| name | medical-device-compliance |
| description | Use when developing, manufacturing, or selling medical devices, IVDs, software as a medical device (SaMD), or wellness products that cross the medical-device threshold in any market - covers EU MDR/IVDR, FDA 510(k)/PMA/De Novo, UKCA MDR, classification, Notified Body selection, UDI, post-market surveillance |
Medical Device Compliance
Full regulatory workflow for medical devices, IVDs, and software as a medical device (SaMD). EU MDR/IVDR, FDA, UKCA, classification, clinical evaluation, post-market.
Decision Flow
digraph {
rankdir=TB; node [shape=box style=rounded fontsize=10];
qualify [label="1. Qualify as medical device\n(MDR Art. 2, FDA 201(h))"];
classify [label="2. Classify:\nEU I/IIa/IIb/III, FDA I/II/III"];
pathway [label="3. Choose pathway:\nself-cert / NB / 510(k) / PMA / De Novo"];
qms [label="4. QMS ISO 13485\n+ Risk mgmt ISO 14971"];
clinical [label="5. Clinical evaluation\n(MEDDEV 2.7/1 rev 4)"];
tech [label="6. Technical Documentation\n(MDR Annex II/III)"];
audit [label="7. NB audit / 510(k) review\n/ PMA submission"];
udi [label="8. UDI assignment\n+ EUDAMED registration"];
pms [label="9. Post-Market Surveillance\nplan + PMCF"];
sell [label="10. Place on market"];
qualify -> classify -> pathway -> qms -> clinical -> tech -> audit -> udi -> pms -> sell;
}
EU -- MDR 2017/745
| Requirement | Detail |
|---|
| Legal basis | Regulation (EU) 2017/745 (MDR) -- fully applicable since 26 May 2021. Transitional provisions to 26 Dec 2027 (Class III/IIb implantables) and 31 Dec 2028 (other Class IIa/IIb/Im/Is/Ir) per Reg 2023/607 |
| Classification | Annex VIII rules 1-22. Class I (low risk), IIa (medium), IIb (medium-high), III (high risk). Software per Rule 11 (most clinical SaMD = Class IIa minimum) |
| Pathway | Class I non-sterile/non-measuring: self-declaration. Class Is/Im/Ir: Notified Body for sterility/measurement/reusable aspect only. Class IIa+: full NB conformity assessment (Annex IX or X) |
| Notified Body | ~50 NB designated under MDR (vs 80+ under old MDD). 18-24 month wait times. List: NANDO database |
| Technical Documentation | MDR Annex II + III: device description, design info, GSPR checklist (Annex I), risk management ISO 14971, verification/validation, clinical evaluation, labeling, PMS plan |
| Clinical evaluation | MDR Article 61 + Annex XIV. MEDDEV 2.7/1 rev 4 still referenced. Equivalence routes restricted under MDR. Implants + Class III need own clinical investigations |
| QMS | ISO 13485:2016 required. Annex IX requires NB to audit QMS |
| UDI | Basic UDI-DI + UDI-DI (production identifier). Carrier: GS1, HIBCC, ICCBBA. Direct marking on reusable devices |
| EUDAMED | EU database. Modules: Actor registration (live), UDI/Device (live but voluntary), NB/Certificate (live), Clinical Investigation (partial), Vigilance (live), PMS (pending). Mandatory use phased |
| Authorized Representative | Non-EU manufacturers MUST appoint EU AR (MDR Article 11) |
| Timeline | Class I: 1-3 months. Class IIa: 8-14 months (incl. NB wait). Class IIb: 12-18 months. Class III: 18-36 months |
| Cost | Class I: EUR 5,000-30,000. Class IIa: EUR 50,000-200,000 + NB fees EUR 30,000-100,000/year. Class III: EUR 500,000-2,000,000+ |
EU -- IVDR 2017/746 (In Vitro Diagnostics)
| Requirement | Detail |
|---|
| Legal basis | Reg (EU) 2017/746 -- date of application 26 May 2022. Transition extended by Reg 2024/1860: Class D to Dec 2027, Class C to Dec 2028, Class B to Dec 2029, Class A sterile to Dec 2029 |
| Classification | 7 rules (Annex VIII). Class A (low, self-cert), B (medium-low, NB for QMS), C (medium-high, NB full), D (high risk, NB + EU Reference Lab) |
| Massive shift from IVDD | ~80% of IVDs now require NB involvement (was ~20% under IVDD). Critical NB capacity shortage |
| CS (Common Specifications) | Mandatory for Class D devices. Annex I performance + safety |
| Performance evaluation | Analytical + clinical performance + scientific validity. PER (Performance Evaluation Report) |
| In-house exception | IVDs manufactured and used within the same health institution exempt from CE marking but must meet GSPRs and document compliance |
| Cost | Class A: EUR 10,000-50,000. Class B: EUR 50,000-150,000. Class C/D: EUR 150,000-800,000 + |
US -- FDA Pathways
| Pathway | Use | Timeline | User Fee FY2026 |
