cosmetic products listed in Annex XVI now fall within the scope of the MDR and are subject to conformity assessment and post-market obligations.

What Products Fall Under MDR Annex XVI?

Under MDR Annex XVI, the following product groups are subject to the MDR, even though they do not have an intended medical purpose:

  • Contact lenses without vision correction (e.g., colored contact lenses)
  • Devices intended to modify the anatomy or fixation of body parts (e.g., subdermal implants without a medical purpose, such as aesthetic implants)
  • Facial and dermal fillers for aesthetic enhancement
  • Equipment for body shaping and fat reduction (e.g., liposuction devices)
  • High-intensity radiation devices for skin treatment, including IPL, lasers, infrared equipment, tattoo removal lasers, and hair removal systems
  • Equipment intended for transcranial brain stimulation without a medical purpose

Manufacturers of these products must comply with the applicable MDR safety, performance, and documentation requirements, subject to adaptations reflecting the absence of a medical purpose.

Classification of Devices Under MDR Annex XVI

How are devices classified under MDR Annex XVI?

Manufacturers must apply the relevant classification rules under Annex VIII, as modified or clarified by applicable Common Specifications and Commission Implementing Regulation (EU) 2022/2347. However, not all rules apply automatically. For example, Rules 9 and 10 address active therapeutic and diagnostic devices and assume a medical purpose. Because Annex XVI products lack a medical purpose, regulators apply specific Common Specifications and implementing regulations to determine the appropriate classification.

Understanding the correct classification is essential. It determines the conformity assessment route, the level of notified body involvement, and the overall regulatory strategy for EU market approval.

Important to note that not all rules can be applied. For instance, rules 9 and 10, which pertain to active therapeutic and diagnostic devices, assume a medical purpose.

To address this, a Commission Implementing Regulation (2022/2347) was introduced to reclassify relevant devices alongside the Common Specifications. Let’s take a closer look at the classification of specific product classes:

  1. Certain body shaping devices are classified as Class IIb under Commission Implementing Regulation (EU) 2022/2347, depending on their specific characteristics.
  2. Devices for skin rejuvenation, hair removal, and similar purposes may fall under Class IIa or IIb, depending on the application. This classification is explained in Section 5.
  3. Equipment for transcranial brain stimulation is classified as Class III and is covered in Section 6.

Annex XVI Medical Devices: Key Regulatory Requirements

MDR 2017/745 establishes clear and structured obligations for products covered under MDR Annex XVI, even when they do not have an intended medical purpose. Manufacturers must meet safety, documentation, and post-market requirements comparable to those applied to traditional medical devices.

Core Compliance Requirements Under MDR Annex XVI

Manufacturers must design and manufacture devices to ensure safety and performance. They must conduct a documented risk analysis and implement appropriate risk control measures in accordance with Annex I.

They must also complete a conformity assessment procedure to demonstrate compliance with the applicable regulatory requirements. Depending on the classification of the device, a notified body may need to be involved.

In addition, manufacturers must prepare and maintain comprehensive technical documentation. This documentation must clearly describe the device design, intended purpose, manufacturing processes, risk management activities, and evidence supporting conformity.

Manufacturers must assign a Unique Device Identification (UDI) to each device. They must ensure traceability by registering the required information in the relevant UDI database.

Clinical Evaluation and Post-Market Obligations

Under MDR Annex XVI, manufacturers must perform a clinical evaluation to demonstrate safety and performance in accordance with Article 61(9) and the applicable Common Specifications. They must base this evaluation on relevant clinical data. Clinical investigations may be required unless sufficient existing clinical data can adequately demonstrate safety and performance, in line with Article 61(9) and the Common Specifications.

Manufacturers must also implement a post-market surveillance (PMS) system. This system must monitor device performance, analyze safety data, investigate complaints and adverse events, and trigger corrective actions when necessary.

Clear and accurate labeling remains essential. Manufacturers must provide instructions for use that specify the intended purpose, handling conditions, storage requirements, and relevant warnings or contraindications.

MDR 2017/745 significantly expands the regulatory scope by including devices without an intended medical purpose under MDR Annex XVI. This expansion ensures a high level of protection for users and strengthens oversight of aesthetic and non-therapeutic technologies entering the EU market.