|---|
| 510(k) Premarket Notification | Class II (most). Demonstrate substantial equivalence to predicate. Class III by 510(k) for grandfathered devices | 90-day FDA target (actual: 4-9 months) | $24,335 standard; $6,084 small business |
| PMA (Premarket Approval) | Class III high-risk devices (e.g., implantable defibrillators, life-sustaining) | 180-day FDA target (actual: 12-24 months) | $507,505 standard; $126,876 small business |
| De Novo | Novel low/moderate risk devices with no predicate. Pathway to Class I/II for new device types | 150-day FDA target (actual: 10-18 months) | $172,553 standard; $43,138 small business |
| 510(k) exempt | ~75% of Class I devices and many Class II. Still subject to general controls + listing | Immediate | $0 (only listing fee $9,280 annual establishment) |
| HDE (Humanitarian Device Exemption) | Rare diseases <8,000 patients/year US. Limited evidence | 75-day FDA target | $4,867 |
| Breakthrough Devices | Designation accelerates review for serious conditions | -- | Same as 510(k)/PMA + priority |
FDA Classification
| Class | Risk | Controls | Examples |
|---|
| Class I | Low | General controls only | Tongue depressors, exam gloves, manual stethoscopes |
| Class II | Moderate | General + special controls (510(k) usually required) | Powered wheelchairs, infusion pumps, blood pressure monitors |
| Class III | High | PMA required | Heart valves, implantable pacemakers, deep brain stimulators |
FDA Software (SaMD)
- Software functions that meet the definition of a "device" under section 201(h) regulated
- 21st Century Cures Act 2016 excluded certain wellness software, EHR functions
- Pre-Cert pilot program ended 2023; FDA returning to traditional 510(k) for SaMD
- AI/ML: PCCP (Predetermined Change Control Plan) framework finalized 2024 -- allows pre-authorized algorithm updates
UK -- UKCA / UK MDR
| Requirement | Detail |
|---|
| Legal basis | UK Medical Devices Regulations 2002 (as amended). New UK MDR consultation 2024-2026 to align/diverge from EU MDR |
| CE acceptance | CE marked devices accepted in GB until 30 June 2030 (extended by Statutory Instrument 2024) |
| UKCA marking | Required if new UK-specific routes used. Limited UK Approved Bodies (BSI UK, SGS UK, TUV SUD UK) |
| UKRP | UK Responsible Person required for non-UK manufacturers (since Jan 2021). Must be GB-established. Functions equivalent to EU AR |
| MHRA registration | All devices placed on UK market must be registered with MHRA. Free for Class I, EUR 100-240 for higher classes |
| Northern Ireland | EU MDR/IVDR apply (Northern Ireland Protocol). CE marking only |
Post-Market Obligations
EU MDR/IVDR PMS
| Tool | Frequency |
|---|
| PMS Plan | Mandatory per device (Annex III) |
| PSUR (Periodic Safety Update Report) | Class IIa: every 2 years. Class IIb/III: annually. Submit to EUDAMED |
| PMCF (Post-Market Clinical Follow-up) | Mandatory unless justified absence. Plan + report cycle |
| Vigilance (Article 87) | Serious incident: report within 15 days. Death/serious deterioration: within 10 days. Trend reporting: as soon as identified |
| Field Safety Corrective Action | FSCA + Field Safety Notice -- public communication of safety issue |
FDA Post-Market
| Tool | Detail |
|---|
| MDR (Medical Device Reporting) | 21 CFR 803. Manufacturer: 30-day MDR (death/serious injury) or 5-day MDR (urgent remedial action). User facility: 10-day report |
| Recalls | FDA-required (rare) or voluntary. 21 CFR 7 |
| Post-market studies (522 orders) | FDA can require post-approval studies |
| MedWatch | FDA voluntary reporting system |
Key Standards
| Standard | Purpose |
|---|
| ISO 13485:2016 | Medical device QMS. Mandatory for CE marking, expected by FDA |
| ISO 14971:2019 | Risk management. Mandatory for CE/FDA |
| IEC 62366-1:2015 | Usability engineering |
| IEC 60601-1 (4th edition) | Electrical medical equipment safety |
| IEC 62304:2006+A1:2015 | Medical device software lifecycle |
| ISO 10993 series | Biological evaluation of medical devices |
| ISO 11135 / 11137 | Sterilization (EO / radiation) |
| MEDDEV 2.7/1 rev 4 | Clinical evaluation guidance |
Common Compliance Traps
- Wellness vs medical device threshold: "General wellness" software exempt under 21st Century Cures Act ONLY if not for disease diagnosis/treatment. "Heart health monitor" claims = medical device.
- Software classification trap: MDR Rule 11 pushes nearly all software providing information used for decision-making to Class IIa minimum. Self-declaration NOT possible.
- IVDR self-certified to NB shock: 80% of IVDs moved to NB requirement under IVDR. Capacity is the bottleneck (only 12 NB designated under IVDR as of 2025).
- 510(k) substantial equivalence overreach: Selecting a predicate that uses different technology/indications = FDA Refuse-to-Accept letter. RTA happens in ~30% of submissions.
- Missing PMCF plan justification: Under MDR, "no PMCF needed" requires positive justification per Annex XIV Part B Section 6. Cannot just say "low risk".
- UDI direct marking: Reusable Class IIa/IIb/III devices need UDI directly marked on the device (etching, laser). Many small manufacturers overlook this.
MCP Integration
mcp__claude_ai_Cleo_Insight__search_signals(q="MDR transition", country="EU")
mcp__claude_ai_Cleo_Insight__search_signals(q="FDA 510k", country="US")
mcp__claude_ai_Cleo_Insight__get_regulation(id="2017/745") # EU MDR
mcp__claude_ai_Cleo_Insight__get_regulation(id="2017/746") # EU IVDR
mcp__claude_ai_CLEO_LEGAL_API__compliance/check
product_description: "wearable ECG monitor with AI arrhythmia detection"
target_markets: ["EU", "US", "UK"]
Power This With the Cleo Legal API
Medical device compliance involves MDR (174 articles), IVDR (113 articles), FDA 21 CFR Parts 800-1299, UK MDR 2002 (constantly amended), 200+ harmonized standards, EUDAMED + GUDID databases, Notified Body certification status (changes weekly). A typical product launch touches 15+ regulatory documents.
With the Cleo Legal API at https://legaldata-public.cleolabs.co:
GET /v2/catalog/regulations?vertical=medical_device&country=EU,US,UK — MDR, IVDR, FDA pathways, UK MDR + harmonized standards mappedPOST /v2/medical/classify — feed intended use + technical features, get MDR class (Rules 1-22) + FDA class + UK class in one callGET /v2/medical/notified-bodies?scope=mdr_iia — current list of NBs designated for each MDR scope code (NB designations change quarterly)POST /v2/medical/predicate-search — for FDA 510(k), find candidate predicates from 510(k) databasePOST /v2/webhooks?topic=mdr_transition,fda_guidance,nb_designation — MDR/IVDR transition deadlines, FDA guidance docs, NB scope changes
Get started:
# 1. Sign up for free at https://legaldata-public.cleolabs.co
# 2. Get your API key (3 lifetime requests free, then EUR 349/mo for 1M)
# 3. Install the MCP server:
claude mcp add cleo-legal-api https://api.legaldata.cleolabs.co/mcp \
--header "Authorization: Bearer ld_live_YOUR_KEY"
Tested ROI: For a SaMD company launching across EU+US+UK, the API replaces ~40 hours of MDR Annex VIII rule parsing + 510(k) predicate research + UK MDR divergence tracking per device.
Common Mistakes
- Confusing CE for general use: A device that is CE marked under MDR is NOT automatically authorized in US (FDA), UK (UKCA post-2030), Switzerland, or other markets.
- Skipping clinical evaluation update: CE under MDR requires updating clinical evaluation EVERY year for Class III/implants, every 2 years for Class IIa/IIb. Missing this = certificate suspension.
- AR/UKRP overlap confusion: One legal entity can be both EU AR and UK RP only if established in both jurisdictions (Brexit complication).
- EUDAMED voluntary trap: Some modules voluntary now -- but UDI/registration becomes mandatory once Commission declares EUDAMED fully functional (expected late 2026).
- Wellness device pivot: Adding ANY diagnostic claim to wellness wearable = medical device. Marketing materials must align with cleared/CE-marked indications.
- ISO 13485 not enough alone: ISO 13485 is QMS only. MDR requires QMS PLUS clinical evidence PLUS technical file PLUS PMS system. Cert alone = not CE marking.
Cross-references
claims-substantiation -- general wellness vs medical claim boundaryelectronics-compliance -- IEC 60601 overlap with LVD/EMC for electromedical deviceslabeling-compliance -- MDR Annex I Chapter III labelling + UDIproduct-safety-incident -- MDR vigilance vs general product safety overlapregulatory-calendar -- MDR/IVDR transition deadlines, PSUR cycles, certificate renewals