By working with MDx CRO, manufacturers can navigate MDR Annex XVI requirements efficiently and position their products for successful EU market access.

From Annex XVI Compliance to Scientific validity reports for EU IVDR Submissions

Although Annex XVI devices do not have an intended medical purpose, they are still required to demonstrate safety and performance through robust evidence. This shift reflects a broader regulatory principle also seen under the In Vitro Diagnostic Regulation (IVDR): claims must be supported by structured, scientifically sound documentation.

Under the MDR, manufacturers of Annex XVI products must:

  • Conduct a clinical evaluation based on available clinical data
  • Justify safety and performance claims through documented evidence
  • Align with Common Specifications and applicable classification rules
  • Maintain technical documentation that withstands notified body scrutiny

This evidence-based mindset closely mirrors what is required for Scientific Validity Reports under the IVDR.

The Regulatory Convergence: MDR Annex XVI & IVDR Scientific Validity

While MDR Annex XVI focuses on devices without an intended medical purpose and IVDR governs in vitro diagnostic devices, both frameworks demand:

  • A clear definition of claims
  • Scientific substantiation of those claims
  • Transparent literature review methodologies
  • Structured documentation aligned with regulatory expectations

In IVDR submissions, the Scientific Validity Report is a foundational document demonstrating the association between an analyte and a clinical condition. Similarly, Annex XVI devices must justify safety and performance through documented clinical evaluation and risk analysis — even when no therapeutic or diagnostic purpose exists.

In both cases, regulatory authorities expect:

  • Systematic literature review strategies
  • Critical appraisal of available data
  • Traceable evidence linking claims to supporting documentation
  • Ongoing updates through post-market surveillance

The common denominator is simple: no claims without evidence.

Why This Matters for Manufacturers

Manufacturers working across MDR and IVDR portfolios increasingly face overlapping regulatory expectations. A strong internal capability to develop:

  • Clinical Evaluation Reports (CERs)
  • Scientific Validity Reports
  • Performance Evaluation documentation
  • Post-market evidence strategies

creates operational efficiency and reduces regulatory risk.

At MDx CRO, we support manufacturers not only in MDR Annex XVI compliance, but also in preparing scientifically robust documentation for EU IVDR submissions — including comprehensive Scientific Validity Reports aligned with notified body expectations.

Explore how Scientific Validity Reports are structured and what notified bodies look for under the IVDR. You can read our detailed guide on Scientific Validity Reports for EU IVDR Submissions.

FAQs

How does MDR define “intended medical purpose” for medical devices?

The MDR 2017/745 places strong emphasis on the concept of intended purpose. Manufacturers define the intended purpose through the information they provide on labeling, in the instructions for use (IFU), and in promotional materials.
The MDR defines “intended purpose” in Article 2(12). Whether a product has a medical purpose depends on the manufacturer’s intended use as reflected in labeling, instructions for use, and promotional materials.Manufacturers must clearly state whether the device supports diagnosis, treatment, monitoring, prevention, or alleviation of a disease or injury.
Under MDR Annex XVI, this distinction becomes particularly important, as certain products without a traditional medical purpose still fall within the scope of the regulation and must meet defined safety and performance requirements.

Are there any exemptions or special considerations for medical devices without an intended medical purpose?

Yes. MDR 2017/745 establishes specific requirements for products covered under MDR Annex XVI, even though they do not have an intended medical purpose.
First, manufacturers must comply with the relevant Common Specifications adopted under Article 9(4). These specifications require manufacturers to apply risk management in line with Annex I and, where necessary, conduct a clinical evaluation focused on safety and performance.
For clinical evaluation, manufacturers do not need to demonstrate a clinical benefit in the traditional medical sense. Instead, under Article 61(9), they must demonstrate the performance and safety of the product.

Are there any specific labeling or instructions for use (IFU) requirements for medical devices without an intended medical purpose under MDR 2017/745?

Yes, devices without an intended medical purpose have specific information requirements that affect both labeling and the instructions for use (IFU).According to Annex I, Section 23 of MDR 2017/745 and the applicable Common Specifications, the instructions for use must clearly state that the device has no intended medical purpose and must describe the associated risks and any limitations of use.

Industry Insights & Regulatory Updates